From 28879665d906abad1aa79ddd4ef0aefde7d5a55d Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:11:53 +0400
Subject: [PATCH 01/67] Add generation-bound supervised lighting qualification

---
 apps/device-qualification/assets/app.css      |    2 +-
 apps/device-qualification/assets/app.js       |   27 +-
 apps/device-qualification/assets/contract.js  |   20 +-
 .../local-qualification-view.schema.json      |    4 +-
 .../tests/fixtures/rust-qualified-mouse.json  |   34 +-
 .../tests/fixtures/rust-qualified-pair.json   |   68 +-
 crates/hfx-ops/src/lib.rs                     |    2 +
 crates/hfx-ops/src/probe.rs                   |    2 +-
 crates/hfx-ops/src/qualification.rs           |  280 +++-
 crates/hfx-ops/src/qualification_runner.rs    | 1224 +++++++++++++++++
 crates/hfx-ops/src/qualification_server.rs    |  585 +++++++-
 crates/hfx-ops/src/qualification_state.rs     |  310 +++++
 tests/test_device_qualification_console.py    |   15 +
 tools/hfxdev/package_pipeline.py              |    1 +
 14 files changed, 2410 insertions(+), 164 deletions(-)
 create mode 100644 crates/hfx-ops/src/qualification_runner.rs
 create mode 100644 crates/hfx-ops/src/qualification_state.rs

diff --git a/apps/device-qualification/assets/app.css b/apps/device-qualification/assets/app.css
index 364b2d9..7bdadf1 100644
--- a/apps/device-qualification/assets/app.css
+++ b/apps/device-qualification/assets/app.css
@@ -699,7 +699,7 @@ code,
   text-align: center;
 }
 
-@media (max-width: 1080px) {
+@media (max-width: 1200px) {
   .qualification-layout { grid-template-columns: 1fr; }
   .inspector { position: static; }
   .identity-strip { grid-template-columns: 1fr 1fr; row-gap: 15px; }
diff --git a/apps/device-qualification/assets/app.js b/apps/device-qualification/assets/app.js
index f0995e0..b816b71 100644
--- a/apps/device-qualification/assets/app.js
+++ b/apps/device-qualification/assets/app.js
@@ -9,7 +9,7 @@ const refreshButton = document.querySelector("#refresh-view");
 
 const state = {
   view: null,
-  selectedDeviceId: null,
+  selectedDeviceKey: null,
   selectedStageId: null,
   busyActionId: null,
   loading: true,
@@ -20,9 +20,9 @@ const state = {
 refreshButton.addEventListener("click", () => refreshView(true));
 
 document.addEventListener("click", (event) => {
-  const deviceButton = event.target.closest("[data-device-id]");
+  const deviceButton = event.target.closest("[data-device-key]");
   if (deviceButton) {
-    state.selectedDeviceId = deviceButton.dataset.deviceId;
+    state.selectedDeviceKey = deviceButton.dataset.deviceKey;
     state.selectedStageId = null;
     state.hasDraft = false;
     render();
@@ -149,7 +149,7 @@ async function invokeStage(form) {
 
 async function fetchWithTimeout(path, options) {
   const controller = new AbortController();
-  const timeout = window.setTimeout(() => controller.abort(), 6_000);
+  const timeout = window.setTimeout(() => controller.abort(), 15_000);
   try {
     return await fetch(path, {
       credentials: "same-origin",
@@ -163,8 +163,8 @@ async function fetchWithTimeout(path, options) {
 
 function reconcileSelection() {
   const contexts = deviceContexts();
-  if (!contexts.some(({ device }) => device.device_id === state.selectedDeviceId)) {
-    state.selectedDeviceId = contexts[0]?.device.device_id ?? null;
+  if (!contexts.some((context) => context.key === state.selectedDeviceKey)) {
+    state.selectedDeviceKey = contexts[0]?.key ?? null;
     state.selectedStageId = null;
     state.hasDraft = false;
   }
@@ -208,10 +208,10 @@ function renderDeviceRail(contexts) {
     <aside class="device-rail" aria-label="Detected controllers">
       <header class="rail-heading"><span>Detected controllers</span><strong>${contexts.length}</strong></header>
       <div class="device-list">
-        ${contexts.map(({ device, plan }) => {
+        ${contexts.map(({ key, device, plan }) => {
           const progress = stageProgress(plan);
           return `
-            <button type="button" class="device-row ${device.device_id === state.selectedDeviceId ? "is-selected" : ""}" data-device-id="${escapeAttribute(device.device_id)}">
+            <button type="button" class="device-row ${key === state.selectedDeviceKey ? "is-selected" : ""}" data-device-key="${escapeAttribute(key)}">
               <span class="device-kind" aria-hidden="true">${device.kind === "mouse" ? "M" : device.kind === "keyboard" ? "K" : "D"}</span>
               <span class="device-copy">
                 <strong>${escapeHtml(device.model_name || "Unrecognized controller")}</strong>
@@ -405,14 +405,21 @@ function emptyInventory() {
 function deviceContexts() {
   if (!state.view) return [];
   return state.view.receivers.flatMap((receiver) => receiver.devices.map((device) => ({
+    key: deviceContextKey(receiver, device),
     receiver,
     device,
-    plan: state.view.plans.find((plan) => plan.device_id === device.device_id) || null,
+    plan: state.view.plans.find((plan) => plan.receiver_id === receiver.receiver_id
+      && plan.generation_id === receiver.generation_id
+      && plan.device_id === device.device_id) || null,
   })));
 }
 
 function selectedContext() {
-  return deviceContexts().find(({ device }) => device.device_id === state.selectedDeviceId) || null;
+  return deviceContexts().find(({ key }) => key === state.selectedDeviceKey) || null;
+}
+
+function deviceContextKey(receiver, device) {
+  return `${encodeURIComponent(receiver.receiver_id)}:${receiver.generation_id}:${encodeURIComponent(device.device_id)}`;
 }
 
 function allStages(plan) {
diff --git a/apps/device-qualification/assets/contract.js b/apps/device-qualification/assets/contract.js
index b59bf46..b66a5a5 100644
--- a/apps/device-qualification/assets/contract.js
+++ b/apps/device-qualification/assets/contract.js
@@ -26,15 +26,19 @@ export function validateQualificationView(value) {
   array(value.actions, "view.actions", 256);
   value.actions.forEach((item, index) => action(item, `view.actions[${index}]`));
 
-  const devices = value.receivers.flatMap((item) => item.devices);
-  unique(devices.map((item) => item.device_id), "device IDs");
+  const receiverKeys = value.receivers.map((item) => receiverKey(item.receiver_id, item.generation_id));
+  unique(receiverKeys, "receiver generation IDs");
+  const receiverByKey = new Map(value.receivers.map((item) => [receiverKey(item.receiver_id, item.generation_id), item]));
+  const deviceKeys = value.receivers.flatMap((receiver) => receiver.devices.map((device) => `${receiverKey(receiver.receiver_id, receiver.generation_id)}\u0000${device.device_id}`));
+  unique(deviceKeys, "receiver-bound device IDs");
   unique(value.plans.map((item) => item.plan_id), "plan IDs");
   unique(value.actions.map((item) => item.id), "action IDs");
-  const deviceById = new Map(devices.map((item) => [item.device_id, item]));
   const actionById = new Map(value.actions.map((item) => [item.id, item]));
   const stageIds = [];
   for (const item of value.plans) {
-    const device = deviceById.get(item.device_id);
+    const receiver = receiverByKey.get(receiverKey(item.receiver_id, item.generation_id));
+    require(receiver, `plan ${item.plan_id} references an unknown receiver generation`);
+    const device = receiver.devices.find((candidate) => candidate.device_id === item.device_id);
     require(device, `plan ${item.plan_id} references an unknown device`);
     if (item.profile_binding || device.profile) {
       require(item.profile_binding && device.profile, `plan ${item.plan_id} profile binding is incomplete`);
@@ -124,8 +128,10 @@ function capability(value, label) {
 
 function plan(value, label) {
   object(value, label);
-  exact(value, ["plan_id", "device_id", "profile_binding", "verdict", "summary", "groups", "evidence"], label);
+  exact(value, ["plan_id", "receiver_id", "generation_id", "device_id", "profile_binding", "verdict", "summary", "groups", "evidence"], label);
   string(value.plan_id, `${label}.plan_id`);
+  string(value.receiver_id, `${label}.receiver_id`);
+  integer(value.generation_id, `${label}.generation_id`, 1);
   string(value.device_id, `${label}.device_id`);
   nullableProfile(value.profile_binding, `${label}.profile_binding`);
   enumeration(value.verdict, VERDICTS, `${label}.verdict`);
@@ -135,6 +141,10 @@ function plan(value, label) {
   evidence(value.evidence, `${label}.evidence`);
 }
 
+function receiverKey(receiverId, generationId) {
+  return `${receiverId}\u0000${generationId}`;
+}
+
 function group(value, label) {
   object(value, label);
   exact(value, ["group_id", "title", "description", "stages"], label);
diff --git a/apps/device-qualification/contracts/local-qualification-view.schema.json b/apps/device-qualification/contracts/local-qualification-view.schema.json
index 6ab24a0..56af8f5 100644
--- a/apps/device-qualification/contracts/local-qualification-view.schema.json
+++ b/apps/device-qualification/contracts/local-qualification-view.schema.json
@@ -173,9 +173,11 @@
     "plan": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["plan_id", "device_id", "profile_binding", "verdict", "summary", "groups", "evidence"],
+      "required": ["plan_id", "receiver_id", "generation_id", "device_id", "profile_binding", "verdict", "summary", "groups", "evidence"],
       "properties": {
         "plan_id": {"type": "string", "minLength": 1},
+        "receiver_id": {"type": "string", "minLength": 1},
+        "generation_id": {"type": "integer", "minimum": 1},
         "device_id": {"type": "string", "minLength": 1},
         "profile_binding": {"oneOf": [{"$ref": "#/$defs/profile"}, {"type": "null"}]},
         "verdict": {"enum": ["not-run", "in-progress", "blocked", "failed", "evidence-ready", "accepted"]},
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 7c5ae6d..d797cc8 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -125,6 +125,8 @@
   "plans": [
     {
       "plan_id": "plan:receiver-test:7:child.razer.basilisk-v3-pro-35k.00cd",
+      "receiver_id": "receiver-test",
+      "generation_id": 7,
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
@@ -139,7 +141,7 @@
           "description": "Read-only facts are bound to this receiver generation and exact profile digest.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-identity",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
               "title": "Profile binding",
               "description": "Verify the observed product ID, immutable profile digest, route, and generation.",
               "kind": "automatic",
@@ -152,11 +154,11 @@
               ],
               "instructions": [],
               "observations": [],
-              "action_id": "run:mouse-00cd-identity",
+              "action_id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
               "result": null
             },
             {
-              "stage_id": "mouse-00cd-telemetry",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
               "title": "Presence and telemetry",
               "description": "Exercise the device and verify fresh passive observations without changing hardware state.",
               "kind": "watched-observation",
@@ -195,7 +197,7 @@
                   ]
                 }
               ],
-              "action_id": "run:mouse-00cd-telemetry",
+              "action_id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
               "result": null
             }
           ]
@@ -206,7 +208,7 @@
           "description": "Only profile-bound writes may exercise the receiver transport.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-map",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-map",
               "title": "Complete LED map",
               "description": "Verify every application slot against the same physical light using bounded sentinel frames.",
               "kind": "watched-observation",
@@ -246,7 +248,7 @@
               "result": null
             },
             {
-              "stage_id": "mouse-00cd-lighting",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lighting",
               "title": "Lighting behavior",
               "description": "Verify complete black, Off, Static, brightness endpoints, and streamed application frames claimed by this profile.",
               "kind": "watched-observation",
@@ -296,7 +298,7 @@
           "description": "New generations must invalidate stale authority and restore only verified state.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-lifecycle",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lifecycle",
               "title": "Sleep, return, reconnect, and resume",
               "description": "Verify controller return, sibling isolation, receiver renewal, and system resume where applicable.",
               "kind": "lifecycle",
@@ -342,11 +344,11 @@
         "artifact_state": "none",
         "completed_claims": [],
         "missing_claims": [
-          "mouse-00cd-identity",
-          "mouse-00cd-telemetry",
-          "mouse-00cd-map",
-          "mouse-00cd-lighting",
-          "mouse-00cd-lifecycle"
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-map",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lighting",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lifecycle"
         ],
         "export_action_id": null
       }
@@ -354,19 +356,19 @@
   ],
   "actions": [
     {
-      "id": "run:mouse-00cd-identity",
+      "id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
       "label": "Run read-only check",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Amouse-00cd-identity",
+      "href": "/v1/qualification/actions/run%3Amouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
       "enabled": true,
       "risk": "read-only",
       "confirmation": null
     },
     {
-      "id": "run:mouse-00cd-telemetry",
+      "id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
       "label": "Record observation",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Amouse-00cd-telemetry",
+      "href": "/v1/qualification/actions/run%3Amouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
       "enabled": false,
       "risk": "read-only",
       "confirmation": null
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 0ac8990..19d39bc 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -209,6 +209,8 @@
   "plans": [
     {
       "plan_id": "plan:receiver-test:7:child.razer.basilisk-v3-pro-35k.00cd",
+      "receiver_id": "receiver-test",
+      "generation_id": 7,
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
@@ -223,7 +225,7 @@
           "description": "Read-only facts are bound to this receiver generation and exact profile digest.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-identity",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
               "title": "Profile binding",
               "description": "Verify the observed product ID, immutable profile digest, route, and generation.",
               "kind": "automatic",
@@ -236,11 +238,11 @@
               ],
               "instructions": [],
               "observations": [],
-              "action_id": "run:mouse-00cd-identity",
+              "action_id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
               "result": null
             },
             {
-              "stage_id": "mouse-00cd-telemetry",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
               "title": "Presence and telemetry",
               "description": "Exercise the device and verify fresh passive observations without changing hardware state.",
               "kind": "watched-observation",
@@ -279,7 +281,7 @@
                   ]
                 }
               ],
-              "action_id": "run:mouse-00cd-telemetry",
+              "action_id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
               "result": null
             }
           ]
@@ -290,7 +292,7 @@
           "description": "Only profile-bound writes may exercise the receiver transport.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-map",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-map",
               "title": "Complete LED map",
               "description": "Verify every application slot against the same physical light using bounded sentinel frames.",
               "kind": "watched-observation",
@@ -330,7 +332,7 @@
               "result": null
             },
             {
-              "stage_id": "mouse-00cd-lighting",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lighting",
               "title": "Lighting behavior",
               "description": "Verify complete black, Off, Static, brightness endpoints, and streamed application frames claimed by this profile.",
               "kind": "watched-observation",
@@ -380,7 +382,7 @@
           "description": "New generations must invalidate stale authority and restore only verified state.",
           "stages": [
             {
-              "stage_id": "mouse-00cd-lifecycle",
+              "stage_id": "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lifecycle",
               "title": "Sleep, return, reconnect, and resume",
               "description": "Verify controller return, sibling isolation, receiver renewal, and system resume where applicable.",
               "kind": "lifecycle",
@@ -426,17 +428,19 @@
         "artifact_state": "none",
         "completed_claims": [],
         "missing_claims": [
-          "mouse-00cd-identity",
-          "mouse-00cd-telemetry",
-          "mouse-00cd-map",
-          "mouse-00cd-lighting",
-          "mouse-00cd-lifecycle"
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-map",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lighting",
+          "mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-lifecycle"
         ],
         "export_action_id": null
       }
     },
     {
       "plan_id": "plan:receiver-test:7:child.razer.deathstalker-v2-pro-tkl.0296",
+      "receiver_id": "receiver-test",
+      "generation_id": 7,
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
@@ -451,7 +455,7 @@
           "description": "Read-only facts are bound to this receiver generation and exact profile digest.",
           "stages": [
             {
-              "stage_id": "keyboard-0296-identity",
+              "stage_id": "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-identity",
               "title": "Profile binding",
               "description": "Verify the observed product ID, immutable profile digest, route, and generation.",
               "kind": "automatic",
@@ -464,11 +468,11 @@
               ],
               "instructions": [],
               "observations": [],
-              "action_id": "run:keyboard-0296-identity",
+              "action_id": "run:keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-identity",
               "result": null
             },
             {
-              "stage_id": "keyboard-0296-telemetry",
+              "stage_id": "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-telemetry",
               "title": "Presence and telemetry",
               "description": "Exercise the device and verify fresh passive observations without changing hardware state.",
               "kind": "watched-observation",
@@ -506,7 +510,7 @@
                   ]
                 }
               ],
-              "action_id": "run:keyboard-0296-telemetry",
+              "action_id": "run:keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-telemetry",
               "result": null
             }
           ]
@@ -517,7 +521,7 @@
           "description": "Only profile-bound writes may exercise the receiver transport.",
           "stages": [
             {
-              "stage_id": "keyboard-0296-map",
+              "stage_id": "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-map",
               "title": "Complete key map",
               "description": "Verify every application slot against the same physical light using bounded sentinel frames.",
               "kind": "watched-observation",
@@ -557,7 +561,7 @@
               "result": null
             },
             {
-              "stage_id": "keyboard-0296-lighting",
+              "stage_id": "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-lighting",
               "title": "Lighting behavior",
               "description": "Verify complete black, Off, Static, brightness endpoints, and streamed application frames claimed by this profile.",
               "kind": "watched-observation",
@@ -607,7 +611,7 @@
           "description": "New generations must invalidate stale authority and restore only verified state.",
           "stages": [
             {
-              "stage_id": "keyboard-0296-lifecycle",
+              "stage_id": "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-lifecycle",
               "title": "Sleep, return, reconnect, and resume",
               "description": "Verify controller return, sibling isolation, receiver renewal, and system resume where applicable.",
               "kind": "lifecycle",
@@ -653,11 +657,11 @@
         "artifact_state": "none",
         "completed_claims": [],
         "missing_claims": [
-          "keyboard-0296-identity",
-          "keyboard-0296-telemetry",
-          "keyboard-0296-map",
-          "keyboard-0296-lighting",
-          "keyboard-0296-lifecycle"
+          "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-identity",
+          "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-telemetry",
+          "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-map",
+          "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-lighting",
+          "keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-lifecycle"
         ],
         "export_action_id": null
       }
@@ -665,37 +669,37 @@
   ],
   "actions": [
     {
-      "id": "run:mouse-00cd-identity",
+      "id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
       "label": "Run read-only check",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Amouse-00cd-identity",
+      "href": "/v1/qualification/actions/run%3Amouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-identity",
       "enabled": true,
       "risk": "read-only",
       "confirmation": null
     },
     {
-      "id": "run:mouse-00cd-telemetry",
+      "id": "run:mouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
       "label": "Record observation",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Amouse-00cd-telemetry",
+      "href": "/v1/qualification/actions/run%3Amouse-00cd-53c368795004e959dfcc0ee6eb1d2cf533b4239e869113fdc31ddde330bc0f56-telemetry",
       "enabled": false,
       "risk": "read-only",
       "confirmation": null
     },
     {
-      "id": "run:keyboard-0296-identity",
+      "id": "run:keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-identity",
       "label": "Run read-only check",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Akeyboard-0296-identity",
+      "href": "/v1/qualification/actions/run%3Akeyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-identity",
       "enabled": true,
       "risk": "read-only",
       "confirmation": null
     },
     {
-      "id": "run:keyboard-0296-telemetry",
+      "id": "run:keyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-telemetry",
       "label": "Record observation",
       "method": "POST",
-      "href": "/v1/qualification/actions/run%3Akeyboard-0296-telemetry",
+      "href": "/v1/qualification/actions/run%3Akeyboard-0296-f8c0f0aafa532c5cd30b53498fdf7fb65433b11af5d58d13de9ddbdb0122260e-telemetry",
       "enabled": false,
       "risk": "read-only",
       "confirmation": null
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 0e56001..1febb3a 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -7,7 +7,9 @@ mod assessment;
 mod configuration;
 mod probe;
 mod qualification;
+mod qualification_runner;
 mod qualification_server;
+mod qualification_state;
 mod support;
 
 pub use activation::{
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 667a139..70fda89 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -288,7 +288,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         output.success && output.stdout == "loaded"
     }
 
-    fn bridge_client(
+    pub(crate) fn bridge_client(
         &self,
         client_id: &str,
         client_name: &str,
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index aab9c09..7df6a23 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -9,6 +9,7 @@ use hfx_profiles::{PROFILE_SOURCE_SHA256, RuntimeProfile, RuntimeProfileCatalog}
 use hfx_protocol::{BatteryObservation, DeviceInventoryView, IntegrationReceiverView};
 use hfx_runtime::PRODUCT_VERSION;
 use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
 use std::collections::BTreeMap;
 use std::fmt::Write as _;
 use std::time::{SystemTime, UNIX_EPOCH};
@@ -212,10 +213,21 @@ pub struct StageResult {
     pub evidence_refs: Vec<String>,
 }
 
-#[derive(Clone, Debug, Eq, PartialEq)]
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct StageCheckpoint {
+    pub checkpoint_id: String,
+    pub instructions: Vec<String>,
+    pub observations: Vec<ObservationPrompt>,
+    pub evidence_refs: Vec<String>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct StageProgress {
     pub status: StageStatus,
-    pub result: StageResult,
+    pub result: Option<StageResult>,
+    pub checkpoint: Option<StageCheckpoint>,
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -257,6 +269,8 @@ pub struct EvidenceView {
 #[serde(deny_unknown_fields)]
 pub struct QualificationPlan {
     pub plan_id: String,
+    pub receiver_id: String,
+    pub generation_id: u64,
     pub device_id: String,
     pub profile_binding: Option<ProfileBindingView>,
     pub verdict: VerdictState,
@@ -344,18 +358,17 @@ pub fn build_qualification_view(
     let state = companion_state(system, integration);
     let mut receivers = Vec::new();
     let mut plans = Vec::new();
-    let mut actions = Vec::new();
     if let Some(integration) = integration {
         for receiver in &integration.view.receivers {
             receivers.push(receiver_view(receiver, catalog));
             for device in &receiver.inventory {
                 if let Some(plan) = qualification_plan(receiver, device, catalog, runner) {
-                    actions.extend(actions_for_plan(&plan));
                     plans.push(plan);
                 }
             }
         }
     }
+    let actions = actions_for_plans(&plans);
     QualificationView {
         schema: QUALIFICATION_SCHEMA.to_owned(),
         api_version: QUALIFICATION_API_VERSION,
@@ -545,15 +558,7 @@ fn qualification_plan(
 ) -> Option<QualificationPlan> {
     let binding = device.profile.as_ref()?;
     let profile = catalog.profile(&binding.profile_id)?;
-    let slug = format!(
-        "{}-{:04x}",
-        match device.device_kind {
-            DeviceKind::Mouse => "mouse",
-            DeviceKind::Keyboard => "keyboard",
-            _ => "device",
-        },
-        device.product_id.get()
-    );
+    let slug = qualification_slug(receiver, device);
     let mut groups = vec![identity_group(&slug, profile, runner.read_only_actions)];
     if let Some(group) = lighting_group(&slug, device, profile, runner.supervised_lighting) {
         groups.push(group);
@@ -569,6 +574,8 @@ fn qualification_plan(
             "plan:{}:{}:{}",
             receiver.receiver_id, receiver.generation_id, binding.profile_id
         ),
+        receiver_id: receiver.receiver_id.as_str().to_owned(),
+        generation_id: receiver.generation_id.get(),
         device_id: device.device_id.as_str().to_owned(),
         profile_binding: Some(profile_binding(binding)),
         verdict: VerdictState::NotRun,
@@ -584,6 +591,26 @@ fn qualification_plan(
     })
 }
 
+fn qualification_slug(receiver: &IntegrationReceiverView, device: &DeviceInventoryView) -> String {
+    let kind = match device.device_kind {
+        DeviceKind::Mouse => "mouse",
+        DeviceKind::Keyboard => "keyboard",
+        _ => "device",
+    };
+    let mut digest = Sha256::new();
+    digest.update(receiver.receiver_id.as_str().as_bytes());
+    digest.update([0]);
+    digest.update(receiver.generation_id.get().to_le_bytes());
+    digest.update([0]);
+    digest.update(device.device_id.as_str().as_bytes());
+    let digest = digest.finalize();
+    let mut suffix = String::with_capacity(64);
+    for byte in digest {
+        write!(&mut suffix, "{byte:02x}").expect("writing to a string cannot fail");
+    }
+    format!("{kind}-{:04x}-{suffix}", device.product_id.get())
+}
+
 fn identity_group(
     slug: &str,
     profile: &RuntimeProfile,
@@ -782,23 +809,34 @@ fn blocked_or_locked_stage(
         } else {
             vec!["The installed build does not include this supervised runner yet; no write was attempted.".to_owned()]
         },
-        observations: vec![outcome_observation()],
+        observations: if runner_enabled {
+            Vec::new()
+        } else {
+            vec![outcome_observation()]
+        },
         action_id: runner_enabled.then(|| action_id(stage_id)),
         result: None,
     }
 }
 
+fn actions_for_plans(plans: &[QualificationPlan]) -> Vec<CompanionAction> {
+    plans.iter().flat_map(actions_for_plan).collect()
+}
+
 fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
     plan.groups
         .iter()
         .flat_map(|group| &group.stages)
         .filter_map(|stage| {
             let id = stage.action_id.clone()?;
-            let confirmation = match stage.risk {
+            let confirmation = if stage.status == StageStatus::AwaitingObservation {
+                None
+            } else {
+                match stage.risk {
                 RiskLevel::ReadOnly => None,
                 RiskLevel::LightingWrite => Some(ActionConfirmation {
                     phrase: "authorize profile-bound lighting test".to_owned(),
-                    summary: "This stage may send bounded RGB frames only to the selected profile and generation."
+                    summary: "This stage may send bounded test and cleanup RGB frames only to the selected profile and generation."
                         .to_owned(),
                 }),
                 RiskLevel::DeviceLifecycle => Some(ActionConfirmation {
@@ -811,21 +849,29 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
                     summary: "A system suspend requires a later, separate confirmation at its checkpoint."
                         .to_owned(),
                 }),
+                }
             };
             Some(CompanionAction {
                 id: id.clone(),
-                label: match stage.kind {
-                    StageKind::Automatic => "Run read-only check",
-                    StageKind::WatchedObservation if stage.risk == RiskLevel::ReadOnly => {
-                        "Record observation"
-                    }
-                    StageKind::WatchedObservation => "Begin supervised test",
-                    StageKind::Lifecycle => "Begin watched lifecycle",
+                label: match stage.status {
+                    StageStatus::AwaitingObservation => "Record watched result",
+                    StageStatus::Running => "Running bounded step",
+                    _ => match stage.kind {
+                        StageKind::Automatic => "Run read-only check",
+                        StageKind::WatchedObservation if stage.risk == RiskLevel::ReadOnly => {
+                            "Record observation"
+                        }
+                        StageKind::WatchedObservation => "Begin supervised test",
+                        StageKind::Lifecycle => "Begin watched lifecycle",
+                    },
                 }
                 .to_owned(),
                 method: "POST".to_owned(),
                 href: format!("/v1/qualification/actions/{}", percent_encode(&id)),
-                enabled: stage.status == StageStatus::Ready,
+                enabled: matches!(
+                    stage.status,
+                    StageStatus::Ready | StageStatus::AwaitingObservation
+                ),
                 risk: stage.risk,
                 confirmation,
             })
@@ -848,9 +894,15 @@ pub(crate) fn apply_stage_results(
         {
             if let Some(progress) = results.get(&stage.stage_id) {
                 stage.status = progress.status;
-                stage.result = Some(progress.result.clone());
+                stage.result.clone_from(&progress.result);
+                if let Some(checkpoint) = &progress.checkpoint {
+                    stage.instructions.clone_from(&checkpoint.instructions);
+                    stage.observations.clone_from(&checkpoint.observations);
+                }
                 if progress.status == StageStatus::Passed {
                     completed.push(stage.stage_id.clone());
+                } else {
+                    first_pending_seen = true;
                 }
                 continue;
             }
@@ -925,17 +977,7 @@ pub(crate) fn apply_stage_results(
             export_action_id: None,
         };
     }
-    for action in &mut view.actions {
-        action.enabled = view.plans.iter().any(|plan| {
-            plan.groups
-                .iter()
-                .flat_map(|group| &group.stages)
-                .any(|stage| {
-                    stage.action_id.as_deref() == Some(action.id.as_str())
-                        && stage.status == StageStatus::Ready
-                })
-        });
-    }
+    view.actions = actions_for_plans(&view.plans);
 }
 
 fn action_id(stage_id: &str) -> String {
@@ -1180,6 +1222,26 @@ mod tests {
             .join("../../apps/device-qualification/tests/fixtures/rust-qualified-pair.json")
     }
 
+    fn stage_by_suffix<'a>(view: &'a QualificationView, suffix: &str) -> &'a QualificationStage {
+        view.plans[0]
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with(suffix))
+            .expect("expected qualification stage exists")
+    }
+
+    fn action_for_stage<'a>(
+        view: &'a QualificationView,
+        stage: &QualificationStage,
+    ) -> &'a CompanionAction {
+        let action_id = stage.action_id.as_deref().expect("stage has an action id");
+        view.actions
+            .iter()
+            .find(|action| action.id == action_id)
+            .expect("expected qualification action exists")
+    }
+
     #[test]
     fn projection_uses_exact_profile_identity_and_no_simulation() {
         let integration = integration();
@@ -1375,7 +1437,8 @@ mod tests {
             stage_ids[0].clone(),
             StageProgress {
                 status: StageStatus::Passed,
-                result: first_result.clone(),
+                result: Some(first_result.clone()),
+                checkpoint: None,
             },
         )]);
         apply_stage_results(&mut view, &results, Some("run-generation-7"));
@@ -1402,7 +1465,8 @@ mod tests {
                 stage_id.clone(),
                 StageProgress {
                     status: StageStatus::Passed,
-                    result: first_result.clone(),
+                    result: Some(first_result.clone()),
+                    checkpoint: None,
                 },
             );
         }
@@ -1418,6 +1482,146 @@ mod tests {
         assert!(!view.companion.hardware_write_executed);
     }
 
+    #[test]
+    fn lighting_authorization_precedes_checkpoint_observations() {
+        let integration = integration();
+        let mut view = build_qualification_view(
+            &system(),
+            Some(&integration),
+            &catalog(),
+            RunnerCapabilities {
+                read_only_actions: RunnerAvailability::Available,
+                supervised_lighting: RunnerAvailability::Available,
+                ..RunnerCapabilities::default()
+            },
+            1,
+            "2026-07-22T12:00:00Z".to_owned(),
+        );
+        let stages = view.plans[0]
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .map(|stage| stage.stage_id.clone())
+            .collect::<Vec<_>>();
+        let completed = StageResult {
+            summary: "Read-only prerequisite passed.".to_owned(),
+            completed_at: "2026-07-22T12:01:00Z".to_owned(),
+            evidence_refs: vec!["local-read-only:test".to_owned()],
+        };
+        let mut results = BTreeMap::from([
+            (
+                stages[0].clone(),
+                StageProgress {
+                    status: StageStatus::Passed,
+                    result: Some(completed.clone()),
+                    checkpoint: None,
+                },
+            ),
+            (
+                stages[1].clone(),
+                StageProgress {
+                    status: StageStatus::Passed,
+                    result: Some(completed),
+                    checkpoint: None,
+                },
+            ),
+        ]);
+        apply_stage_results(&mut view, &results, Some("run-generation-7"));
+        let map = stage_by_suffix(&view, "-map");
+        assert_eq!(map.status, StageStatus::Ready);
+        assert!(map.observations.is_empty());
+        let action = action_for_stage(&view, map);
+        assert!(action.enabled);
+        assert!(
+            action
+                .confirmation
+                .as_ref()
+                .expect("lighting authorization")
+                .summary
+                .contains("cleanup")
+        );
+
+        results.insert(
+            map.stage_id.clone(),
+            StageProgress {
+                status: StageStatus::AwaitingObservation,
+                result: None,
+                checkpoint: Some(StageCheckpoint {
+                    checkpoint_id: "map-pattern".to_owned(),
+                    instructions: vec!["Inspect the pattern.".to_owned()],
+                    observations: vec![outcome_observation()],
+                    evidence_refs: vec!["bridge-transaction:test".to_owned()],
+                }),
+            },
+        );
+        apply_stage_results(&mut view, &results, Some("run-generation-7"));
+        let map = stage_by_suffix(&view, "-map");
+        assert_eq!(map.status, StageStatus::AwaitingObservation);
+        assert_eq!(map.observations.len(), 1);
+        let action = action_for_stage(&view, map);
+        assert_eq!(action.label, "Record watched result");
+        assert!(action.enabled);
+        assert!(action.confirmation.is_none());
+        let lighting = stage_by_suffix(&view, "-lighting");
+        assert_eq!(lighting.status, StageStatus::Locked);
+        let lighting_action = action_for_stage(&view, lighting);
+        assert!(!lighting_action.enabled);
+    }
+
+    #[test]
+    fn identical_models_on_two_receivers_have_distinct_stage_and_action_ids() {
+        let mut integration = integration();
+        let mut second = integration.view.receivers[0].clone();
+        second.receiver_id = ReceiverId::try_from("receiver-second").expect("id is valid");
+        second.generation_id = GenerationId::try_from(11_u64).expect("generation is valid");
+        integration.view.receivers.push(second);
+        let view = build_qualification_view(
+            &system(),
+            Some(&integration),
+            &catalog(),
+            RunnerCapabilities {
+                read_only_actions: RunnerAvailability::Available,
+                supervised_lighting: RunnerAvailability::Available,
+                ..RunnerCapabilities::default()
+            },
+            1,
+            "2026-07-22T12:00:00Z".to_owned(),
+        );
+        assert_eq!(view.plans.len(), 2);
+        let plan_bindings = view
+            .plans
+            .iter()
+            .map(|plan| {
+                (
+                    plan.receiver_id.as_str(),
+                    plan.generation_id,
+                    plan.device_id.as_str(),
+                )
+            })
+            .collect::<std::collections::BTreeSet<_>>();
+        assert_eq!(plan_bindings.len(), 2);
+        let stage_ids = view
+            .plans
+            .iter()
+            .flat_map(|plan| &plan.groups)
+            .flat_map(|group| &group.stages)
+            .map(|stage| stage.stage_id.as_str())
+            .collect::<std::collections::BTreeSet<_>>();
+        let stage_count = view
+            .plans
+            .iter()
+            .flat_map(|plan| &plan.groups)
+            .map(|group| group.stages.len())
+            .sum::<usize>();
+        assert_eq!(stage_ids.len(), stage_count);
+        let action_ids = view
+            .actions
+            .iter()
+            .map(|action| action.id.as_str())
+            .collect::<std::collections::BTreeSet<_>>();
+        assert_eq!(action_ids.len(), view.actions.len());
+    }
+
     #[test]
     fn unknown_device_never_receives_a_qualification_plan() {
         let mut integration = integration();
diff --git a/crates/hfx-ops/src/qualification_runner.rs b/crates/hfx-ops/src/qualification_runner.rs
new file mode 100644
index 0000000..5fd8c58
--- /dev/null
+++ b/crates/hfx-ops/src/qualification_runner.rs
@@ -0,0 +1,1224 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::qualification::{StageCheckpoint, StageProgress};
+use crate::{
+    ObservationChoice, ObservationPrompt, QualificationStage, QualificationView, RealSystemProbe,
+    StageResult, StageStatus, qualification_generated_at,
+};
+use hfx_domain::{
+    ColorChannel, ControllerAvailability, FrameIndex, LeaseDurationMs, MonotonicMs,
+    SideEffectCertainty, StableLightingMode, TransactionClass, TransactionId, TransactionState,
+};
+use hfx_protocol::{
+    ControllerView, DeviceProfileBinding, LeaseGrant, LeaseResult, LightingFrame, ResourceKey,
+    RgbColor, StableLightingIntent, TransactionResult, TransactionTerminal,
+};
+use hfx_sdk::{KernelRequestIdentitySource, RequestIdentitySource, TransactionSubmission};
+use rustix::time::{ClockId, clock_gettime};
+use serde::{Deserialize, Serialize};
+use std::fmt;
+use std::thread;
+use std::time::{Duration, Instant};
+
+const LEASE_DURATION_MS: u32 = 15_000;
+const TRANSACTION_DEADLINE_MS: u64 = 5_000;
+const TRANSACTION_WAIT: Duration = Duration::from_secs(6);
+const TRANSACTION_POLL: Duration = Duration::from_millis(20);
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum ObservationVerdict {
+    Pass,
+    Fail,
+    Unclear,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+enum LightingCommand {
+    MapPattern,
+    StaticBlue,
+    Off,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum LightingStep {
+    MapPattern,
+    MapCleanup,
+    LightingBlue,
+    LightingOff,
+    LightingRestore,
+    FailedCleanup,
+    UnclearCleanup,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct BoundTarget {
+    receiver_id: hfx_domain::ReceiverId,
+    generation_id: hfx_domain::GenerationId,
+    device_id: hfx_domain::LogicalDeviceId,
+    receiver_profile: hfx_protocol::ProfileBindingView,
+    device_profile: hfx_protocol::ProfileBindingView,
+    application_slots: hfx_domain::LedCount,
+    rows: hfx_domain::LedCount,
+    columns: hfx_domain::LedCount,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct DeliveryReceipt {
+    evidence_ref: String,
+    hardware_write_executed: bool,
+}
+
+trait LightingTransport {
+    fn deliver(
+        &mut self,
+        target: &BoundTarget,
+        command: LightingCommand,
+        transaction_id: &TransactionId,
+    ) -> Result<DeliveryReceipt, QualificationRunnerError>;
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct RunnerTransition {
+    pub progress: StageProgress,
+    pub hardware_write_executed: bool,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct PendingLightingTransaction {
+    pub stage_id: String,
+    pub transaction_id: TransactionId,
+    pub step: LightingStep,
+    pub prior_progress: Option<StageProgress>,
+}
+
+pub(crate) enum PreparedLightingAction {
+    Record(RunnerTransition),
+    Write(PreparedLightingWrite),
+}
+
+pub(crate) struct PreparedLightingWrite {
+    target: BoundTarget,
+    step: LightingStep,
+    prior_progress: Option<StageProgress>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct QualificationRunnerError {
+    message: String,
+    hardware_write_executed: bool,
+    retry_forbidden: bool,
+}
+
+impl QualificationRunnerError {
+    fn before_write(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+            hardware_write_executed: false,
+            retry_forbidden: false,
+        }
+    }
+
+    fn after_submission(message: impl Into<String>, hardware_write_executed: bool) -> Self {
+        Self {
+            message: message.into(),
+            hardware_write_executed,
+            retry_forbidden: true,
+        }
+    }
+
+    #[must_use]
+    pub(crate) fn hardware_write_executed(&self) -> bool {
+        self.hardware_write_executed
+    }
+
+    #[must_use]
+    pub(crate) fn retry_forbidden(&self) -> bool {
+        self.retry_forbidden
+    }
+}
+
+impl fmt::Display for QualificationRunnerError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for QualificationRunnerError {}
+
+pub(crate) struct LiveLightingTransport<'a> {
+    probe: &'a RealSystemProbe,
+}
+
+impl<'a> LiveLightingTransport<'a> {
+    pub(crate) const fn new(probe: &'a RealSystemProbe) -> Self {
+        Self { probe }
+    }
+}
+
+impl LightingTransport for LiveLightingTransport<'_> {
+    fn deliver(
+        &mut self,
+        target: &BoundTarget,
+        command: LightingCommand,
+        transaction_id: &TransactionId,
+    ) -> Result<DeliveryReceipt, QualificationRunnerError> {
+        let mut client = self
+            .probe
+            .bridge_client(
+                "hyperflux-qualification-runner",
+                "HyperFlux Qualification Runner",
+            )
+            .map_err(|_| {
+                QualificationRunnerError::before_write(
+                    "The local bridge could not open a qualification writer session.",
+                )
+            })?;
+        let controller = current_controller(&mut client, target)?;
+        let lease = acquire_qualification_lease(&mut client, &controller.resource)?;
+        let submission = lighting_submission(
+            target,
+            command,
+            &controller.resource,
+            &lease,
+            transaction_id,
+        )?;
+        let submitted = client.submit_transaction(submission).map_err(|_| {
+            QualificationRunnerError::after_submission(
+                "The bridge did not return a transaction outcome; the request was not repeated.",
+                false,
+            )
+        });
+        let result = match submitted {
+            Ok(result) => wait_for_terminal(&mut client, transaction_id, result),
+            Err(error) => Err(error),
+        };
+        let released = matches!(
+            client.release_lease(lease.lease_id),
+            Ok(LeaseResult::Granted(_))
+        );
+        let terminal = result?;
+        if !released {
+            return Err(QualificationRunnerError::after_submission(
+                "The lighting request completed, but its lease release was not confirmed; wait for lease expiry before retrying.",
+                terminal.live_write_executed,
+            ));
+        }
+        validate_terminal(&terminal)?;
+        Ok(DeliveryReceipt {
+            evidence_ref: format!("bridge-transaction:{transaction_id}"),
+            hardware_write_executed: true,
+        })
+    }
+}
+
+fn current_controller<S, I>(
+    client: &mut hfx_sdk::HyperFluxClient<S, I>,
+    target: &BoundTarget,
+) -> Result<ControllerView, QualificationRunnerError>
+where
+    S: std::io::Read + std::io::Write,
+    I: RequestIdentitySource,
+{
+    let integration = client.integration_view().map_err(|_| {
+        QualificationRunnerError::before_write(
+            "The bridge could not refresh the generation-bound controller view.",
+        )
+    })?;
+    let controller = exact_controller(&integration, target)?.clone();
+    if controller.availability != ControllerAvailability::Ready {
+        return Err(QualificationRunnerError::before_write(
+            "The selected controller is not ready for a bounded lighting step.",
+        ));
+    }
+    Ok(controller)
+}
+
+fn acquire_qualification_lease<S, I>(
+    client: &mut hfx_sdk::HyperFluxClient<S, I>,
+    resource: &ResourceKey,
+) -> Result<LeaseGrant, QualificationRunnerError>
+where
+    S: std::io::Read + std::io::Write,
+    I: RequestIdentitySource,
+{
+    let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS).map_err(|_| {
+        QualificationRunnerError::before_write(
+            "The qualification lease duration is outside the protocol contract.",
+        )
+    })?;
+    match client.acquire_lease(vec![resource.clone()], duration) {
+        Ok(LeaseResult::Granted(grant)) => Ok(grant),
+        Ok(LeaseResult::Conflict(_)) => Err(QualificationRunnerError::before_write(
+            "Another application owns this controller. Close its lighting session and retry.",
+        )),
+        Ok(LeaseResult::Rejected(_)) | Err(_) => Err(QualificationRunnerError::before_write(
+            "The bridge rejected the qualification lighting lease before any write.",
+        )),
+    }
+}
+
+fn lighting_submission(
+    target: &BoundTarget,
+    command: LightingCommand,
+    resource: &ResourceKey,
+    lease: &LeaseGrant,
+    transaction_id: &TransactionId,
+) -> Result<TransactionSubmission, QualificationRunnerError> {
+    let stable_intents = command.stable_mode().map_or_else(Vec::new, |mode| {
+        vec![StableLightingIntent {
+            device_id: target.device_id.clone(),
+            mode,
+        }]
+    });
+    Ok(TransactionSubmission {
+        transaction_id: transaction_id.clone(),
+        lease_id: lease.lease_id.clone(),
+        receiver_id: target.receiver_id.clone(),
+        generation_id: target.generation_id,
+        receiver_profile_id: target.receiver_profile.profile_id.clone(),
+        receiver_profile_digest: target.receiver_profile.profile_digest.clone(),
+        device_profiles: vec![DeviceProfileBinding {
+            device_id: target.device_id.clone(),
+            profile_id: target.device_profile.profile_id.clone(),
+            profile_digest: target.device_profile.profile_digest.clone(),
+            application_slot_count: target.application_slots,
+        }],
+        transaction_class: command.transaction_class(),
+        stable_intents,
+        deadline_ms: transaction_deadline()?,
+        resources: vec![resource.clone()],
+        frames: vec![LightingFrame {
+            device_id: target.device_id.clone(),
+            frame_index: FrameIndex::try_from(0_u32).map_err(|_| {
+                QualificationRunnerError::before_write(
+                    "The qualification frame index is outside the protocol contract.",
+                )
+            })?,
+            colors: command.colors(target),
+        }],
+    })
+}
+
+fn validate_terminal(terminal: &TransactionTerminal) -> Result<(), QualificationRunnerError> {
+    if terminal.state == TransactionState::Succeeded
+        && terminal.declared_frames.get() == 1
+        && terminal.delivered_frames.get() == 1
+        && terminal.side_effect_certainty == SideEffectCertainty::Committed
+        && terminal.live_write_executed
+    {
+        return Ok(());
+    }
+    Err(QualificationRunnerError::after_submission(
+        "The bridge did not terminally confirm one complete qualification frame; the request was not repeated.",
+        terminal.live_write_executed,
+    ))
+}
+
+pub(crate) fn prepare_lighting_stage(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+) -> Result<PreparedLightingAction, QualificationRunnerError> {
+    let target = bound_target(probe, view, stage)?;
+    prepare_lighting_stage_for_target(target, stage)
+}
+
+pub(crate) fn prepare_lighting_checkpoint(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+    current: &StageProgress,
+    verdict: ObservationVerdict,
+) -> Result<PreparedLightingAction, QualificationRunnerError> {
+    let target = bound_target(probe, view, stage)?;
+    prepare_lighting_checkpoint_for_target(target, stage, current, verdict)
+}
+
+fn prepare_lighting_stage_for_target(
+    target: BoundTarget,
+    stage: &QualificationStage,
+) -> Result<PreparedLightingAction, QualificationRunnerError> {
+    let step = if stage.stage_id.ends_with("-map") {
+        LightingStep::MapPattern
+    } else if stage.stage_id.ends_with("-lighting") {
+        LightingStep::LightingBlue
+    } else {
+        return Err(QualificationRunnerError::before_write(
+            "This supervised stage is not a recognized lighting qualification step.",
+        ));
+    };
+    Ok(PreparedLightingAction::Write(PreparedLightingWrite {
+        target,
+        step,
+        prior_progress: None,
+    }))
+}
+
+fn prepare_lighting_checkpoint_for_target(
+    target: BoundTarget,
+    stage: &QualificationStage,
+    current: &StageProgress,
+    verdict: ObservationVerdict,
+) -> Result<PreparedLightingAction, QualificationRunnerError> {
+    let checkpoint = current.checkpoint.as_ref().ok_or_else(|| {
+        QualificationRunnerError::before_write(
+            "The supervised stage has no resumable checkpoint; no request was sent.",
+        )
+    })?;
+    let step = match verdict {
+        ObservationVerdict::Fail => LightingStep::FailedCleanup,
+        ObservationVerdict::Unclear => LightingStep::UnclearCleanup,
+        ObservationVerdict::Pass => match checkpoint.checkpoint_id.as_str() {
+            "map-pattern" if stage.stage_id.ends_with("-map") => LightingStep::MapCleanup,
+            "lighting-blue" if stage.stage_id.ends_with("-lighting") => LightingStep::LightingOff,
+            "lighting-off" if stage.stage_id.ends_with("-lighting") => {
+                LightingStep::LightingRestore
+            }
+            "lighting-restored" if stage.stage_id.ends_with("-lighting") => {
+                return Ok(PreparedLightingAction::Record(finished(
+                    StageStatus::Passed,
+                    "Static blue, semantic Off, complete black, and final blue restoration were confirmed.",
+                    checkpoint.evidence_refs.clone(),
+                    false,
+                )));
+            }
+            _ => {
+                return Err(QualificationRunnerError::before_write(
+                    "The checkpoint does not belong to the current profile-bound stage.",
+                ));
+            }
+        },
+    };
+    Ok(PreparedLightingAction::Write(PreparedLightingWrite {
+        target,
+        step,
+        prior_progress: Some(current.clone()),
+    }))
+}
+
+impl PreparedLightingWrite {
+    #[must_use]
+    pub(crate) fn pending(
+        &self,
+        stage_id: &str,
+        transaction_id: TransactionId,
+    ) -> PendingLightingTransaction {
+        PendingLightingTransaction {
+            stage_id: stage_id.to_owned(),
+            transaction_id,
+            step: self.step,
+            prior_progress: self.prior_progress.clone(),
+        }
+    }
+
+    pub(crate) fn execute(
+        &self,
+        probe: &RealSystemProbe,
+        transaction_id: &TransactionId,
+    ) -> Result<RunnerTransition, QualificationRunnerError> {
+        let mut transport = LiveLightingTransport::new(probe);
+        execute_lighting_write(&mut transport, self, transaction_id)
+    }
+}
+
+pub(crate) fn reconcile_pending_lighting(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+    pending: &PendingLightingTransaction,
+) -> Result<Option<RunnerTransition>, QualificationRunnerError> {
+    if stage.stage_id != pending.stage_id || !pending.step.belongs_to(stage) {
+        return Err(QualificationRunnerError::before_write(
+            "The saved transaction does not belong to the current profile-bound stage.",
+        ));
+    }
+    let target = bound_target(probe, view, stage)?;
+    let mut client = probe
+        .bridge_client(
+            "hyperflux-qualification-runner",
+            "HyperFlux Qualification Recovery",
+        )
+        .map_err(|_| {
+            QualificationRunnerError::before_write(
+                "The bridge is unavailable while reconciling the saved transaction.",
+            )
+        })?;
+    let outcome = client
+        .transaction_outcome(pending.transaction_id.clone())
+        .map_err(|_| {
+            QualificationRunnerError::after_submission(
+                "The saved transaction outcome cannot be queried yet; it was not repeated.",
+                false,
+            )
+        })?;
+    match outcome {
+        TransactionResult::Progress(_) => Ok(None),
+        TransactionResult::Terminal(terminal) => {
+            if let Err(error) = validate_terminal(&terminal) {
+                return Ok(Some(blocked_pending(
+                    pending,
+                    &error.to_string(),
+                    terminal.live_write_executed,
+                )));
+            }
+            let prepared = PreparedLightingWrite {
+                target,
+                step: pending.step,
+                prior_progress: pending.prior_progress.clone(),
+            };
+            complete_lighting_step(
+                &prepared.target,
+                prepared.step,
+                prepared.prior_progress.as_ref(),
+                DeliveryReceipt {
+                    evidence_ref: format!("bridge-transaction:{}", pending.transaction_id),
+                    hardware_write_executed: true,
+                },
+            )
+            .map(Some)
+        }
+        TransactionResult::Unavailable(_) => Ok(Some(blocked_pending(
+            pending,
+            "The saved transaction outcome is no longer retained; the request was not repeated.",
+            false,
+        ))),
+    }
+}
+
+fn blocked_pending(
+    pending: &PendingLightingTransaction,
+    summary: &str,
+    hardware_write_executed: bool,
+) -> RunnerTransition {
+    let mut evidence = pending
+        .prior_progress
+        .as_ref()
+        .and_then(|progress| progress.checkpoint.as_ref())
+        .map_or_else(Vec::new, |checkpoint| checkpoint.evidence_refs.clone());
+    evidence.push(format!("bridge-transaction:{}", pending.transaction_id));
+    finished(
+        StageStatus::Blocked,
+        summary,
+        evidence,
+        hardware_write_executed,
+    )
+}
+
+fn execute_lighting_write<T: LightingTransport>(
+    transport: &mut T,
+    prepared: &PreparedLightingWrite,
+    transaction_id: &TransactionId,
+) -> Result<RunnerTransition, QualificationRunnerError> {
+    let receipt = transport.deliver(&prepared.target, prepared.step.command(), transaction_id)?;
+    complete_lighting_step(
+        &prepared.target,
+        prepared.step,
+        prepared.prior_progress.as_ref(),
+        receipt,
+    )
+}
+
+fn complete_lighting_step(
+    target: &BoundTarget,
+    step: LightingStep,
+    prior: Option<&StageProgress>,
+    receipt: DeliveryReceipt,
+) -> Result<RunnerTransition, QualificationRunnerError> {
+    let hardware_write_executed = receipt.hardware_write_executed;
+    let prior_evidence = || -> Result<Vec<String>, QualificationRunnerError> {
+        prior
+            .and_then(|progress| progress.checkpoint.as_ref())
+            .map(|checkpoint| checkpoint.evidence_refs.clone())
+            .ok_or_else(|| {
+                QualificationRunnerError::after_submission(
+                    "The completed transaction has no compatible saved checkpoint; it was not repeated.",
+                    hardware_write_executed,
+                )
+            })
+    };
+    let mut evidence = if matches!(step, LightingStep::MapPattern | LightingStep::LightingBlue) {
+        Vec::new()
+    } else {
+        prior_evidence()?
+    };
+    evidence.push(receipt.evidence_ref);
+    Ok(match step {
+        LightingStep::MapPattern => {
+            awaiting(map_checkpoint(target, evidence), hardware_write_executed)
+        }
+        LightingStep::MapCleanup => finished(
+            StageStatus::Passed,
+            "The application layout pattern and bounded blue cleanup were confirmed.",
+            evidence,
+            hardware_write_executed,
+        ),
+        LightingStep::LightingBlue => awaiting(blue_checkpoint(evidence), hardware_write_executed),
+        LightingStep::LightingOff => awaiting(off_checkpoint(evidence), hardware_write_executed),
+        LightingStep::LightingRestore => {
+            awaiting(restored_checkpoint(evidence), hardware_write_executed)
+        }
+        LightingStep::FailedCleanup => finished(
+            StageStatus::Failed,
+            "The watched lighting result did not match every requested checkpoint.",
+            evidence,
+            hardware_write_executed,
+        ),
+        LightingStep::UnclearCleanup => finished(
+            StageStatus::Blocked,
+            "The watched lighting result was inconclusive.",
+            evidence,
+            hardware_write_executed,
+        ),
+    })
+}
+
+fn awaiting(checkpoint: StageCheckpoint, hardware_write_executed: bool) -> RunnerTransition {
+    RunnerTransition {
+        progress: StageProgress {
+            status: StageStatus::AwaitingObservation,
+            result: None,
+            checkpoint: Some(checkpoint),
+        },
+        hardware_write_executed,
+    }
+}
+
+fn finished(
+    status: StageStatus,
+    summary: &str,
+    evidence_refs: Vec<String>,
+    hardware_write_executed: bool,
+) -> RunnerTransition {
+    RunnerTransition {
+        progress: StageProgress {
+            status,
+            result: Some(StageResult {
+                summary: summary.to_owned(),
+                completed_at: qualification_generated_at(),
+                evidence_refs,
+            }),
+            checkpoint: None,
+        },
+        hardware_write_executed,
+    }
+}
+
+fn bound_target(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+) -> Result<BoundTarget, QualificationRunnerError> {
+    let plan = view
+        .plans
+        .iter()
+        .find(|plan| {
+            plan.groups
+                .iter()
+                .flat_map(|group| &group.stages)
+                .any(|candidate| candidate.stage_id == stage.stage_id)
+        })
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write(
+                "The selected stage no longer belongs to a current qualification plan.",
+            )
+        })?;
+    let receiver = view
+        .receivers
+        .iter()
+        .find(|receiver| {
+            receiver.receiver_id == plan.receiver_id
+                && receiver.generation_id == plan.generation_id
+                && receiver
+                    .devices
+                    .iter()
+                    .any(|device| device.device_id == plan.device_id)
+        })
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write(
+                "The selected controller no longer belongs to a current receiver generation.",
+            )
+        })?;
+    let integration = probe.qualification_integration().map_err(|_| {
+        QualificationRunnerError::before_write(
+            "The bridge could not refresh the selected controller before the write.",
+        )
+    })?;
+    let current_receiver = integration
+        .view
+        .receivers
+        .iter()
+        .find(|candidate| {
+            candidate.receiver_id.as_str() == receiver.receiver_id
+                && candidate.generation_id.get() == receiver.generation_id
+        })
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write(
+                "The receiver generation changed before the qualification write.",
+            )
+        })?;
+    let controller = current_receiver
+        .controllers
+        .iter()
+        .find(|controller| controller.device_id.as_str() == plan.device_id)
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write(
+                "The selected controller has no current writable profile-bound route.",
+            )
+        })?;
+    if plan.profile_binding.as_ref().is_none_or(|binding| {
+        binding.id != controller.device_profile.profile_id.as_str()
+            || binding.digest != controller.device_profile.profile_digest.as_str()
+    }) {
+        return Err(QualificationRunnerError::before_write(
+            "The selected controller profile changed before the qualification write.",
+        ));
+    }
+    Ok(BoundTarget::from(controller))
+}
+
+fn exact_controller<'a>(
+    integration: &'a hfx_protocol::IntegrationView,
+    target: &BoundTarget,
+) -> Result<&'a ControllerView, QualificationRunnerError> {
+    integration
+        .receivers
+        .iter()
+        .find(|receiver| {
+            receiver.receiver_id == target.receiver_id
+                && receiver.generation_id == target.generation_id
+        })
+        .and_then(|receiver| {
+            receiver.controllers.iter().find(|controller| {
+                controller.device_id == target.device_id
+                    && controller.receiver_profile == target.receiver_profile
+                    && controller.device_profile == target.device_profile
+                    && controller.lighting.application_slot_count == target.application_slots
+                    && controller.lighting.rows == target.rows
+                    && controller.lighting.columns == target.columns
+            })
+        })
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write(
+                "The controller authority changed before lease acquisition.",
+            )
+        })
+}
+
+impl From<&ControllerView> for BoundTarget {
+    fn from(controller: &ControllerView) -> Self {
+        Self {
+            receiver_id: controller.receiver_id.clone(),
+            generation_id: controller.generation_id,
+            device_id: controller.device_id.clone(),
+            receiver_profile: controller.receiver_profile.clone(),
+            device_profile: controller.device_profile.clone(),
+            application_slots: controller.lighting.application_slot_count,
+            rows: controller.lighting.rows,
+            columns: controller.lighting.columns,
+        }
+    }
+}
+
+impl LightingCommand {
+    const fn transaction_class(self) -> TransactionClass {
+        match self {
+            Self::MapPattern => TransactionClass::EffectFrame,
+            Self::StaticBlue | Self::Off => TransactionClass::StaticLighting,
+        }
+    }
+
+    const fn stable_mode(self) -> Option<StableLightingMode> {
+        match self {
+            Self::MapPattern => None,
+            Self::StaticBlue => Some(StableLightingMode::Static),
+            Self::Off => Some(StableLightingMode::Off),
+        }
+    }
+
+    fn colors(self, target: &BoundTarget) -> Vec<RgbColor> {
+        let count = usize::from(target.application_slots.get());
+        match self {
+            Self::MapPattern => map_colors(target, count),
+            Self::StaticBlue => vec![rgb(0, 0, 255); count],
+            Self::Off => vec![rgb(0, 0, 0); count],
+        }
+    }
+}
+
+impl LightingStep {
+    const fn command(self) -> LightingCommand {
+        match self {
+            Self::MapPattern => LightingCommand::MapPattern,
+            Self::MapCleanup
+            | Self::LightingBlue
+            | Self::LightingRestore
+            | Self::FailedCleanup
+            | Self::UnclearCleanup => LightingCommand::StaticBlue,
+            Self::LightingOff => LightingCommand::Off,
+        }
+    }
+
+    fn belongs_to(self, stage: &QualificationStage) -> bool {
+        match self {
+            Self::MapPattern | Self::MapCleanup => stage.stage_id.ends_with("-map"),
+            Self::LightingBlue | Self::LightingOff | Self::LightingRestore => {
+                stage.stage_id.ends_with("-lighting")
+            }
+            Self::FailedCleanup | Self::UnclearCleanup => {
+                stage.stage_id.ends_with("-map") || stage.stage_id.ends_with("-lighting")
+            }
+        }
+    }
+}
+
+fn map_colors(target: &BoundTarget, count: usize) -> Vec<RgbColor> {
+    const PALETTE: [(u8, u8, u8); 8] = [
+        (255, 0, 0),
+        (255, 128, 0),
+        (255, 255, 0),
+        (0, 255, 0),
+        (0, 255, 255),
+        (0, 0, 255),
+        (128, 0, 255),
+        (255, 0, 255),
+    ];
+    let columns = usize::from(target.columns.get());
+    let rows = usize::from(target.rows.get());
+    (0..count)
+        .map(|index| {
+            let palette_index = if rows > 1 {
+                (index / columns) % PALETTE.len()
+            } else {
+                index % PALETTE.len()
+            };
+            let (red, green, blue) = PALETTE[palette_index];
+            rgb(red, green, blue)
+        })
+        .collect()
+}
+
+fn rgb(red: u8, green: u8, blue: u8) -> RgbColor {
+    RgbColor {
+        red: ColorChannel::try_from(red).expect("every u8 is a canonical color channel"),
+        green: ColorChannel::try_from(green).expect("every u8 is a canonical color channel"),
+        blue: ColorChannel::try_from(blue).expect("every u8 is a canonical color channel"),
+    }
+}
+
+pub(crate) fn new_transaction_id() -> Result<TransactionId, QualificationRunnerError> {
+    let mut identities = KernelRequestIdentitySource;
+    let request = identities.next_request_id().map_err(|_| {
+        QualificationRunnerError::before_write(
+            "Operating-system entropy is unavailable for a unique transaction identity.",
+        )
+    })?;
+    TransactionId::try_from(format!("qualification-{}", request.as_str())).map_err(|_| {
+        QualificationRunnerError::before_write(
+            "The generated qualification transaction identity is invalid.",
+        )
+    })
+}
+
+fn transaction_deadline() -> Result<MonotonicMs, QualificationRunnerError> {
+    let stamp = clock_gettime(ClockId::Monotonic);
+    let seconds = u64::try_from(stamp.tv_sec).map_err(|_| {
+        QualificationRunnerError::before_write("The system monotonic clock is unavailable.")
+    })?;
+    let nanos = u64::try_from(stamp.tv_nsec).map_err(|_| {
+        QualificationRunnerError::before_write("The system monotonic clock is unavailable.")
+    })?;
+    let now = seconds
+        .checked_mul(1_000)
+        .and_then(|value| value.checked_add(nanos / 1_000_000))
+        .ok_or_else(|| {
+            QualificationRunnerError::before_write("The system monotonic clock overflowed.")
+        })?;
+    MonotonicMs::try_from(now.saturating_add(TRANSACTION_DEADLINE_MS)).map_err(|_| {
+        QualificationRunnerError::before_write("The qualification transaction deadline is invalid.")
+    })
+}
+
+fn wait_for_terminal<S, I>(
+    client: &mut hfx_sdk::HyperFluxClient<S, I>,
+    transaction_id: &TransactionId,
+    mut result: TransactionResult,
+) -> Result<hfx_protocol::TransactionTerminal, QualificationRunnerError>
+where
+    S: std::io::Read + std::io::Write,
+    I: RequestIdentitySource,
+{
+    let started = Instant::now();
+    loop {
+        match result {
+            TransactionResult::Terminal(terminal) => return Ok(terminal),
+            TransactionResult::Unavailable(_) => {
+                return Err(QualificationRunnerError::after_submission(
+                    "The submitted transaction is unavailable; the request was not repeated.",
+                    true,
+                ));
+            }
+            TransactionResult::Progress(_) if started.elapsed() < TRANSACTION_WAIT => {
+                thread::sleep(TRANSACTION_POLL);
+                result = client
+                    .transaction_outcome(transaction_id.clone())
+                    .map_err(|_| {
+                        QualificationRunnerError::after_submission(
+                            "The transaction outcome could not be refreshed; the request was not repeated.",
+                            true,
+                        )
+                    })?;
+            }
+            TransactionResult::Progress(_) => {
+                return Err(QualificationRunnerError::after_submission(
+                    "The transaction did not become terminal before its bounded wait expired; the request was not repeated.",
+                    true,
+                ));
+            }
+        }
+    }
+}
+
+fn map_checkpoint(target: &BoundTarget, evidence_refs: Vec<String>) -> StageCheckpoint {
+    let pattern = if target.rows.get() > 1 {
+        "Confirm that each physical row follows the displayed repeating row palette from top to bottom."
+    } else {
+        "Confirm that the complete physical LED path follows the repeating red, orange, yellow, green, cyan, blue, violet, and magenta palette in application order."
+    };
+    StageCheckpoint {
+        checkpoint_id: "map-pattern".to_owned(),
+        instructions: vec![
+            pattern.to_owned(),
+            "Exercise the device's ordinary controls once; do not repeat the lighting action."
+                .to_owned(),
+        ],
+        observations: vec![
+            visual_observation("Does the physical layout match the requested application pattern?"),
+            controls_observation(),
+        ],
+        evidence_refs,
+    }
+}
+
+fn blue_checkpoint(evidence_refs: Vec<String>) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "lighting-blue".to_owned(),
+        instructions: vec![
+            "Confirm that every light on only the selected controller is solid blue.".to_owned(),
+            "Exercise the device's ordinary controls once.".to_owned(),
+        ],
+        observations: vec![
+            visual_observation("Is the selected controller completely blue?"),
+            controls_observation(),
+        ],
+        evidence_refs,
+    }
+}
+
+fn off_checkpoint(evidence_refs: Vec<String>) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "lighting-off".to_owned(),
+        instructions: vec![
+            "Confirm that every light on the selected controller is unlit while sibling controllers remain unchanged."
+                .to_owned(),
+            "Exercise the device's ordinary controls once.".to_owned(),
+        ],
+        observations: vec![
+            visual_observation("Is only the selected controller completely unlit?"),
+            controls_observation(),
+        ],
+        evidence_refs,
+    }
+}
+
+fn restored_checkpoint(evidence_refs: Vec<String>) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "lighting-restored".to_owned(),
+        instructions: vec![
+            "Confirm that the selected controller returned to complete solid blue and sibling controllers remain unchanged."
+                .to_owned(),
+            "Exercise the device's ordinary controls once.".to_owned(),
+        ],
+        observations: vec![
+            visual_observation("Did complete solid blue return on only the selected controller?"),
+            controls_observation(),
+        ],
+        evidence_refs,
+    }
+}
+
+fn visual_observation(prompt: &str) -> ObservationPrompt {
+    ObservationPrompt {
+        id: "visual".to_owned(),
+        prompt: prompt.to_owned(),
+        choices: choices("Matches", "Does not match"),
+    }
+}
+
+fn controls_observation() -> ObservationPrompt {
+    ObservationPrompt {
+        id: "controls".to_owned(),
+        prompt: "Do the device's ordinary semantic controls still work correctly?".to_owned(),
+        choices: choices("Controls work", "A control changed"),
+    }
+}
+
+fn choices(pass: &str, fail: &str) -> Vec<ObservationChoice> {
+    vec![
+        ObservationChoice {
+            id: "pass".to_owned(),
+            label: pass.to_owned(),
+            outcome: "pass".to_owned(),
+        },
+        ObservationChoice {
+            id: "fail".to_owned(),
+            label: fail.to_owned(),
+            outcome: "fail".to_owned(),
+        },
+        ObservationChoice {
+            id: "unclear".to_owned(),
+            label: "Unclear".to_owned(),
+            outcome: "unclear".to_owned(),
+        },
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        GenerationId, LedCount, LogicalDeviceId, ProfileDigest, ProfileId, ReceiverId,
+    };
+    use std::collections::VecDeque;
+
+    struct FakeTransport {
+        commands: Vec<LightingCommand>,
+        transactions: Vec<TransactionId>,
+        receipts: VecDeque<Result<DeliveryReceipt, QualificationRunnerError>>,
+    }
+
+    impl FakeTransport {
+        fn successful() -> Self {
+            Self {
+                commands: Vec::new(),
+                transactions: Vec::new(),
+                receipts: (1..=8)
+                    .map(|index| {
+                        Ok(DeliveryReceipt {
+                            evidence_ref: format!("transaction:{index}"),
+                            hardware_write_executed: true,
+                        })
+                    })
+                    .collect(),
+            }
+        }
+    }
+
+    impl LightingTransport for FakeTransport {
+        fn deliver(
+            &mut self,
+            _target: &BoundTarget,
+            command: LightingCommand,
+            transaction_id: &TransactionId,
+        ) -> Result<DeliveryReceipt, QualificationRunnerError> {
+            self.commands.push(command);
+            self.transactions.push(transaction_id.clone());
+            self.receipts.pop_front().expect("fake receipt exists")
+        }
+    }
+
+    fn binding(id: &str, digest: char) -> hfx_protocol::ProfileBindingView {
+        hfx_protocol::ProfileBindingView {
+            profile_id: ProfileId::try_from(id).expect("profile id"),
+            profile_digest: ProfileDigest::try_from(digest.to_string().repeat(64))
+                .expect("profile digest"),
+        }
+    }
+
+    fn target(rows: u16, columns: u16) -> BoundTarget {
+        BoundTarget {
+            receiver_id: ReceiverId::try_from("receiver-test").expect("receiver id"),
+            generation_id: GenerationId::try_from(7_u64).expect("generation"),
+            device_id: LogicalDeviceId::try_from("device-test").expect("device id"),
+            receiver_profile: binding("receiver.test", 'a'),
+            device_profile: binding("child.test", 'b'),
+            application_slots: LedCount::try_from(rows * columns).expect("slots"),
+            rows: LedCount::try_from(rows).expect("rows"),
+            columns: LedCount::try_from(columns).expect("columns"),
+        }
+    }
+
+    fn stage(id: &str) -> QualificationStage {
+        QualificationStage {
+            stage_id: id.to_owned(),
+            title: "Test".to_owned(),
+            description: "Test".to_owned(),
+            kind: crate::StageKind::WatchedObservation,
+            risk: crate::RiskLevel::LightingWrite,
+            status: StageStatus::Ready,
+            capabilities: Vec::new(),
+            instructions: Vec::new(),
+            observations: Vec::new(),
+            action_id: Some(format!("run:{id}")),
+            result: None,
+        }
+    }
+
+    fn execute_prepared(
+        transport: &mut FakeTransport,
+        action: PreparedLightingAction,
+        sequence: usize,
+    ) -> RunnerTransition {
+        match action {
+            PreparedLightingAction::Record(transition) => transition,
+            PreparedLightingAction::Write(prepared) => execute_lighting_write(
+                transport,
+                &prepared,
+                &TransactionId::try_from(format!("transaction-{sequence}"))
+                    .expect("transaction id"),
+            )
+            .expect("fake transaction succeeds"),
+        }
+    }
+
+    #[test]
+    fn lighting_sequence_never_repeats_a_completed_request() {
+        let target = target(1, 13);
+        let stage = stage("mouse-00cd-lighting");
+        let mut transport = FakeTransport::successful();
+        let first = execute_prepared(
+            &mut transport,
+            prepare_lighting_stage_for_target(target.clone(), &stage).expect("blue step prepares"),
+            1,
+        );
+        assert_eq!(transport.commands, vec![LightingCommand::StaticBlue]);
+        assert_eq!(
+            first
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("checkpoint")
+                .checkpoint_id,
+            "lighting-blue"
+        );
+
+        let second = execute_prepared(
+            &mut transport,
+            prepare_lighting_checkpoint_for_target(
+                target.clone(),
+                &stage,
+                &first.progress,
+                ObservationVerdict::Pass,
+            )
+            .expect("off step prepares"),
+            2,
+        );
+        assert_eq!(
+            transport.commands,
+            vec![LightingCommand::StaticBlue, LightingCommand::Off]
+        );
+
+        let third = execute_prepared(
+            &mut transport,
+            prepare_lighting_checkpoint_for_target(
+                target.clone(),
+                &stage,
+                &second.progress,
+                ObservationVerdict::Pass,
+            )
+            .expect("restore step prepares"),
+            3,
+        );
+        let done = execute_prepared(
+            &mut transport,
+            prepare_lighting_checkpoint_for_target(
+                target,
+                &stage,
+                &third.progress,
+                ObservationVerdict::Pass,
+            )
+            .expect("final observation prepares"),
+            4,
+        );
+        assert_eq!(
+            transport.commands,
+            vec![
+                LightingCommand::StaticBlue,
+                LightingCommand::Off,
+                LightingCommand::StaticBlue
+            ]
+        );
+        assert_eq!(
+            transport
+                .transactions
+                .iter()
+                .map(TransactionId::as_str)
+                .collect::<Vec<_>>(),
+            vec!["transaction-1", "transaction-2", "transaction-3"]
+        );
+        assert_eq!(done.progress.status, StageStatus::Passed);
+        assert_eq!(
+            done.progress
+                .result
+                .as_ref()
+                .expect("result")
+                .evidence_refs
+                .len(),
+            3
+        );
+    }
+
+    #[test]
+    fn failed_observation_performs_one_cleanup_without_repeating_the_test_frame() {
+        let target = target(6, 17);
+        let stage = stage("keyboard-0296-map");
+        let mut transport = FakeTransport::successful();
+        let first = execute_prepared(
+            &mut transport,
+            prepare_lighting_stage_for_target(target.clone(), &stage)
+                .expect("pattern step prepares"),
+            1,
+        );
+        let done = execute_prepared(
+            &mut transport,
+            prepare_lighting_checkpoint_for_target(
+                target,
+                &stage,
+                &first.progress,
+                ObservationVerdict::Fail,
+            )
+            .expect("cleanup prepares"),
+            2,
+        );
+        assert_eq!(
+            transport.commands,
+            vec![LightingCommand::MapPattern, LightingCommand::StaticBlue]
+        );
+        assert_eq!(done.progress.status, StageStatus::Failed);
+    }
+
+    #[test]
+    fn map_pattern_uses_rows_for_matrices_and_slots_for_linear_devices() {
+        let matrix = target(6, 17);
+        let matrix_colors = LightingCommand::MapPattern.colors(&matrix);
+        assert_eq!(matrix_colors[0], matrix_colors[16]);
+        assert_ne!(matrix_colors[0], matrix_colors[17]);
+
+        let linear = target(1, 13);
+        let linear_colors = LightingCommand::MapPattern.colors(&linear);
+        assert_ne!(linear_colors[0], linear_colors[1]);
+        assert_eq!(linear_colors[0], linear_colors[8]);
+    }
+
+    #[test]
+    fn uncertain_submission_forbids_retry_without_claiming_confirmed_execution() {
+        let error = QualificationRunnerError::after_submission("uncertain", false);
+        assert!(error.retry_forbidden());
+        assert!(!error.hardware_write_executed());
+        let prewrite = QualificationRunnerError::before_write("safe to retry");
+        assert!(!prewrite.retry_forbidden());
+        assert!(!prewrite.hardware_write_executed());
+    }
+}
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index 53d9700..3070da4 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -1,6 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::qualification::{StageProgress, apply_stage_results};
+use crate::qualification_runner::{
+    ObservationVerdict, PreparedLightingAction, new_transaction_id, prepare_lighting_checkpoint,
+    prepare_lighting_stage, reconcile_pending_lighting,
+};
+use crate::qualification_state::{
+    QualificationSessionState, QualificationStateError, default_state_path, load_state, save_state,
+};
 use crate::{
     BatteryAvailability, CompanionAction, PresenceView, QualificationStage, QualificationView,
     RealSystemProbe, RiskLevel, RunnerAvailability, RunnerCapabilities, StageResult, StageStatus,
@@ -22,13 +29,7 @@ const MAX_REQUEST_BYTES: usize = 16 * 1_024;
 const MAX_ASSET_BYTES: u64 = 2 * 1_024 * 1_024;
 const REQUEST_TIMEOUT: Duration = Duration::from_secs(3);
 
-#[derive(Debug, Default)]
-struct ServerState {
-    revision: u64,
-    identity_fingerprint: Option<[u8; 32]>,
-    run_id: Option<String>,
-    results: BTreeMap<String, StageProgress>,
-}
+type ServerState = QualificationSessionState;
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq)]
 #[serde(deny_unknown_fields)]
@@ -64,6 +65,7 @@ struct DeviceIdentityFingerprint<'a> {
 pub struct QualificationServerConfig {
     pub assets: PathBuf,
     pub port: u16,
+    pub state_file: Option<PathBuf>,
 }
 
 impl Default for QualificationServerConfig {
@@ -71,6 +73,7 @@ impl Default for QualificationServerConfig {
         Self {
             assets: PathBuf::from("/usr/share/hyperflux-next/qualification-console"),
             port: DEFAULT_PORT,
+            state_file: default_state_path().ok(),
         }
     }
 }
@@ -79,6 +82,7 @@ impl Default for QualificationServerConfig {
 pub enum QualificationServerError {
     AssetRootInvalid,
     CatalogInvalid,
+    StateUnavailable,
     BindFailed(io::Error),
     ConnectionFailed(io::Error),
 }
@@ -90,6 +94,7 @@ impl fmt::Display for QualificationServerError {
                 "qualification console assets are missing or are not a readable directory"
             }
             Self::CatalogInvalid => "the installed profile catalog is invalid",
+            Self::StateUnavailable => "the private qualification checkpoint store is unavailable",
             Self::BindFailed(_) => "the local qualification endpoint could not be opened",
             Self::ConnectionFailed(_) => "the local qualification endpoint stopped unexpectedly",
         })
@@ -100,7 +105,7 @@ impl std::error::Error for QualificationServerError {
     fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
         match self {
             Self::BindFailed(error) | Self::ConnectionFailed(error) => Some(error),
-            Self::AssetRootInvalid | Self::CatalogInvalid => None,
+            Self::AssetRootInvalid | Self::CatalogInvalid | Self::StateUnavailable => None,
         }
     }
 }
@@ -120,8 +125,17 @@ pub fn serve_qualification_console(
         RuntimeProfileCatalog::load().map_err(|_| QualificationServerError::CatalogInvalid)?;
     let listener = TcpListener::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, config.port))
         .map_err(QualificationServerError::BindFailed)?;
+    let state_file = config
+        .state_file
+        .as_deref()
+        .ok_or(QualificationServerError::StateUnavailable)?;
+    let mut state = match load_state(state_file) {
+        Ok(Some(state)) => state,
+        Ok(None) | Err(QualificationStateError::Stale) => ServerState::default(),
+        Err(_) => return Err(QualificationServerError::StateUnavailable),
+    };
+    save_state(state_file, &state).map_err(|_| QualificationServerError::StateUnavailable)?;
     let probe = RealSystemProbe::default();
-    let mut state = ServerState::default();
     for connection in listener.incoming() {
         let mut stream = connection.map_err(QualificationServerError::ConnectionFailed)?;
         let _ = handle_connection(
@@ -130,6 +144,7 @@ pub fn serve_qualification_console(
             config.port,
             &probe,
             &catalog,
+            state_file,
             &mut state,
         );
     }
@@ -150,6 +165,7 @@ fn handle_connection(
     port: u16,
     probe: &RealSystemProbe,
     catalog: &RuntimeProfileCatalog,
+    state_file: &Path,
     state: &mut ServerState,
 ) -> io::Result<()> {
     stream.set_read_timeout(Some(REQUEST_TIMEOUT))?;
@@ -166,7 +182,7 @@ fn handle_connection(
     let head_only = request.method == "HEAD";
     if request.path == "/v1/qualification/view" && matches!(request.method.as_str(), "GET" | "HEAD")
     {
-        let view = live_view(probe, catalog, state)?;
+        let view = live_view(probe, catalog, state_file, state)?;
         let body = serde_json::to_vec(&view).map_err(io::Error::other)?;
         return write_response(
             stream,
@@ -178,7 +194,7 @@ fn handle_connection(
         );
     }
     if request.path.starts_with("/v1/qualification/actions/") && request.method == "POST" {
-        return invoke_action(stream, &request, probe, catalog, state);
+        return invoke_action(stream, &request, probe, catalog, state_file, state);
     }
     if request.method != "GET" && request.method != "HEAD" {
         return write_error(stream, HttpStatus::MethodNotAllowed);
@@ -206,6 +222,7 @@ fn handle_connection(
 fn live_view(
     probe: &RealSystemProbe,
     catalog: &RuntimeProfileCatalog,
+    state_file: &Path,
     state: &mut ServerState,
 ) -> io::Result<QualificationView> {
     let system = probe.snapshot();
@@ -216,42 +233,93 @@ fn live_view(
         catalog,
         RunnerCapabilities {
             read_only_actions: RunnerAvailability::Available,
+            supervised_lighting: RunnerAvailability::Available,
             ..RunnerCapabilities::default()
         },
         state.revision.max(1),
         qualification_generated_at(),
     );
     let fingerprint = identity_fingerprint(&view)?;
+    let mut changed = refresh_identity_binding(state, fingerprint);
+    if reconcile_pending(probe, &view, state) {
+        changed = true;
+    }
+    view.view_revision = state.revision;
+    apply_stage_results(&mut view, &state.results, state.run_id.as_deref());
+    view.companion.hardware_write_executed = state.hardware_write_executed;
+    if changed {
+        save_state(state_file, state).map_err(io::Error::other)?;
+    }
+    Ok(view)
+}
+
+fn refresh_identity_binding(state: &mut ServerState, fingerprint: [u8; 32]) -> bool {
     match state.identity_fingerprint {
         None => {
             state.revision = 1;
             state.identity_fingerprint = Some(fingerprint);
+            true
         }
         Some(previous) if previous != fingerprint => {
             state.revision = state.revision.saturating_add(1);
             state.identity_fingerprint = Some(fingerprint);
             state.run_id = None;
             state.results.clear();
+            if let Some(pending) = &state.pending_transaction {
+                state.results.insert(
+                    pending.stage_id.clone(),
+                    StageProgress {
+                        status: StageStatus::Running,
+                        result: None,
+                        checkpoint: None,
+                    },
+                );
+            }
+            true
         }
-        Some(_) => {}
+        Some(_) => false,
     }
-    view.view_revision = state.revision;
-    apply_stage_results(&mut view, &state.results, state.run_id.as_deref());
-    Ok(view)
+}
+
+fn reconcile_pending(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    session: &mut ServerState,
+) -> bool {
+    let Some(pending) = session.pending_transaction.clone() else {
+        return false;
+    };
+    let Some(stage) = view
+        .plans
+        .iter()
+        .flat_map(|plan| &plan.groups)
+        .flat_map(|group| &group.stages)
+        .find(|stage| stage.stage_id == pending.stage_id)
+    else {
+        session.pending_transaction = None;
+        session.results.clear();
+        session.run_id = None;
+        session.revision = session.revision.saturating_add(1);
+        return true;
+    };
+    let Ok(Some(transition)) = reconcile_pending_lighting(probe, view, stage, &pending) else {
+        return false;
+    };
+    session.hardware_write_executed |= transition.hardware_write_executed;
+    session
+        .results
+        .insert(pending.stage_id, transition.progress);
+    session.pending_transaction = None;
+    session.revision = session.revision.saturating_add(1);
+    true
 }
 
 fn identity_fingerprint(view: &QualificationView) -> io::Result<[u8; 32]> {
-    let receivers = view
+    let mut receivers = view
         .receivers
         .iter()
-        .map(|receiver| ReceiverIdentityFingerprint {
-            receiver_id: &receiver.receiver_id,
-            generation_id: receiver.generation_id,
-            profile: receiver
-                .profile
-                .as_ref()
-                .map(|profile| (profile.id.as_str(), profile.digest.as_str())),
-            devices: receiver
+        .map(|receiver| {
+            let mut devices = receiver
                 .devices
                 .iter()
                 .map(|device| DeviceIdentityFingerprint {
@@ -262,9 +330,20 @@ fn identity_fingerprint(view: &QualificationView) -> io::Result<[u8; 32]> {
                         .as_ref()
                         .map(|profile| (profile.id.as_str(), profile.digest.as_str())),
                 })
-                .collect(),
+                .collect::<Vec<_>>();
+            devices.sort_by_key(|device| (device.device_id, device.product_id));
+            ReceiverIdentityFingerprint {
+                receiver_id: &receiver.receiver_id,
+                generation_id: receiver.generation_id,
+                profile: receiver
+                    .profile
+                    .as_ref()
+                    .map(|profile| (profile.id.as_str(), profile.digest.as_str())),
+                devices,
+            }
         })
-        .collect();
+        .collect::<Vec<_>>();
+    receivers.sort_by_key(|receiver| (receiver.receiver_id, receiver.generation_id));
     let encoded =
         serde_json::to_vec(&IdentityFingerprint { receivers }).map_err(io::Error::other)?;
     Ok(Sha256::digest(encoded).into())
@@ -275,6 +354,7 @@ fn invoke_action(
     request: &HttpRequest,
     probe: &RealSystemProbe,
     catalog: &RuntimeProfileCatalog,
+    state_file: &Path,
     state: &mut ServerState,
 ) -> io::Result<()> {
     let input: ActionInput = match serde_json::from_slice(&request.body) {
@@ -287,7 +367,7 @@ fn invoke_action(
             );
         }
     };
-    let view = live_view(probe, catalog, state)?;
+    let view = live_view(probe, catalog, state_file, state)?;
     if input.view_revision != view.view_revision {
         return write_json_error(
             stream,
@@ -313,13 +393,6 @@ fn invoke_action(
             "This action has no current profile-bound stage.",
         );
     };
-    if action.risk != RiskLevel::ReadOnly || selected_stage.risk != RiskLevel::ReadOnly {
-        return write_json_error(
-            stream,
-            HttpStatus::NotImplemented,
-            "The supervised hardware runner is not installed; no hardware write was attempted.",
-        );
-    }
     if action
         .confirmation
         .as_ref()
@@ -331,28 +404,17 @@ fn invoke_action(
             "The exact authorization phrase was not supplied.",
         );
     }
-    let (status, summary) = read_only_outcome(&view, selected_stage, &input);
-    let completed_at = qualification_generated_at();
-    if state.run_id.is_none() {
-        let timestamp = completed_at
-            .chars()
-            .filter(|character| !matches!(character, ':' | '-'))
-            .collect::<String>();
-        state.run_id = Some(format!("local-{timestamp}"));
+    ensure_run_id(state);
+    if let Err(failure) = apply_action(probe, &view, selected_stage, &input, state_file, state) {
+        if failure.state_changed {
+            state.revision = state.revision.saturating_add(1);
+            save_state(state_file, state).map_err(io::Error::other)?;
+        }
+        return write_json_error(stream, failure.status, &failure.message);
     }
-    state.results.insert(
-        selected_stage.stage_id.clone(),
-        StageProgress {
-            status,
-            result: StageResult {
-                summary: summary.to_owned(),
-                completed_at,
-                evidence_refs: vec![format!("local-read-only:{}", selected_stage.stage_id)],
-            },
-        },
-    );
     state.revision = state.revision.saturating_add(1);
-    let response = live_view(probe, catalog, state)?;
+    commit_completed_state(state_file, state)?;
+    let response = live_view(probe, catalog, state_file, state)?;
     let body = serde_json::to_vec(&response).map_err(io::Error::other)?;
     write_response(
         stream,
@@ -364,6 +426,231 @@ fn invoke_action(
     )
 }
 
+struct ActionFailure {
+    status: HttpStatus,
+    message: String,
+    state_changed: bool,
+}
+
+impl ActionFailure {
+    fn unchanged(status: HttpStatus, message: impl Into<String>) -> Self {
+        Self {
+            status,
+            message: message.into(),
+            state_changed: false,
+        }
+    }
+}
+
+fn apply_action(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+    input: &ActionInput,
+    state_file: &Path,
+    session: &mut ServerState,
+) -> Result<(), ActionFailure> {
+    match stage.risk {
+        RiskLevel::ReadOnly => {
+            record_read_only_result(view, stage, input, session);
+            Ok(())
+        }
+        RiskLevel::LightingWrite => {
+            apply_lighting_action(probe, view, stage, input, state_file, session)
+        }
+        RiskLevel::DeviceLifecycle | RiskLevel::SystemLifecycle => Err(ActionFailure::unchanged(
+            HttpStatus::NotImplemented,
+            "The supervised lifecycle runner is not installed; no hardware action was requested.",
+        )),
+    }
+}
+
+fn record_read_only_result(
+    view: &QualificationView,
+    stage: &QualificationStage,
+    input: &ActionInput,
+    session: &mut ServerState,
+) {
+    let (status, summary) = read_only_outcome(view, stage, input);
+    session.results.insert(
+        stage.stage_id.clone(),
+        StageProgress {
+            status,
+            result: Some(StageResult {
+                summary: summary.to_owned(),
+                completed_at: qualification_generated_at(),
+                evidence_refs: vec![format!("local-read-only:{}", stage.stage_id)],
+            }),
+            checkpoint: None,
+        },
+    );
+}
+
+fn apply_lighting_action(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+    input: &ActionInput,
+    state_file: &Path,
+    session: &mut ServerState,
+) -> Result<(), ActionFailure> {
+    let prepared = if stage.status == StageStatus::Ready {
+        prepare_lighting_stage(probe, view, stage)
+    } else if stage.status == StageStatus::AwaitingObservation {
+        let verdict = observation_verdict(stage, input)
+            .map_err(|message| ActionFailure::unchanged(HttpStatus::BadRequest, message))?;
+        let current = session.results.get(&stage.stage_id).ok_or_else(|| {
+            ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "The watched checkpoint is no longer available; no request was sent.",
+            )
+        })?;
+        prepare_lighting_checkpoint(probe, view, stage, current, verdict)
+    } else {
+        return Err(ActionFailure::unchanged(
+            HttpStatus::Conflict,
+            "This lighting stage is not at a runnable checkpoint.",
+        ));
+    };
+    let prepared = prepared
+        .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?;
+    let transition = match prepared {
+        PreparedLightingAction::Record(transition) => transition,
+        PreparedLightingAction::Write(prepared) => {
+            execute_prepared_lighting(&prepared, probe, stage, state_file, session)?
+        }
+    };
+    session.hardware_write_executed |= transition.hardware_write_executed;
+    session
+        .results
+        .insert(stage.stage_id.clone(), transition.progress);
+    Ok(())
+}
+
+fn execute_prepared_lighting(
+    prepared: &crate::qualification_runner::PreparedLightingWrite,
+    probe: &RealSystemProbe,
+    stage: &QualificationStage,
+    state_file: &Path,
+    session: &mut ServerState,
+) -> Result<crate::qualification_runner::RunnerTransition, ActionFailure> {
+    let transaction_id = new_transaction_id()
+        .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?;
+    let prior = session.results.get(&stage.stage_id).cloned();
+    let pending = prepared.pending(&stage.stage_id, transaction_id.clone());
+    session.pending_transaction = Some(pending.clone());
+    session.results.insert(
+        stage.stage_id.clone(),
+        StageProgress {
+            status: StageStatus::Running,
+            result: None,
+            checkpoint: None,
+        },
+    );
+    if save_state(state_file, session).is_err() {
+        restore_prior_progress(session, &stage.stage_id, prior);
+        return Err(ActionFailure::unchanged(
+            HttpStatus::Conflict,
+            "The private checkpoint could not be committed; no request was sent.",
+        ));
+    }
+    match prepared.execute(probe, &transaction_id) {
+        Ok(transition) => Ok(transition),
+        Err(error) => {
+            let retry_forbidden = error.retry_forbidden();
+            session.hardware_write_executed |= error.hardware_write_executed();
+            if !retry_forbidden {
+                restore_prior_progress(session, &stage.stage_id, prior);
+                if save_state(state_file, session).is_err() {
+                    restore_pending_progress(session, pending);
+                    return Err(ActionFailure::unchanged(
+                        HttpStatus::Conflict,
+                        "The request was not sent, but its private checkpoint could not be restored.",
+                    ));
+                }
+            }
+            Err(ActionFailure {
+                status: HttpStatus::Conflict,
+                message: error.to_string(),
+                state_changed: retry_forbidden,
+            })
+        }
+    }
+}
+
+fn restore_pending_progress(
+    session: &mut ServerState,
+    pending: crate::qualification_runner::PendingLightingTransaction,
+) {
+    session.results.insert(
+        pending.stage_id.clone(),
+        StageProgress {
+            status: StageStatus::Running,
+            result: None,
+            checkpoint: None,
+        },
+    );
+    session.pending_transaction = Some(pending);
+}
+
+fn restore_prior_progress(session: &mut ServerState, stage_id: &str, prior: Option<StageProgress>) {
+    session.pending_transaction = None;
+    if let Some(progress) = prior {
+        session.results.insert(stage_id.to_owned(), progress);
+    } else {
+        session.results.remove(stage_id);
+    }
+}
+
+fn ensure_run_id(state: &mut ServerState) {
+    if state.run_id.is_none() {
+        let timestamp = qualification_generated_at()
+            .chars()
+            .filter(|character| !matches!(character, ':' | '-'))
+            .collect::<String>();
+        state.run_id = Some(format!("local-{timestamp}"));
+    }
+}
+
+fn commit_completed_state(state_file: &Path, state: &mut ServerState) -> io::Result<()> {
+    let completed_pending = state.pending_transaction.take();
+    if let Err(error) = save_state(state_file, state) {
+        state.pending_transaction = completed_pending;
+        return Err(io::Error::other(error));
+    }
+    Ok(())
+}
+
+fn observation_verdict(
+    stage: &QualificationStage,
+    input: &ActionInput,
+) -> Result<ObservationVerdict, &'static str> {
+    if input.observations.len() != stage.observations.len() {
+        return Err("Answer every watched observation exactly once; no request was sent.");
+    }
+    let mut verdict = ObservationVerdict::Pass;
+    for prompt in &stage.observations {
+        let answer = input
+            .observations
+            .get(&prompt.id)
+            .ok_or("Answer every watched observation exactly once; no request was sent.")?;
+        let choice = prompt
+            .choices
+            .iter()
+            .find(|choice| choice.id == *answer)
+            .ok_or("A watched answer is outside the declared choices; no request was sent.")?;
+        match choice.outcome.as_str() {
+            "fail" => verdict = ObservationVerdict::Fail,
+            "unclear" if verdict != ObservationVerdict::Fail => {
+                verdict = ObservationVerdict::Unclear;
+            }
+            "pass" | "unclear" => {}
+            _ => return Err("A watched answer has an invalid outcome; no request was sent."),
+        }
+    }
+    Ok(verdict)
+}
+
 fn stage_for_action<'a>(
     view: &'a QualificationView,
     action: &CompanionAction,
@@ -386,12 +673,7 @@ fn read_only_outcome<'a>(
                 .iter()
                 .flat_map(|group| &group.stages)
                 .any(|candidate| candidate.stage_id == stage.stage_id)
-                .then(|| {
-                    view.receivers
-                        .iter()
-                        .flat_map(|receiver| &receiver.devices)
-                        .find(|device| device.device_id == plan.device_id)
-                })
+                .then(|| device_for_plan(view, plan))
                 .flatten()
         });
         let Some(device) = device else {
@@ -460,6 +742,20 @@ fn read_only_outcome<'a>(
     }
 }
 
+fn device_for_plan<'a>(
+    view: &'a QualificationView,
+    plan: &crate::QualificationPlan,
+) -> Option<&'a crate::DeviceView> {
+    view.receivers
+        .iter()
+        .find(|receiver| {
+            receiver.receiver_id == plan.receiver_id && receiver.generation_id == plan.generation_id
+        })?
+        .devices
+        .iter()
+        .find(|device| device.device_id == plan.device_id)
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 struct HttpRequest {
     method: String,
@@ -729,6 +1025,16 @@ fn write_response(
 mod tests {
     use super::*;
 
+    fn pending_transaction() -> crate::qualification_runner::PendingLightingTransaction {
+        crate::qualification_runner::PendingLightingTransaction {
+            stage_id: "mouse-test-lighting".to_owned(),
+            transaction_id: hfx_domain::TransactionId::try_from("qualification-test")
+                .expect("transaction id"),
+            step: crate::qualification_runner::LightingStep::LightingBlue,
+            prior_progress: None,
+        }
+    }
+
     #[test]
     fn parser_accepts_only_bounded_http11_shapes() {
         let request =
@@ -771,4 +1077,163 @@ mod tests {
         assert_eq!(resolve_asset(&canonical, "/../secret"), None);
         fs::remove_dir_all(&root).expect("test root removes");
     }
+
+    #[test]
+    fn failed_final_commit_keeps_the_pending_transaction_for_reconciliation() {
+        let parent = std::env::temp_dir().join(format!(
+            "hyperflux-qualification-invalid-state-parent-{}",
+            std::process::id()
+        ));
+        let _ = fs::remove_file(&parent);
+        fs::write(&parent, "not a directory").expect("blocking parent writes");
+        let pending = pending_transaction();
+        let mut state = ServerState {
+            pending_transaction: Some(pending.clone()),
+            ..ServerState::default()
+        };
+        assert!(commit_completed_state(&parent.join("session.json"), &mut state).is_err());
+        assert_eq!(state.pending_transaction, Some(pending));
+        fs::remove_file(parent).expect("blocking parent removes");
+    }
+
+    #[test]
+    fn failed_unsent_restore_keeps_the_pending_gate_in_memory() {
+        let pending = pending_transaction();
+        let mut state = ServerState {
+            pending_transaction: Some(pending.clone()),
+            results: BTreeMap::from([(
+                pending.stage_id.clone(),
+                StageProgress {
+                    status: StageStatus::Running,
+                    result: None,
+                    checkpoint: None,
+                },
+            )]),
+            ..ServerState::default()
+        };
+        restore_prior_progress(&mut state, &pending.stage_id, None);
+        restore_pending_progress(&mut state, pending.clone());
+        assert_eq!(state.pending_transaction, Some(pending.clone()));
+        assert_eq!(
+            state.results[&pending.stage_id].status,
+            StageStatus::Running
+        );
+    }
+
+    #[test]
+    fn identity_change_invalidates_claims_but_preserves_uncertain_side_effects() {
+        let pending = pending_transaction();
+        let mut state = ServerState {
+            identity_fingerprint: Some([1_u8; 32]),
+            run_id: Some("run-old-generation".to_owned()),
+            results: BTreeMap::from([(
+                "mouse-test-profile".to_owned(),
+                StageProgress {
+                    status: StageStatus::Passed,
+                    result: None,
+                    checkpoint: None,
+                },
+            )]),
+            pending_transaction: Some(pending.clone()),
+            hardware_write_executed: true,
+            ..ServerState::default()
+        };
+        assert!(refresh_identity_binding(&mut state, [2_u8; 32]));
+        assert_eq!(state.results.len(), 1);
+        assert_eq!(
+            state.results["mouse-test-lighting"].status,
+            StageStatus::Running
+        );
+        assert!(state.run_id.is_none());
+        assert_eq!(state.pending_transaction, Some(pending));
+        assert!(state.hardware_write_executed);
+    }
+
+    #[test]
+    fn identity_fingerprint_ignores_inventory_order() {
+        let fixture = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../apps/device-qualification/tests/fixtures/rust-qualified-pair.json");
+        let mut view: QualificationView =
+            serde_json::from_slice(&fs::read(fixture).expect("fixture reads"))
+                .expect("fixture parses");
+        let mut second = view.receivers[0].clone();
+        second.receiver_id = "receiver-second".to_owned();
+        second.generation_id = 11;
+        view.receivers.push(second);
+        let expected = identity_fingerprint(&view).expect("fingerprint computes");
+        view.receivers.reverse();
+        for receiver in &mut view.receivers {
+            receiver.devices.reverse();
+        }
+        assert_eq!(
+            identity_fingerprint(&view).expect("reordered fingerprint computes"),
+            expected
+        );
+    }
+
+    #[test]
+    fn watched_answers_are_exact_and_reduce_to_one_verdict() {
+        let stage = QualificationStage {
+            stage_id: "mouse-test-lighting".to_owned(),
+            title: "Lighting".to_owned(),
+            description: "Lighting".to_owned(),
+            kind: crate::StageKind::WatchedObservation,
+            risk: RiskLevel::LightingWrite,
+            status: StageStatus::AwaitingObservation,
+            capabilities: Vec::new(),
+            instructions: Vec::new(),
+            observations: vec![crate::ObservationPrompt {
+                id: "visual".to_owned(),
+                prompt: "Does it match?".to_owned(),
+                choices: vec![
+                    crate::ObservationChoice {
+                        id: "pass".to_owned(),
+                        label: "Matches".to_owned(),
+                        outcome: "pass".to_owned(),
+                    },
+                    crate::ObservationChoice {
+                        id: "fail".to_owned(),
+                        label: "Does not match".to_owned(),
+                        outcome: "fail".to_owned(),
+                    },
+                    crate::ObservationChoice {
+                        id: "unclear".to_owned(),
+                        label: "Unclear".to_owned(),
+                        outcome: "unclear".to_owned(),
+                    },
+                ],
+            }],
+            action_id: Some("run:mouse-test-lighting".to_owned()),
+            result: None,
+        };
+        let input = |answer: &str| ActionInput {
+            view_revision: 1,
+            confirmation: None,
+            observations: BTreeMap::from([("visual".to_owned(), answer.to_owned())]),
+        };
+        assert_eq!(
+            observation_verdict(&stage, &input("pass")),
+            Ok(ObservationVerdict::Pass)
+        );
+        assert_eq!(
+            observation_verdict(&stage, &input("fail")),
+            Ok(ObservationVerdict::Fail)
+        );
+        assert_eq!(
+            observation_verdict(&stage, &input("unclear")),
+            Ok(ObservationVerdict::Unclear)
+        );
+        assert!(observation_verdict(&stage, &input("typo")).is_err());
+        assert!(
+            observation_verdict(
+                &stage,
+                &ActionInput {
+                    view_revision: 1,
+                    confirmation: None,
+                    observations: BTreeMap::new(),
+                }
+            )
+            .is_err()
+        );
+    }
 }
diff --git a/crates/hfx-ops/src/qualification_state.rs b/crates/hfx-ops/src/qualification_state.rs
new file mode 100644
index 0000000..c14aef9
--- /dev/null
+++ b/crates/hfx-ops/src/qualification_state.rs
@@ -0,0 +1,310 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::probe::write_private_file;
+use crate::qualification::StageProgress;
+use crate::qualification_runner::PendingLightingTransaction;
+use hfx_profiles::PROFILE_SOURCE_SHA256;
+use hfx_runtime::{LINUX_RUNTIME_SHA256, PRODUCT_VERSION};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeMap;
+use std::fmt::{self, Write as _};
+use std::fs;
+use std::io;
+use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+const SESSION_SCHEMA: &str = "hyperflux-qualification-session-v1";
+const MAX_SESSION_BYTES: u64 = 256 * 1024;
+const MAX_STAGE_RESULTS: usize = 64;
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct QualificationSessionState {
+    pub schema: String,
+    pub product_version: String,
+    pub coordinator_sha256: String,
+    pub runtime_sha256: String,
+    pub profile_catalog_sha256: String,
+    pub revision: u64,
+    pub identity_fingerprint: Option<[u8; 32]>,
+    pub run_id: Option<String>,
+    pub results: BTreeMap<String, StageProgress>,
+    pub pending_transaction: Option<PendingLightingTransaction>,
+    pub hardware_write_executed: bool,
+}
+
+impl Default for QualificationSessionState {
+    fn default() -> Self {
+        Self {
+            schema: SESSION_SCHEMA.to_owned(),
+            product_version: PRODUCT_VERSION.to_owned(),
+            coordinator_sha256: coordinator_sha256(),
+            runtime_sha256: LINUX_RUNTIME_SHA256.to_owned(),
+            profile_catalog_sha256: PROFILE_SOURCE_SHA256.to_owned(),
+            revision: 0,
+            identity_fingerprint: None,
+            run_id: None,
+            results: BTreeMap::new(),
+            pending_transaction: None,
+            hardware_write_executed: false,
+        }
+    }
+}
+
+impl QualificationSessionState {
+    fn validate(&self) -> Result<(), QualificationStateError> {
+        if !valid_digest(&self.coordinator_sha256)
+            || !valid_digest(&self.runtime_sha256)
+            || !valid_digest(&self.profile_catalog_sha256)
+        {
+            return Err(QualificationStateError::Invalid);
+        }
+        if self.schema != SESSION_SCHEMA
+            || self.product_version != PRODUCT_VERSION
+            || self.coordinator_sha256 != coordinator_sha256()
+            || self.runtime_sha256 != LINUX_RUNTIME_SHA256
+            || self.profile_catalog_sha256 != PROFILE_SOURCE_SHA256
+        {
+            return Err(QualificationStateError::Stale);
+        }
+        if self.results.len() > MAX_STAGE_RESULTS
+            || self.run_id.as_deref().is_some_and(|value| {
+                value.is_empty()
+                    || value.len() > 96
+                    || !value.bytes().all(|byte| {
+                        byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.')
+                    })
+            })
+            || self.results.iter().any(|(stage_id, progress)| {
+                stage_id.is_empty()
+                    || stage_id.len() > 128
+                    || !stage_id.bytes().all(|byte| {
+                        byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.')
+                    })
+                    || progress.checkpoint.as_ref().is_some_and(|checkpoint| {
+                        checkpoint.checkpoint_id.is_empty()
+                            || checkpoint.checkpoint_id.len() > 128
+                            || checkpoint.instructions.len() > 16
+                            || checkpoint.observations.len() > 16
+                            || checkpoint.evidence_refs.len() > 32
+                    })
+            })
+            || self.pending_transaction.as_ref().is_some_and(|pending| {
+                pending.stage_id.is_empty()
+                    || pending.stage_id.len() > 128
+                    || !pending.stage_id.bytes().all(|byte| {
+                        byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.')
+                    })
+            })
+        {
+            return Err(QualificationStateError::Invalid);
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug)]
+pub(crate) enum QualificationStateError {
+    Io(io::Error),
+    Invalid,
+    Stale,
+    TooLarge,
+    Insecure,
+}
+
+impl fmt::Display for QualificationStateError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::Io(_) => "qualification checkpoint state could not be stored safely",
+            Self::Invalid => "qualification checkpoint state is invalid",
+            Self::Stale => "qualification checkpoint state belongs to a different build",
+            Self::TooLarge => "qualification checkpoint state exceeds its size bound",
+            Self::Insecure => "qualification checkpoint state is not private",
+        })
+    }
+}
+
+impl std::error::Error for QualificationStateError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::Io(error) => Some(error),
+            Self::Invalid | Self::Stale | Self::TooLarge | Self::Insecure => None,
+        }
+    }
+}
+
+impl From<io::Error> for QualificationStateError {
+    fn from(error: io::Error) -> Self {
+        Self::Io(error)
+    }
+}
+
+pub(crate) fn default_state_path() -> Result<PathBuf, QualificationStateError> {
+    let base = std::env::var_os("XDG_STATE_HOME")
+        .filter(|value| !value.is_empty())
+        .map(PathBuf::from)
+        .or_else(|| {
+            std::env::var_os("HOME")
+                .filter(|value| !value.is_empty())
+                .map(|home| PathBuf::from(home).join(".local/state"))
+        })
+        .ok_or(QualificationStateError::Invalid)?;
+    if !base.is_absolute() {
+        return Err(QualificationStateError::Invalid);
+    }
+    Ok(base
+        .join("hyperflux-next")
+        .join("qualification-session.json"))
+}
+
+pub(crate) fn load_state(
+    path: &Path,
+) -> Result<Option<QualificationSessionState>, QualificationStateError> {
+    let metadata = match fs::symlink_metadata(path) {
+        Ok(metadata) => metadata,
+        Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
+        Err(error) => return Err(error.into()),
+    };
+    if !metadata.file_type().is_file()
+        || metadata.uid() != rustix::process::geteuid().as_raw()
+        || metadata.mode() & 0o077 != 0
+    {
+        return Err(QualificationStateError::Insecure);
+    }
+    if metadata.len() > MAX_SESSION_BYTES {
+        return Err(QualificationStateError::TooLarge);
+    }
+    let payload = fs::read(path)?;
+    let state: QualificationSessionState =
+        serde_json::from_slice(&payload).map_err(|_| QualificationStateError::Invalid)?;
+    state.validate()?;
+    Ok(Some(state))
+}
+
+pub(crate) fn save_state(
+    path: &Path,
+    state: &QualificationSessionState,
+) -> Result<(), QualificationStateError> {
+    state.validate()?;
+    let parent = path.parent().ok_or(QualificationStateError::Invalid)?;
+    fs::create_dir_all(parent)?;
+    let parent_metadata = fs::symlink_metadata(parent)?;
+    if !parent_metadata.file_type().is_dir()
+        || parent_metadata.uid() != rustix::process::geteuid().as_raw()
+    {
+        return Err(QualificationStateError::Insecure);
+    }
+    fs::set_permissions(parent, fs::Permissions::from_mode(0o700))?;
+    let payload = serde_json::to_vec_pretty(state).map_err(|_| QualificationStateError::Invalid)?;
+    if payload.len() as u64 > MAX_SESSION_BYTES {
+        return Err(QualificationStateError::TooLarge);
+    }
+    let temporary = temporary_path(path);
+    match fs::symlink_metadata(&temporary) {
+        Ok(metadata)
+            if metadata.file_type().is_file()
+                && metadata.uid() == rustix::process::geteuid().as_raw() =>
+        {
+            fs::remove_file(&temporary)?;
+        }
+        Ok(_) => return Err(QualificationStateError::Insecure),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {}
+        Err(error) => return Err(error.into()),
+    }
+    write_private_file(&temporary, &payload)?;
+    fs::rename(&temporary, path)?;
+    fs::File::open(parent)?.sync_all()?;
+    Ok(())
+}
+
+fn temporary_path(path: &Path) -> PathBuf {
+    let mut name = path.as_os_str().to_owned();
+    name.push(format!(".{}.tmp", std::process::id()));
+    PathBuf::from(name)
+}
+
+fn coordinator_sha256() -> String {
+    let mut digest = Sha256::new();
+    digest.update(include_bytes!("qualification.rs"));
+    digest.update(include_bytes!("qualification_runner.rs"));
+    digest.update(include_bytes!("qualification_server.rs"));
+    digest.update(include_bytes!("qualification_state.rs"));
+    digest.update(option_env!("HFX_SOURCE_REVISION").unwrap_or("development-unbound"));
+    let mut encoded = String::with_capacity(64);
+    for byte in digest.finalize() {
+        write!(&mut encoded, "{byte:02x}").expect("writing to a string cannot fail");
+    }
+    encoded
+}
+
+fn valid_digest(value: &str) -> bool {
+    value.len() == 64 && value.bytes().all(|byte| byte.is_ascii_hexdigit())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_path(label: &str) -> PathBuf {
+        std::env::temp_dir().join(format!(
+            "hyperflux-next-qualification-state-{}-{label}/session.json",
+            std::process::id()
+        ))
+    }
+
+    #[test]
+    fn state_round_trips_privately_and_rejects_stale_authority() {
+        let path = test_path("round-trip");
+        let _ = fs::remove_dir_all(path.parent().expect("parent"));
+        let mut state = QualificationSessionState {
+            revision: 7,
+            identity_fingerprint: Some([9_u8; 32]),
+            run_id: Some("local-test".to_owned()),
+            pending_transaction: Some(PendingLightingTransaction {
+                stage_id: "mouse-00cd-lighting".to_owned(),
+                transaction_id: hfx_domain::TransactionId::try_from("qualification-test")
+                    .expect("transaction id"),
+                step: crate::qualification_runner::LightingStep::LightingOff,
+                prior_progress: Some(StageProgress {
+                    status: crate::StageStatus::AwaitingObservation,
+                    result: None,
+                    checkpoint: Some(crate::qualification::StageCheckpoint {
+                        checkpoint_id: "lighting-blue".to_owned(),
+                        instructions: Vec::new(),
+                        observations: Vec::new(),
+                        evidence_refs: vec!["bridge-transaction:previous".to_owned()],
+                    }),
+                }),
+            }),
+            ..QualificationSessionState::default()
+        };
+        save_state(&path, &state).expect("state saves");
+        assert_eq!(
+            fs::metadata(&path).expect("metadata").permissions().mode() & 0o777,
+            0o600
+        );
+        assert_eq!(load_state(&path).expect("state loads"), Some(state.clone()));
+        state.coordinator_sha256 = "0".repeat(64);
+        let payload = serde_json::to_vec_pretty(&state).expect("state serializes");
+        fs::write(&path, payload).expect("test state changes");
+        assert!(matches!(
+            load_state(&path),
+            Err(QualificationStateError::Stale)
+        ));
+        fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
+    }
+
+    #[test]
+    fn state_rejects_world_readable_files() {
+        let path = test_path("permissions");
+        let _ = fs::remove_dir_all(path.parent().expect("parent"));
+        save_state(&path, &QualificationSessionState::default()).expect("state saves");
+        fs::set_permissions(&path, fs::Permissions::from_mode(0o644)).expect("permissions change");
+        assert!(matches!(
+            load_state(&path),
+            Err(QualificationStateError::Insecure)
+        ));
+        fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
+    }
+}
diff --git a/tests/test_device_qualification_console.py b/tests/test_device_qualification_console.py
index 513853e..7ca90d9 100644
--- a/tests/test_device_qualification_console.py
+++ b/tests/test_device_qualification_console.py
@@ -88,6 +88,7 @@ def test_browser_has_no_remote_or_direct_hardware_surface(self) -> None:
         self.assertNotRegex(application, r"https?://")
         self.assertIn('fetchWithTimeout("/v1/qualification/view"', application)
         self.assertIn('action.href', application)
+        self.assertIn("15_000", application)
         self.assertIn('network_upload_executed', contract)
 
     def test_contract_and_rust_fixture_share_the_versioned_schema(self) -> None:
@@ -105,6 +106,20 @@ def test_contract_and_rust_fixture_share_the_versioned_schema(self) -> None:
         self.assertEqual(schema["properties"]["api_version"]["const"], fixture["api_version"])
         self.assertFalse(fixture["companion"]["network_upload_executed"])
         self.assertFalse(fixture["companion"]["hardware_write_executed"])
+        self.assertTrue(
+            {"receiver_id", "generation_id", "device_id"}
+            <= set(schema["$defs"]["plan"]["required"])
+        )
+        receiver_keys = {
+            (receiver["receiver_id"], receiver["generation_id"])
+            for receiver in fixture["receivers"]
+        }
+        self.assertTrue(
+            all(
+                (plan["receiver_id"], plan["generation_id"]) in receiver_keys
+                for plan in fixture["plans"]
+            )
+        )
         self.assertIn(
             "legacy-v2-detected",
             schema["properties"]["companion"]["properties"]["state"]["enum"],
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index 1323ecf..ae95ab6 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -510,6 +510,7 @@ def build_artifacts(
     revision, epoch = _source_identity(root, revision)
     output = _new_output_directory(output, "package build")
     environment = _base_environment(root, output, epoch)
+    environment["HFX_SOURCE_REVISION"] = revision
     capabilities = capabilities or {}
     toolchain = verify_current_toolchain(root)
     inputs = _provenance_inputs(root, install, runtime)

From 2143bc5d857311cafd0ca1756e8bbb10919f73f6 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:30:30 +0400
Subject: [PATCH 02/67] Fix installed DKMS module discovery

---
 crates/hfx-runtime/src/generated.rs           |  4 +--
 docs/generated/linux-runtime.md               |  2 +-
 packaging/generated/dkms.conf                 |  6 ++--
 packaging/generated/install-plan.json         | 28 +++++++++----------
 packaging/generated/runtime.env               |  2 +-
 runtime/linux.json                            |  2 +-
 .../hyperflux_sdk/generated/linux_runtime.py  |  4 +--
 tests/test_install.py                         | 11 +++-----
 tests/test_linux_runtime.py                   | 20 ++++++++++++-
 tools/hfxdev/generators/linux_runtime.py      | 10 ++-----
 tools/hfxdev/linux_runtime.py                 |  9 ++++--
 11 files changed, 57 insertions(+), 41 deletions(-)

diff --git a/crates/hfx-runtime/src/generated.rs b/crates/hfx-runtime/src/generated.rs
index fcff87b..1008f7f 100644
--- a/crates/hfx-runtime/src/generated.rs
+++ b/crates/hfx-runtime/src/generated.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const LINUX_RUNTIME_SHA256: &str =
-    "182eef37f8c5ae2045bf346e47e3c9e2be7b7f1314782f8697da817df622b454";
+    "cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634";
 pub const PRODUCT_DISPLAY_NAME: &str = "HyperFlux Next";
 pub const PRODUCT_VERSION: &str = "0.0.0-dev.1";
 pub const PACKAGE_NAME: &str = "hyperflux-next-linux";
@@ -23,7 +23,7 @@ pub const BRIDGE_CONFIGURATION_FILE_PATH: &str = "/etc/hyperflux-next/bridge.jso
 pub const KERNEL_MODULE_NAME: &str = "hid-hyperflux-next";
 pub const KERNEL_DKMS_NAME: &str = "hid-hyperflux-next";
 pub const KERNEL_DEVICE_PREFIX: &str = "hyperflux-next";
-pub const KERNEL_SOURCE_DIRECTORY: &str = "/usr/src/hid-hyperflux-next-0.0.0-dev.1";
+pub const KERNEL_SOURCE_DIRECTORY: &str = "/usr/src/hid-hyperflux-next-0.0.0_dev.1";
 pub const OPERATIONS_CLI_PATH: &str = "/usr/bin/hyperfluxctl";
 pub const ACTIVATION_UTILITY_PATH: &str = "/usr/lib/hyperflux-next/hyperflux-next-activate";
 pub const ACTIVATION_SERVICE_UNIT: &str = "hyperflux-next-activation.service";
diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index cab4c15..4f574d1 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical source digest: `182eef37f8c5ae2045bf346e47e3c9e2be7b7f1314782f8697da817df622b454`.
+Canonical source digest: `cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634`.
 
 ## Product
 
diff --git a/packaging/generated/dkms.conf b/packaging/generated/dkms.conf
index 8500c14..f9a0754 100644
--- a/packaging/generated/dkms.conf
+++ b/packaging/generated/dkms.conf
@@ -1,9 +1,9 @@
 # Generated by ./hfx generate. Do not edit manually.
 # SPDX-License-Identifier: GPL-2.0-only
 PACKAGE_NAME="hid-hyperflux-next"
-PACKAGE_VERSION="0.0.0-dev.1"
+PACKAGE_VERSION="0.0.0_dev.1"
 BUILT_MODULE_NAME[0]="hid-hyperflux-next"
+BUILT_MODULE_LOCATION[0]="module"
 DEST_MODULE_LOCATION[0]="/updates/dkms"
-MAKE[0]="make KDIR=/lib/modules/${kernelver}/build MO=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/${kernelver}/${arch}/module"
-CLEAN="make KDIR=/lib/modules/${kernelver}/build MO=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/${kernelver}/${arch}/module clean"
+MAKE[0]="make KDIR=/lib/modules/${kernelver}/build MO=${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/module"
 AUTOINSTALL="yes"
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index dd1e6a5..fa8234e 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -77,98 +77,98 @@
     {
       "component": "kernel-source",
       "source": "driver/kernel/Makefile",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/Makefile",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/Makefile",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/generated/hyperflux_receiver_profiles.inc",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/generated/hyperflux_receiver_profiles.inc",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/generated/hyperflux_receiver_profiles.inc",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-core.c",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-core.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-core.c",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-internal.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-internal.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-internal.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-observation.c",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-observation.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-observation.c",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-passive.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-passive.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-passive.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-profile.c",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-profile.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-profile.c",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-profile.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-profile.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-profile.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-session.c",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-session.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-session.c",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-transport.c",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-transport.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-transport.c",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-version.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-version.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-version.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-wire.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-wire.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-wire.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "kernel-source",
       "source": "driver/kernel/uapi/hyperflux_next.h",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/uapi/hyperflux_next.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/uapi/hyperflux_next.h",
       "mode": "0644",
       "preserve": false
     },
     {
       "component": "dkms-configuration",
       "source": "packaging/generated/dkms.conf",
-      "destination": "/usr/src/hid-hyperflux-next-0.0.0-dev.1/dkms.conf",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/dkms.conf",
       "mode": "0644",
       "preserve": false
     },
diff --git a/packaging/generated/runtime.env b/packaging/generated/runtime.env
index efaab99..76acc5f 100644
--- a/packaging/generated/runtime.env
+++ b/packaging/generated/runtime.env
@@ -8,7 +8,7 @@ HFX_BRIDGE_EXECUTABLE_PATH='/usr/lib/hyperflux-next/hyperflux-next-bridge'
 HFX_CONFIGURATION_FILE_PATH='/etc/hyperflux-next/bridge.json'
 HFX_KERNEL_MODULE_NAME='hid-hyperflux-next'
 HFX_KERNEL_DKMS_NAME='hid-hyperflux-next'
-HFX_KERNEL_SOURCE_DIRECTORY='/usr/src/hid-hyperflux-next-0.0.0-dev.1'
+HFX_KERNEL_SOURCE_DIRECTORY='/usr/src/hid-hyperflux-next-0.0.0_dev.1'
 HFX_OPERATIONS_CLI_PATH='/usr/bin/hyperfluxctl'
 HFX_ACTIVATION_UTILITY_PATH='/usr/lib/hyperflux-next/hyperflux-next-activate'
 HFX_ACTIVATION_SERVICE_UNIT='hyperflux-next-activation.service'
diff --git a/runtime/linux.json b/runtime/linux.json
index 952c4a8..051e772 100644
--- a/runtime/linux.json
+++ b/runtime/linux.json
@@ -55,7 +55,7 @@
     "module_name": "hid-hyperflux-next",
     "dkms_name": "hid-hyperflux-next",
     "device_prefix": "hyperflux-next",
-    "source_directory": "/usr/src/hid-hyperflux-next-0.0.0-dev.1",
+    "source_directory": "/usr/src/hid-hyperflux-next-0.0.0_dev.1",
     "control_transfer_timeout_ms": 1000
   },
   "operations": {
diff --git a/sdk/python/hyperflux_sdk/generated/linux_runtime.py b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
index 1960cd9..dfe175d 100644
--- a/sdk/python/hyperflux_sdk/generated/linux_runtime.py
+++ b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
@@ -1,7 +1,7 @@
 """Generated by ./hfx generate. Do not edit manually."""
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-LINUX_RUNTIME_SHA256 = "182eef37f8c5ae2045bf346e47e3c9e2be7b7f1314782f8697da817df622b454"
+LINUX_RUNTIME_SHA256 = "cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634"
 PRODUCT_DISPLAY_NAME = "HyperFlux Next"
 PRODUCT_VERSION = "0.0.0-dev.1"
 PACKAGE_NAME = "hyperflux-next-linux"
@@ -19,7 +19,7 @@
 KERNEL_MODULE_NAME = "hid-hyperflux-next"
 KERNEL_DKMS_NAME = "hid-hyperflux-next"
 KERNEL_DEVICE_PREFIX = "hyperflux-next"
-KERNEL_SOURCE_DIRECTORY = "/usr/src/hid-hyperflux-next-0.0.0-dev.1"
+KERNEL_SOURCE_DIRECTORY = "/usr/src/hid-hyperflux-next-0.0.0_dev.1"
 OPERATIONS_CLI_PATH = "/usr/bin/hyperfluxctl"
 ACTIVATION_UTILITY_PATH = "/usr/lib/hyperflux-next/hyperflux-next-activate"
 ACTIVATION_SERVICE_UNIT = "hyperflux-next-activation.service"
diff --git a/tests/test_install.py b/tests/test_install.py
index a42f2e4..8c1f4ad 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -13,6 +13,7 @@
 sys.path.insert(0, str(ROOT / "tools"))
 
 from hfxdev.install import load_install_manifest
+from hfxdev.linux_runtime import load_linux_runtime
 from hfxdev.model import ModelError, load_json
 
 
@@ -59,13 +60,9 @@ def test_runtime_destinations_and_dkms_source_are_derived(self) -> None:
             "/usr/bin/hyperfluxctl",
         )
         destinations = {str(file.destination) for file in self.manifest.files}
-        self.assertIn(
-            "/usr/src/hid-hyperflux-next-0.0.0-dev.1/dkms.conf", destinations
-        )
-        self.assertIn(
-            "/usr/src/hid-hyperflux-next-0.0.0-dev.1/hyperflux-next-core.c",
-            destinations,
-        )
+        source_directory = load_linux_runtime(ROOT).kernel.source_directory
+        self.assertIn(f"{source_directory}/dkms.conf", destinations)
+        self.assertIn(f"{source_directory}/hyperflux-next-core.c", destinations)
 
     def test_python_sdk_license_is_generated_from_repository_authority(self) -> None:
         self.assertEqual(
diff --git a/tests/test_linux_runtime.py b/tests/test_linux_runtime.py
index 03078eb..33eb7f0 100644
--- a/tests/test_linux_runtime.py
+++ b/tests/test_linux_runtime.py
@@ -18,6 +18,7 @@
     activation_service,
     confirmation_service,
     default_bridge_configuration,
+    dkms_configuration,
     systemd_service,
     sysusers,
     tmpfiles,
@@ -59,8 +60,25 @@ def test_kernel_names_are_bounded_and_not_product_presentation(self) -> None:
             self.assertIsNone(re.search(r"razer|mouse|keyboard|hard|cloth", value))
         self.assertEqual(
             kernel.source_directory,
-            f"/usr/src/{kernel.dkms_name}-{self.runtime.product.version}",
+            f"/usr/src/{kernel.dkms_name}-{kernel.dkms_version}",
         )
+        self.assertEqual(kernel.dkms_version, "0.0.0_dev.1")
+
+    def test_dkms_identity_and_output_match_arch_hook_contract(self) -> None:
+        kernel = self.runtime.kernel
+        source_name = PurePosixPath(kernel.source_directory).name
+        hook_name, hook_version = source_name.rsplit("-", 1)
+        self.assertEqual((hook_name, hook_version), (kernel.dkms_name, kernel.dkms_version))
+
+        config = dkms_configuration(self.runtime)
+        self.assertIn(f'PACKAGE_NAME="{hook_name}"', config)
+        self.assertIn(f'PACKAGE_VERSION="{hook_version}"', config)
+        self.assertIn('BUILT_MODULE_LOCATION[0]="module"', config)
+        self.assertIn(
+            "${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/module",
+            config,
+        )
+        self.assertNotIn("CLEAN=", config)
 
     def test_derived_runtime_paths_are_bounded_and_unique(self) -> None:
         bridge = self.runtime.bridge
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 26c9510..49d0182 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -234,21 +234,17 @@ def python_version_module(runtime: LinuxRuntime, license_expression: str) -> str
 
 def dkms_configuration(runtime: LinuxRuntime) -> str:
     kernel = runtime.kernel
-    version = runtime.product.version
-    module_output = (
-        '${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/'
-        '${kernelver}/${arch}/module'
-    )
+    module_output = '${dkms_tree}/${PACKAGE_NAME}/${PACKAGE_VERSION}/build/module'
     return "\n".join(
         [
             "# Generated by ./hfx generate. Do not edit manually.",
             "# SPDX-License-Identifier: GPL-2.0-only",
             f'PACKAGE_NAME="{kernel.dkms_name}"',
-            f'PACKAGE_VERSION="{version}"',
+            f'PACKAGE_VERSION="{kernel.dkms_version}"',
             f'BUILT_MODULE_NAME[0]="{kernel.module_name}"',
+            'BUILT_MODULE_LOCATION[0]="module"',
             'DEST_MODULE_LOCATION[0]="/updates/dkms"',
             f'MAKE[0]="make KDIR=/lib/modules/${{kernelver}}/build MO={module_output}"',
-            f'CLEAN="make KDIR=/lib/modules/${{kernelver}}/build MO={module_output} clean"',
             'AUTOINSTALL="yes"',
             "",
         ]
diff --git a/tools/hfxdev/linux_runtime.py b/tools/hfxdev/linux_runtime.py
index 6d96c29..81a3394 100644
--- a/tools/hfxdev/linux_runtime.py
+++ b/tools/hfxdev/linux_runtime.py
@@ -176,6 +176,7 @@ def configuration_file_path(self) -> str:
 class KernelRuntime:
     module_name: str
     dkms_name: str
+    dkms_version: str
     device_prefix: str
     source_directory: str
     control_transfer_timeout_ms: int
@@ -471,9 +472,11 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
 
     kernel_value = _object(value["kernel"], "Linux kernel runtime")
     _exact(kernel_value, KERNEL_KEYS, "Linux kernel runtime")
+    dkms_version = product.version.replace("-", "_")
     kernel = KernelRuntime(
         module_name=_string(kernel_value["module_name"], "kernel module name", KERNEL_NAME, 64),
         dkms_name=_string(kernel_value["dkms_name"], "DKMS name", KERNEL_NAME, 64),
+        dkms_version=dkms_version,
         device_prefix=_string(
             kernel_value["device_prefix"], "kernel device prefix", KERNEL_NAME, 64
         ),
@@ -490,9 +493,11 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
     for name in (kernel.module_name, kernel.dkms_name, kernel.device_prefix):
         if FORBIDDEN_KERNEL_PRESENTATION.search(name):
             raise ModelError("kernel names must not contain product presentation facts")
-    expected_source = f"/usr/src/{kernel.dkms_name}-{product.version}"
+    expected_source = f"/usr/src/{kernel.dkms_name}-{kernel.dkms_version}"
     if kernel.source_directory != expected_source:
-        raise ModelError("DKMS source directory must derive from the canonical name and version")
+        raise ModelError(
+            "DKMS source directory must derive from the canonical name and normalized version"
+        )
     from .kernel_uapi import load_kernel_uapi
 
     uapi = load_kernel_uapi(root)

From e9361eff7d551f0eac969e5e204b103868fce193 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Wed, 22 Jul 2026 22:45:57 +0400
Subject: [PATCH 03/67] Unify packaged runtime directory modes

---
 crates/hfx-runtime/src/generated.rs           |  2 +-
 docs/generated/linux-runtime.md               |  5 +-
 runtime/linux.json                            |  5 ++
 schemas/linux-runtime.schema.json             | 12 +++++
 .../hyperflux_sdk/generated/linux_runtime.py  |  2 +-
 tests/test_linux_runtime.py                   | 24 +++++++++
 tests/test_package_pipeline.py                | 16 ++++++
 tools/hfxdev/generators/linux_runtime.py      | 18 ++++---
 tools/hfxdev/linux_runtime.py                 | 49 +++++++++++++++++++
 tools/hfxdev/package_pipeline.py              | 21 ++++++--
 10 files changed, 142 insertions(+), 12 deletions(-)

diff --git a/crates/hfx-runtime/src/generated.rs b/crates/hfx-runtime/src/generated.rs
index 1008f7f..a4a1b28 100644
--- a/crates/hfx-runtime/src/generated.rs
+++ b/crates/hfx-runtime/src/generated.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const LINUX_RUNTIME_SHA256: &str =
-    "cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634";
+    "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723";
 pub const PRODUCT_DISPLAY_NAME: &str = "HyperFlux Next";
 pub const PRODUCT_VERSION: &str = "0.0.0-dev.1";
 pub const PACKAGE_NAME: &str = "hyperflux-next-linux";
diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index 4f574d1..90ae7f2 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical source digest: `cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634`.
+Canonical source digest: `6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723`.
 
 ## Product
 
@@ -23,6 +23,9 @@ Canonical source digest: `cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e4
 | SDK socket | `/run/hyperflux-next/bridge.sock` |
 | Process lock | `/run/hyperflux-next/bridge.lock` |
 | Configuration | `/etc/hyperflux-next/bridge.json` |
+| Runtime directory mode | `2750` |
+| State directory mode | `0700` |
+| Configuration directory mode | `2750` |
 | Durable state | `/var/lib/hyperflux-next/bridge-state.json` |
 | Private receiver identity | `/var/lib/hyperflux-next/receiver-identity.key` |
 | Version-neutral Python modules | `/usr/lib/hyperflux-next/python` |
diff --git a/runtime/linux.json b/runtime/linux.json
index 051e772..468fe0d 100644
--- a/runtime/linux.json
+++ b/runtime/linux.json
@@ -21,6 +21,11 @@
     "identity_secret_file_name": "receiver-identity.key",
     "configuration_directory": "/etc/hyperflux-next",
     "configuration_file_name": "bridge.json",
+    "directory_modes": {
+      "runtime": "2750",
+      "state": "0700",
+      "configuration": "2750"
+    },
     "limits": {
       "max_connections": 32,
       "command_queue_capacity": 128,
diff --git a/schemas/linux-runtime.schema.json b/schemas/linux-runtime.schema.json
index 9779bc3..8545f23 100644
--- a/schemas/linux-runtime.schema.json
+++ b/schemas/linux-runtime.schema.json
@@ -40,6 +40,7 @@
         "identity_secret_file_name",
         "configuration_directory",
         "configuration_file_name",
+        "directory_modes",
         "limits",
         "timing",
         "restoration",
@@ -59,6 +60,16 @@
         "identity_secret_file_name": {"$ref": "#/$defs/fileName"},
         "configuration_directory": {"type": "string", "pattern": "^/etc/[a-z0-9][a-z0-9_-]{0,63}$"},
         "configuration_file_name": {"$ref": "#/$defs/fileName"},
+        "directory_modes": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["runtime", "state", "configuration"],
+          "properties": {
+            "runtime": {"$ref": "#/$defs/directoryMode"},
+            "state": {"$ref": "#/$defs/directoryMode"},
+            "configuration": {"$ref": "#/$defs/directoryMode"}
+          }
+        },
         "limits": {
           "type": "object",
           "additionalProperties": false,
@@ -184,6 +195,7 @@
   "$defs": {
     "account": {"type": "string", "pattern": "^[a-z_][a-z0-9_-]{0,31}$"},
     "fileName": {"type": "string", "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"},
+    "directoryMode": {"type": "string", "pattern": "^[0-7]{4}$"},
     "kernelName": {"type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$"},
     "queueBound": {"type": "integer", "minimum": 1, "maximum": 4096}
   }
diff --git a/sdk/python/hyperflux_sdk/generated/linux_runtime.py b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
index dfe175d..7570102 100644
--- a/sdk/python/hyperflux_sdk/generated/linux_runtime.py
+++ b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
@@ -1,7 +1,7 @@
 """Generated by ./hfx generate. Do not edit manually."""
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-LINUX_RUNTIME_SHA256 = "cfd13c3d790c3e79bab7575ac49c26303d5a44d3b1454a9323e8e476b5fee634"
+LINUX_RUNTIME_SHA256 = "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723"
 PRODUCT_DISPLAY_NAME = "HyperFlux Next"
 PRODUCT_VERSION = "0.0.0-dev.1"
 PACKAGE_NAME = "hyperflux-next-linux"
diff --git a/tests/test_linux_runtime.py b/tests/test_linux_runtime.py
index 33eb7f0..95b2d3e 100644
--- a/tests/test_linux_runtime.py
+++ b/tests/test_linux_runtime.py
@@ -102,6 +102,9 @@ def test_derived_runtime_paths_are_bounded_and_unique(self) -> None:
         )
         self.assertLess(len(bridge.socket_path.encode()), 108)
         self.assertNotEqual(bridge.kernel_access_group, bridge.client_group)
+        self.assertEqual(bridge.directory_modes.runtime, 0o2750)
+        self.assertEqual(bridge.directory_modes.state, 0o0700)
+        self.assertEqual(bridge.directory_modes.configuration, 0o2750)
         self.assertGreater(
             bridge.restoration.max_pending_claims,
             bridge.restoration.max_pending_triggers,
@@ -129,6 +132,19 @@ def test_generated_linux_policy_is_hardened_and_non_activating(self) -> None:
         self.assertIn(
             f"Wants={self.runtime.operations.confirmation_service_unit}", service
         )
+        self.assertIn(
+            f"RuntimeDirectoryMode={self.runtime.bridge.directory_modes.runtime:04o}",
+            service,
+        )
+        self.assertIn(
+            f"StateDirectoryMode={self.runtime.bridge.directory_modes.state:04o}",
+            service,
+        )
+        self.assertIn(
+            "ConfigurationDirectoryMode="
+            f"{self.runtime.bridge.directory_modes.configuration:04o}",
+            service,
+        )
 
         prepare = activation_service(self.runtime)
         confirm = confirmation_service(self.runtime)
@@ -198,6 +214,14 @@ def test_semantic_loader_rejects_cross_file_drift(self) -> None:
         expired_restore_authority["bridge"]["restoration"]["lease_duration_ms"] = 1_000
         cases.append(expired_restore_authority)
 
+        public_state = copy.deepcopy(self.value)
+        public_state["bridge"]["directory_modes"]["state"] = "0755"
+        cases.append(public_state)
+
+        unshared_configuration = copy.deepcopy(self.value)
+        unshared_configuration["bridge"]["directory_modes"]["configuration"] = "0700"
+        cases.append(unshared_configuration)
+
         for index, value in enumerate(cases):
             with self.subTest(index=index), tempfile.TemporaryDirectory() as directory:
                 root = Path(directory)
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index 1d7e89b..bbfd464 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -24,6 +24,7 @@
     _build_python,
     _install_wheels,
     _inspect_staged_files,
+    _normalize_tree,
     _private_stage_prefixes,
     _provenance_inputs,
     _provenance_materials,
@@ -185,6 +186,21 @@ def test_tree_digest_is_order_independent_and_mode_sensitive(self) -> None:
             second.chmod(0o600)
             self.assertNotEqual(digest, _tree_digest([first, second], root))
 
+    def test_tree_normalization_preserves_authoritative_configuration_mode(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            configuration = root / "etc" / "hyperflux-next"
+            configuration.mkdir(parents=True)
+            sibling = root / "usr" / "share" / "hyperflux-next"
+            sibling.mkdir(parents=True)
+            _normalize_tree(
+                root,
+                1_700_000_000,
+                (("/etc/hyperflux-next", 0o2750),),
+            )
+            self.assertEqual(configuration.stat().st_mode & 0o7777, 0o2750)
+            self.assertEqual(sibling.stat().st_mode & 0o7777, 0o0755)
+
     def test_private_build_path_is_rejected_from_staged_payload(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 49d0182..76ad545 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -275,11 +275,11 @@ def systemd_service(runtime: LinuxRuntime) -> str:
             f"SupplementaryGroups={bridge.kernel_access_group}",
             f"ExecStart={bridge.executable_path} --config {bridge.configuration_file_path}",
             f"RuntimeDirectory={PurePosixPath(bridge.runtime_directory).name}",
-            "RuntimeDirectoryMode=2750",
+            f"RuntimeDirectoryMode={bridge.directory_modes.runtime:04o}",
             f"StateDirectory={PurePosixPath(bridge.state_directory).name}",
-            "StateDirectoryMode=0700",
+            f"StateDirectoryMode={bridge.directory_modes.state:04o}",
             f"ConfigurationDirectory={PurePosixPath(bridge.configuration_directory).name}",
-            "ConfigurationDirectoryMode=2750",
+            f"ConfigurationDirectoryMode={bridge.directory_modes.configuration:04o}",
             "UMask=0027",
             "Restart=on-failure",
             "RestartSec=2s",
@@ -400,9 +400,12 @@ def tmpfiles(runtime: LinuxRuntime) -> str:
         [
             "# Generated by ./hfx generate. Do not edit manually.",
             "# SPDX-License-Identifier: GPL-2.0-only",
-            f"d {bridge.runtime_directory} 2750 {bridge.service_account} {bridge.client_group} -",
-            f"d {bridge.state_directory} 0700 {bridge.service_account} {bridge.client_group} -",
-            f"d {bridge.configuration_directory} 2750 root {bridge.kernel_access_group} -",
+            f"d {bridge.runtime_directory} {bridge.directory_modes.runtime:04o} "
+            f"{bridge.service_account} {bridge.client_group} -",
+            f"d {bridge.state_directory} {bridge.directory_modes.state:04o} "
+            f"{bridge.service_account} {bridge.client_group} -",
+            f"d {bridge.configuration_directory} "
+            f"{bridge.directory_modes.configuration:04o} root {bridge.kernel_access_group} -",
             "",
         ]
     )
@@ -493,6 +496,9 @@ def markdown(runtime: LinuxRuntime) -> str:
             f"| SDK socket | `{bridge.socket_path}` |",
             f"| Process lock | `{bridge.socket_lock_path}` |",
             f"| Configuration | `{bridge.configuration_file_path}` |",
+            f"| Runtime directory mode | `{bridge.directory_modes.runtime:04o}` |",
+            f"| State directory mode | `{bridge.directory_modes.state:04o}` |",
+            f"| Configuration directory mode | `{bridge.directory_modes.configuration:04o}` |",
             f"| Durable state | `{bridge.state_file_path}` |",
             f"| Private receiver identity | `{bridge.identity_secret_file_path}` |",
             f"| Version-neutral Python modules | `{operations.python_module_directory}` |",
diff --git a/tools/hfxdev/linux_runtime.py b/tools/hfxdev/linux_runtime.py
index 81a3394..7a3d94e 100644
--- a/tools/hfxdev/linux_runtime.py
+++ b/tools/hfxdev/linux_runtime.py
@@ -26,6 +26,7 @@
     "identity_secret_file_name",
     "configuration_directory",
     "configuration_file_name",
+    "directory_modes",
     "limits",
     "timing",
     "restoration",
@@ -59,6 +60,7 @@
     "max_persisted_receivers",
     "max_persistence_bytes",
 }
+BRIDGE_DIRECTORY_MODE_KEYS = {"runtime", "state", "configuration"}
 KERNEL_KEYS = {
     "module_name",
     "dkms_name",
@@ -119,6 +121,13 @@ class BridgeTiming:
     kernel_session_duration_ms: int
 
 
+@dataclass(frozen=True)
+class BridgeDirectoryModes:
+    runtime: int
+    state: int
+    configuration: int
+
+
 @dataclass(frozen=True)
 class BridgeRestoration:
     max_pending_triggers: int
@@ -146,6 +155,7 @@ class BridgeRuntime:
     identity_secret_file_name: str
     configuration_directory: str
     configuration_file_name: str
+    directory_modes: BridgeDirectoryModes
     limits: BridgeLimits
     timing: BridgeTiming
     restoration: BridgeRestoration
@@ -260,6 +270,15 @@ def _bounded_integer(value: Any, label: str, minimum: int, maximum: int) -> int:
     return value
 
 
+def _directory_mode(value: Any, label: str) -> int:
+    if not isinstance(value, str) or re.fullmatch(r"[0-7]{4}", value) is None:
+        raise ModelError(f"{label}: must be a four-digit octal mode")
+    mode = int(value, 8)
+    if mode & 0o700 != 0o700 or mode & 0o007:
+        raise ModelError(f"{label}: owner access is required and world access is forbidden")
+    return mode
+
+
 def load_linux_runtime(root: Path) -> LinuxRuntime:
     path = root / "runtime" / "linux.json"
     value = load_json(path)
@@ -289,6 +308,14 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
     _exact(limits_value, BRIDGE_LIMIT_KEYS, "Linux bridge limits")
     timing_value = _object(bridge_value["timing"], "Linux bridge timing")
     _exact(timing_value, BRIDGE_TIMING_KEYS, "Linux bridge timing")
+    directory_modes_value = _object(
+        bridge_value["directory_modes"], "Linux bridge directory modes"
+    )
+    _exact(
+        directory_modes_value,
+        BRIDGE_DIRECTORY_MODE_KEYS,
+        "Linux bridge directory modes",
+    )
     restoration_value = _object(
         bridge_value["restoration"], "Linux bridge restoration"
     )
@@ -344,6 +371,18 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
             FILE_NAME,
             64,
         ),
+        directory_modes=BridgeDirectoryModes(
+            runtime=_directory_mode(
+                directory_modes_value["runtime"], "bridge runtime directory mode"
+            ),
+            state=_directory_mode(
+                directory_modes_value["state"], "bridge state directory mode"
+            ),
+            configuration=_directory_mode(
+                directory_modes_value["configuration"],
+                "bridge configuration directory mode",
+            ),
+        ),
         limits=BridgeLimits(
             max_connections=_bounded_integer(
                 limits_value["max_connections"], "bridge connection bound", 1, 1024
@@ -455,6 +494,16 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
     )
     if bridge.client_group == bridge.kernel_access_group:
         raise ModelError("bridge client and kernel access groups must remain separate")
+    if bridge.directory_modes.state & 0o077:
+        raise ModelError("bridge state directory must remain private to its owner")
+    for mode in (
+        bridge.directory_modes.runtime,
+        bridge.directory_modes.configuration,
+    ):
+        if mode & 0o2050 != 0o2050:
+            raise ModelError(
+                "shared bridge directories require setgid and group read/execute access"
+            )
     if bridge.identity_secret_file_name == bridge.state_file_name:
         raise ModelError("bridge identity secret and durable state must use separate files")
     if bridge.socket_lock_name == bridge.socket_name:
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index ae95ab6..dead247 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -1015,11 +1015,20 @@ def _private_stage_prefixes(
     return tuple(prefixes)
 
 
-def _normalize_tree(stage_root: Path, epoch: int) -> None:
+def _normalize_tree(
+    stage_root: Path,
+    epoch: int,
+    directory_modes: tuple[tuple[str, int], ...] = (),
+) -> None:
     for path in sorted(stage_root.rglob("*"), reverse=True):
         if path.is_dir():
             path.chmod(0o755)
         os.utime(path, (epoch, epoch), follow_symlinks=False)
+    for destination, mode in directory_modes:
+        path = _stage_path(stage_root, destination)
+        if not path.is_dir():
+            raise ModelError(f"staged directory mode target is missing: {destination}")
+        path.chmod(mode)
     stage_root.chmod(0o755)
     os.utime(stage_root, (epoch, epoch))
 
@@ -1055,7 +1064,13 @@ def stage_rootfs(root: Path, manifest_path: Path, stage_root: Path) -> StageResu
         wheels,
         runtime.operations.python_module_directory,
     )
-    _normalize_tree(stage_root, artifacts.source_date_epoch)
+    directory_modes = (
+        (
+            runtime.bridge.configuration_directory,
+            runtime.bridge.directory_modes.configuration,
+        ),
+    )
+    _normalize_tree(stage_root, artifacts.source_date_epoch, directory_modes)
     canonical_workspace = Path(load_development_environment(root).workspace_path)
     private_prefixes = _private_stage_prefixes(root, artifacts.root, canonical_workspace)
     staged_files = _inspect_staged_files(stage_root, private_prefixes)
@@ -1096,7 +1111,7 @@ def stage_rootfs(root: Path, manifest_path: Path, stage_root: Path) -> StageResu
     )
     inventory.chmod(0o644)
     os.utime(inventory, (artifacts.source_date_epoch, artifacts.source_date_epoch))
-    _normalize_tree(stage_root, artifacts.source_date_epoch)
+    _normalize_tree(stage_root, artifacts.source_date_epoch, directory_modes)
     return StageResult(
         root=stage_root,
         inventory=inventory,

From 0d9dbc4c80a7762cd43bd1e76ca28a043f7c09f7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Wed, 22 Jul 2026 23:00:50 +0400
Subject: [PATCH 04/67] Preserve canonical modes in native packages

---
 tests/test_distribution_package.py   | 29 ++++++++++++++++
 tests/test_distribution_rpm.py       |  4 +++
 tools/hfxdev/distribution_debian.py  | 23 +++++++++++--
 tools/hfxdev/distribution_native.py  | 17 +++++-----
 tools/hfxdev/distribution_package.py | 17 +++++++++-
 tools/hfxdev/distribution_rpm.py     | 20 ++++++++++-
 tools/hfxdev/package_pipeline.py     | 19 +----------
 tools/hfxdev/tree_metadata.py        | 51 ++++++++++++++++++++++++++++
 8 files changed, 150 insertions(+), 30 deletions(-)
 create mode 100644 tools/hfxdev/tree_metadata.py

diff --git a/tests/test_distribution_package.py b/tests/test_distribution_package.py
index ec1d641..2ea70e5 100644
--- a/tests/test_distribution_package.py
+++ b/tests/test_distribution_package.py
@@ -25,6 +25,7 @@
     _arch_pkgbuild,
     _tar_payload,
 )
+from hfxdev.distribution_native import normalize_tree, package_directory_modes
 from hfxdev.distributions import load_distribution_catalog
 from hfxdev.linux_runtime import load_linux_runtime
 from hfxdev.model import ModelError, sha256_file
@@ -137,6 +138,10 @@ def test_payload_tar_is_reproducible_and_root_owned(self) -> None:
             file.parent.mkdir(parents=True)
             file.write_text("stable\n", encoding="utf-8")
             file.chmod(0o644)
+            configuration = payload / "etc/hyperflux-next"
+            configuration.mkdir(parents=True)
+            configuration.chmod(0o2750)
+            (configuration / "bridge.json").write_text("{}\n", encoding="utf-8")
             first = root / "first.tar"
             second = root / "second.tar"
             _tar_payload(payload, first, 1_700_000_000)
@@ -147,6 +152,30 @@ def test_payload_tar_is_reproducible_and_root_owned(self) -> None:
             with tarfile.open(first) as archive:
                 member = archive.getmember("usr/share/hyperflux-next/value")
                 self.assertEqual((member.uid, member.gid, member.mode), (0, 0, 0o644))
+                self.assertEqual(
+                    archive.getmember("etc/hyperflux-next").mode,
+                    self.runtime.bridge.directory_modes.configuration,
+                )
+
+    def test_distribution_normalization_keeps_package_owned_directory_modes(
+        self,
+    ) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            configuration = root / "etc/hyperflux-next"
+            configuration.mkdir(parents=True)
+            sibling = root / "usr/share/hyperflux-next"
+            sibling.mkdir(parents=True)
+            normalize_tree(
+                root,
+                1_700_000_000,
+                package_directory_modes(self.runtime),
+            )
+            self.assertEqual(
+                configuration.stat().st_mode & 0o7777,
+                self.runtime.bridge.directory_modes.configuration,
+            )
+            self.assertEqual(sibling.stat().st_mode & 0o7777, 0o0755)
 
 
 if __name__ == "__main__":
diff --git a/tests/test_distribution_rpm.py b/tests/test_distribution_rpm.py
index 3531f7c..f0fe217 100644
--- a/tests/test_distribution_rpm.py
+++ b/tests/test_distribution_rpm.py
@@ -96,6 +96,10 @@ def test_spec_uses_catalog_metadata_and_preserves_configuration(self) -> None:
         for item in self.target.optional_dependencies:
             self.assertIn(f"Suggests: {item.package}\n", spec)
         self.assertIn(f"%config(noreplace) %attr(0640,root,root) {RPM_CONFIGURATION}", spec)
+        self.assertIn(
+            "%dir %attr(2750,root,root) /etc/hyperflux-next",
+            spec,
+        )
         self.assertIn(f"%license %attr(0644,root,root) {RPM_LICENSE_PATH}", spec)
         self.assertIn(
             f"%doc %attr(0644,root,root) {RPM_DOCUMENT_ROOT}README.md", spec
diff --git a/tools/hfxdev/distribution_debian.py b/tools/hfxdev/distribution_debian.py
index 9573608..6520eb8 100644
--- a/tools/hfxdev/distribution_debian.py
+++ b/tools/hfxdev/distribution_debian.py
@@ -11,7 +11,12 @@
 import subprocess
 import tarfile
 
-from .distribution_native import NativePackageContext, normalize_tree, tree_files
+from .distribution_native import (
+    NativePackageContext,
+    normalize_tree,
+    package_directory_modes,
+    tree_files,
+)
 from .model import ModelError
 
 
@@ -275,6 +280,7 @@ def _verify_debian_package(
             raise ModelError(f"Debian control member {name} differs from its authority")
 
     payload_entries: list[tuple[str, int, bytes]] = []
+    directory_modes: dict[str, int] = {}
     forbidden = tuple(
         value.encode("utf-8")
         for value in {
@@ -307,6 +313,7 @@ def _verify_debian_package(
                 ):
                     raise ModelError("Debian payload metadata is not canonical")
                 if member.isdir():
+                    directory_modes[name.rstrip("/")] = member.mode
                     continue
                 if not member.isfile():
                     raise ModelError("Debian payload contains an unsupported member type")
@@ -331,13 +338,25 @@ def _verify_debian_package(
         or digest.hexdigest() != context.payload_sha256
     ):
         raise ModelError("Debian package payload differs from the staged distribution root")
+    for destination, expected in package_directory_modes(context.runtime):
+        actual = directory_modes.get(destination.removeprefix("/"))
+        if actual != expected:
+            found = "missing" if actual is None else f"{actual:04o}"
+            raise ModelError(
+                f"Debian package directory mode differs for {destination}: "
+                f"expected {expected:04o}, found {found}"
+            )
 
 
 def build_debian_package(context: NativePackageContext) -> Path:
     root = context.workspace_root / "debian-root"
     shutil.copytree(context.package_root, root, symlinks=False)
     controls = _write_control_files(context, root)
-    normalize_tree(root, context.artifacts.source_date_epoch)
+    normalize_tree(
+        root,
+        context.artifacts.source_date_epoch,
+        package_directory_modes(context.runtime),
+    )
     version = _debian_version(
         context.runtime.product.version, context.runtime.product.package_release
     )
diff --git a/tools/hfxdev/distribution_native.py b/tools/hfxdev/distribution_native.py
index dfa44d5..c914bb9 100644
--- a/tools/hfxdev/distribution_native.py
+++ b/tools/hfxdev/distribution_native.py
@@ -13,6 +13,7 @@
 from .linux_runtime import LinuxRuntime
 from .model import ModelError, sha256_file
 from .package_pipeline import ArtifactSet
+from .tree_metadata import DirectoryModes, normalize_tree, verify_directory_modes
 
 
 @dataclass(frozen=True)
@@ -51,13 +52,13 @@ def tree_digest(root: Path, files: list[Path]) -> str:
     return digest.hexdigest()
 
 
-def normalize_tree(root: Path, epoch: int) -> None:
-    for path in sorted(root.rglob("*"), reverse=True):
-        if path.is_dir():
-            path.chmod(0o755)
-        os.utime(path, (epoch, epoch), follow_symlinks=False)
-    root.chmod(0o755)
-    os.utime(root, (epoch, epoch), follow_symlinks=False)
+def package_directory_modes(runtime: LinuxRuntime) -> DirectoryModes:
+    return (
+        (
+            runtime.bridge.configuration_directory,
+            runtime.bridge.directory_modes.configuration,
+        ),
+    )
 
 
 def write_payload_tar(root: Path, destination: Path, epoch: int) -> None:
@@ -72,7 +73,7 @@ def write_payload_tar(root: Path, destination: Path, epoch: int) -> None:
             info.uname = "root"
             info.gname = "root"
             info.mtime = epoch
-            info.mode = 0o755 if path.is_dir() else stat.S_IMODE(path.stat().st_mode)
+            info.mode = stat.S_IMODE(path.stat().st_mode)
             if path.is_dir():
                 info.type = tarfile.DIRTYPE
                 archive.addfile(info)
diff --git a/tools/hfxdev/distribution_package.py b/tools/hfxdev/distribution_package.py
index ce7e12b..fe234c6 100644
--- a/tools/hfxdev/distribution_package.py
+++ b/tools/hfxdev/distribution_package.py
@@ -21,6 +21,7 @@
 from .distribution_native import (
     NativePackageContext,
     normalize_tree as _normalize,
+    package_directory_modes as _package_directory_modes,
     tree_digest as _tree_digest,
     tree_files as _tree_files,
     write_payload_tar as _tar_payload,
@@ -430,6 +431,7 @@ def _verify_arch_package(
 ) -> None:
     metadata_files: dict[str, bytes] = {}
     archive_entries: list[tuple[tarfile.TarInfo, bytes | None]] = []
+    directory_modes: dict[str, int] = {}
     digest = hashlib.sha256()
     payload_files = 0
     forbidden = tuple(
@@ -457,6 +459,7 @@ def _verify_arch_package(
                     ):
                         raise ModelError("Arch package directory metadata is not canonical")
                     archive_entries.append((copy.copy(member), None))
+                    directory_modes[path.as_posix().rstrip("/")] = member.mode
                     continue
                 if not member.isfile():
                     raise ModelError("Arch package contains an unsupported member type")
@@ -491,6 +494,14 @@ def _verify_arch_package(
         archive_entries, artifacts.source_date_epoch
     ):
         raise ModelError("Arch package MTREE does not describe the canonical archive")
+    for destination, expected in _package_directory_modes(runtime):
+        actual = directory_modes.get(destination.removeprefix("/"))
+        if actual != expected:
+            found = "missing" if actual is None else f"{actual:04o}"
+            raise ModelError(
+                f"Arch package directory mode differs for {destination}: "
+                f"expected {expected:04o}, found {found}"
+            )
     if payload_files != payload_file_count or digest.hexdigest() != payload_sha256:
         raise ModelError("Arch package payload differs from the staged distribution root")
     if metadata_files[".INSTALL"] != _arch_install(runtime).encode("utf-8"):
@@ -687,7 +698,11 @@ def build_distribution_package(
             ),
         )
         overlays.append(installed_manifest)
-        _normalize(package_root, artifacts.source_date_epoch)
+        _normalize(
+            package_root,
+            artifacts.source_date_epoch,
+            _package_directory_modes(runtime),
+        )
         distribution_files = _tree_files(package_root)
         distribution_digest = _tree_digest(package_root, distribution_files)
 
diff --git a/tools/hfxdev/distribution_rpm.py b/tools/hfxdev/distribution_rpm.py
index 02234da..a44c3fc 100644
--- a/tools/hfxdev/distribution_rpm.py
+++ b/tools/hfxdev/distribution_rpm.py
@@ -11,8 +11,10 @@
 
 from .distribution_native import (
     NativePackageContext,
+    package_directory_modes,
     tree_digest,
     tree_files,
+    verify_directory_modes,
     write_payload_tar,
 )
 from .model import ModelError
@@ -129,7 +131,10 @@ def _rpm_scripts(context: NativePackageContext) -> dict[str, str]:
 
 
 def _rpm_files(context: NativePackageContext) -> list[str]:
-    result = []
+    result = [
+        f"%dir %attr({mode:04o},root,root) {destination}"
+        for destination, mode in package_directory_modes(context.runtime)
+    ]
     for path in tree_files(context.package_root):
         destination = "/" + path.relative_to(context.package_root).as_posix()
         if not re.fullmatch(r"/[A-Za-z0-9._+@%/=-]+", destination):
@@ -406,6 +411,14 @@ def _verify_rpm_package(context: NativePackageContext, package: Path) -> None:
         "%{FILEGROUPNAME}\\t%{FILEMTIMES}\\t%{FILEFLAGS}\\n]",
     ).splitlines()
     expected_files = {}
+    for destination, mode in package_directory_modes(context.runtime):
+        expected_files[destination] = (
+            f"{stat.S_IFDIR | mode:o}",
+            "root",
+            "root",
+            str(context.artifacts.source_date_epoch),
+            "0",
+        )
     for path in tree_files(context.package_root):
         destination = "/" + path.relative_to(context.package_root).as_posix()
         flags = "17" if destination == RPM_CONFIGURATION else "0"
@@ -447,6 +460,11 @@ def _verify_rpm_package(context: NativePackageContext, package: Path) -> None:
 
     extracted = context.workspace_root / "rpm-extracted"
     _extract_rpm(package, extracted)
+    verify_directory_modes(
+        extracted,
+        package_directory_modes(context.runtime),
+        "RPM package",
+    )
     extracted_files = tree_files(extracted)
     if (
         len(extracted_files) != context.payload_file_count
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index dead247..53227f6 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -25,6 +25,7 @@
 from .model import ModelError, load_json, require_unique, sha256_file
 from .supply_chain import load_dependency_inventory
 from .toolchains import load_toolchain_pins, verify_current_toolchain
+from .tree_metadata import normalize_tree as _normalize_tree
 
 
 REVISION = re.compile(r"^[0-9a-f]{40}$")
@@ -1015,24 +1016,6 @@ def _private_stage_prefixes(
     return tuple(prefixes)
 
 
-def _normalize_tree(
-    stage_root: Path,
-    epoch: int,
-    directory_modes: tuple[tuple[str, int], ...] = (),
-) -> None:
-    for path in sorted(stage_root.rglob("*"), reverse=True):
-        if path.is_dir():
-            path.chmod(0o755)
-        os.utime(path, (epoch, epoch), follow_symlinks=False)
-    for destination, mode in directory_modes:
-        path = _stage_path(stage_root, destination)
-        if not path.is_dir():
-            raise ModelError(f"staged directory mode target is missing: {destination}")
-        path.chmod(mode)
-    stage_root.chmod(0o755)
-    os.utime(stage_root, (epoch, epoch))
-
-
 def stage_rootfs(root: Path, manifest_path: Path, stage_root: Path) -> StageResult:
     root = root.resolve()
     install = load_install_manifest(root)
diff --git a/tools/hfxdev/tree_metadata.py b/tools/hfxdev/tree_metadata.py
new file mode 100644
index 0000000..2117c44
--- /dev/null
+++ b/tools/hfxdev/tree_metadata.py
@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import os
+from pathlib import Path, PurePosixPath
+import stat
+
+from .model import ModelError
+
+
+DirectoryModes = tuple[tuple[str, int], ...]
+
+
+def directory_path(root: Path, destination: str) -> Path:
+    path = PurePosixPath(destination)
+    if not path.is_absolute() or len(path.parts) < 2 or ".." in path.parts:
+        raise ModelError(f"unsafe staged directory destination: {destination}")
+    target = root.joinpath(*path.parts[1:])
+    if not target.is_dir() or target.is_symlink():
+        raise ModelError(f"staged directory mode target is missing: {destination}")
+    return target
+
+
+def normalize_tree(
+    root: Path,
+    epoch: int,
+    directory_modes: DirectoryModes = (),
+) -> None:
+    for path in sorted(root.rglob("*"), reverse=True):
+        if path.is_dir():
+            path.chmod(0o755)
+        os.utime(path, (epoch, epoch), follow_symlinks=False)
+    for destination, mode in directory_modes:
+        directory_path(root, destination).chmod(mode)
+    root.chmod(0o755)
+    os.utime(root, (epoch, epoch), follow_symlinks=False)
+
+
+def verify_directory_modes(
+    root: Path,
+    directory_modes: DirectoryModes,
+    label: str,
+) -> None:
+    for destination, expected in directory_modes:
+        actual = stat.S_IMODE(directory_path(root, destination).stat().st_mode)
+        if actual != expected:
+            raise ModelError(
+                f"{label} directory mode differs for {destination}: "
+                f"expected {expected:04o}, found {actual:04o}"
+            )

From 703e693d2464fabb5d38133c10b99554c5f7ad12 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Wed, 22 Jul 2026 23:25:16 +0400
Subject: [PATCH 05/67] Report receiver-bound driver activation first

---
 crates/hfx-ops/src/assessment.rs    | 50 ++++++++++++---
 crates/hfx-ops/src/probe.rs         | 99 +++++++++++++++++++++++++++++
 crates/hfx-ops/src/qualification.rs |  1 +
 crates/hfx-ops/src/support.rs       |  1 +
 4 files changed, 143 insertions(+), 8 deletions(-)

diff --git a/crates/hfx-ops/src/assessment.rs b/crates/hfx-ops/src/assessment.rs
index 601b86b..32a1fbe 100644
--- a/crates/hfx-ops/src/assessment.rs
+++ b/crates/hfx-ops/src/assessment.rs
@@ -98,23 +98,31 @@ fn bridge_findings(snapshot: &SystemSnapshot) -> Vec<AssessmentFinding> {
         .collect()
 }
 
-#[must_use]
-pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
-    let mut working = vec!["package metadata is available".to_owned()];
-    let installed = snapshot.installed_module_identity.as_deref();
-    let loaded = snapshot.loaded_module_identity.as_deref();
-    let driver = match (installed, loaded) {
+fn classify_driver(snapshot: &SystemSnapshot, working: &mut Vec<String>) -> DriverState {
+    match (
+        snapshot.installed_module_identity.as_deref(),
+        snapshot.loaded_module_identity.as_deref(),
+    ) {
         (Some(installed), Some(loaded)) if installed == loaded => {
             working.push("the installed driver is active".to_owned());
             DriverState::Active
         }
         (Some(_), Some(_)) => DriverState::ActivationPending,
+        (Some(_), None) if snapshot.supported_receiver_present => DriverState::ActivationPending,
         (Some(_), None) => {
             working.push("the driver is installed and no receiver is currently bound".to_owned());
             DriverState::InstalledIdle
         }
         (None, _) => DriverState::Unavailable,
-    };
+    }
+}
+
+#[must_use]
+pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
+    let mut working = vec!["package metadata is available".to_owned()];
+    let installed = snapshot.installed_module_identity.as_deref();
+    let loaded = snapshot.loaded_module_identity.as_deref();
+    let driver = classify_driver(snapshot, &mut working);
 
     let mut findings = Vec::new();
     if matches!(
@@ -130,7 +138,13 @@ pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
                 ),
                 (
                     "loaded_abi".to_owned(),
-                    loaded.unwrap_or("not-loaded").to_owned(),
+                    loaded
+                        .unwrap_or(if snapshot.supported_receiver_present {
+                            "receiver-unbound"
+                        } else {
+                            "not-loaded"
+                        })
+                        .to_owned(),
                 ),
             ]),
         ));
@@ -300,6 +314,7 @@ mod tests {
             service_state: ServiceState::Active,
             bridge: Some(empty_bridge()),
             legacy_v2_stack_detected: false,
+            supported_receiver_present: false,
         }
     }
 
@@ -323,6 +338,25 @@ mod tests {
         assert_eq!(assessment.findings[0].code, "HFX-KERNEL-001");
     }
 
+    #[test]
+    fn attached_supported_receiver_requires_driver_activation_before_service_start() {
+        let mut value = snapshot();
+        value.loaded_module_identity = None;
+        value.supported_receiver_present = true;
+        value.service_state = ServiceState::Inactive;
+        value.bridge = None;
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.driver, DriverState::ActivationPending);
+        assert_eq!(assessment.findings.len(), 1);
+        assert_eq!(assessment.findings[0].code, "HFX-KERNEL-001");
+        assert_eq!(
+            assessment.findings[0].details["loaded_abi"],
+            "receiver-unbound"
+        );
+    }
+
     #[test]
     fn active_but_unreachable_service_is_named_truthfully() {
         let mut value = snapshot();
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 70fda89..6fd550b 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use hfx_domain::{ClientId, ClientName, ProtocolFeatureId, ProtocolVersion};
+use hfx_profiles::receiver_profile_by_usb_id;
 use hfx_protocol::{BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, IntegrationView};
 use hfx_runtime::{
     BRIDGE_SERVICE_UNIT, BRIDGE_SOCKET_PATH, KERNEL_MODULE_NAME, PRODUCT_VERSION, STATUS_TIMEOUT_MS,
@@ -17,6 +18,8 @@ use std::thread;
 use std::time::{Duration, Instant};
 
 const MAX_COMMAND_OUTPUT_BYTES: usize = 4_096;
+const MAX_USB_DEVICE_ENTRIES: usize = 256;
+const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
 const LEGACY_V2_BRIDGE_SERVICE_UNIT: &str = "hyperflux-bridge.service";
 const LEGACY_V2_KERNEL_MODULE_NAME: &str = "hid-razer-hyperflux-v2";
 
@@ -158,6 +161,7 @@ pub struct SystemSnapshot {
     pub service_state: ServiceState,
     pub bridge: Option<BridgeHealth>,
     pub legacy_v2_stack_detected: bool,
+    pub supported_receiver_present: bool,
 }
 
 pub trait SystemProbe {
@@ -191,6 +195,7 @@ pub trait SystemController {
 pub struct RealSystemProbe<R = RealCommandRunner> {
     runner: R,
     sys_module_root: PathBuf,
+    usb_devices_root: PathBuf,
     socket_path: PathBuf,
     timeout: Duration,
 }
@@ -200,6 +205,7 @@ impl Default for RealSystemProbe<RealCommandRunner> {
         Self {
             runner: RealCommandRunner,
             sys_module_root: PathBuf::from("/sys/module"),
+            usb_devices_root: PathBuf::from(USB_DEVICES_ROOT),
             socket_path: PathBuf::from(BRIDGE_SOCKET_PATH),
             timeout: Duration::from_millis(STATUS_TIMEOUT_MS),
         }
@@ -213,10 +219,27 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         sys_module_root: PathBuf,
         socket_path: PathBuf,
         timeout: Duration,
+    ) -> Self {
+        Self::with_all_paths(
+            runner,
+            sys_module_root,
+            PathBuf::from(USB_DEVICES_ROOT),
+            socket_path,
+            timeout,
+        )
+    }
+
+    fn with_all_paths(
+        runner: R,
+        sys_module_root: PathBuf,
+        usb_devices_root: PathBuf,
+        socket_path: PathBuf,
+        timeout: Duration,
     ) -> Self {
         Self {
             runner,
             sys_module_root,
+            usb_devices_root,
             socket_path,
             timeout,
         }
@@ -288,6 +311,25 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         output.success && output.stdout == "loaded"
     }
 
+    fn supported_receiver_present(&self) -> bool {
+        let Ok(entries) = fs::read_dir(&self.usb_devices_root) else {
+            return false;
+        };
+        entries
+            .filter_map(Result::ok)
+            .take(MAX_USB_DEVICE_ENTRIES)
+            .any(|entry| {
+                let path = entry.path();
+                let Some(vendor_id) = read_usb_hex_id(&path.join("idVendor")) else {
+                    return false;
+                };
+                let Some(product_id) = read_usb_hex_id(&path.join("idProduct")) else {
+                    return false;
+                };
+                receiver_profile_by_usb_id(vendor_id, product_id).is_some()
+            })
+    }
+
     pub(crate) fn bridge_client(
         &self,
         client_id: &str,
@@ -369,6 +411,7 @@ impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
             service_state,
             bridge,
             legacy_v2_stack_detected: self.legacy_v2_stack_detected(),
+            supported_receiver_present: self.supported_receiver_present(),
         }
     }
 }
@@ -423,6 +466,15 @@ fn bounded_identity(value: &str) -> Option<String> {
     }
 }
 
+fn read_usb_hex_id(path: &Path) -> Option<u16> {
+    let value = fs::read_to_string(path).ok()?;
+    let value = value.trim();
+    if value.len() != 4 || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return None;
+    }
+    u16::from_str_radix(value, 16).ok()
+}
+
 pub(crate) fn write_private_file(path: &Path, value: &[u8]) -> io::Result<()> {
     use std::fs::OpenOptions;
     use std::io::Write as _;
@@ -440,6 +492,7 @@ mod tests {
     use super::*;
     use std::collections::VecDeque;
     use std::sync::Mutex;
+    use std::time::{SystemTime, UNIX_EPOCH};
 
     #[derive(Debug)]
     struct FakeRunner {
@@ -518,4 +571,50 @@ mod tests {
         );
         assert!(!probe.legacy_v2_stack_detected());
     }
+
+    #[test]
+    fn qualified_receiver_is_discovered_from_generated_usb_profiles() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        let usb_root = std::env::temp_dir().join(format!("hfx-usb-{unique}"));
+        let receiver = usb_root.join("3-4");
+        fs::create_dir_all(&receiver).expect("create receiver fixture");
+        fs::write(receiver.join("idVendor"), "1532\n").expect("write vendor");
+        fs::write(receiver.join("idProduct"), "00cf\n").expect("write product");
+        let probe = RealSystemProbe::with_all_paths(
+            FakeRunner::new(Vec::new()),
+            PathBuf::from("/missing"),
+            usb_root.clone(),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+
+        assert!(probe.supported_receiver_present());
+        fs::remove_dir_all(usb_root).expect("remove receiver fixture");
+    }
+
+    #[test]
+    fn unknown_usb_device_is_not_treated_as_a_supported_receiver() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        let usb_root = std::env::temp_dir().join(format!("hfx-usb-{unique}"));
+        let device = usb_root.join("1-1");
+        fs::create_dir_all(&device).expect("create USB fixture");
+        fs::write(device.join("idVendor"), "ffff\n").expect("write vendor");
+        fs::write(device.join("idProduct"), "ffff\n").expect("write product");
+        let probe = RealSystemProbe::with_all_paths(
+            FakeRunner::new(Vec::new()),
+            PathBuf::from("/missing"),
+            usb_root.clone(),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+
+        assert!(!probe.supported_receiver_present());
+        fs::remove_dir_all(usb_root).expect("remove USB fixture");
+    }
 }
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 7df6a23..584c053 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1209,6 +1209,7 @@ mod tests {
             service_state: ServiceState::Active,
             bridge: None,
             legacy_v2_stack_detected: false,
+            supported_receiver_present: false,
         }
     }
 
diff --git a/crates/hfx-ops/src/support.rs b/crates/hfx-ops/src/support.rs
index 70fbfb1..b7e7af9 100644
--- a/crates/hfx-ops/src/support.rs
+++ b/crates/hfx-ops/src/support.rs
@@ -240,6 +240,7 @@ mod tests {
             service_state: ServiceState::Inactive,
             bridge: None,
             legacy_v2_stack_detected: false,
+            supported_receiver_present: false,
         }
     }
 

From 75d666bf32a32a5c2b64d90a6f41115a8715d6a8 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 00:31:08 +0400
Subject: [PATCH 06/67] feat(qualification): supervise hardware lifecycle gates

---
 apps/device-qualification/assets/app.js       |    4 +-
 apps/device-qualification/assets/contract.js  |    2 +-
 .../local-qualification-view.schema.json      |    2 +-
 crates/hfx-ops/src/bin/hyperfluxctl.rs        |   86 +-
 crates/hfx-ops/src/configuration.rs           |  146 ++
 crates/hfx-ops/src/lib.rs                     |    6 +-
 crates/hfx-ops/src/probe.rs                   |   51 +-
 crates/hfx-ops/src/qualification.rs           |   54 +-
 crates/hfx-ops/src/qualification_lifecycle.rs | 1847 +++++++++++++++++
 crates/hfx-ops/src/qualification_server.rs    |  262 ++-
 crates/hfx-ops/src/qualification_state.rs     |   13 +-
 11 files changed, 2445 insertions(+), 28 deletions(-)
 create mode 100644 crates/hfx-ops/src/qualification_lifecycle.rs

diff --git a/apps/device-qualification/assets/app.js b/apps/device-qualification/assets/app.js
index b816b71..06219e6 100644
--- a/apps/device-qualification/assets/app.js
+++ b/apps/device-qualification/assets/app.js
@@ -78,6 +78,8 @@ async function refreshView(visible) {
     reconcileSelection();
     if (value.companion.state === "legacy-v2-detected") {
       renderConnection("warning", "HyperFlux V2 detected");
+    } else if (value.companion.state === "lifecycle-transition") {
+      renderConnection("warning", "Lifecycle transition");
     } else {
       renderConnection("ready", value.companion.state === "ready" ? "Connected" : "Needs attention");
     }
@@ -182,7 +184,7 @@ function render() {
     return;
   }
   if (!state.view) return;
-  if (state.view.companion.state !== "ready") {
+  if (!["ready", "lifecycle-transition"].includes(state.view.companion.state)) {
     app.innerHTML = systemGate(state.view.companion.state);
     return;
   }
diff --git a/apps/device-qualification/assets/contract.js b/apps/device-qualification/assets/contract.js
index b66a5a5..8b2ebcc 100644
--- a/apps/device-qualification/assets/contract.js
+++ b/apps/device-qualification/assets/contract.js
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-const COMPANION_STATES = new Set(["ready", "driver-pending", "legacy-v2-detected", "bridge-unavailable", "no-receiver"]);
+const COMPANION_STATES = new Set(["ready", "lifecycle-transition", "driver-pending", "legacy-v2-detected", "bridge-unavailable", "no-receiver"]);
 const PRESENCE_STATES = new Set(["active", "sleeping", "unavailable", "unknown"]);
 const SUPPORT_STATES = new Set(["unknown", "identified", "profile-qualified", "production-qualified"]);
 const VERDICTS = new Set(["not-run", "in-progress", "blocked", "failed", "evidence-ready", "accepted"]);
diff --git a/apps/device-qualification/contracts/local-qualification-view.schema.json b/apps/device-qualification/contracts/local-qualification-view.schema.json
index 56af8f5..36c96e7 100644
--- a/apps/device-qualification/contracts/local-qualification-view.schema.json
+++ b/apps/device-qualification/contracts/local-qualification-view.schema.json
@@ -15,7 +15,7 @@
       "additionalProperties": false,
       "required": ["state", "version", "bridge_protocol", "endpoint", "simulation", "network_upload_executed", "hardware_write_executed"],
       "properties": {
-        "state": {"enum": ["ready", "driver-pending", "legacy-v2-detected", "bridge-unavailable", "no-receiver"]},
+        "state": {"enum": ["ready", "lifecycle-transition", "driver-pending", "legacy-v2-detected", "bridge-unavailable", "no-receiver"]},
         "version": {"type": "string", "minLength": 1},
         "bridge_protocol": {"type": ["integer", "null"], "minimum": 1},
         "endpoint": {"type": "string", "pattern": "^http://(127\\.0\\.0\\.1|localhost)(:[0-9]+)?$"},
diff --git a/crates/hfx-ops/src/bin/hyperfluxctl.rs b/crates/hfx-ops/src/bin/hyperfluxctl.rs
index bfc3f2f..c967548 100644
--- a/crates/hfx-ops/src/bin/hyperfluxctl.rs
+++ b/crates/hfx-ops/src/bin/hyperfluxctl.rs
@@ -1,17 +1,20 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use hfx_ops::{
-    AssessmentState, QualificationServerConfig, RealSystemProbe, RunnerCapabilities,
-    SystemController, SystemProbe, assess_system, build_qualification_view, build_support_bundle,
+    AssessmentState, DriverState, QualificationConfigurationOutcome, QualificationServerConfig,
+    RealSystemProbe, RunnerCapabilities, SystemController, SystemProbe, assess_system,
+    build_qualification_view, build_support_bundle, enable_qualification_configuration,
     preview_support_bundle, qualification_generated_at, render_doctor_text, render_status_text,
-    serve_qualification_console, suggested_support_name, write_support_bundle,
+    restore_qualification_configuration, serve_qualification_console, suggested_support_name,
+    write_support_bundle,
 };
 use hfx_profiles::RuntimeProfileCatalog;
+use hfx_runtime::BRIDGE_CONFIGURATION_FILE_PATH;
 use std::env;
 use std::path::PathBuf;
 
 fn usage() -> &'static str {
-    "Usage:\n  hyperfluxctl status [--json]\n  hyperfluxctl doctor [--explain] [--json] [--repair]\n  hyperfluxctl support-bundle --preview\n  hyperfluxctl support-bundle --output PATH\n  hyperfluxctl qualification view --json\n  hyperfluxctl qualification serve [--assets PATH]\n"
+    "Usage:\n  hyperfluxctl status [--json]\n  hyperfluxctl doctor [--explain] [--json] [--repair]\n  hyperfluxctl support-bundle --preview\n  hyperfluxctl support-bundle --output PATH\n  hyperfluxctl qualification view --json\n  hyperfluxctl qualification prepare\n  hyperfluxctl qualification restore\n  hyperfluxctl qualification serve [--assets PATH]\n"
 }
 
 fn json<T: serde::Serialize>(value: &T) -> Result<String, String> {
@@ -110,6 +113,12 @@ fn qualification(arguments: &[String]) -> Result<i32, String> {
         println!("{}", json(&view)?);
         return Ok(0);
     }
+    if arguments == ["prepare"] {
+        return prepare_qualification_configuration();
+    }
+    if arguments == ["restore"] {
+        return restore_prequalification_configuration();
+    }
     let config = match arguments {
         [serve] if serve == "serve" => QualificationServerConfig::default(),
         [serve, assets, path] if serve == "serve" && assets == "--assets" => {
@@ -129,6 +138,75 @@ fn qualification(arguments: &[String]) -> Result<i32, String> {
     Ok(0)
 }
 
+fn prepare_qualification_configuration() -> Result<i32, String> {
+    require_root_for_qualification_configuration()?;
+    let probe = RealSystemProbe::default();
+    let assessment = assess_system(&probe.snapshot());
+    if assessment.driver == DriverState::ActivationPending {
+        return Err(
+            "driver activation is pending; run hyperfluxctl doctor and complete its one action before enabling qualification"
+                .to_owned(),
+        );
+    }
+    let path = std::path::Path::new(BRIDGE_CONFIGURATION_FILE_PATH);
+    let outcome = enable_qualification_configuration(path)
+        .map_err(|error| format!("qualification configuration failed: {error}"))?;
+    if let Err(error) = probe.restart_bridge() {
+        let restored = if matches!(outcome, QualificationConfigurationOutcome::Enabled { .. }) {
+            let _ = restore_qualification_configuration(path);
+            let _ = probe.restart_bridge();
+            true
+        } else {
+            false
+        };
+        let recovery = if restored {
+            "the previous configuration was restored"
+        } else {
+            "the already-enabled configuration was left unchanged"
+        };
+        return Err(format!(
+            "qualification bridge start failed and {recovery}: {error}"
+        ));
+    }
+    match outcome {
+        QualificationConfigurationOutcome::AlreadyEnabled => {
+            println!("Qualification mode was already enabled; the bridge restarted cleanly.");
+        }
+        QualificationConfigurationOutcome::Enabled { rollback_path } => {
+            println!("Qualification mode enabled.");
+            println!("Previous configuration: {}", rollback_path.display());
+        }
+        QualificationConfigurationOutcome::Restored => unreachable!("prepare cannot restore"),
+    }
+    println!("No lighting request or hardware lifecycle action was executed.");
+    println!("Next: hyperfluxctl qualification serve");
+    Ok(0)
+}
+
+fn restore_prequalification_configuration() -> Result<i32, String> {
+    require_root_for_qualification_configuration()?;
+    let outcome =
+        restore_qualification_configuration(std::path::Path::new(BRIDGE_CONFIGURATION_FILE_PATH))
+            .map_err(|error| format!("qualification configuration restore failed: {error}"))?;
+    RealSystemProbe::default()
+        .restart_bridge()
+        .map_err(|error| {
+            format!("previous configuration restored, but bridge restart failed: {error}")
+        })?;
+    debug_assert_eq!(outcome, QualificationConfigurationOutcome::Restored);
+    println!("Previous bridge configuration restored; the bridge restarted cleanly.");
+    println!("No lighting request or hardware lifecycle action was executed.");
+    Ok(0)
+}
+
+fn require_root_for_qualification_configuration() -> Result<(), String> {
+    if rustix::process::geteuid().as_raw() == 0 {
+        Ok(())
+    } else {
+        Err("qualification configuration requires sudo; no configuration was changed".to_owned())
+    }
+}
+
 fn run() -> Result<i32, String> {
     let arguments: Vec<String> = env::args().skip(1).collect();
     let Some((command, rest)) = arguments.split_first() else {
diff --git a/crates/hfx-ops/src/configuration.rs b/crates/hfx-ops/src/configuration.rs
index 1ae2449..9e3b0cc 100644
--- a/crates/hfx-ops/src/configuration.rs
+++ b/crates/hfx-ops/src/configuration.rs
@@ -30,6 +30,13 @@ pub enum ConfigMigrationOutcome {
     Migrated { rollback_path: PathBuf },
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum QualificationConfigurationOutcome {
+    AlreadyEnabled,
+    Enabled { rollback_path: PathBuf },
+    Restored,
+}
+
 #[derive(Debug)]
 pub enum ConfigMigrationError {
     Io(io::Error),
@@ -37,6 +44,7 @@ pub enum ConfigMigrationError {
     Invalid,
     UnsupportedSchema(String),
     RollbackAlreadyExists,
+    QualificationRollbackMissing,
 }
 
 impl fmt::Display for ConfigMigrationError {
@@ -54,6 +62,9 @@ impl fmt::Display for ConfigMigrationError {
             Self::RollbackAlreadyExists => {
                 formatter.write_str("an unconfirmed configuration rollback already exists")
             }
+            Self::QualificationRollbackMissing => {
+                formatter.write_str("no qualification configuration rollback is available")
+            }
         }
     }
 }
@@ -170,6 +181,64 @@ pub fn confirm_configuration(path: &Path) -> Result<(), ConfigMigrationError> {
     }
 }
 
+/// Atomically enables profile-qualified writes and stable restoration while
+/// retaining the exact previous configuration for an explicit rollback.
+///
+/// # Errors
+///
+/// Returns without replacing the live configuration when validation, backup,
+/// or commit fails.
+pub fn enable_qualification_configuration(
+    path: &Path,
+) -> Result<QualificationConfigurationOutcome, ConfigMigrationError> {
+    let (bytes, mode) = read_current(path)?;
+    let mut config = parse_current(&bytes)?;
+    if config.mode == BridgeMode::QualifiedLive && config.restoration.enabled {
+        return Ok(QualificationConfigurationOutcome::AlreadyEnabled);
+    }
+    let rollback_path = qualification_rollback_path(path);
+    if rollback_path.exists() {
+        return Err(ConfigMigrationError::RollbackAlreadyExists);
+    }
+    write_new(&rollback_path, &bytes, mode)?;
+    config.mode = BridgeMode::QualifiedLive;
+    config.restoration.enabled = true;
+    config
+        .validate()
+        .map_err(|_| ConfigMigrationError::Invalid)?;
+    let mut payload =
+        serde_json::to_vec_pretty(&config).map_err(|_| ConfigMigrationError::Invalid)?;
+    payload.push(b'\n');
+    if let Err(error) = commit(path, &payload, mode) {
+        let _ = fs::remove_file(&rollback_path);
+        return Err(error);
+    }
+    Ok(QualificationConfigurationOutcome::Enabled { rollback_path })
+}
+
+/// Restores the exact configuration retained by
+/// [`enable_qualification_configuration`].
+///
+/// # Errors
+///
+/// Returns without replacing the live configuration when the rollback is
+/// missing, invalid, or cannot be committed atomically.
+pub fn restore_qualification_configuration(
+    path: &Path,
+) -> Result<QualificationConfigurationOutcome, ConfigMigrationError> {
+    let rollback_path = qualification_rollback_path(path);
+    if !rollback_path.exists() {
+        return Err(ConfigMigrationError::QualificationRollbackMissing);
+    }
+    let (rollback, mode) = read_current(&rollback_path)?;
+    parse_current(&rollback)?;
+    let _ = read_current(path)?;
+    commit(path, &rollback, mode)?;
+    fs::remove_file(&rollback_path)?;
+    fs::File::open(path.parent().ok_or(ConfigMigrationError::Invalid)?)?.sync_all()?;
+    Ok(QualificationConfigurationOutcome::Restored)
+}
+
 fn migration_plan(bytes: &[u8]) -> Result<ConfigMigrationPlan, ConfigMigrationError> {
     let value: Value = serde_json::from_slice(bytes).map_err(|_| ConfigMigrationError::Invalid)?;
     let schema = value
@@ -206,6 +275,25 @@ fn rollback_path(path: &Path) -> PathBuf {
     path.with_file_name(format!("{name}.rollback-v0"))
 }
 
+fn qualification_rollback_path(path: &Path) -> PathBuf {
+    let name = path
+        .file_name()
+        .and_then(|value| value.to_str())
+        .unwrap_or("bridge.json");
+    path.with_file_name(format!("{name}.pre-qualification"))
+}
+
+fn read_current(path: &Path) -> Result<(Vec<u8>, u32), ConfigMigrationError> {
+    let metadata = fs::symlink_metadata(path)?;
+    if !metadata.file_type().is_file() {
+        return Err(ConfigMigrationError::Invalid);
+    }
+    if metadata.len() > MAX_CONFIGURATION_BYTES {
+        return Err(ConfigMigrationError::TooLarge);
+    }
+    Ok((fs::read(path)?, metadata.permissions().mode() & 0o777))
+}
+
 fn commit(path: &Path, payload: &[u8], mode: u32) -> Result<(), ConfigMigrationError> {
     let parent = path.parent().ok_or(ConfigMigrationError::Invalid)?;
     fs::create_dir_all(parent)?;
@@ -305,4 +393,62 @@ mod tests {
         assert_eq!(fs::read(&path).expect("unchanged"), future);
         fs::remove_dir_all(directory).expect("cleanup");
     }
+
+    #[test]
+    fn qualification_configuration_round_trips_the_exact_previous_state() {
+        let directory = temporary_directory();
+        let path = directory.join("bridge.json");
+        migrate_configuration(&path).expect("default creates");
+        let original = fs::read(&path).expect("original reads");
+        let QualificationConfigurationOutcome::Enabled { rollback_path } =
+            enable_qualification_configuration(&path).expect("qualification enables")
+        else {
+            panic!("expected an enabled configuration");
+        };
+        assert!(rollback_path.is_file());
+        let enabled = parse_current(&fs::read(&path).expect("enabled reads")).expect("enabled");
+        assert_eq!(enabled.mode, BridgeMode::QualifiedLive);
+        assert!(enabled.restoration.enabled);
+        assert_eq!(
+            restore_qualification_configuration(&path).expect("qualification restores"),
+            QualificationConfigurationOutcome::Restored
+        );
+        assert_eq!(fs::read(&path).expect("restored reads"), original);
+        assert!(!rollback_path.exists());
+        fs::remove_dir_all(directory).expect("cleanup");
+    }
+
+    #[test]
+    fn already_enabled_configuration_is_not_rewritten_or_backed_up() {
+        let directory = temporary_directory();
+        let path = directory.join("bridge.json");
+        migrate_configuration(&path).expect("default creates");
+        let mut config = parse_current(&fs::read(&path).expect("default reads")).expect("default");
+        config.mode = BridgeMode::QualifiedLive;
+        config.restoration.enabled = true;
+        let bytes = serde_json::to_vec_pretty(&config).expect("config serializes");
+        fs::write(&path, &bytes).expect("enabled writes");
+        assert_eq!(
+            enable_qualification_configuration(&path).expect("enabled is accepted"),
+            QualificationConfigurationOutcome::AlreadyEnabled
+        );
+        assert_eq!(fs::read(&path).expect("unchanged reads"), bytes);
+        assert!(!qualification_rollback_path(&path).exists());
+        fs::remove_dir_all(directory).expect("cleanup");
+    }
+
+    #[test]
+    fn existing_qualification_rollback_fails_closed() {
+        let directory = temporary_directory();
+        let path = directory.join("bridge.json");
+        migrate_configuration(&path).expect("default creates");
+        let original = fs::read(&path).expect("original reads");
+        fs::write(qualification_rollback_path(&path), &original).expect("rollback writes");
+        assert!(matches!(
+            enable_qualification_configuration(&path),
+            Err(ConfigMigrationError::RollbackAlreadyExists)
+        ));
+        assert_eq!(fs::read(&path).expect("unchanged reads"), original);
+        fs::remove_dir_all(directory).expect("cleanup");
+    }
 }
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 1febb3a..d64092f 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -7,6 +7,7 @@ mod assessment;
 mod configuration;
 mod probe;
 mod qualification;
+mod qualification_lifecycle;
 mod qualification_runner;
 mod qualification_server;
 mod qualification_state;
@@ -21,8 +22,9 @@ pub use assessment::{
     render_status_text,
 };
 pub use configuration::{
-    ConfigMigrationError, ConfigMigrationOutcome, ConfigMigrationPlan, confirm_configuration,
-    migrate_configuration,
+    ConfigMigrationError, ConfigMigrationOutcome, ConfigMigrationPlan,
+    QualificationConfigurationOutcome, confirm_configuration, enable_qualification_configuration,
+    migrate_configuration, restore_qualification_configuration,
 };
 pub use probe::{
     BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, ProbeError, RealCommandRunner,
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 6fd550b..746a32d 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -394,6 +394,20 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             view,
         })
     }
+
+    /// Requests exactly one asynchronous system suspend without invoking a
+    /// shell. The qualification coordinator persists its resume checkpoint
+    /// before calling this method.
+    pub(crate) fn request_system_suspend(&self) -> Result<(), ProbeError> {
+        let output = self
+            .runner
+            .run("systemctl", &["--no-block", "suspend"], self.timeout)?;
+        if output.success {
+            Ok(())
+        } else {
+            Err(ProbeError::CommandUnavailable)
+        }
+    }
 }
 
 impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
@@ -497,23 +511,33 @@ mod tests {
     #[derive(Debug)]
     struct FakeRunner {
         outputs: Mutex<VecDeque<Result<CommandOutput, ProbeError>>>,
+        calls: Mutex<Vec<(String, Vec<String>)>>,
     }
 
     impl FakeRunner {
         fn new(outputs: Vec<Result<CommandOutput, ProbeError>>) -> Self {
             Self {
                 outputs: Mutex::new(outputs.into()),
+                calls: Mutex::new(Vec::new()),
             }
         }
+
+        fn calls(&self) -> Vec<(String, Vec<String>)> {
+            self.calls.lock().expect("fake call lock").clone()
+        }
     }
 
     impl CommandRunner for FakeRunner {
         fn run(
             &self,
-            _program: &str,
-            _arguments: &[&str],
+            program: &str,
+            arguments: &[&str],
             _timeout: Duration,
         ) -> Result<CommandOutput, ProbeError> {
+            self.calls.lock().expect("fake call lock").push((
+                program.to_owned(),
+                arguments.iter().map(|value| (*value).to_owned()).collect(),
+            ));
             self.outputs
                 .lock()
                 .expect("fake command lock")
@@ -572,6 +596,29 @@ mod tests {
         assert!(!probe.legacy_v2_stack_detected());
     }
 
+    #[test]
+    fn suspend_request_is_one_bounded_shell_free_systemctl_call() {
+        let probe = RealSystemProbe::with_paths(
+            FakeRunner::new(vec![Ok(CommandOutput {
+                success: true,
+                stdout: String::new(),
+            })]),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+        probe
+            .request_system_suspend()
+            .expect("suspend request succeeds");
+        assert_eq!(
+            probe.runner.calls(),
+            vec![(
+                "systemctl".to_owned(),
+                vec!["--no-block".to_owned(), "suspend".to_owned()]
+            )]
+        );
+    }
+
     #[test]
     fn qualified_receiver_is_discovered_from_generated_usb_profiles() {
         let unique = SystemTime::now()
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 584c053..2ee751a 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -22,6 +22,7 @@ pub const QUALIFICATION_ENDPOINT: &str = "http://127.0.0.1:47821";
 #[serde(rename_all = "kebab-case")]
 pub enum CompanionState {
     Ready,
+    LifecycleTransition,
     DriverPending,
     LegacyV2Detected,
     BridgeUnavailable,
@@ -830,7 +831,15 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
         .filter_map(|stage| {
             let id = stage.action_id.clone()?;
             let confirmation = if stage.status == StageStatus::AwaitingObservation {
-                None
+                if stage.risk == RiskLevel::SystemLifecycle && stage.observations.is_empty() {
+                    Some(ActionConfirmation {
+                        phrase: "authorize one supervised system suspend".to_owned(),
+                        summary: "This checkpoint requests exactly one system suspend. It is committed before the request and is never replayed automatically."
+                            .to_owned(),
+                    })
+                } else {
+                    None
+                }
             } else {
                 match stage.risk {
                 RiskLevel::ReadOnly => None,
@@ -977,9 +986,52 @@ pub(crate) fn apply_stage_results(
             export_action_id: None,
         };
     }
+    order_receiver_lifecycle_stages(&mut view.plans);
     view.actions = actions_for_plans(&view.plans);
 }
 
+fn order_receiver_lifecycle_stages(plans: &mut [QualificationPlan]) {
+    let receiver_ids = plans
+        .iter()
+        .map(|plan| plan.receiver_id.clone())
+        .collect::<std::collections::BTreeSet<_>>();
+    for receiver_id in receiver_ids {
+        let prerequisites_complete = plans
+            .iter()
+            .filter(|plan| plan.receiver_id == receiver_id)
+            .flat_map(|plan| &plan.groups)
+            .filter(|group| group.group_id != "lifecycle")
+            .flat_map(|group| &group.stages)
+            .all(|stage| stage.status == StageStatus::Passed);
+        let mut active_seen = false;
+        for stage in plans
+            .iter_mut()
+            .filter(|plan| plan.receiver_id == receiver_id)
+            .flat_map(|plan| &mut plan.groups)
+            .filter(|group| group.group_id == "lifecycle")
+            .flat_map(|group| &mut group.stages)
+        {
+            if matches!(
+                stage.status,
+                StageStatus::Passed | StageStatus::Failed | StageStatus::Blocked
+            ) {
+                continue;
+            }
+            if !prerequisites_complete || active_seen {
+                stage.status = StageStatus::Locked;
+            } else if matches!(
+                stage.status,
+                StageStatus::Running | StageStatus::AwaitingObservation
+            ) {
+                active_seen = true;
+            } else {
+                stage.status = StageStatus::Ready;
+                active_seen = true;
+            }
+        }
+    }
+}
+
 fn action_id(stage_id: &str) -> String {
     format!("run:{stage_id}")
 }
diff --git a/crates/hfx-ops/src/qualification_lifecycle.rs b/crates/hfx-ops/src/qualification_lifecycle.rs
new file mode 100644
index 0000000..38f0531
--- /dev/null
+++ b/crates/hfx-ops/src/qualification_lifecycle.rs
@@ -0,0 +1,1847 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::qualification::{StageCheckpoint, StageProgress};
+use crate::qualification_runner::{ObservationVerdict, RunnerTransition};
+use crate::{
+    BatteryAvailability, BridgeIntegration, CompanionState, PresenceView, ProfileBindingView,
+    QualificationPlan, QualificationStage, QualificationView, ReceiverLifecycleView, ReceiverView,
+    RiskLevel, StageResult, StageStatus, qualification_generated_at,
+};
+use hfx_domain::{
+    ControllerAvailability, InventoryAvailability, ReceiverLifecycleState, RestoreState,
+};
+use rustix::time::{ClockId, clock_gettime};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+use std::fmt;
+use std::fs;
+
+const MAX_GENERATION_HISTORY: usize = 16;
+const MAX_RUN_PLANS: usize = 16;
+const MAX_RUN_DEVICES: usize = 32;
+const MAX_EVIDENCE_REFS: usize = 64;
+const MINIMUM_SUSPEND_GAP_MS: u64 = 1_000;
+const BOOT_ID_PATH: &str = "/proc/sys/kernel/random/boot_id";
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum LifecyclePhase {
+    DeviceDeparture,
+    DeviceReturn,
+    ReceiverDeparture,
+    ReceiverReturn,
+    SuspendAuthorization,
+    SystemResumePending,
+    SystemResumeObservation,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct SuspendStamp {
+    boot_id_sha256: String,
+    suspend_gap_ms: u64,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct LifecycleStageState {
+    pub stage_id: String,
+    pub device_id: String,
+    pub device_kind: String,
+    pub phase: LifecyclePhase,
+    pub baseline_generation_id: u64,
+    pub evidence_refs: Vec<String>,
+    pub suspend_stamp: Option<SuspendStamp>,
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct LifecycleRunState {
+    pub receiver: ReceiverView,
+    pub plans: Vec<QualificationPlan>,
+    pub generation_history: Vec<u64>,
+    pub active: Option<LifecycleStageState>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct ObservedDevice {
+    device_id: String,
+    profile: Option<ProfileBindingView>,
+    availability: InventoryAvailability,
+    controller_ready: bool,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct LifecycleObservation {
+    receiver_id: String,
+    receiver_present: bool,
+    generation_id: Option<u64>,
+    receiver_profile: Option<ProfileBindingView>,
+    receiver_lifecycle: Option<ReceiverLifecycleState>,
+    stable_restore_enabled: bool,
+    restore_state: Option<RestoreState>,
+    selected: Option<ObservedDevice>,
+    siblings: Vec<ObservedDevice>,
+    cursor_ref: Option<String>,
+}
+
+pub(crate) enum PreparedLifecycleAction {
+    Record {
+        run: LifecycleRunState,
+        transition: RunnerTransition,
+    },
+    Suspend {
+        run: LifecycleRunState,
+        transition: RunnerTransition,
+    },
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct LifecycleRunnerError {
+    message: String,
+}
+
+impl LifecycleRunnerError {
+    fn new(message: impl Into<String>) -> Self {
+        Self {
+            message: message.into(),
+        }
+    }
+}
+
+impl fmt::Display for LifecycleRunnerError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.message)
+    }
+}
+
+impl std::error::Error for LifecycleRunnerError {}
+
+impl LifecycleRunState {
+    pub(crate) fn validate(&self) -> Result<(), LifecycleRunnerError> {
+        if self.plans.is_empty()
+            || self.plans.len() > MAX_RUN_PLANS
+            || self.receiver.devices.len() > MAX_RUN_DEVICES
+            || self.generation_history.is_empty()
+            || self.generation_history.len() > MAX_GENERATION_HISTORY
+            || self
+                .generation_history
+                .windows(2)
+                .any(|window| window[0] >= window[1])
+            || self.generation_history.last().copied() != Some(self.receiver.generation_id)
+        {
+            return Err(LifecycleRunnerError::new(
+                "The saved lifecycle run is outside its bounded generation contract.",
+            ));
+        }
+        let mut devices = BTreeSet::new();
+        for plan in &self.plans {
+            if plan.receiver_id != self.receiver.receiver_id
+                || plan.generation_id != self.receiver.generation_id
+                || !devices.insert(plan.device_id.as_str())
+            {
+                return Err(LifecycleRunnerError::new(
+                    "The saved lifecycle plans do not share one exact receiver generation.",
+                ));
+            }
+        }
+        if let Some(active) = &self.active {
+            let stage_plan = self.plans.iter().find(|plan| {
+                plan.device_id == active.device_id
+                    && plan
+                        .groups
+                        .iter()
+                        .flat_map(|group| &group.stages)
+                        .any(|stage| stage.stage_id == active.stage_id)
+            });
+            let expected_kind = self
+                .receiver
+                .devices
+                .iter()
+                .find(|device| device.device_id == active.device_id)
+                .map(|device| device.kind.as_str());
+            let suspend_phase = matches!(
+                active.phase,
+                LifecyclePhase::SystemResumePending | LifecyclePhase::SystemResumeObservation
+            );
+            let stage_exists_anywhere = self.plans.iter().any(|plan| {
+                plan.groups
+                    .iter()
+                    .flat_map(|group| &group.stages)
+                    .any(|stage| stage.stage_id == active.stage_id)
+            });
+            if !stage_exists_anywhere
+                || stage_plan.is_none()
+                || !matches!(active.device_kind.as_str(), "mouse" | "keyboard")
+                || expected_kind != Some(active.device_kind.as_str())
+                || active.evidence_refs.len() > MAX_EVIDENCE_REFS
+                || !self
+                    .generation_history
+                    .contains(&active.baseline_generation_id)
+                || suspend_phase != active.suspend_stamp.is_some()
+            {
+                return Err(LifecycleRunnerError::new(
+                    "The saved lifecycle checkpoint is not bound to this run.",
+                ));
+            }
+            if let Some(stamp) = &active.suspend_stamp
+                && !valid_digest(&stamp.boot_id_sha256)
+            {
+                return Err(LifecycleRunnerError::new(
+                    "The saved suspend checkpoint is invalid.",
+                ));
+            }
+        }
+        Ok(())
+    }
+}
+
+pub(crate) fn capture_lifecycle_run(
+    view: &QualificationView,
+    stage: &QualificationStage,
+) -> Result<LifecycleRunState, LifecycleRunnerError> {
+    let plan = plan_for_stage(view, stage)?;
+    let receiver = view
+        .receivers
+        .iter()
+        .find(|receiver| {
+            receiver.receiver_id == plan.receiver_id && receiver.generation_id == plan.generation_id
+        })
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The selected lifecycle stage has no current receiver generation.",
+            )
+        })?;
+    let plans = view
+        .plans
+        .iter()
+        .filter(|candidate| {
+            candidate.receiver_id == plan.receiver_id
+                && candidate.generation_id == plan.generation_id
+        })
+        .cloned()
+        .collect::<Vec<_>>();
+    if plans.iter().any(|candidate| {
+        candidate
+            .groups
+            .iter()
+            .filter(|group| group.group_id != "lifecycle")
+            .flat_map(|group| &group.stages)
+            .any(|candidate_stage| candidate_stage.status != StageStatus::Passed)
+    }) {
+        return Err(LifecycleRunnerError::new(
+            "Complete every identity and lighting check on this receiver before lifecycle testing.",
+        ));
+    }
+    let run = LifecycleRunState {
+        receiver: receiver.clone(),
+        plans,
+        generation_history: vec![receiver.generation_id],
+        active: None,
+    };
+    run.validate()?;
+    Ok(run)
+}
+
+pub(crate) fn observe_lifecycle(
+    integration: Option<&BridgeIntegration>,
+    run: &LifecycleRunState,
+    selected_device_id: &str,
+) -> LifecycleObservation {
+    let expected_siblings = run
+        .plans
+        .iter()
+        .map(|plan| plan.device_id.as_str())
+        .filter(|device_id| *device_id != selected_device_id)
+        .collect::<BTreeSet<_>>();
+    let receiver = integration.and_then(|value| {
+        value
+            .view
+            .receivers
+            .iter()
+            .find(|receiver| receiver.receiver_id.as_str() == run.receiver.receiver_id)
+    });
+    let selected = receiver.and_then(|receiver| {
+        observed_device(receiver, selected_device_id).or_else(|| {
+            expected_device(run, selected_device_id)
+                .ok()
+                .map(|expected| ObservedDevice {
+                    device_id: expected.device_id.clone(),
+                    profile: expected.profile.clone(),
+                    availability: InventoryAvailability::Unavailable,
+                    controller_ready: false,
+                })
+        })
+    });
+    let siblings = receiver.map_or_else(Vec::new, |receiver| {
+        expected_siblings
+            .iter()
+            .filter_map(|device_id| observed_device(receiver, device_id))
+            .collect()
+    });
+    LifecycleObservation {
+        receiver_id: run.receiver.receiver_id.clone(),
+        receiver_present: receiver.is_some(),
+        generation_id: receiver.map(|receiver| receiver.generation_id.get()),
+        receiver_profile: receiver
+            .and_then(|receiver| receiver.profile.as_ref())
+            .map(profile_binding),
+        receiver_lifecycle: receiver.map(|receiver| receiver.lifecycle),
+        stable_restore_enabled: receiver.is_some_and(|receiver| receiver.stable_restore_enabled),
+        restore_state: receiver.map(|receiver| receiver.restore_state),
+        selected,
+        siblings,
+        cursor_ref: integration.map(|value| cursor_evidence(&value.view)),
+    }
+}
+
+pub(crate) fn start_lifecycle_stage(
+    mut run: LifecycleRunState,
+    stage: &QualificationStage,
+    observation: &LifecycleObservation,
+) -> Result<(LifecycleRunState, RunnerTransition), LifecycleRunnerError> {
+    if run.active.is_some() {
+        return Err(LifecycleRunnerError::new(
+            "Another lifecycle stage is already active in this receiver campaign.",
+        ));
+    }
+    let plan = run
+        .plans
+        .iter()
+        .find(|plan| stage_belongs_to_plan(plan, stage))
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The lifecycle stage does not belong to the retained receiver campaign.",
+            )
+        })?;
+    let device = run
+        .receiver
+        .devices
+        .iter()
+        .find(|device| device.device_id == plan.device_id)
+        .ok_or_else(|| LifecycleRunnerError::new("The lifecycle target is no longer retained."))?;
+    if !matches!(device.kind.as_str(), "mouse" | "keyboard")
+        || !matches!(
+            stage.risk,
+            RiskLevel::DeviceLifecycle | RiskLevel::SystemLifecycle
+        )
+    {
+        return Err(LifecycleRunnerError::new(
+            "This stage is not a supported controller lifecycle campaign.",
+        ));
+    }
+    validate_ready_identity(&run, plan.device_id.as_str(), observation)?;
+    if !observation.stable_restore_enabled {
+        return Err(LifecycleRunnerError::new(
+            "Stable restoration is disabled; enable it before a watched lifecycle campaign.",
+        ));
+    }
+    let mut evidence_refs = vec![format!(
+        "receiver-generation:{}",
+        observation.generation_id.unwrap_or_default()
+    )];
+    if let Some(cursor) = &observation.cursor_ref {
+        evidence_refs.push(cursor.clone());
+    }
+    run.active = Some(LifecycleStageState {
+        stage_id: stage.stage_id.clone(),
+        device_id: plan.device_id.clone(),
+        device_kind: device.kind.clone(),
+        phase: LifecyclePhase::DeviceDeparture,
+        baseline_generation_id: observation.generation_id.unwrap_or_default(),
+        evidence_refs,
+        suspend_stamp: None,
+    });
+    let transition = awaiting(device_departure_checkpoint(&run));
+    run.validate()?;
+    Ok((run, transition))
+}
+
+pub(crate) fn prepare_lifecycle_checkpoint(
+    mut run: LifecycleRunState,
+    stage: &QualificationStage,
+    current: &StageProgress,
+    verdict: ObservationVerdict,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    let checkpoint = current.checkpoint.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new(
+            "The lifecycle stage has no resumable checkpoint; no action was repeated.",
+        )
+    })?;
+    let active = run.active.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The retained lifecycle campaign has no active stage.")
+    })?;
+    if active.stage_id != stage.stage_id {
+        return Err(LifecycleRunnerError::new(
+            "The watched checkpoint belongs to a different lifecycle stage.",
+        ));
+    }
+    if verdict != ObservationVerdict::Pass {
+        let evidence = active.evidence_refs.clone();
+        run.active = None;
+        let (status, summary) = if verdict == ObservationVerdict::Fail {
+            (
+                StageStatus::Failed,
+                "A watched lifecycle result did not match the required physical state.",
+            )
+        } else {
+            (
+                StageStatus::Blocked,
+                "The watched lifecycle result was inconclusive; no physical step was repeated.",
+            )
+        };
+        return Ok(PreparedLifecycleAction::Record {
+            run,
+            transition: finished(status, summary, evidence),
+        });
+    }
+    match checkpoint.checkpoint_id.as_str() {
+        "device-departure" => record_device_departure(run, observation),
+        "device-return" => record_device_return(run, observation),
+        "receiver-departure" => record_receiver_departure(run, observation),
+        "receiver-return" => record_receiver_return(run, observation),
+        "system-suspend-authorization" => prepare_system_suspend(run, observation),
+        "system-resume-observation" => record_system_resume(run, observation),
+        _ => Err(LifecycleRunnerError::new(
+            "The lifecycle checkpoint is not recognized; no physical step was repeated.",
+        )),
+    }
+}
+
+pub(crate) fn reconcile_system_resume(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+    current_stamp: &SuspendStamp,
+) -> Result<Option<(LifecycleRunState, RunnerTransition)>, LifecycleRunnerError> {
+    let Some(active) = run.active.as_mut() else {
+        return Ok(None);
+    };
+    if active.phase != LifecyclePhase::SystemResumePending {
+        return Ok(None);
+    }
+    let baseline = active.suspend_stamp.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The system-resume checkpoint has no suspend clock anchor.")
+    })?;
+    if baseline.boot_id_sha256 != current_stamp.boot_id_sha256 {
+        let evidence = active.evidence_refs.clone();
+        run.active = None;
+        return Ok(Some((
+            run,
+            finished(
+                StageStatus::Blocked,
+                "The computer rebooted instead of resuming the authorized suspend.",
+                evidence,
+            ),
+        )));
+    }
+    let suspended_ms = current_stamp
+        .suspend_gap_ms
+        .saturating_sub(baseline.suspend_gap_ms);
+    if suspended_ms < MINIMUM_SUSPEND_GAP_MS
+        || validate_restored_identity(&run, observation, false).is_err()
+    {
+        return Ok(None);
+    }
+    let active = run.active.as_mut().expect("active lifecycle stage exists");
+    active.phase = LifecyclePhase::SystemResumeObservation;
+    active
+        .evidence_refs
+        .push(format!("system-suspend-gap-ms:{suspended_ms}"));
+    if let Some(cursor) = &observation.cursor_ref {
+        active.evidence_refs.push(cursor.clone());
+    }
+    accept_generation(&mut run, observation)?;
+    let evidence = run
+        .active
+        .as_ref()
+        .expect("active lifecycle stage exists")
+        .evidence_refs
+        .clone();
+    let has_siblings = run.plans.len() > 1;
+    Ok(Some((
+        run,
+        awaiting(system_resume_checkpoint(evidence, has_siblings)),
+    )))
+}
+
+pub(crate) fn overlay_lifecycle_run(view: &mut QualificationView, run: &LifecycleRunState) {
+    let live_receiver = view
+        .receivers
+        .iter()
+        .find(|receiver| receiver.receiver_id == run.receiver.receiver_id)
+        .cloned();
+    let mut receiver = run.receiver.clone();
+    if let Some(live) = &live_receiver {
+        receiver.generation_id = live.generation_id;
+        receiver.lifecycle = live.lifecycle;
+        receiver.profile.clone_from(&live.profile);
+        merge_live_devices(&mut receiver, live);
+    } else {
+        receiver.lifecycle = ReceiverLifecycleView::Unavailable;
+        for device in &mut receiver.devices {
+            device.presence = PresenceView::Unavailable;
+            device.battery.availability = if device.battery.percentage.is_some() {
+                BatteryAvailability::Stale
+            } else {
+                BatteryAvailability::Unavailable
+            };
+        }
+        if view.companion.state == CompanionState::NoReceiver {
+            view.companion.state = CompanionState::LifecycleTransition;
+        }
+    }
+    let generation_id = receiver.generation_id;
+    let history = run
+        .generation_history
+        .iter()
+        .map(u64::to_string)
+        .collect::<Vec<_>>()
+        .join(" -> ");
+    let mut plans = run.plans.clone();
+    for plan in &mut plans {
+        plan.generation_id = generation_id;
+        plan.summary = format!(
+            "Lifecycle campaign generations {history}; evidence remains bound to each recorded checkpoint."
+        );
+    }
+    view.receivers
+        .retain(|candidate| candidate.receiver_id != run.receiver.receiver_id);
+    view.plans
+        .retain(|candidate| candidate.receiver_id != run.receiver.receiver_id);
+    view.receivers.push(receiver);
+    view.plans.extend(plans);
+}
+
+pub(crate) fn identity_transition_matches(
+    view: &QualificationView,
+    run: &LifecycleRunState,
+) -> bool {
+    if run.validate().is_err() {
+        return false;
+    }
+    let receiver = view
+        .receivers
+        .iter()
+        .find(|receiver| receiver.receiver_id == run.receiver.receiver_id);
+    let Some(active) = &run.active else {
+        return receiver.is_some_and(|receiver| {
+            receiver.generation_id == run.receiver.generation_id
+                && receiver_identity_matches(receiver, run, false)
+        });
+    };
+    let Some(receiver) = receiver else {
+        return matches!(
+            active.phase,
+            LifecyclePhase::ReceiverDeparture
+                | LifecyclePhase::ReceiverReturn
+                | LifecyclePhase::SystemResumePending
+        );
+    };
+    let generation_matches = match active.phase {
+        LifecyclePhase::ReceiverReturn | LifecyclePhase::SystemResumePending => {
+            receiver.generation_id >= active.baseline_generation_id
+        }
+        LifecyclePhase::SystemResumeObservation => {
+            receiver.generation_id == run.receiver.generation_id
+        }
+        LifecyclePhase::DeviceDeparture
+        | LifecyclePhase::DeviceReturn
+        | LifecyclePhase::ReceiverDeparture
+        | LifecyclePhase::SuspendAuthorization => {
+            receiver.generation_id == active.baseline_generation_id
+        }
+    };
+    if !generation_matches || !receiver_identity_matches(receiver, run, true) {
+        return false;
+    }
+    match active.phase {
+        LifecyclePhase::DeviceDeparture | LifecyclePhase::DeviceReturn => run
+            .receiver
+            .devices
+            .iter()
+            .filter(|device| device.device_id != active.device_id)
+            .all(|expected| receiver_has_exact_device(receiver, expected)),
+        LifecyclePhase::SuspendAuthorization | LifecyclePhase::SystemResumeObservation => run
+            .receiver
+            .devices
+            .iter()
+            .all(|expected| receiver_has_exact_device(receiver, expected)),
+        LifecyclePhase::ReceiverDeparture
+        | LifecyclePhase::ReceiverReturn
+        | LifecyclePhase::SystemResumePending => true,
+    }
+}
+
+pub(crate) fn current_suspend_stamp() -> Result<SuspendStamp, LifecycleRunnerError> {
+    let boot_id = fs::read_to_string(BOOT_ID_PATH).map_err(|_| {
+        LifecycleRunnerError::new("The current Linux boot identity is unavailable.")
+    })?;
+    let boot_id = boot_id.trim();
+    if boot_id.len() != 36
+        || !boot_id
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() || byte == b'-')
+    {
+        return Err(LifecycleRunnerError::new(
+            "The current Linux boot identity is malformed.",
+        ));
+    }
+    let boottime = clock_milliseconds(ClockId::Boottime)?;
+    let monotonic = clock_milliseconds(ClockId::Monotonic)?;
+    Ok(SuspendStamp {
+        boot_id_sha256: digest_hex(boot_id.as_bytes()),
+        suspend_gap_ms: boottime.saturating_sub(monotonic),
+    })
+}
+
+fn record_device_departure(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    validate_same_generation(&run, observation)?;
+    let selected = selected_observation(&run, observation)?;
+    if selected.controller_ready
+        || !matches!(
+            selected.availability,
+            InventoryAvailability::Sleeping
+                | InventoryAvailability::Unavailable
+                | InventoryAvailability::ReceiverUnavailable
+        )
+        || !siblings_ready(&run, observation)
+    {
+        return Err(LifecycleRunnerError::new(
+            "The selected controller has not departed cleanly while its qualified siblings remain ready.",
+        ));
+    }
+    let active = run.active.as_mut().expect("active lifecycle stage exists");
+    active.phase = LifecyclePhase::DeviceReturn;
+    active.evidence_refs.push(format!(
+        "device-departure:{}",
+        selected.availability.as_str()
+    ));
+    let evidence = active.evidence_refs.clone();
+    let has_siblings = run.plans.len() > 1;
+    Ok(PreparedLifecycleAction::Record {
+        run,
+        transition: awaiting(device_return_checkpoint(evidence, has_siblings)),
+    })
+}
+
+fn record_device_return(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    validate_ready_identity_for_active(&run, observation)?;
+    if observation.restore_state != Some(RestoreState::Succeeded) {
+        return Err(LifecycleRunnerError::new(
+            "The controller returned, but one successful stable restore is not visible yet.",
+        ));
+    }
+    let active = run.active.as_mut().expect("active lifecycle stage exists");
+    active.evidence_refs.push("device-return:ready".to_owned());
+    let checkpoint = if active.device_kind == "keyboard" {
+        active.phase = LifecyclePhase::SuspendAuthorization;
+        system_suspend_checkpoint(active.evidence_refs.clone())
+    } else {
+        active.phase = LifecyclePhase::ReceiverDeparture;
+        receiver_departure_checkpoint(active.evidence_refs.clone())
+    };
+    Ok(PreparedLifecycleAction::Record {
+        run,
+        transition: awaiting(checkpoint),
+    })
+}
+
+fn record_receiver_departure(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    if observation.receiver_present
+        && !matches!(
+            observation.receiver_lifecycle,
+            Some(ReceiverLifecycleState::Disconnecting | ReceiverLifecycleState::Unknown)
+        )
+    {
+        return Err(LifecycleRunnerError::new(
+            "The exact receiver generation has not disappeared yet.",
+        ));
+    }
+    let active = run.active.as_mut().expect("active lifecycle stage exists");
+    active.phase = LifecyclePhase::ReceiverReturn;
+    active
+        .evidence_refs
+        .push("receiver-departure:observed".to_owned());
+    let evidence = active.evidence_refs.clone();
+    let has_siblings = run.plans.len() > 1;
+    Ok(PreparedLifecycleAction::Record {
+        run,
+        transition: awaiting(receiver_return_checkpoint(evidence, has_siblings)),
+    })
+}
+
+fn record_receiver_return(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    validate_restored_identity(&run, observation, true)?;
+    let generation = observation
+        .generation_id
+        .ok_or_else(|| LifecycleRunnerError::new("The renewed receiver has no generation."))?;
+    let active = run.active.as_ref().expect("active lifecycle stage exists");
+    if generation <= active.baseline_generation_id {
+        return Err(LifecycleRunnerError::new(
+            "Receiver return did not create a newer generation.",
+        ));
+    }
+    let mut evidence = active.evidence_refs.clone();
+    evidence.push(format!("receiver-generation:{generation}"));
+    evidence.push("stable-restore:succeeded".to_owned());
+    if let Some(cursor) = &observation.cursor_ref {
+        evidence.push(cursor.clone());
+    }
+    accept_generation(&mut run, observation)?;
+    run.active = None;
+    let summary = if run.plans.len() > 1 {
+        "Controller return, sibling isolation, and a newer restored receiver generation were confirmed."
+    } else {
+        "Controller return and a newer restored receiver generation were confirmed."
+    };
+    Ok(PreparedLifecycleAction::Record {
+        run,
+        transition: finished(StageStatus::Passed, summary, evidence),
+    })
+}
+
+fn prepare_system_suspend(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    validate_ready_identity_for_active(&run, observation)?;
+    let stamp = current_suspend_stamp()?;
+    let active = run.active.as_mut().expect("active lifecycle stage exists");
+    if active.phase != LifecyclePhase::SuspendAuthorization {
+        return Err(LifecycleRunnerError::new(
+            "The lifecycle campaign is not awaiting a system suspend.",
+        ));
+    }
+    active.phase = LifecyclePhase::SystemResumePending;
+    active.suspend_stamp = Some(stamp);
+    active
+        .evidence_refs
+        .push("system-suspend:authorized".to_owned());
+    let checkpoint = StageCheckpoint {
+        checkpoint_id: "system-resume-pending".to_owned(),
+        instructions: vec![
+            "The authorized suspend is in progress. Wake this computer normally and wait for the bridge and controller routes to return."
+                .to_owned(),
+        ],
+        observations: Vec::new(),
+        evidence_refs: active.evidence_refs.clone(),
+    };
+    Ok(PreparedLifecycleAction::Suspend {
+        run,
+        transition: RunnerTransition {
+            progress: StageProgress {
+                status: StageStatus::Running,
+                result: None,
+                checkpoint: Some(checkpoint),
+            },
+            hardware_write_executed: false,
+        },
+    })
+}
+
+fn record_system_resume(
+    mut run: LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
+    validate_restored_identity(&run, observation, false)?;
+    let active = run.active.as_ref().expect("active lifecycle stage exists");
+    if active.phase != LifecyclePhase::SystemResumeObservation {
+        return Err(LifecycleRunnerError::new(
+            "A measured system resume has not reached its observation checkpoint.",
+        ));
+    }
+    let mut evidence = active.evidence_refs.clone();
+    evidence.push("stable-restore:succeeded".to_owned());
+    run.active = None;
+    let summary = if run.plans.len() > 1 {
+        "Controller return, sibling isolation, measured suspend, and restored system resume were confirmed."
+    } else {
+        "Controller return, measured suspend, and restored system resume were confirmed."
+    };
+    Ok(PreparedLifecycleAction::Record {
+        run,
+        transition: finished(StageStatus::Passed, summary, evidence),
+    })
+}
+
+fn validate_ready_identity_for_active(
+    run: &LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<(), LifecycleRunnerError> {
+    let active = run.active.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The retained lifecycle campaign has no active stage.")
+    })?;
+    validate_ready_identity(run, &active.device_id, observation)
+}
+
+fn validate_ready_identity(
+    run: &LifecycleRunState,
+    selected_device_id: &str,
+    observation: &LifecycleObservation,
+) -> Result<(), LifecycleRunnerError> {
+    validate_receiver_identity(run, observation)?;
+    let selected = observation.selected.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The exact selected controller is not currently observable.")
+    })?;
+    let expected = expected_device(run, selected_device_id)?;
+    if selected.device_id != selected_device_id
+        || selected.profile.as_ref() != expected.profile.as_ref()
+        || selected.availability != InventoryAvailability::Available
+        || !selected.controller_ready
+        || !siblings_ready(run, observation)
+    {
+        return Err(LifecycleRunnerError::new(
+            "The selected controller and every qualified sibling are not ready on the exact retained profiles.",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_restored_identity(
+    run: &LifecycleRunState,
+    observation: &LifecycleObservation,
+    require_new_generation: bool,
+) -> Result<(), LifecycleRunnerError> {
+    validate_ready_identity_for_active(run, observation)?;
+    let generation = observation
+        .generation_id
+        .ok_or_else(|| LifecycleRunnerError::new("The active receiver has no generation."))?;
+    let baseline = run
+        .active
+        .as_ref()
+        .expect("active lifecycle stage exists")
+        .baseline_generation_id;
+    if generation < baseline || (require_new_generation && generation <= baseline) {
+        return Err(LifecycleRunnerError::new(
+            "The active receiver generation does not satisfy this lifecycle checkpoint.",
+        ));
+    }
+    if !observation.stable_restore_enabled
+        || observation.restore_state != Some(RestoreState::Succeeded)
+    {
+        return Err(LifecycleRunnerError::new(
+            "The exact generation is ready, but stable restoration has not terminally succeeded.",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_receiver_identity(
+    run: &LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<(), LifecycleRunnerError> {
+    if observation.receiver_id != run.receiver.receiver_id
+        || !observation.receiver_present
+        || observation.receiver_profile.as_ref() != run.receiver.profile.as_ref()
+        || !matches!(
+            observation.receiver_lifecycle,
+            Some(ReceiverLifecycleState::Active | ReceiverLifecycleState::PartiallySuspended)
+        )
+    {
+        return Err(LifecycleRunnerError::new(
+            "The current receiver does not match the retained profile-bound lifecycle authority.",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_same_generation(
+    run: &LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<(), LifecycleRunnerError> {
+    validate_receiver_identity(run, observation)?;
+    let active = run.active.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The retained lifecycle campaign has no active stage.")
+    })?;
+    if observation.generation_id != Some(active.baseline_generation_id) {
+        return Err(LifecycleRunnerError::new(
+            "The receiver generation changed before the controller-return checkpoint.",
+        ));
+    }
+    Ok(())
+}
+
+fn selected_observation<'a>(
+    run: &LifecycleRunState,
+    observation: &'a LifecycleObservation,
+) -> Result<&'a ObservedDevice, LifecycleRunnerError> {
+    let active = run.active.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The retained lifecycle campaign has no active stage.")
+    })?;
+    observation.selected.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new(format!(
+            "The selected controller {} is not retained in the current receiver inventory.",
+            active.device_id
+        ))
+    })
+}
+
+fn siblings_ready(run: &LifecycleRunState, observation: &LifecycleObservation) -> bool {
+    let selected_id = run
+        .active
+        .as_ref()
+        .map(|active| active.device_id.as_str())
+        .or_else(|| {
+            observation
+                .selected
+                .as_ref()
+                .map(|selected| selected.device_id.as_str())
+        })
+        .unwrap_or("");
+    let expected = run
+        .plans
+        .iter()
+        .filter(|plan| plan.device_id != selected_id)
+        .collect::<Vec<_>>();
+    expected.iter().all(|plan| {
+        let profile = run
+            .receiver
+            .devices
+            .iter()
+            .find(|device| device.device_id == plan.device_id)
+            .and_then(|device| device.profile.as_ref());
+        observation.siblings.iter().any(|sibling| {
+            sibling.device_id == plan.device_id
+                && sibling.profile.as_ref() == profile
+                && sibling.availability == InventoryAvailability::Available
+                && sibling.controller_ready
+        })
+    })
+}
+
+fn accept_generation(
+    run: &mut LifecycleRunState,
+    observation: &LifecycleObservation,
+) -> Result<(), LifecycleRunnerError> {
+    let generation = observation
+        .generation_id
+        .ok_or_else(|| LifecycleRunnerError::new("The accepted receiver has no generation."))?;
+    if generation < run.receiver.generation_id {
+        return Err(LifecycleRunnerError::new(
+            "A stale receiver generation cannot enter the lifecycle history.",
+        ));
+    }
+    if generation > run.receiver.generation_id {
+        run.generation_history.push(generation);
+        if run.generation_history.len() > MAX_GENERATION_HISTORY {
+            return Err(LifecycleRunnerError::new(
+                "The lifecycle generation history exceeded its bound.",
+            ));
+        }
+        run.receiver.generation_id = generation;
+        for plan in &mut run.plans {
+            plan.generation_id = generation;
+        }
+    }
+    Ok(())
+}
+
+fn plan_for_stage<'a>(
+    view: &'a QualificationView,
+    stage: &QualificationStage,
+) -> Result<&'a QualificationPlan, LifecycleRunnerError> {
+    view.plans
+        .iter()
+        .find(|plan| stage_belongs_to_plan(plan, stage))
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The selected lifecycle stage no longer belongs to a current plan.",
+            )
+        })
+}
+
+fn stage_belongs_to_plan(plan: &QualificationPlan, stage: &QualificationStage) -> bool {
+    plan.groups
+        .iter()
+        .flat_map(|group| &group.stages)
+        .any(|candidate| candidate.stage_id == stage.stage_id)
+}
+
+fn expected_device<'a>(
+    run: &'a LifecycleRunState,
+    device_id: &str,
+) -> Result<&'a crate::DeviceView, LifecycleRunnerError> {
+    run.receiver
+        .devices
+        .iter()
+        .find(|device| device.device_id == device_id)
+        .ok_or_else(|| LifecycleRunnerError::new("The expected controller identity is missing."))
+}
+
+fn observed_device(
+    receiver: &hfx_protocol::IntegrationReceiverView,
+    device_id: &str,
+) -> Option<ObservedDevice> {
+    let inventory = receiver
+        .inventory
+        .iter()
+        .find(|device| device.device_id.as_str() == device_id)?;
+    let controller_ready = receiver.controllers.iter().any(|controller| {
+        controller.device_id == inventory.device_id
+            && controller.availability == ControllerAvailability::Ready
+    });
+    Some(ObservedDevice {
+        device_id: inventory.device_id.as_str().to_owned(),
+        profile: inventory.profile.as_ref().map(profile_binding),
+        availability: inventory.availability,
+        controller_ready,
+    })
+}
+
+fn profile_binding(binding: &hfx_protocol::ProfileBindingView) -> ProfileBindingView {
+    ProfileBindingView {
+        id: binding.profile_id.as_str().to_owned(),
+        digest: binding.profile_digest.as_str().to_owned(),
+    }
+}
+
+fn merge_live_devices(receiver: &mut ReceiverView, live: &ReceiverView) {
+    for device in &mut receiver.devices {
+        if let Some(current) = live
+            .devices
+            .iter()
+            .find(|current| current.device_id == device.device_id)
+        {
+            *device = current.clone();
+        } else {
+            device.presence = PresenceView::Unavailable;
+            device.battery.availability = BatteryAvailability::Unavailable;
+        }
+    }
+    for device in &live.devices {
+        if !receiver
+            .devices
+            .iter()
+            .any(|retained| retained.device_id == device.device_id)
+        {
+            receiver.devices.push(device.clone());
+        }
+    }
+}
+
+fn receiver_identity_matches(
+    receiver: &ReceiverView,
+    run: &LifecycleRunState,
+    allow_missing_devices: bool,
+) -> bool {
+    if receiver.receiver_id != run.receiver.receiver_id
+        || receiver.profile != run.receiver.profile
+        || receiver.devices.iter().any(|device| {
+            run.receiver
+                .devices
+                .iter()
+                .find(|expected| expected.device_id == device.device_id)
+                .is_none_or(|expected| {
+                    expected.kind != device.kind
+                        || expected.product_id != device.product_id
+                        || expected.profile != device.profile
+                })
+        })
+    {
+        return false;
+    }
+    allow_missing_devices
+        || run
+            .receiver
+            .devices
+            .iter()
+            .all(|expected| receiver_has_exact_device(receiver, expected))
+}
+
+fn receiver_has_exact_device(receiver: &ReceiverView, expected: &crate::DeviceView) -> bool {
+    receiver.devices.iter().any(|device| {
+        device.device_id == expected.device_id
+            && device.kind == expected.kind
+            && device.product_id == expected.product_id
+            && device.profile == expected.profile
+    })
+}
+
+fn device_departure_checkpoint(run: &LifecycleRunState) -> StageCheckpoint {
+    let has_siblings = run.plans.len() > 1;
+    StageCheckpoint {
+        checkpoint_id: "device-departure".to_owned(),
+        instructions: vec![
+            "Power off the selected controller or allow it to enter its normal sleep state. Keep every sibling controller awake."
+                .to_owned(),
+            "Wait until the selected controller is unlit, then record this checkpoint once."
+                .to_owned(),
+        ],
+        observations: lifecycle_observations(
+            "Is the selected controller asleep or powered off?",
+            has_siblings,
+        ),
+        evidence_refs: run
+            .active
+            .as_ref()
+            .expect("active lifecycle stage exists")
+            .evidence_refs
+            .clone(),
+    }
+}
+
+fn device_return_checkpoint(evidence_refs: Vec<String>, has_siblings: bool) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "device-return".to_owned(),
+        instructions: vec![
+            "Wake or power on the selected controller and exercise its ordinary controls."
+                .to_owned(),
+            "Wait for its saved solid-blue state to return, then record this checkpoint once."
+                .to_owned(),
+        ],
+        observations: lifecycle_observations(
+            "Did the selected controller return with solid blue lighting?",
+            has_siblings,
+        ),
+        evidence_refs,
+    }
+}
+
+fn receiver_departure_checkpoint(evidence_refs: Vec<String>) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "receiver-departure".to_owned(),
+        instructions: vec![
+            "Unplug only the HyperFlux receiver. The retained campaign will remain visible while its generation is absent."
+                .to_owned(),
+            "After the receiver and both controller routes disappear, record this checkpoint once."
+                .to_owned(),
+        ],
+        observations: vec![physical_observation(
+            "Was the exact HyperFlux receiver physically unplugged?",
+        )],
+        evidence_refs,
+    }
+}
+
+fn receiver_return_checkpoint(evidence_refs: Vec<String>, has_siblings: bool) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "receiver-return".to_owned(),
+        instructions: vec![
+            "Replug the receiver, wake every paired qualified controller, and exercise the selected controller."
+                .to_owned(),
+            "Wait for a newer generation and the saved solid-blue state, then record this checkpoint once."
+                .to_owned(),
+        ],
+        observations: lifecycle_observations(
+            "Did the selected controller return with solid blue lighting on the renewed receiver?",
+            has_siblings,
+        ),
+        evidence_refs,
+    }
+}
+
+fn system_suspend_checkpoint(evidence_refs: Vec<String>) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "system-suspend-authorization".to_owned(),
+        instructions: vec![
+            "Save unrelated work. The next action requests exactly one system suspend and never repeats it automatically."
+                .to_owned(),
+            "Wake the computer normally after it suspends; the private checkpoint survives the request."
+                .to_owned(),
+        ],
+        observations: Vec::new(),
+        evidence_refs,
+    }
+}
+
+fn system_resume_checkpoint(evidence_refs: Vec<String>, has_siblings: bool) -> StageCheckpoint {
+    StageCheckpoint {
+        checkpoint_id: "system-resume-observation".to_owned(),
+        instructions: vec![
+            "A same-boot suspend gap and restored receiver route were detected. Exercise both controllers once."
+                .to_owned(),
+            "Confirm the selected controller's saved solid-blue state and sibling isolation."
+                .to_owned(),
+        ],
+        observations: lifecycle_observations(
+            "Did solid blue return on the selected controller after resume?",
+            has_siblings,
+        ),
+        evidence_refs,
+    }
+}
+
+fn lifecycle_observations(prompt: &str, has_siblings: bool) -> Vec<crate::ObservationPrompt> {
+    let mut prompts = vec![physical_observation(prompt), controls_observation()];
+    if has_siblings {
+        prompts.push(crate::ObservationPrompt {
+            id: "siblings".to_owned(),
+            prompt: "Did every sibling controller remain isolated and responsive?".to_owned(),
+            choices: choices("Siblings remained correct", "A sibling changed"),
+        });
+    }
+    prompts
+}
+
+fn physical_observation(prompt: &str) -> crate::ObservationPrompt {
+    crate::ObservationPrompt {
+        id: "physical".to_owned(),
+        prompt: prompt.to_owned(),
+        choices: choices("Physical state matches", "Physical state differs"),
+    }
+}
+
+fn controls_observation() -> crate::ObservationPrompt {
+    crate::ObservationPrompt {
+        id: "controls".to_owned(),
+        prompt: "Do all available controllers' ordinary controls still work correctly?".to_owned(),
+        choices: choices("Controls work", "A control changed"),
+    }
+}
+
+fn choices(pass: &str, fail: &str) -> Vec<crate::ObservationChoice> {
+    vec![
+        crate::ObservationChoice {
+            id: "pass".to_owned(),
+            label: pass.to_owned(),
+            outcome: "pass".to_owned(),
+        },
+        crate::ObservationChoice {
+            id: "fail".to_owned(),
+            label: fail.to_owned(),
+            outcome: "fail".to_owned(),
+        },
+        crate::ObservationChoice {
+            id: "unclear".to_owned(),
+            label: "Unclear".to_owned(),
+            outcome: "unclear".to_owned(),
+        },
+    ]
+}
+
+fn awaiting(checkpoint: StageCheckpoint) -> RunnerTransition {
+    RunnerTransition {
+        progress: StageProgress {
+            status: StageStatus::AwaitingObservation,
+            result: None,
+            checkpoint: Some(checkpoint),
+        },
+        hardware_write_executed: false,
+    }
+}
+
+fn finished(status: StageStatus, summary: &str, evidence_refs: Vec<String>) -> RunnerTransition {
+    RunnerTransition {
+        progress: StageProgress {
+            status,
+            result: Some(StageResult {
+                summary: summary.to_owned(),
+                completed_at: qualification_generated_at(),
+                evidence_refs,
+            }),
+            checkpoint: None,
+        },
+        hardware_write_executed: false,
+    }
+}
+
+fn cursor_evidence(view: &hfx_protocol::IntegrationView) -> String {
+    let encoded = serde_json::to_vec(&view.cursor).unwrap_or_default();
+    format!("bridge-cursor-sha256:{}", digest_hex(&encoded))
+}
+
+fn clock_milliseconds(clock: ClockId) -> Result<u64, LifecycleRunnerError> {
+    let stamp = clock_gettime(clock);
+    let seconds = u64::try_from(stamp.tv_sec).map_err(|_| {
+        LifecycleRunnerError::new("A required Linux lifecycle clock is unavailable.")
+    })?;
+    let nanos = u64::try_from(stamp.tv_nsec).map_err(|_| {
+        LifecycleRunnerError::new("A required Linux lifecycle clock is unavailable.")
+    })?;
+    seconds
+        .checked_mul(1_000)
+        .and_then(|value| value.checked_add(nanos / 1_000_000))
+        .ok_or_else(|| LifecycleRunnerError::new("A Linux lifecycle clock overflowed."))
+}
+
+fn digest_hex(value: &[u8]) -> String {
+    let digest = Sha256::digest(value);
+    let mut encoded = String::with_capacity(64);
+    for byte in digest {
+        use std::fmt::Write as _;
+        write!(&mut encoded, "{byte:02x}").expect("writing to a string cannot fail");
+    }
+    encoded
+}
+
+fn valid_digest(value: &str) -> bool {
+    value.len() == 64 && value.bytes().all(|byte| byte.is_ascii_hexdigit())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::path::PathBuf;
+
+    fn fixture_path(name: &str) -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("../../apps/device-qualification/tests/fixtures")
+            .join(name)
+    }
+
+    fn fixture_view(name: &str, prerequisites_passed: bool) -> QualificationView {
+        let mut view: QualificationView = serde_json::from_slice(
+            &fs::read(fixture_path(name)).expect("qualification fixture reads"),
+        )
+        .expect("qualification fixture parses");
+        if prerequisites_passed {
+            for group in view.plans.iter_mut().flat_map(|plan| &mut plan.groups) {
+                for stage in &mut group.stages {
+                    stage.status = if group.group_id == "lifecycle" {
+                        StageStatus::Ready
+                    } else {
+                        StageStatus::Passed
+                    };
+                }
+            }
+        }
+        view
+    }
+
+    fn lifecycle_stage(view: &QualificationView, device_id: &str) -> QualificationStage {
+        view.plans
+            .iter()
+            .find(|plan| plan.device_id == device_id)
+            .expect("device plan exists")
+            .groups
+            .iter()
+            .find(|group| group.group_id == "lifecycle")
+            .expect("lifecycle group exists")
+            .stages[0]
+            .clone()
+    }
+
+    fn observed_device(
+        run: &LifecycleRunState,
+        device_id: &str,
+        availability: InventoryAvailability,
+        controller_ready: bool,
+    ) -> ObservedDevice {
+        let expected = expected_device(run, device_id).expect("expected device exists");
+        ObservedDevice {
+            device_id: device_id.to_owned(),
+            profile: expected.profile.clone(),
+            availability,
+            controller_ready,
+        }
+    }
+
+    fn observation(
+        run: &LifecycleRunState,
+        selected_device_id: &str,
+        generation_id: u64,
+        selected_availability: InventoryAvailability,
+        selected_ready: bool,
+    ) -> LifecycleObservation {
+        LifecycleObservation {
+            receiver_id: run.receiver.receiver_id.clone(),
+            receiver_present: true,
+            generation_id: Some(generation_id),
+            receiver_profile: run.receiver.profile.clone(),
+            receiver_lifecycle: Some(ReceiverLifecycleState::Active),
+            stable_restore_enabled: true,
+            restore_state: Some(RestoreState::Succeeded),
+            selected: Some(observed_device(
+                run,
+                selected_device_id,
+                selected_availability,
+                selected_ready,
+            )),
+            siblings: run
+                .plans
+                .iter()
+                .filter(|plan| plan.device_id != selected_device_id)
+                .map(|plan| {
+                    observed_device(run, &plan.device_id, InventoryAvailability::Available, true)
+                })
+                .collect(),
+            cursor_ref: Some("bridge-cursor-sha256:test".to_owned()),
+        }
+    }
+
+    fn absent_receiver(run: &LifecycleRunState) -> LifecycleObservation {
+        LifecycleObservation {
+            receiver_id: run.receiver.receiver_id.clone(),
+            receiver_present: false,
+            generation_id: None,
+            receiver_profile: None,
+            receiver_lifecycle: None,
+            stable_restore_enabled: false,
+            restore_state: None,
+            selected: None,
+            siblings: Vec::new(),
+            cursor_ref: Some("bridge-cursor-sha256:absent".to_owned()),
+        }
+    }
+
+    fn unwrap_record(action: PreparedLifecycleAction) -> (LifecycleRunState, RunnerTransition) {
+        match action {
+            PreparedLifecycleAction::Record { run, transition } => (run, transition),
+            PreparedLifecycleAction::Suspend { .. } => panic!("record action expected"),
+        }
+    }
+
+    fn unwrap_suspend(action: PreparedLifecycleAction) -> (LifecycleRunState, RunnerTransition) {
+        match action {
+            PreparedLifecycleAction::Suspend { run, transition } => (run, transition),
+            PreparedLifecycleAction::Record { .. } => panic!("suspend action expected"),
+        }
+    }
+
+    fn start_stage(device_id: &str) -> (LifecycleRunState, QualificationStage, RunnerTransition) {
+        let view = fixture_view("rust-qualified-pair.json", true);
+        let stage = lifecycle_stage(&view, device_id);
+        let run = capture_lifecycle_run(&view, &stage).expect("campaign captures");
+        let ready = observation(
+            &run,
+            device_id,
+            run.receiver.generation_id,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, transition) = start_lifecycle_stage(run, &stage, &ready).expect("stage starts");
+        (run, stage, transition)
+    }
+
+    fn advance_to_device_return(
+        run: LifecycleRunState,
+        stage: &QualificationStage,
+        progress: &StageProgress,
+    ) -> (LifecycleRunState, RunnerTransition) {
+        let generation = run.receiver.generation_id;
+        let device_id = run
+            .active
+            .as_ref()
+            .expect("stage is active")
+            .device_id
+            .clone();
+        let departure = observation(
+            &run,
+            &device_id,
+            generation,
+            InventoryAvailability::Sleeping,
+            false,
+        );
+        unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                stage,
+                progress,
+                ObservationVerdict::Pass,
+                &departure,
+            )
+            .expect("departure records"),
+        )
+    }
+
+    #[test]
+    fn campaign_requires_every_non_lifecycle_prerequisite() {
+        let view = fixture_view("rust-qualified-pair.json", false);
+        let stage = lifecycle_stage(&view, "mouse-test");
+        let error = capture_lifecycle_run(&view, &stage).expect_err("prerequisites must gate");
+        assert!(error.to_string().contains("identity and lighting"));
+    }
+
+    #[test]
+    fn mouse_lifecycle_accepts_only_a_newer_profile_bound_generation() {
+        let (run, stage, departure) = start_stage("mouse-test");
+        assert_eq!(
+            departure
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("departure checkpoint")
+                .checkpoint_id,
+            "device-departure"
+        );
+        let (run, device_return) = advance_to_device_return(run, &stage, &departure.progress);
+        let ready = observation(
+            &run,
+            "mouse-test",
+            7,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, receiver_departure) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &device_return.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("device return records"),
+        );
+        let absent = absent_receiver(&run);
+        let (run, receiver_return) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &receiver_departure.progress,
+                ObservationVerdict::Pass,
+                &absent,
+            )
+            .expect("receiver departure records"),
+        );
+
+        let same_generation = observation(
+            &run,
+            "mouse-test",
+            7,
+            InventoryAvailability::Available,
+            true,
+        );
+        assert!(
+            prepare_lifecycle_checkpoint(
+                run.clone(),
+                &stage,
+                &receiver_return.progress,
+                ObservationVerdict::Pass,
+                &same_generation,
+            )
+            .is_err()
+        );
+
+        let mut wrong_profile = observation(
+            &run,
+            "mouse-test",
+            8,
+            InventoryAvailability::Available,
+            true,
+        );
+        wrong_profile
+            .receiver_profile
+            .as_mut()
+            .expect("profile exists")
+            .digest = "0".repeat(64);
+        assert!(
+            prepare_lifecycle_checkpoint(
+                run.clone(),
+                &stage,
+                &receiver_return.progress,
+                ObservationVerdict::Pass,
+                &wrong_profile,
+            )
+            .is_err()
+        );
+
+        let renewed = observation(
+            &run,
+            "mouse-test",
+            8,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, completed) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &receiver_return.progress,
+                ObservationVerdict::Pass,
+                &renewed,
+            )
+            .expect("new generation records"),
+        );
+        assert_eq!(completed.progress.status, StageStatus::Passed);
+        assert_eq!(run.generation_history, vec![7, 8]);
+        assert_eq!(run.receiver.generation_id, 8);
+        assert!(run.active.is_none());
+        run.validate().expect("completed run remains valid");
+    }
+
+    #[test]
+    fn sibling_loss_blocks_selected_device_departure() {
+        let (run, stage, departure) = start_stage("mouse-test");
+        let mut sleeping = observation(
+            &run,
+            "mouse-test",
+            7,
+            InventoryAvailability::Sleeping,
+            false,
+        );
+        sleeping.siblings[0].controller_ready = false;
+        assert!(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &departure.progress,
+                ObservationVerdict::Pass,
+                &sleeping,
+            )
+            .is_err()
+        );
+    }
+
+    #[test]
+    fn failed_or_unclear_observation_finishes_without_replay() {
+        for (verdict, expected) in [
+            (ObservationVerdict::Fail, StageStatus::Failed),
+            (ObservationVerdict::Unclear, StageStatus::Blocked),
+        ] {
+            let (run, stage, departure) = start_stage("mouse-test");
+            let ready = observation(
+                &run,
+                "mouse-test",
+                7,
+                InventoryAvailability::Available,
+                true,
+            );
+            let (run, transition) = unwrap_record(
+                prepare_lifecycle_checkpoint(run, &stage, &departure.progress, verdict, &ready)
+                    .expect("terminal observation records"),
+            );
+            assert_eq!(transition.progress.status, expected);
+            assert!(!transition.hardware_write_executed);
+            assert!(run.active.is_none());
+        }
+    }
+
+    #[test]
+    fn keyboard_suspend_is_separately_authorized_and_same_boot_bound() {
+        let (run, stage, departure) = start_stage("keyboard-test");
+        let (run, device_return) = advance_to_device_return(run, &stage, &departure.progress);
+        let ready = observation(
+            &run,
+            "keyboard-test",
+            7,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, authorization) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &device_return.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("device return reaches suspend authorization"),
+        );
+        assert_eq!(
+            authorization
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("authorization checkpoint")
+                .checkpoint_id,
+            "system-suspend-authorization"
+        );
+        assert!(
+            authorization
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("authorization checkpoint")
+                .observations
+                .is_empty()
+        );
+
+        let (suspended, pending) = unwrap_suspend(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &authorization.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("suspend checkpoint prepares"),
+        );
+        assert_eq!(
+            pending
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("pending checkpoint")
+                .checkpoint_id,
+            "system-resume-pending"
+        );
+        let baseline = suspended
+            .active
+            .as_ref()
+            .and_then(|active| active.suspend_stamp.clone())
+            .expect("suspend stamp exists");
+
+        let reboot_stamp = SuspendStamp {
+            boot_id_sha256: digest_hex(b"different-boot"),
+            suspend_gap_ms: baseline.suspend_gap_ms + MINIMUM_SUSPEND_GAP_MS,
+        };
+        let (blocked_run, blocked) =
+            reconcile_system_resume(suspended.clone(), &ready, &reboot_stamp)
+                .expect("reboot is a recorded block")
+                .expect("reboot yields a transition");
+        assert_eq!(blocked.progress.status, StageStatus::Blocked);
+        assert!(blocked_run.active.is_none());
+
+        let resume_stamp = SuspendStamp {
+            boot_id_sha256: baseline.boot_id_sha256,
+            suspend_gap_ms: baseline.suspend_gap_ms + MINIMUM_SUSPEND_GAP_MS,
+        };
+        let (run, resume) = reconcile_system_resume(suspended, &ready, &resume_stamp)
+            .expect("resume reconciles")
+            .expect("measured gap yields a checkpoint");
+        assert_eq!(
+            resume
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("resume checkpoint")
+                .checkpoint_id,
+            "system-resume-observation"
+        );
+        let (run, completed) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &resume.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("resume observation records"),
+        );
+        assert_eq!(completed.progress.status, StageStatus::Passed);
+        assert!(run.active.is_none());
+    }
+
+    #[test]
+    fn retained_campaign_keeps_the_expected_identity_visible_while_absent() {
+        let (mut run, _, _) = start_stage("mouse-test");
+        run.active.as_mut().expect("stage is active").phase = LifecyclePhase::ReceiverReturn;
+        let mut view = fixture_view("rust-qualified-pair.json", true);
+        view.receivers.clear();
+        view.plans.clear();
+        view.companion.state = CompanionState::NoReceiver;
+        overlay_lifecycle_run(&mut view, &run);
+        assert_eq!(view.companion.state, CompanionState::LifecycleTransition);
+        assert_eq!(view.receivers.len(), 1);
+        assert_eq!(view.plans.len(), 2);
+        assert!(
+            view.receivers[0]
+                .devices
+                .iter()
+                .all(|device| device.presence == PresenceView::Unavailable)
+        );
+    }
+
+    #[test]
+    fn single_controller_campaign_never_prompts_about_siblings() {
+        let view = fixture_view("rust-qualified-mouse.json", true);
+        let stage = lifecycle_stage(&view, "mouse-test");
+        let run = capture_lifecycle_run(&view, &stage).expect("campaign captures");
+        let ready = observation(
+            &run,
+            "mouse-test",
+            7,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, departure) = start_lifecycle_stage(run, &stage, &ready).expect("stage starts");
+        assert!(
+            departure
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("departure checkpoint")
+                .observations
+                .iter()
+                .all(|prompt| prompt.id != "siblings")
+        );
+        let (run, device_return) = advance_to_device_return(run, &stage, &departure.progress);
+        assert!(
+            device_return
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("return checkpoint")
+                .observations
+                .iter()
+                .all(|prompt| prompt.id != "siblings")
+        );
+        let ready = observation(
+            &run,
+            "mouse-test",
+            run.receiver.generation_id,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, receiver_departure) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &device_return.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("device return records"),
+        );
+        let absent = absent_receiver(&run);
+        let (run, receiver_return) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &receiver_departure.progress,
+                ObservationVerdict::Pass,
+                &absent,
+            )
+            .expect("receiver departure records"),
+        );
+        assert!(
+            receiver_return
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("receiver return checkpoint")
+                .observations
+                .iter()
+                .all(|prompt| prompt.id != "siblings")
+        );
+        run.validate().expect("single-device run remains valid");
+    }
+
+    #[test]
+    fn unrelated_receivers_do_not_invalidate_a_bound_campaign() {
+        let mut view = fixture_view("rust-qualified-pair.json", true);
+        let stage = lifecycle_stage(&view, "mouse-test");
+        let mut run = capture_lifecycle_run(&view, &stage).expect("campaign captures");
+        let mut unrelated = view.receivers[0].clone();
+        unrelated.receiver_id = "receiver-unrelated".to_owned();
+        view.receivers.insert(0, unrelated.clone());
+        assert!(identity_transition_matches(&view, &run));
+
+        run.active = Some(LifecycleStageState {
+            stage_id: stage.stage_id,
+            device_id: "mouse-test".to_owned(),
+            device_kind: "mouse".to_owned(),
+            phase: LifecyclePhase::ReceiverReturn,
+            baseline_generation_id: run.receiver.generation_id,
+            evidence_refs: Vec::new(),
+            suspend_stamp: None,
+        });
+        view.receivers = vec![unrelated];
+        assert!(identity_transition_matches(&view, &run));
+    }
+
+    #[test]
+    fn malformed_saved_runs_cannot_cross_bind_a_stage_or_generation() {
+        let (mut run, _, _) = start_stage("mouse-test");
+        run.active.as_mut().expect("stage is active").device_id = "keyboard-test".to_owned();
+        assert!(run.validate().is_err());
+
+        let (mut run, _, _) = start_stage("mouse-test");
+        run.generation_history = vec![7, 7];
+        assert!(run.validate().is_err());
+    }
+}
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index 3070da4..a465c3a 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -1,6 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::qualification::{StageProgress, apply_stage_results};
+use crate::qualification_lifecycle::{
+    PreparedLifecycleAction, capture_lifecycle_run, current_suspend_stamp,
+    identity_transition_matches, observe_lifecycle, overlay_lifecycle_run,
+    prepare_lifecycle_checkpoint, reconcile_system_resume, start_lifecycle_stage,
+};
 use crate::qualification_runner::{
     ObservationVerdict, PreparedLightingAction, new_transaction_id, prepare_lighting_checkpoint,
     prepare_lighting_stage, reconcile_pending_lighting,
@@ -234,16 +239,23 @@ fn live_view(
         RunnerCapabilities {
             read_only_actions: RunnerAvailability::Available,
             supervised_lighting: RunnerAvailability::Available,
-            ..RunnerCapabilities::default()
+            device_lifecycle: RunnerAvailability::Available,
+            system_lifecycle: RunnerAvailability::Available,
         },
         state.revision.max(1),
         qualification_generated_at(),
     );
     let fingerprint = identity_fingerprint(&view)?;
-    let mut changed = refresh_identity_binding(state, fingerprint);
+    let mut changed = refresh_identity_binding(state, fingerprint, &view);
     if reconcile_pending(probe, &view, state) {
         changed = true;
     }
+    if reconcile_lifecycle_resume_state(integration.as_ref(), state) {
+        changed = true;
+    }
+    if let Some(run) = &state.lifecycle_run {
+        overlay_lifecycle_run(&mut view, run);
+    }
     view.view_revision = state.revision;
     apply_stage_results(&mut view, &state.results, state.run_id.as_deref());
     view.companion.hardware_write_executed = state.hardware_write_executed;
@@ -253,7 +265,11 @@ fn live_view(
     Ok(view)
 }
 
-fn refresh_identity_binding(state: &mut ServerState, fingerprint: [u8; 32]) -> bool {
+fn refresh_identity_binding(
+    state: &mut ServerState,
+    fingerprint: [u8; 32],
+    view: &QualificationView,
+) -> bool {
     match state.identity_fingerprint {
         None => {
             state.revision = 1;
@@ -261,10 +277,19 @@ fn refresh_identity_binding(state: &mut ServerState, fingerprint: [u8; 32]) -> b
             true
         }
         Some(previous) if previous != fingerprint => {
+            if state
+                .lifecycle_run
+                .as_ref()
+                .is_some_and(|run| identity_transition_matches(view, run))
+            {
+                state.identity_fingerprint = Some(fingerprint);
+                return true;
+            }
             state.revision = state.revision.saturating_add(1);
             state.identity_fingerprint = Some(fingerprint);
             state.run_id = None;
             state.results.clear();
+            state.lifecycle_run = None;
             if let Some(pending) = &state.pending_transaction {
                 state.results.insert(
                     pending.stage_id.clone(),
@@ -281,6 +306,31 @@ fn refresh_identity_binding(state: &mut ServerState, fingerprint: [u8; 32]) -> b
     }
 }
 
+fn reconcile_lifecycle_resume_state(
+    integration: Option<&crate::BridgeIntegration>,
+    session: &mut ServerState,
+) -> bool {
+    let Some(run) = session.lifecycle_run.clone() else {
+        return false;
+    };
+    let Some(active) = &run.active else {
+        return false;
+    };
+    let stage_id = active.stage_id.clone();
+    let device_id = active.device_id.clone();
+    let observation = observe_lifecycle(integration, &run, &device_id);
+    let Ok(stamp) = current_suspend_stamp() else {
+        return false;
+    };
+    let Ok(Some((run, transition))) = reconcile_system_resume(run, &observation, &stamp) else {
+        return false;
+    };
+    session.lifecycle_run = Some(run);
+    session.results.insert(stage_id, transition.progress);
+    session.revision = session.revision.saturating_add(1);
+    true
+}
+
 fn reconcile_pending(
     probe: &RealSystemProbe,
     view: &QualificationView,
@@ -458,11 +508,125 @@ fn apply_action(
         RiskLevel::LightingWrite => {
             apply_lighting_action(probe, view, stage, input, state_file, session)
         }
-        RiskLevel::DeviceLifecycle | RiskLevel::SystemLifecycle => Err(ActionFailure::unchanged(
-            HttpStatus::NotImplemented,
-            "The supervised lifecycle runner is not installed; no hardware action was requested.",
-        )),
+        RiskLevel::DeviceLifecycle | RiskLevel::SystemLifecycle => {
+            apply_lifecycle_action(probe, view, stage, input, state_file, session)
+        }
+    }
+}
+
+fn apply_lifecycle_action(
+    probe: &RealSystemProbe,
+    view: &QualificationView,
+    stage: &QualificationStage,
+    input: &ActionInput,
+    state_file: &Path,
+    session: &mut ServerState,
+) -> Result<(), ActionFailure> {
+    let run = match &session.lifecycle_run {
+        Some(run) => run.clone(),
+        None => capture_lifecycle_run(view, stage)
+            .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?,
+    };
+    let selected_device_id = run
+        .active
+        .as_ref()
+        .map(|active| active.device_id.clone())
+        .or_else(|| device_id_for_stage(view, stage).map(str::to_owned))
+        .ok_or_else(|| {
+            ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "The lifecycle stage has no exact selected controller.",
+            )
+        })?;
+    let integration = probe.qualification_integration().ok();
+    let observation = observe_lifecycle(integration.as_ref(), &run, &selected_device_id);
+    let prepared = if stage.status == StageStatus::Ready {
+        let (run, transition) = start_lifecycle_stage(run, stage, &observation)
+            .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?;
+        PreparedLifecycleAction::Record { run, transition }
+    } else if stage.status == StageStatus::AwaitingObservation {
+        let verdict = observation_verdict(stage, input)
+            .map_err(|message| ActionFailure::unchanged(HttpStatus::BadRequest, message))?;
+        let current = session.results.get(&stage.stage_id).ok_or_else(|| {
+            ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "The watched lifecycle checkpoint is no longer available.",
+            )
+        })?;
+        prepare_lifecycle_checkpoint(run, stage, current, verdict, &observation)
+            .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?
+    } else {
+        return Err(ActionFailure::unchanged(
+            HttpStatus::Conflict,
+            "This lifecycle stage is not at a runnable checkpoint.",
+        ));
+    };
+    commit_lifecycle_action(prepared, probe, stage, state_file, session)
+}
+
+fn commit_lifecycle_action(
+    prepared: PreparedLifecycleAction,
+    probe: &RealSystemProbe,
+    stage: &QualificationStage,
+    state_file: &Path,
+    session: &mut ServerState,
+) -> Result<(), ActionFailure> {
+    let (run, transition, requests_suspend) = match prepared {
+        PreparedLifecycleAction::Record { run, transition } => (run, transition, false),
+        PreparedLifecycleAction::Suspend { run, transition } => (run, transition, true),
+    };
+    let previous_run = session.lifecycle_run.clone();
+    let previous_progress = session.results.get(&stage.stage_id).cloned();
+    session.lifecycle_run = Some(run);
+    session
+        .results
+        .insert(stage.stage_id.clone(), transition.progress);
+    if !requests_suspend {
+        return Ok(());
+    }
+    if save_state(state_file, session).is_err() {
+        restore_lifecycle_state(session, &stage.stage_id, previous_run, previous_progress);
+        return Err(ActionFailure::unchanged(
+            HttpStatus::Conflict,
+            "The private resume checkpoint could not be committed; suspend was not requested.",
+        ));
     }
+    if probe.request_system_suspend().is_err() {
+        restore_lifecycle_state(session, &stage.stage_id, previous_run, previous_progress);
+        let _ = save_state(state_file, session);
+        return Err(ActionFailure::unchanged(
+            HttpStatus::Conflict,
+            "The operating system rejected the single suspend request.",
+        ));
+    }
+    Ok(())
+}
+
+fn restore_lifecycle_state(
+    session: &mut ServerState,
+    stage_id: &str,
+    previous_run: Option<crate::qualification_lifecycle::LifecycleRunState>,
+    previous_progress: Option<StageProgress>,
+) {
+    session.lifecycle_run = previous_run;
+    if let Some(progress) = previous_progress {
+        session.results.insert(stage_id.to_owned(), progress);
+    } else {
+        session.results.remove(stage_id);
+    }
+}
+
+fn device_id_for_stage<'a>(
+    view: &'a QualificationView,
+    stage: &QualificationStage,
+) -> Option<&'a str> {
+    view.plans.iter().find_map(|plan| {
+        plan.groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .any(|candidate| candidate.stage_id == stage.stage_id)
+            .then_some(plan.device_id.as_str())
+    })
 }
 
 fn record_read_only_result(
@@ -955,7 +1119,6 @@ enum HttpStatus {
     Conflict,
     RequestTooLarge,
     UnsupportedMediaType,
-    NotImplemented,
 }
 
 impl HttpStatus {
@@ -969,7 +1132,6 @@ impl HttpStatus {
             Self::Conflict => "409 Conflict",
             Self::RequestTooLarge => "413 Content Too Large",
             Self::UnsupportedMediaType => "415 Unsupported Media Type",
-            Self::NotImplemented => "501 Not Implemented",
         }
     }
 }
@@ -1025,6 +1187,13 @@ fn write_response(
 mod tests {
     use super::*;
 
+    fn qualification_fixture(name: &str) -> QualificationView {
+        let fixture = Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../../apps/device-qualification/tests/fixtures")
+            .join(name);
+        serde_json::from_slice(&fs::read(fixture).expect("fixture reads")).expect("fixture parses")
+    }
+
     fn pending_transaction() -> crate::qualification_runner::PendingLightingTransaction {
         crate::qualification_runner::PendingLightingTransaction {
             stage_id: "mouse-test-lighting".to_owned(),
@@ -1138,7 +1307,11 @@ mod tests {
             hardware_write_executed: true,
             ..ServerState::default()
         };
-        assert!(refresh_identity_binding(&mut state, [2_u8; 32]));
+        assert!(refresh_identity_binding(
+            &mut state,
+            [2_u8; 32],
+            &qualification_fixture("rust-qualified-mouse.json"),
+        ));
         assert_eq!(state.results.len(), 1);
         assert_eq!(
             state.results["mouse-test-lighting"].status,
@@ -1151,11 +1324,7 @@ mod tests {
 
     #[test]
     fn identity_fingerprint_ignores_inventory_order() {
-        let fixture = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("../../apps/device-qualification/tests/fixtures/rust-qualified-pair.json");
-        let mut view: QualificationView =
-            serde_json::from_slice(&fs::read(fixture).expect("fixture reads"))
-                .expect("fixture parses");
+        let mut view = qualification_fixture("rust-qualified-pair.json");
         let mut second = view.receivers[0].clone();
         second.receiver_id = "receiver-second".to_owned();
         second.generation_id = 11;
@@ -1171,6 +1340,69 @@ mod tests {
         );
     }
 
+    #[test]
+    fn lifecycle_binding_accepts_only_its_expected_profile_bound_generation() {
+        let mut view = qualification_fixture("rust-qualified-pair.json");
+        for group in view.plans.iter_mut().flat_map(|plan| &mut plan.groups) {
+            for stage in &mut group.stages {
+                stage.status = if group.group_id == "lifecycle" {
+                    StageStatus::Ready
+                } else {
+                    StageStatus::Passed
+                };
+            }
+        }
+        let lifecycle_stage = view.plans[0]
+            .groups
+            .iter()
+            .find(|group| group.group_id == "lifecycle")
+            .expect("lifecycle group")
+            .stages[0]
+            .clone();
+        let mut run = capture_lifecycle_run(&view, &lifecycle_stage).expect("run captures");
+        run.active = Some(crate::qualification_lifecycle::LifecycleStageState {
+            stage_id: lifecycle_stage.stage_id.clone(),
+            device_id: view.plans[0].device_id.clone(),
+            device_kind: "mouse".to_owned(),
+            phase: crate::qualification_lifecycle::LifecyclePhase::ReceiverReturn,
+            baseline_generation_id: 7,
+            evidence_refs: vec!["receiver-generation:7".to_owned()],
+            suspend_stamp: None,
+        });
+        run.validate().expect("run is valid");
+        let mut session = ServerState {
+            identity_fingerprint: Some(identity_fingerprint(&view).expect("fingerprint")),
+            run_id: Some("run-generation-7".to_owned()),
+            results: BTreeMap::from([(
+                lifecycle_stage.stage_id.clone(),
+                StageProgress {
+                    status: StageStatus::AwaitingObservation,
+                    result: None,
+                    checkpoint: None,
+                },
+            )]),
+            lifecycle_run: Some(run),
+            ..ServerState::default()
+        };
+
+        view.receivers[0].generation_id = 8;
+        let renewed = identity_fingerprint(&view).expect("renewed fingerprint");
+        assert!(refresh_identity_binding(&mut session, renewed, &view));
+        assert!(session.lifecycle_run.is_some());
+        assert!(!session.results.is_empty());
+
+        view.receivers[0].devices[0]
+            .profile
+            .as_mut()
+            .expect("profile exists")
+            .digest = "0".repeat(64);
+        let foreign = identity_fingerprint(&view).expect("foreign fingerprint");
+        assert!(refresh_identity_binding(&mut session, foreign, &view));
+        assert!(session.lifecycle_run.is_none());
+        assert!(session.results.is_empty());
+        assert!(session.run_id.is_none());
+    }
+
     #[test]
     fn watched_answers_are_exact_and_reduce_to_one_verdict() {
         let stage = QualificationStage {
diff --git a/crates/hfx-ops/src/qualification_state.rs b/crates/hfx-ops/src/qualification_state.rs
index c14aef9..e53c152 100644
--- a/crates/hfx-ops/src/qualification_state.rs
+++ b/crates/hfx-ops/src/qualification_state.rs
@@ -2,6 +2,7 @@
 
 use crate::probe::write_private_file;
 use crate::qualification::StageProgress;
+use crate::qualification_lifecycle::LifecycleRunState;
 use crate::qualification_runner::PendingLightingTransaction;
 use hfx_profiles::PROFILE_SOURCE_SHA256;
 use hfx_runtime::{LINUX_RUNTIME_SHA256, PRODUCT_VERSION};
@@ -14,7 +15,7 @@ use std::io;
 use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
 use std::path::{Path, PathBuf};
 
-const SESSION_SCHEMA: &str = "hyperflux-qualification-session-v1";
+const SESSION_SCHEMA: &str = "hyperflux-qualification-session-v2";
 const MAX_SESSION_BYTES: u64 = 256 * 1024;
 const MAX_STAGE_RESULTS: usize = 64;
 
@@ -31,6 +32,7 @@ pub(crate) struct QualificationSessionState {
     pub run_id: Option<String>,
     pub results: BTreeMap<String, StageProgress>,
     pub pending_transaction: Option<PendingLightingTransaction>,
+    pub lifecycle_run: Option<LifecycleRunState>,
     pub hardware_write_executed: bool,
 }
 
@@ -47,6 +49,7 @@ impl Default for QualificationSessionState {
             run_id: None,
             results: BTreeMap::new(),
             pending_transaction: None,
+            lifecycle_run: None,
             hardware_write_executed: false,
         }
     }
@@ -100,6 +103,13 @@ impl QualificationSessionState {
         {
             return Err(QualificationStateError::Invalid);
         }
+        if self
+            .lifecycle_run
+            .as_ref()
+            .is_some_and(|run| run.validate().is_err())
+        {
+            return Err(QualificationStateError::Invalid);
+        }
         Ok(())
     }
 }
@@ -227,6 +237,7 @@ fn temporary_path(path: &Path) -> PathBuf {
 fn coordinator_sha256() -> String {
     let mut digest = Sha256::new();
     digest.update(include_bytes!("qualification.rs"));
+    digest.update(include_bytes!("qualification_lifecycle.rs"));
     digest.update(include_bytes!("qualification_runner.rs"));
     digest.update(include_bytes!("qualification_server.rs"));
     digest.update(include_bytes!("qualification_state.rs"));

From 3c4d10b7b51ee27d4bee3ffbfa5d8ac49293d045 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 07:47:15 +0400
Subject: [PATCH 07/67] fix(packaging): allow bounded activation state access

---
 docs/generated/linux-runtime.md                         | 1 +
 packaging/generated/hyperflux-next-activation.service   | 2 +-
 packaging/generated/hyperflux-next-confirmation.service | 2 +-
 tests/test_linux_runtime.py                             | 3 +++
 tools/hfxdev/generators/linux_runtime.py                | 8 +++++++-
 5 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index 90ae7f2..f73c722 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -33,6 +33,7 @@ Canonical source digest: `6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc
 | Start confirmation | `hyperflux-next-confirmation.service` |
 
 The service owns receiver access. Application integrations use only the SDK socket. The default configuration is read-only and restoration is disabled until a user makes an explicit setup choice.
+The root-owned activation helper retains only `CAP_DAC_OVERRIDE`, bounded by systemd to the configuration and private state directories, so it can consume package-update checkpoints without weakening the bridge service sandbox.
 
 ## Kernel Activation
 
diff --git a/packaging/generated/hyperflux-next-activation.service b/packaging/generated/hyperflux-next-activation.service
index 407fc14..4dcd9ac 100644
--- a/packaging/generated/hyperflux-next-activation.service
+++ b/packaging/generated/hyperflux-next-activation.service
@@ -24,7 +24,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
-CapabilityBoundingSet=
+CapabilityBoundingSet=CAP_DAC_OVERRIDE
 AmbientCapabilities=
 ReadOnlyPaths=/usr/lib/hyperflux-next
 ReadWritePaths=/etc/hyperflux-next /var/lib/hyperflux-next
diff --git a/packaging/generated/hyperflux-next-confirmation.service b/packaging/generated/hyperflux-next-confirmation.service
index 80c862f..3301019 100644
--- a/packaging/generated/hyperflux-next-confirmation.service
+++ b/packaging/generated/hyperflux-next-confirmation.service
@@ -25,7 +25,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
-CapabilityBoundingSet=
+CapabilityBoundingSet=CAP_DAC_OVERRIDE
 AmbientCapabilities=
 ReadOnlyPaths=/usr/lib/hyperflux-next
 ReadWritePaths=/etc/hyperflux-next /var/lib/hyperflux-next
diff --git a/tests/test_linux_runtime.py b/tests/test_linux_runtime.py
index 95b2d3e..4b83f9f 100644
--- a/tests/test_linux_runtime.py
+++ b/tests/test_linux_runtime.py
@@ -154,6 +154,9 @@ def test_generated_linux_policy_is_hardened_and_non_activating(self) -> None:
             self.assertIn("ProtectSystem=strict", unit)
             self.assertIn(self.runtime.bridge.configuration_directory, unit)
             self.assertIn(self.runtime.bridge.state_directory, unit)
+            self.assertIn("CapabilityBoundingSet=CAP_DAC_OVERRIDE", unit)
+            self.assertIn("AmbientCapabilities=\n", unit)
+            self.assertNotIn("CAP_SYS_ADMIN", unit)
             self.assertNotIn("modprobe", unit)
 
         rules = udev_rules(self.runtime)
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 76ad545..43e7f65 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -334,7 +334,10 @@ def _activation_sandbox(runtime: LinuxRuntime) -> list[str]:
         "MemoryDenyWriteExecute=yes",
         "SystemCallArchitectures=native",
         "SystemCallFilter=@system-service",
-        "CapabilityBoundingSet=",
+        # The root helper must cross the bridge account's 0700 state directory
+        # to consume the root-owned package-update checkpoint. The writable
+        # path allowlist keeps this single DAC capability locally bounded.
+        "CapabilityBoundingSet=CAP_DAC_OVERRIDE",
         "AmbientCapabilities=",
         f"ReadOnlyPaths={private_directory}",
         f"ReadWritePaths={bridge.configuration_directory} {bridge.state_directory}",
@@ -508,6 +511,9 @@ def markdown(runtime: LinuxRuntime) -> str:
             "The service owns receiver access. Application integrations use only the SDK socket. "
             "The default configuration is read-only and restoration is disabled until a user makes "
             "an explicit setup choice.",
+            "The root-owned activation helper retains only `CAP_DAC_OVERRIDE`, bounded by systemd "
+            "to the configuration and private state directories, so it can consume package-update "
+            "checkpoints without weakening the bridge service sandbox.",
             "",
             "## Kernel Activation",
             "",

From 560f65a05232160568e707db0c56529f71d824c0 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:01:58 +0400
Subject: [PATCH 08/67] fix(packaging): permit read-only module inspection

---
 docs/generated/linux-runtime.md               |  1 +
 .../hyperflux-next-activation.service         |  5 ++--
 .../hyperflux-next-confirmation.service       |  1 +
 tests/test_linux_runtime.py                   |  6 +++++
 tools/hfxdev/generators/linux_runtime.py      | 24 ++++++++++++++-----
 5 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index f73c722..0cdb95a 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -34,6 +34,7 @@ Canonical source digest: `6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc
 
 The service owns receiver access. Application integrations use only the SDK socket. The default configuration is read-only and restoration is disabled until a user makes an explicit setup choice.
 The root-owned activation helper retains only `CAP_DAC_OVERRIDE`, bounded by systemd to the configuration and private state directories, so it can consume package-update checkpoints without weakening the bridge service sandbox.
+Start preparation may read installed module metadata to compare source versions, but module-management syscalls and `CAP_SYS_MODULE` remain unavailable.
 
 ## Kernel Activation
 
diff --git a/packaging/generated/hyperflux-next-activation.service b/packaging/generated/hyperflux-next-activation.service
index 4dcd9ac..6fc0aeb 100644
--- a/packaging/generated/hyperflux-next-activation.service
+++ b/packaging/generated/hyperflux-next-activation.service
@@ -16,7 +16,7 @@ ProtectHome=yes
 PrivateTmp=yes
 ProtectControlGroups=yes
 ProtectKernelTunables=yes
-ProtectKernelModules=yes
+ProtectKernelModules=no
 ProtectKernelLogs=yes
 RestrictAddressFamilies=AF_UNIX
 RestrictSUIDSGID=yes
@@ -24,7 +24,8 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
+SystemCallFilter=~@module
 CapabilityBoundingSet=CAP_DAC_OVERRIDE
 AmbientCapabilities=
-ReadOnlyPaths=/usr/lib/hyperflux-next
+ReadOnlyPaths=/usr/lib/hyperflux-next /usr/lib/modules
 ReadWritePaths=/etc/hyperflux-next /var/lib/hyperflux-next
diff --git a/packaging/generated/hyperflux-next-confirmation.service b/packaging/generated/hyperflux-next-confirmation.service
index 3301019..008e280 100644
--- a/packaging/generated/hyperflux-next-confirmation.service
+++ b/packaging/generated/hyperflux-next-confirmation.service
@@ -25,6 +25,7 @@ LockPersonality=yes
 MemoryDenyWriteExecute=yes
 SystemCallArchitectures=native
 SystemCallFilter=@system-service
+SystemCallFilter=~@module
 CapabilityBoundingSet=CAP_DAC_OVERRIDE
 AmbientCapabilities=
 ReadOnlyPaths=/usr/lib/hyperflux-next
diff --git a/tests/test_linux_runtime.py b/tests/test_linux_runtime.py
index 4b83f9f..8029735 100644
--- a/tests/test_linux_runtime.py
+++ b/tests/test_linux_runtime.py
@@ -156,9 +156,15 @@ def test_generated_linux_policy_is_hardened_and_non_activating(self) -> None:
             self.assertIn(self.runtime.bridge.state_directory, unit)
             self.assertIn("CapabilityBoundingSet=CAP_DAC_OVERRIDE", unit)
             self.assertIn("AmbientCapabilities=\n", unit)
+            self.assertIn("SystemCallFilter=~@module", unit)
+            self.assertNotIn("CAP_SYS_MODULE", unit)
             self.assertNotIn("CAP_SYS_ADMIN", unit)
             self.assertNotIn("modprobe", unit)
 
+        self.assertIn("ProtectKernelModules=no", prepare)
+        self.assertIn("ReadOnlyPaths=/usr/lib/hyperflux-next /usr/lib/modules", prepare)
+        self.assertIn("ProtectKernelModules=yes", confirm)
+
         rules = udev_rules(self.runtime)
         self.assertIn('MODE="0660"', rules)
         self.assertNotIn('MODE="0666"', rules)
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 43e7f65..4d2f863 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -313,10 +313,18 @@ def systemd_service(runtime: LinuxRuntime) -> str:
     )
 
 
-def _activation_sandbox(runtime: LinuxRuntime) -> list[str]:
+def _activation_sandbox(
+    runtime: LinuxRuntime, *, inspect_installed_module: bool
+) -> list[str]:
     bridge = runtime.bridge
     private_directory = PurePosixPath(bridge.executable_path).parent
-    return [
+    read_only_paths = str(private_directory)
+    if inspect_installed_module:
+        # ProtectKernelModules hides /usr/lib/modules, but start preparation
+        # must compare installed and loaded srcversions. Module syscalls and
+        # CAP_SYS_MODULE remain unavailable, so this is metadata-only access.
+        read_only_paths += " /usr/lib/modules"
+    lines = [
         "User=root",
         "Group=root",
         "UMask=0077",
@@ -326,7 +334,7 @@ def _activation_sandbox(runtime: LinuxRuntime) -> list[str]:
         "PrivateTmp=yes",
         "ProtectControlGroups=yes",
         "ProtectKernelTunables=yes",
-        "ProtectKernelModules=yes",
+        f"ProtectKernelModules={'no' if inspect_installed_module else 'yes'}",
         "ProtectKernelLogs=yes",
         "RestrictAddressFamilies=AF_UNIX",
         "RestrictSUIDSGID=yes",
@@ -334,14 +342,16 @@ def _activation_sandbox(runtime: LinuxRuntime) -> list[str]:
         "MemoryDenyWriteExecute=yes",
         "SystemCallArchitectures=native",
         "SystemCallFilter=@system-service",
+        "SystemCallFilter=~@module",
         # The root helper must cross the bridge account's 0700 state directory
         # to consume the root-owned package-update checkpoint. The writable
         # path allowlist keeps this single DAC capability locally bounded.
         "CapabilityBoundingSet=CAP_DAC_OVERRIDE",
         "AmbientCapabilities=",
-        f"ReadOnlyPaths={private_directory}",
+        f"ReadOnlyPaths={read_only_paths}",
         f"ReadWritePaths={bridge.configuration_directory} {bridge.state_directory}",
     ]
+    return lines
 
 
 def activation_service(runtime: LinuxRuntime) -> str:
@@ -357,7 +367,7 @@ def activation_service(runtime: LinuxRuntime) -> str:
         "Type=oneshot",
         f"ExecStart={operations.activation_path} prepare-start",
     ]
-    lines.extend(_activation_sandbox(runtime))
+    lines.extend(_activation_sandbox(runtime, inspect_installed_module=True))
     lines.append("")
     return "\n".join(lines)
 
@@ -376,7 +386,7 @@ def confirmation_service(runtime: LinuxRuntime) -> str:
         "Type=oneshot",
         f"ExecStart={operations.activation_path} confirm-start",
     ]
-    lines.extend(_activation_sandbox(runtime))
+    lines.extend(_activation_sandbox(runtime, inspect_installed_module=False))
     lines.append("")
     return "\n".join(lines)
 
@@ -514,6 +524,8 @@ def markdown(runtime: LinuxRuntime) -> str:
             "The root-owned activation helper retains only `CAP_DAC_OVERRIDE`, bounded by systemd "
             "to the configuration and private state directories, so it can consume package-update "
             "checkpoints without weakening the bridge service sandbox.",
+            "Start preparation may read installed module metadata to compare source versions, but "
+            "module-management syscalls and `CAP_SYS_MODULE` remain unavailable.",
             "",
             "## Kernel Activation",
             "",

From 36805aa78e4867d467aefd8862c75a1490683ff7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:19:21 +0400
Subject: [PATCH 09/67] fix(ops): negotiate features per client

---
 crates/hfx-ops/src/probe.rs                | 87 ++++++++++++++++++----
 crates/hfx-ops/src/qualification_runner.rs | 10 +++
 2 files changed, 82 insertions(+), 15 deletions(-)

diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 746a32d..5dd88b6 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -20,6 +20,8 @@ use std::time::{Duration, Instant};
 const MAX_COMMAND_OUTPUT_BYTES: usize = 4_096;
 const MAX_USB_DEVICE_ENTRIES: usize = 256;
 const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
+const INTEGRATION_VIEW_FEATURE: &str = "integration-view-projection";
+const STRUCTURED_DIAGNOSTICS_FEATURE: &str = "structured-diagnostics";
 const LEGACY_V2_BRIDGE_SERVICE_UNIT: &str = "hyperflux-bridge.service";
 const LEGACY_V2_KERNEL_MODULE_NAME: &str = "hid-razer-hyperflux-v2";
 
@@ -334,6 +336,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         &self,
         client_id: &str,
         client_name: &str,
+        required_features: &[&str],
     ) -> Result<HyperFluxClient<UnixStream, KernelRequestIdentitySource>, ProbeError> {
         let stream =
             UnixStream::connect(&self.socket_path).map_err(|_| ProbeError::BridgeUnavailable)?;
@@ -345,24 +348,17 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             .map_err(|_| ProbeError::BridgeUnavailable)?;
         let version = ProtocolVersion::try_from(CURRENT_PROTOCOL_VERSION)
             .map_err(|_| ProbeError::BridgeUnavailable)?;
-        let config = SdkClientConfig {
-            client_id: ClientId::try_from(client_id).map_err(|_| ProbeError::BridgeUnavailable)?,
-            client_name: ClientName::try_from(client_name)
-                .map_err(|_| ProbeError::BridgeUnavailable)?,
-            minimum_version: version,
-            maximum_version: version,
-            required_features: vec![
-                ProtocolFeatureId::try_from("integration-view-projection")
-                    .map_err(|_| ProbeError::BridgeUnavailable)?,
-            ],
-            optional_features: Vec::new(),
-        };
+        let config = sdk_client_config(client_id, client_name, version, required_features)?;
         HyperFluxClient::connect(stream, config, KernelRequestIdentitySource)
             .map_err(|_| ProbeError::BridgeUnavailable)
     }
 
     fn bridge_health(&self) -> Result<BridgeHealth, ProbeError> {
-        let mut client = self.bridge_client("hyperfluxctl", "HyperFlux Doctor")?;
+        let mut client = self.bridge_client(
+            "hyperfluxctl",
+            "HyperFlux Doctor",
+            &[STRUCTURED_DIAGNOSTICS_FEATURE],
+        )?;
         let snapshot = client
             .snapshot()
             .map_err(|_| ProbeError::BridgeUnavailable)?;
@@ -383,8 +379,11 @@ impl<R: CommandRunner> RealSystemProbe<R> {
     /// Returns a bounded bridge-unavailable error when the local socket cannot
     /// be reached, negotiated, or queried.
     pub fn qualification_integration(&self) -> Result<BridgeIntegration, ProbeError> {
-        let mut client =
-            self.bridge_client("hyperflux-qualification", "HyperFlux Qualification Console")?;
+        let mut client = self.bridge_client(
+            "hyperflux-qualification",
+            "HyperFlux Qualification Console",
+            &[INTEGRATION_VIEW_FEATURE],
+        )?;
         let protocol_version = client.server_hello().selected_version;
         let view = client
             .integration_view()
@@ -410,6 +409,28 @@ impl<R: CommandRunner> RealSystemProbe<R> {
     }
 }
 
+fn sdk_client_config(
+    client_id: &str,
+    client_name: &str,
+    version: ProtocolVersion,
+    required_features: &[&str],
+) -> Result<SdkClientConfig, ProbeError> {
+    Ok(SdkClientConfig {
+        client_id: ClientId::try_from(client_id).map_err(|_| ProbeError::BridgeUnavailable)?,
+        client_name: ClientName::try_from(client_name)
+            .map_err(|_| ProbeError::BridgeUnavailable)?,
+        minimum_version: version,
+        maximum_version: version,
+        required_features: required_features
+            .iter()
+            .map(|feature| {
+                ProtocolFeatureId::try_from(*feature).map_err(|_| ProbeError::BridgeUnavailable)
+            })
+            .collect::<Result<Vec<_>, _>>()?,
+        optional_features: Vec::new(),
+    })
+}
+
 impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
     fn snapshot(&self) -> SystemSnapshot {
         let service_state = self.service_state();
@@ -546,6 +567,42 @@ mod tests {
         }
     }
 
+    #[test]
+    fn operational_clients_negotiate_the_features_they_call() {
+        let version = ProtocolVersion::try_from(CURRENT_PROTOCOL_VERSION).expect("version");
+        let doctor = sdk_client_config(
+            "hyperfluxctl",
+            "HyperFlux Doctor",
+            version,
+            &[STRUCTURED_DIAGNOSTICS_FEATURE],
+        )
+        .expect("doctor config");
+        let qualification = sdk_client_config(
+            "hyperflux-qualification",
+            "HyperFlux Qualification Console",
+            version,
+            &[INTEGRATION_VIEW_FEATURE],
+        )
+        .expect("qualification config");
+
+        assert_eq!(
+            doctor
+                .required_features
+                .iter()
+                .map(ProtocolFeatureId::as_str)
+                .collect::<Vec<_>>(),
+            [STRUCTURED_DIAGNOSTICS_FEATURE]
+        );
+        assert_eq!(
+            qualification
+                .required_features
+                .iter()
+                .map(ProtocolFeatureId::as_str)
+                .collect::<Vec<_>>(),
+            [INTEGRATION_VIEW_FEATURE]
+        );
+    }
+
     #[test]
     fn invalid_service_output_becomes_unavailable() {
         let probe = RealSystemProbe::with_paths(
diff --git a/crates/hfx-ops/src/qualification_runner.rs b/crates/hfx-ops/src/qualification_runner.rs
index 5fd8c58..996f24b 100644
--- a/crates/hfx-ops/src/qualification_runner.rs
+++ b/crates/hfx-ops/src/qualification_runner.rs
@@ -24,6 +24,14 @@ const LEASE_DURATION_MS: u32 = 15_000;
 const TRANSACTION_DEADLINE_MS: u64 = 5_000;
 const TRANSACTION_WAIT: Duration = Duration::from_secs(6);
 const TRANSACTION_POLL: Duration = Duration::from_millis(20);
+const LIVE_LIGHTING_FEATURES: &[&str] = &[
+    "atomic-transactions",
+    "integration-view-projection",
+    "ownership-leases",
+    "profile-bound-transactions",
+    "semantic-stable-lighting",
+];
+const TRANSACTION_RECOVERY_FEATURES: &[&str] = &["atomic-transactions"];
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub(crate) enum ObservationVerdict {
@@ -170,6 +178,7 @@ impl LightingTransport for LiveLightingTransport<'_> {
             .bridge_client(
                 "hyperflux-qualification-runner",
                 "HyperFlux Qualification Runner",
+                LIVE_LIGHTING_FEATURES,
             )
             .map_err(|_| {
                 QualificationRunnerError::before_write(
@@ -440,6 +449,7 @@ pub(crate) fn reconcile_pending_lighting(
         .bridge_client(
             "hyperflux-qualification-runner",
             "HyperFlux Qualification Recovery",
+            TRANSACTION_RECOVERY_FEATURES,
         )
         .map_err(|_| {
             QualificationRunnerError::before_write(

From d046ebff80b4bb6fff8713a409b9e8cfa21e12fc Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:21:35 +0400
Subject: [PATCH 10/67] fix(qualification): preserve full generation identities

---
 apps/device-qualification/assets/contract.js  | 15 ++++-
 .../local-qualification-view.schema.json      | 10 +++-
 .../tests/fixtures/rust-qualified-mouse.json  |  4 +-
 .../tests/fixtures/rust-qualified-pair.json   |  6 +-
 crates/hfx-ops/src/qualification.rs           | 56 +++++++++++++++++++
 tests/test_device_qualification_console.py    | 15 +++++
 6 files changed, 97 insertions(+), 9 deletions(-)

diff --git a/apps/device-qualification/assets/contract.js b/apps/device-qualification/assets/contract.js
index 8b2ebcc..c7f04b9 100644
--- a/apps/device-qualification/assets/contract.js
+++ b/apps/device-qualification/assets/contract.js
@@ -7,6 +7,8 @@ const VERDICTS = new Set(["not-run", "in-progress", "blocked", "failed", "eviden
 const STAGE_STATUSES = new Set(["locked", "ready", "running", "awaiting-observation", "passed", "failed", "blocked", "skipped"]);
 const RISKS = new Set(["read-only", "lighting-write", "device-lifecycle", "system-lifecycle"]);
 const DIGEST = /^[a-f0-9]{64}$/;
+const DECIMAL_GENERATION_ID = /^[1-9][0-9]{0,19}$/;
+const MAX_GENERATION_ID = 18_446_744_073_709_551_615n;
 const LOCAL_ENDPOINT = /^http:\/\/(127\.0\.0\.1|localhost)(:[0-9]+)?$/;
 
 export function validateQualificationView(value) {
@@ -84,7 +86,7 @@ function receiver(value, label) {
   object(value, label);
   exact(value, ["receiver_id", "generation_id", "model_name", "vendor_id", "product_id", "profile", "lifecycle", "devices"], label);
   string(value.receiver_id, `${label}.receiver_id`);
-  integer(value.generation_id, `${label}.generation_id`, 1);
+  generationId(value.generation_id, `${label}.generation_id`);
   nullableString(value.model_name, `${label}.model_name`);
   nullableInteger(value.vendor_id, `${label}.vendor_id`, 0, 65535);
   nullableInteger(value.product_id, `${label}.product_id`, 0, 65535);
@@ -131,7 +133,7 @@ function plan(value, label) {
   exact(value, ["plan_id", "receiver_id", "generation_id", "device_id", "profile_binding", "verdict", "summary", "groups", "evidence"], label);
   string(value.plan_id, `${label}.plan_id`);
   string(value.receiver_id, `${label}.receiver_id`);
-  integer(value.generation_id, `${label}.generation_id`, 1);
+  generationId(value.generation_id, `${label}.generation_id`);
   string(value.device_id, `${label}.device_id`);
   nullableProfile(value.profile_binding, `${label}.profile_binding`);
   enumeration(value.verdict, VERDICTS, `${label}.verdict`);
@@ -267,6 +269,15 @@ function nullableInteger(value, label, minimum, maximum = Number.MAX_SAFE_INTEGE
   if (value !== null) integer(value, label, minimum, maximum);
 }
 
+function generationId(value, label) {
+  require(
+    typeof value === "string"
+      && DECIMAL_GENERATION_ID.test(value)
+      && BigInt(value) <= MAX_GENERATION_ID,
+    `${label} must be a canonical decimal u64 string`,
+  );
+}
+
 function boolean(value, label) {
   require(typeof value === "boolean", `${label} must be boolean`);
 }
diff --git a/apps/device-qualification/contracts/local-qualification-view.schema.json b/apps/device-qualification/contracts/local-qualification-view.schema.json
index 36c96e7..f77ca9a 100644
--- a/apps/device-qualification/contracts/local-qualification-view.schema.json
+++ b/apps/device-qualification/contracts/local-qualification-view.schema.json
@@ -39,6 +39,12 @@
     "actions": {"type": "array", "maxItems": 256, "items": {"$ref": "#/$defs/action"}}
   },
   "$defs": {
+    "generationId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 20,
+      "pattern": "^[1-9][0-9]*$"
+    },
     "profile": {
       "type": "object",
       "additionalProperties": false,
@@ -90,7 +96,7 @@
       "required": ["receiver_id", "generation_id", "model_name", "vendor_id", "product_id", "profile", "lifecycle", "devices"],
       "properties": {
         "receiver_id": {"type": "string", "minLength": 1},
-        "generation_id": {"type": "integer", "minimum": 1},
+        "generation_id": {"$ref": "#/$defs/generationId"},
         "model_name": {"type": ["string", "null"]},
         "vendor_id": {"type": ["integer", "null"], "minimum": 0, "maximum": 65535},
         "product_id": {"type": ["integer", "null"], "minimum": 0, "maximum": 65535},
@@ -177,7 +183,7 @@
       "properties": {
         "plan_id": {"type": "string", "minLength": 1},
         "receiver_id": {"type": "string", "minLength": 1},
-        "generation_id": {"type": "integer", "minimum": 1},
+        "generation_id": {"$ref": "#/$defs/generationId"},
         "device_id": {"type": "string", "minLength": 1},
         "profile_binding": {"oneOf": [{"$ref": "#/$defs/profile"}, {"type": "null"}]},
         "verdict": {"enum": ["not-run", "in-progress", "blocked", "failed", "evidence-ready", "accepted"]},
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index d797cc8..0551589 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -20,7 +20,7 @@
   "receivers": [
     {
       "receiver_id": "receiver-test",
-      "generation_id": 7,
+      "generation_id": "7",
       "model_name": "Razer HyperFlux V2 Receiver",
       "vendor_id": 5426,
       "product_id": 207,
@@ -126,7 +126,7 @@
     {
       "plan_id": "plan:receiver-test:7:child.razer.basilisk-v3-pro-35k.00cd",
       "receiver_id": "receiver-test",
-      "generation_id": 7,
+      "generation_id": "7",
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 19d39bc..8019d5a 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -20,7 +20,7 @@
   "receivers": [
     {
       "receiver_id": "receiver-test",
-      "generation_id": 7,
+      "generation_id": "7",
       "model_name": "Razer HyperFlux V2 Receiver",
       "vendor_id": 5426,
       "product_id": 207,
@@ -210,7 +210,7 @@
     {
       "plan_id": "plan:receiver-test:7:child.razer.basilisk-v3-pro-35k.00cd",
       "receiver_id": "receiver-test",
-      "generation_id": 7,
+      "generation_id": "7",
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
@@ -440,7 +440,7 @@
     {
       "plan_id": "plan:receiver-test:7:child.razer.deathstalker-v2-pro-tkl.0296",
       "receiver_id": "receiver-test",
-      "generation_id": 7,
+      "generation_id": "7",
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 2ee751a..305dadb 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -18,6 +18,28 @@ pub const QUALIFICATION_API_VERSION: u16 = 1;
 pub const QUALIFICATION_SCHEMA: &str = "hyperflux-local-qualification-v1";
 pub const QUALIFICATION_ENDPOINT: &str = "http://127.0.0.1:47821";
 
+mod generation_id_wire {
+    use hfx_domain::GenerationId;
+    use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+    #[allow(clippy::trivially_copy_pass_by_ref)]
+    pub fn serialize<S>(value: &u64, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        GenerationId::try_from(*value)
+            .map_err(serde::ser::Error::custom)?
+            .serialize(serializer)
+    }
+
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<u64, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        GenerationId::deserialize(deserializer).map(GenerationId::get)
+    }
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(rename_all = "kebab-case")]
 pub enum CompanionState {
@@ -162,6 +184,7 @@ pub struct DeviceView {
 #[serde(deny_unknown_fields)]
 pub struct ReceiverView {
     pub receiver_id: String,
+    #[serde(with = "generation_id_wire")]
     pub generation_id: u64,
     pub model_name: Option<String>,
     pub vendor_id: Option<u16>,
@@ -271,6 +294,7 @@ pub struct EvidenceView {
 pub struct QualificationPlan {
     pub plan_id: String,
     pub receiver_id: String,
+    #[serde(with = "generation_id_wire")]
     pub generation_id: u64,
     pub device_id: String,
     pub profile_binding: Option<ProfileBindingView>,
@@ -1337,6 +1361,38 @@ mod tests {
         );
     }
 
+    #[test]
+    fn generation_ids_use_exact_decimal_strings_across_the_browser_boundary() {
+        let mut integration = integration();
+        integration.view.receivers[0].generation_id =
+            GenerationId::try_from(u64::MAX).expect("maximum generation is valid");
+        let view = build_qualification_view(
+            &system(),
+            Some(&integration),
+            &catalog(),
+            RunnerCapabilities {
+                read_only_actions: RunnerAvailability::Available,
+                ..RunnerCapabilities::default()
+            },
+            1,
+            "2026-07-22T12:00:00Z".to_owned(),
+        );
+
+        let encoded = serde_json::to_value(&view).expect("view serializes");
+        assert_eq!(
+            encoded["receivers"][0]["generation_id"],
+            serde_json::Value::String(u64::MAX.to_string())
+        );
+        assert_eq!(
+            encoded["plans"][0]["generation_id"],
+            serde_json::Value::String(u64::MAX.to_string())
+        );
+        let decoded: QualificationView =
+            serde_json::from_value(encoded).expect("view deserializes");
+        assert_eq!(decoded.receivers[0].generation_id, u64::MAX);
+        assert_eq!(decoded.plans[0].generation_id, u64::MAX);
+    }
+
     #[test]
     fn rust_contract_fixture_matches_the_current_projection() {
         let integration = integration();
diff --git a/tests/test_device_qualification_console.py b/tests/test_device_qualification_console.py
index 7ca90d9..90f4e5e 100644
--- a/tests/test_device_qualification_console.py
+++ b/tests/test_device_qualification_console.py
@@ -106,6 +106,21 @@ def test_contract_and_rust_fixture_share_the_versioned_schema(self) -> None:
         self.assertEqual(schema["properties"]["api_version"]["const"], fixture["api_version"])
         self.assertFalse(fixture["companion"]["network_upload_executed"])
         self.assertFalse(fixture["companion"]["hardware_write_executed"])
+        self.assertEqual(
+            schema["$defs"]["generationId"],
+            {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 20,
+                "pattern": "^[1-9][0-9]*$",
+            },
+        )
+        self.assertTrue(
+            all(isinstance(receiver["generation_id"], str) for receiver in fixture["receivers"])
+        )
+        self.assertTrue(
+            all(isinstance(plan["generation_id"], str) for plan in fixture["plans"])
+        )
         self.assertTrue(
             {"receiver_id", "generation_id", "device_id"}
             <= set(schema["$defs"]["plan"]["required"])

From 4ac175ca409613fd9956b6f3c0d6f52462d8f9e2 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:57:42 +0400
Subject: [PATCH 11/67] fix(runtime): preserve writable routes across bridge
 restart

---
 crates/hfx-daemon/src/observation.rs       | 50 +++++++++++++++-------
 driver/kernel/hyperflux-next-internal.h    |  1 +
 driver/kernel/hyperflux-next-observation.c | 24 +++++++++++
 driver/kernel/hyperflux-next-session.c     |  5 ++-
 4 files changed, 64 insertions(+), 16 deletions(-)

diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index afd054b..3706b47 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -369,11 +369,7 @@ impl PassiveObservationTranslator {
             },
         )];
         if passive.report_implies_route_available {
-            observations.push(self.endpoint_observation(
-                binding,
-                stamp,
-                EndpointFact::Route(RouteState::Available),
-            ));
+            observations.extend(self.route_observations(binding, stamp, RouteState::Available));
         }
         Ok(PassiveTranslation::applied(observations))
     }
@@ -398,11 +394,7 @@ impl PassiveObservationTranslator {
         let mut observations =
             vec![self.endpoint_observation(binding, stamp.clone(), EndpointFact::Contact(state))];
         if passive.report_implies_route_available {
-            observations.push(self.endpoint_observation(
-                binding,
-                stamp,
-                EndpointFact::Route(RouteState::Available),
-            ));
+            observations.extend(self.route_observations(binding, stamp, RouteState::Available));
         }
         PassiveTranslation::applied(observations)
     }
@@ -421,11 +413,25 @@ impl PassiveObservationTranslator {
         } else {
             RouteState::Unknown
         };
-        PassiveTranslation::applied(vec![self.endpoint_observation(
-            binding,
-            stamp,
-            EndpointFact::Route(state),
-        )])
+        PassiveTranslation::applied(self.route_observations(binding, stamp, state))
+    }
+
+    fn route_observations(
+        &self,
+        binding: &LaneBinding,
+        stamp: ObservationStamp,
+        state: RouteState,
+    ) -> Vec<LifecycleObservation> {
+        let mut observations =
+            vec![self.endpoint_observation(binding, stamp.clone(), EndpointFact::Route(state))];
+        if matches!(state, RouteState::Available | RouteState::Unavailable) {
+            observations.push(self.endpoint_observation(
+                binding,
+                stamp,
+                EndpointFact::Freshness(FreshnessState::Fresh),
+            ));
+        }
+        observations
     }
 
     fn endpoint_observation(
@@ -591,6 +597,13 @@ mod tests {
                 ..
             }
         ));
+        assert!(matches!(
+            &contact.observations[2].kind,
+            LifecycleObservationKind::Freshness {
+                value: FreshnessState::Fresh,
+                ..
+            }
+        ));
 
         let battery = translator
             .translate(raw(
@@ -632,6 +645,13 @@ mod tests {
                 &translated.observations[0].kind,
                 LifecycleObservationKind::Route { value, .. } if *value == expected
             ));
+            assert!(matches!(
+                &translated.observations[1].kind,
+                LifecycleObservationKind::Freshness {
+                    value: FreshnessState::Fresh,
+                    ..
+                }
+            ));
         }
     }
 
diff --git a/driver/kernel/hyperflux-next-internal.h b/driver/kernel/hyperflux-next-internal.h
index 205302c..e6ebded 100644
--- a/driver/kernel/hyperflux-next-internal.h
+++ b/driver/kernel/hyperflux-next-internal.h
@@ -111,6 +111,7 @@ void hfx_observation_emit(struct hfx_receiver *receiver, u32 kind,
 void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number);
 void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 			 const u8 *data, int size);
+void hfx_observation_replay_cached_identities(struct hfx_receiver *receiver);
 bool hfx_observation_identity_conflicted(struct hfx_receiver *receiver);
 long hfx_observation_read(struct hfx_receiver *receiver, void __user *user_arg);
 
diff --git a/driver/kernel/hyperflux-next-observation.c b/driver/kernel/hyperflux-next-observation.c
index b0213ca..2dabc0c 100644
--- a/driver/kernel/hyperflux-next-observation.c
+++ b/driver/kernel/hyperflux-next-observation.c
@@ -109,6 +109,30 @@ bool hfx_observation_identity_conflicted(struct hfx_receiver *receiver)
 	return conflicted;
 }
 
+void hfx_observation_replay_cached_identities(struct hfx_receiver *receiver)
+{
+	unsigned long flags;
+	u64 now_ns = ktime_get_boottime_ns();
+	u32 slot;
+
+	spin_lock_irqsave(&receiver->observation_lock, flags);
+	if (receiver->identity_conflict)
+		goto out;
+	for (slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
+	     slot <= HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE; slot++) {
+		if (!receiver->observed_product_id_valid[slot])
+			continue;
+		hfx_observation_append_locked(
+			receiver, now_ns,
+			HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID, slot,
+			HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE,
+			HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT,
+			receiver->observed_product_id[slot], 0);
+	}
+out:
+	spin_unlock_irqrestore(&receiver->observation_lock, flags);
+}
+
 void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 			 const u8 *data, int size)
 {
diff --git a/driver/kernel/hyperflux-next-session.c b/driver/kernel/hyperflux-next-session.c
index 8b37798..dad938e 100644
--- a/driver/kernel/hyperflux-next-session.c
+++ b/driver/kernel/hyperflux-next-session.c
@@ -151,8 +151,11 @@ static int hfx_session_open(struct inode *inode, struct file *file)
 
 	file->private_data = context;
 	ret = nonseekable_open(inode, file);
-	if (!ret)
+	if (!ret) {
+		if (context->writer)
+			hfx_observation_replay_cached_identities(receiver);
 		return 0;
+	}
 
 	if (context->writer) {
 		spin_lock_irqsave(&receiver->authorization_lock, flags);

From 37cd57fc28cf6c39af5c82d3f68aecde1dab4e97 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 12:06:34 +0400
Subject: [PATCH 12/67] fix(runtime): restore devices after quiet activity

---
 crates/hfx-daemon/src/manager.rs              | 139 +++++++++----
 crates/hfx-daemon/src/observation.rs          | 191 +++++++++++++++++-
 crates/hfx-runtime/src/generated.rs           |   3 +-
 docs/generated/linux-runtime.md               |   2 +-
 runtime/linux.json                            |   3 +-
 schemas/linux-runtime.schema.json             |   6 +-
 .../hyperflux_sdk/generated/linux_runtime.py  |   3 +-
 tools/hfxdev/generators/linux_runtime.py      |   3 +
 tools/hfxdev/linux_runtime.py                 |   8 +
 9 files changed, 303 insertions(+), 55 deletions(-)

diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index d8f0598..20140a8 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -2,7 +2,7 @@
 
 use crate::{
     EndpointCandidate, EndpointDiscovery, EndpointDiscoveryError, PassiveDisposition,
-    PassiveObservationTranslator, PassiveTranslationError, ProductionBackend,
+    PassiveObservationTranslator, PassiveTranslation, PassiveTranslationError, ProductionBackend,
     ReceiverIdentityAuthority, ReceiverIdentityError, RestorationScheduleError,
     RestorationScheduler, RestorationTickReport, WriterAuthorityError, derive_capability_digest,
 };
@@ -392,44 +392,13 @@ impl LinuxRuntimeManager {
                             endpoint.cursor = sequence;
                             return Ok(false);
                         }
-                        for observation in translation.observations {
-                            let sequence = observation.stamp.sequence();
-                            let outcome = backend
-                                .observe_lifecycle(observation)
-                                .map_err(RuntimeTickError::Observation)?;
-                            if let LifecycleObservationOutcome::Applied(applied) = outcome {
-                                if matches!(
-                                    applied.receiver_before,
-                                    ReceiverLifecycleState::Suspended
-                                        | ReceiverLifecycleState::PartiallySuspended
-                                ) && applied.receiver_after == ReceiverLifecycleState::Active
-                                {
-                                    self.restoration
-                                        .schedule_system_resume(
-                                            applied.receiver_id.clone(),
-                                            applied.generation_id,
-                                            sequence,
-                                        )
-                                        .map_err(RuntimeTickError::Restoration)?;
-                                }
-                                if matches!(
-                                    applied.device_presence_before,
-                                    Some(PresenceState::Sleeping | PresenceState::Unavailable)
-                                ) && applied.device_presence_after
-                                    == Some(PresenceState::Available)
-                                    && let Some(device_id) = applied.device_id
-                                {
-                                    self.restoration
-                                        .schedule_device_return(
-                                            applied.receiver_id,
-                                            applied.generation_id,
-                                            device_id,
-                                            sequence,
-                                        )
-                                        .map_err(RuntimeTickError::Restoration)?;
-                                }
-                            }
-                        }
+                        self.apply_lifecycle_translation(
+                            &endpoint.receiver_id,
+                            info.generation_id,
+                            sequence,
+                            translation,
+                            backend,
+                        )?;
                     }
                     Err(error) => {
                         if Self::downgrade(endpoint, backend)? {
@@ -454,6 +423,66 @@ impl LinuxRuntimeManager {
         Ok(true)
     }
 
+    fn apply_lifecycle_translation(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: hfx_domain::GenerationId,
+        raw_sequence: u64,
+        translation: PassiveTranslation,
+        backend: &mut ProductionBackend,
+    ) -> Result<(), RuntimeTickError> {
+        let mut scheduled_returns = BTreeSet::new();
+        for observation in translation.observations {
+            let sequence = observation.stamp.sequence();
+            let outcome = backend
+                .observe_lifecycle(observation)
+                .map_err(RuntimeTickError::Observation)?;
+            if let LifecycleObservationOutcome::Applied(applied) = outcome {
+                if matches!(
+                    applied.receiver_before,
+                    ReceiverLifecycleState::Suspended | ReceiverLifecycleState::PartiallySuspended
+                ) && applied.receiver_after == ReceiverLifecycleState::Active
+                {
+                    self.restoration
+                        .schedule_system_resume(
+                            applied.receiver_id.clone(),
+                            applied.generation_id,
+                            sequence,
+                        )
+                        .map_err(RuntimeTickError::Restoration)?;
+                }
+                if is_device_return_transition(
+                    applied.device_presence_before,
+                    applied.device_presence_after,
+                ) && let Some(device_id) = applied.device_id
+                {
+                    scheduled_returns.insert(device_id.clone());
+                    self.restoration
+                        .schedule_device_return(
+                            applied.receiver_id,
+                            applied.generation_id,
+                            device_id,
+                            sequence,
+                        )
+                        .map_err(RuntimeTickError::Restoration)?;
+                }
+            }
+        }
+        if let Some(device_id) = translation.activity_resumption
+            && !scheduled_returns.contains(&device_id)
+        {
+            self.restoration
+                .schedule_device_return(
+                    receiver_id.clone(),
+                    generation_id,
+                    device_id,
+                    SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?,
+                )
+                .map_err(RuntimeTickError::Restoration)?;
+        }
+        Ok(())
+    }
+
     fn try_admit_writer(
         &self,
         endpoint: &mut ActiveEndpoint,
@@ -621,6 +650,16 @@ fn nonzero_interval(interval: Duration) -> Duration {
     }
 }
 
+const fn is_device_return_transition(
+    before: Option<PresenceState>,
+    after: Option<PresenceState>,
+) -> bool {
+    matches!(
+        before,
+        Some(PresenceState::Sleeping | PresenceState::Unavailable | PresenceState::Unknown)
+    ) && matches!(after, Some(PresenceState::Available))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -648,4 +687,26 @@ mod tests {
         assert_eq!(value.sequence().get(), 4);
         assert_eq!(value.observed_at_ms().get(), 5);
     }
+
+    #[test]
+    fn available_evidence_wakes_sleeping_unavailable_and_unknown_devices() {
+        for before in [
+            PresenceState::Sleeping,
+            PresenceState::Unavailable,
+            PresenceState::Unknown,
+        ] {
+            assert!(is_device_return_transition(
+                Some(before),
+                Some(PresenceState::Available)
+            ));
+        }
+        assert!(!is_device_return_transition(
+            Some(PresenceState::Available),
+            Some(PresenceState::Available)
+        ));
+        assert!(!is_device_return_transition(
+            None,
+            Some(PresenceState::Available)
+        ));
+    }
 }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index 3706b47..b98ff15 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -22,6 +22,7 @@ use hfx_kernel_transport::{
 use hfx_profiles::{
     PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord, RuntimeProfileCatalog,
 };
+use hfx_runtime::ACTIVITY_RESUMPTION_QUIET_MS;
 use std::collections::BTreeMap;
 use std::fmt;
 
@@ -38,6 +39,9 @@ pub enum PassiveDisposition {
 pub struct PassiveTranslation {
     pub disposition: PassiveDisposition,
     pub observations: Vec<LifecycleObservation>,
+    /// One device whose first input report followed a bounded quiet interval.
+    /// This is a restoration hint, not a claim that the device was asleep.
+    pub activity_resumption: Option<LogicalDeviceId>,
 }
 
 impl PassiveTranslation {
@@ -45,6 +49,15 @@ impl PassiveTranslation {
         Self {
             disposition: PassiveDisposition::Applied,
             observations,
+            activity_resumption: None,
+        }
+    }
+
+    fn resumed(observations: Vec<LifecycleObservation>, device_id: LogicalDeviceId) -> Self {
+        Self {
+            disposition: PassiveDisposition::Applied,
+            observations,
+            activity_resumption: Some(device_id),
         }
     }
 
@@ -52,6 +65,7 @@ impl PassiveTranslation {
         Self {
             disposition,
             observations: Vec::new(),
+            activity_resumption: None,
         }
     }
 }
@@ -103,6 +117,7 @@ struct LaneBinding {
     device_id: LogicalDeviceId,
     endpoint_id: EndpointId,
     passive: Option<PassiveTelemetryRecord>,
+    last_activity_ms: Option<MonotonicMs>,
 }
 
 pub struct PassiveObservationTranslator {
@@ -262,11 +277,16 @@ impl PassiveObservationTranslator {
             device_kind.as_str()
         ))?;
         let endpoint_id = EndpointId::try_from(format!("hyperflux-{}", lane_name(lane)))?;
+        let last_activity_ms = self
+            .lanes
+            .get(&slot)
+            .and_then(|binding| binding.last_activity_ms);
         let binding = LaneBinding {
             product_id,
             device_id: device_id.clone(),
             endpoint_id: endpoint_id.clone(),
             passive: profile.and_then(|profile| profile.passive),
+            last_activity_ms,
         };
         let child = ChildIdentity::new(device_id.clone(), device_kind, product_id)?;
         let endpoint = EndpointIdentity::new(
@@ -299,7 +319,7 @@ impl PassiveObservationTranslator {
     }
 
     fn activity(
-        &self,
+        &mut self,
         slot: u32,
         value: u32,
         stamp: ObservationStamp,
@@ -307,34 +327,50 @@ impl PassiveObservationTranslator {
         if value != 1 {
             return Err(PassiveTranslationError::InvalidObservationValue);
         }
-        let Some(binding) = self.lanes.get(&slot) else {
+        let Some(binding) = self.lanes.get_mut(&slot) else {
             return Ok(PassiveTranslation::disposition(
                 PassiveDisposition::IgnoredUnknownLane,
             ));
         };
-        Ok(PassiveTranslation::applied(vec![
+        let observed_at_ms = stamp.observed_at_ms();
+        let resumed = binding.last_activity_ms.is_some_and(|prior| {
+            observed_at_ms.get().saturating_sub(prior.get()) >= ACTIVITY_RESUMPTION_QUIET_MS
+        });
+        if binding
+            .last_activity_ms
+            .is_none_or(|prior| observed_at_ms > prior)
+        {
+            binding.last_activity_ms = Some(observed_at_ms);
+        }
+        let binding = binding.clone();
+        let observations = vec![
             self.endpoint_observation(
-                binding,
+                &binding,
                 stamp.clone(),
                 EndpointFact::Route(RouteState::Available),
             ),
-            self.endpoint_observation(binding, stamp.clone(), EndpointFact::Power(PowerState::On)),
+            self.endpoint_observation(&binding, stamp.clone(), EndpointFact::Power(PowerState::On)),
             self.endpoint_observation(
-                binding,
+                &binding,
                 stamp.clone(),
                 EndpointFact::Sleep(SleepState::Awake),
             ),
             self.endpoint_observation(
-                binding,
+                &binding,
                 stamp.clone(),
                 EndpointFact::Activity(ActivityState::Active),
             ),
             self.endpoint_observation(
-                binding,
+                &binding,
                 stamp,
                 EndpointFact::Freshness(FreshnessState::Fresh),
             ),
-        ]))
+        ];
+        Ok(if resumed {
+            PassiveTranslation::resumed(observations, binding.device_id)
+        } else {
+            PassiveTranslation::applied(observations)
+        })
     }
 
     fn battery(
@@ -527,9 +563,19 @@ mod tests {
     }
 
     fn raw(sequence: u64, kind: u32, slot: u32, value: u32) -> RawKernelObservation {
+        raw_at(sequence, sequence, kind, slot, value)
+    }
+
+    fn raw_at(
+        sequence: u64,
+        observed_at_ms: u64,
+        kind: u32,
+        slot: u32,
+        value: u32,
+    ) -> RawKernelObservation {
         RawKernelObservation {
             sequence,
-            observed_boottime_ns: sequence * 1_000_000,
+            observed_boottime_ns: observed_at_ms * 1_000_000,
             kind,
             endpoint_slot: slot,
             source: HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE,
@@ -539,6 +585,19 @@ mod tests {
         }
     }
 
+    fn activity(sequence: u64, observed_at_ms: u64, slot: u32) -> RawKernelObservation {
+        let mut observation = raw_at(
+            sequence,
+            observed_at_ms,
+            HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ACTIVITY,
+            slot,
+            1,
+        );
+        observation.source = HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT;
+        observation.confidence = HFX_UAPI_OBSERVATION_CONFIDENCE_OBSERVED;
+        observation
+    }
+
     fn identify(
         translator: &mut PassiveObservationTranslator,
         sequence: u64,
@@ -697,6 +756,118 @@ mod tests {
         assert_eq!(activity.observations.len(), 5);
     }
 
+    #[test]
+    fn first_activity_after_quiet_emits_one_device_scoped_resumption() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+
+        let first = translator
+            .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("first activity translates");
+        assert_eq!(first.activity_resumption, None);
+
+        let resumed = translator
+            .translate(activity(
+                3,
+                1_000 + ACTIVITY_RESUMPTION_QUIET_MS,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            ))
+            .expect("post-quiet activity translates");
+        assert_eq!(
+            resumed
+                .activity_resumption
+                .as_ref()
+                .map(LogicalDeviceId::as_str),
+            Some("paired-mouse-00cd")
+        );
+
+        let continuous = translator
+            .translate(activity(
+                4,
+                1_001 + ACTIVITY_RESUMPTION_QUIET_MS,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            ))
+            .expect("continuous activity translates");
+        assert_eq!(continuous.activity_resumption, None);
+    }
+
+    #[test]
+    fn identity_replay_preserves_activity_continuity_and_sibling_isolation() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        identify(
+            &mut translator,
+            2,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        translator
+            .translate(activity(3, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("mouse activity translates");
+        translator
+            .translate(activity(4, 1_000, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("keyboard activity translates");
+
+        identify(
+            &mut translator,
+            5,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        let mouse = translator
+            .translate(activity(
+                6,
+                1_000 + ACTIVITY_RESUMPTION_QUIET_MS,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            ))
+            .expect("mouse resumes after identity replay");
+        assert_eq!(
+            mouse
+                .activity_resumption
+                .as_ref()
+                .map(LogicalDeviceId::as_str),
+            Some("paired-mouse-00cd")
+        );
+
+        let keyboard = translator
+            .translate(activity(7, 1_001, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("keyboard remains continuous");
+        assert_eq!(keyboard.activity_resumption, None);
+    }
+
+    #[test]
+    fn a_new_generation_requires_prior_activity_before_resumption() {
+        let mut next_generation = PassiveObservationTranslator::new(
+            ReceiverId::try_from("receiver-test").expect("receiver id is valid"),
+            GenerationId::try_from(8_u64).expect("generation is valid"),
+            RuntimeProfileCatalog::load().expect("profile catalog is valid"),
+        );
+        identify(
+            &mut next_generation,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        let first = next_generation
+            .translate(activity(
+                2,
+                ACTIVITY_RESUMPTION_QUIET_MS * 10,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            ))
+            .expect("first generation-bound activity translates");
+        assert_eq!(first.activity_resumption, None);
+    }
+
     #[test]
     fn lane_mismatch_and_identity_replacement_fail_closed() {
         let mut translator = translator();
diff --git a/crates/hfx-runtime/src/generated.rs b/crates/hfx-runtime/src/generated.rs
index a4a1b28..57724c1 100644
--- a/crates/hfx-runtime/src/generated.rs
+++ b/crates/hfx-runtime/src/generated.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const LINUX_RUNTIME_SHA256: &str =
-    "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723";
+    "aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8";
 pub const PRODUCT_DISPLAY_NAME: &str = "HyperFlux Next";
 pub const PRODUCT_VERSION: &str = "0.0.0-dev.1";
 pub const PACKAGE_NAME: &str = "hyperflux-next-linux";
@@ -52,6 +52,7 @@ pub const DISCOVERY_INTERVAL_MS: u64 = 100;
 pub const ACCEPT_POLL_INTERVAL_MS: u64 = 25;
 pub const ACTOR_RESPONSE_TIMEOUT_MS: u64 = 30_000;
 pub const KERNEL_SESSION_DURATION_MS: u64 = 120_000;
+pub const ACTIVITY_RESUMPTION_QUIET_MS: u64 = 30_000;
 pub const RESTORATION_MAX_PENDING_TRIGGERS: usize = 64;
 pub const RESTORATION_MAX_PENDING_CLAIMS: usize = 4_096;
 pub const RESTORATION_CLAIMS_PER_TICK: usize = 1;
diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index 0cdb95a..b01568c 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical source digest: `6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723`.
+Canonical source digest: `aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8`.
 
 ## Product
 
diff --git a/runtime/linux.json b/runtime/linux.json
index 468fe0d..52b4e43 100644
--- a/runtime/linux.json
+++ b/runtime/linux.json
@@ -42,7 +42,8 @@
       "discovery_interval_ms": 100,
       "accept_poll_interval_ms": 25,
       "actor_response_timeout_ms": 30000,
-      "kernel_session_duration_ms": 120000
+      "kernel_session_duration_ms": 120000,
+      "activity_resumption_quiet_ms": 30000
     },
     "restoration": {
       "max_pending_triggers": 64,
diff --git a/schemas/linux-runtime.schema.json b/schemas/linux-runtime.schema.json
index 8545f23..2c82146 100644
--- a/schemas/linux-runtime.schema.json
+++ b/schemas/linux-runtime.schema.json
@@ -105,13 +105,15 @@
             "discovery_interval_ms",
             "accept_poll_interval_ms",
             "actor_response_timeout_ms",
-            "kernel_session_duration_ms"
+            "kernel_session_duration_ms",
+            "activity_resumption_quiet_ms"
           ],
           "properties": {
             "discovery_interval_ms": {"type": "integer", "minimum": 10, "maximum": 10000},
             "accept_poll_interval_ms": {"type": "integer", "minimum": 1, "maximum": 1000},
             "actor_response_timeout_ms": {"type": "integer", "minimum": 100, "maximum": 30000},
-            "kernel_session_duration_ms": {"type": "integer", "minimum": 6000, "maximum": 300000}
+            "kernel_session_duration_ms": {"type": "integer", "minimum": 6000, "maximum": 300000},
+            "activity_resumption_quiet_ms": {"type": "integer", "minimum": 1000, "maximum": 3600000}
           }
         },
         "restoration": {
diff --git a/sdk/python/hyperflux_sdk/generated/linux_runtime.py b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
index 7570102..d899783 100644
--- a/sdk/python/hyperflux_sdk/generated/linux_runtime.py
+++ b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
@@ -1,7 +1,7 @@
 """Generated by ./hfx generate. Do not edit manually."""
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-LINUX_RUNTIME_SHA256 = "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723"
+LINUX_RUNTIME_SHA256 = "aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8"
 PRODUCT_DISPLAY_NAME = "HyperFlux Next"
 PRODUCT_VERSION = "0.0.0-dev.1"
 PACKAGE_NAME = "hyperflux-next-linux"
@@ -47,6 +47,7 @@
 ACCEPT_POLL_INTERVAL_MS = 25
 ACTOR_RESPONSE_TIMEOUT_MS = 30000
 KERNEL_SESSION_DURATION_MS = 120000
+ACTIVITY_RESUMPTION_QUIET_MS = 30000
 RESTORATION_MAX_PENDING_TRIGGERS = 64
 RESTORATION_MAX_PENDING_CLAIMS = 4096
 RESTORATION_CLAIMS_PER_TICK = 1
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 4d2f863..94a667e 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -98,6 +98,8 @@ def rust_constants(runtime: LinuxRuntime) -> str:
             f"{bridge.timing.actor_response_timeout_ms:_};",
             "pub const KERNEL_SESSION_DURATION_MS: u64 = "
             f"{bridge.timing.kernel_session_duration_ms:_};",
+            "pub const ACTIVITY_RESUMPTION_QUIET_MS: u64 = "
+            f"{bridge.timing.activity_resumption_quiet_ms:_};",
             "pub const RESTORATION_MAX_PENDING_TRIGGERS: usize = "
             f"{bridge.restoration.max_pending_triggers:_};",
             "pub const RESTORATION_MAX_PENDING_CLAIMS: usize = "
@@ -171,6 +173,7 @@ def python_constants(runtime: LinuxRuntime) -> str:
         ("ACCEPT_POLL_INTERVAL_MS", bridge.timing.accept_poll_interval_ms),
         ("ACTOR_RESPONSE_TIMEOUT_MS", bridge.timing.actor_response_timeout_ms),
         ("KERNEL_SESSION_DURATION_MS", bridge.timing.kernel_session_duration_ms),
+        ("ACTIVITY_RESUMPTION_QUIET_MS", bridge.timing.activity_resumption_quiet_ms),
         ("RESTORATION_MAX_PENDING_TRIGGERS", bridge.restoration.max_pending_triggers),
         ("RESTORATION_MAX_PENDING_CLAIMS", bridge.restoration.max_pending_claims),
         ("RESTORATION_CLAIMS_PER_TICK", bridge.restoration.claims_per_tick),
diff --git a/tools/hfxdev/linux_runtime.py b/tools/hfxdev/linux_runtime.py
index 7a3d94e..9525843 100644
--- a/tools/hfxdev/linux_runtime.py
+++ b/tools/hfxdev/linux_runtime.py
@@ -49,6 +49,7 @@
     "accept_poll_interval_ms",
     "actor_response_timeout_ms",
     "kernel_session_duration_ms",
+    "activity_resumption_quiet_ms",
 }
 BRIDGE_RESTORATION_KEYS = {
     "max_pending_triggers",
@@ -119,6 +120,7 @@ class BridgeTiming:
     accept_poll_interval_ms: int
     actor_response_timeout_ms: int
     kernel_session_duration_ms: int
+    activity_resumption_quiet_ms: int
 
 
 @dataclass(frozen=True)
@@ -434,6 +436,12 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
             kernel_session_duration_ms=_bounded_integer(
                 timing_value["kernel_session_duration_ms"], "kernel session duration", 6000, 300000
             ),
+            activity_resumption_quiet_ms=_bounded_integer(
+                timing_value["activity_resumption_quiet_ms"],
+                "activity resumption quiet interval",
+                1000,
+                3_600_000,
+            ),
         ),
         restoration=BridgeRestoration(
             max_pending_triggers=_bounded_integer(

From 2b27e8693f3dbb67fa688de5c31482861b92411a Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 12:30:08 +0400
Subject: [PATCH 13/67] fix(qualification): keep transient telemetry retryable

---
 crates/hfx-ops/src/qualification_server.rs | 138 ++++++++++++++++-----
 1 file changed, 106 insertions(+), 32 deletions(-)

diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index a465c3a..bf10d5d 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -501,10 +501,7 @@ fn apply_action(
     session: &mut ServerState,
 ) -> Result<(), ActionFailure> {
     match stage.risk {
-        RiskLevel::ReadOnly => {
-            record_read_only_result(view, stage, input, session);
-            Ok(())
-        }
+        RiskLevel::ReadOnly => record_read_only_result(view, stage, input, session),
         RiskLevel::LightingWrite => {
             apply_lighting_action(probe, view, stage, input, state_file, session)
         }
@@ -634,8 +631,8 @@ fn record_read_only_result(
     stage: &QualificationStage,
     input: &ActionInput,
     session: &mut ServerState,
-) {
-    let (status, summary) = read_only_outcome(view, stage, input);
+) -> Result<(), ActionFailure> {
+    let (status, summary) = read_only_outcome(view, stage, input)?;
     session.results.insert(
         stage.stage_id.clone(),
         StageProgress {
@@ -648,6 +645,7 @@ fn record_read_only_result(
             checkpoint: None,
         },
     );
+    Ok(())
 }
 
 fn apply_lighting_action(
@@ -826,11 +824,11 @@ fn stage_for_action<'a>(
         .find(|stage| stage.action_id.as_deref() == Some(action.id.as_str()))
 }
 
-fn read_only_outcome<'a>(
-    view: &'a QualificationView,
+fn read_only_outcome(
+    view: &QualificationView,
     stage: &QualificationStage,
     input: &ActionInput,
-) -> (StageStatus, &'a str) {
+) -> Result<(StageStatus, &'static str), ActionFailure> {
     if stage.stage_id.ends_with("-telemetry") {
         let device = view.plans.iter().find_map(|plan| {
             plan.groups
@@ -841,16 +839,16 @@ fn read_only_outcome<'a>(
                 .flatten()
         });
         let Some(device) = device else {
-            return (
-                StageStatus::Blocked,
-                "The selected device is no longer present.",
-            );
+            return Err(ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "The selected device is no longer present. Let it return, refresh, and retry.",
+            ));
         };
         if device.presence != PresenceView::Active {
-            return (
-                StageStatus::Blocked,
-                "Fresh active-device evidence was not available after the exercise step.",
-            );
+            return Err(ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "Fresh active-device evidence is not available yet. Exercise the device, refresh, and retry.",
+            ));
         }
         let battery_claimed = stage
             .capabilities
@@ -858,39 +856,39 @@ fn read_only_outcome<'a>(
             .any(|capability| capability == "telemetry.battery-percent");
         if battery_claimed && !matches!(device.battery.availability, BatteryAvailability::Reported)
         {
-            return (
-                StageStatus::Blocked,
-                "The profile claims battery telemetry, but no fresh value was available.",
-            );
+            return Err(ActionFailure::unchanged(
+                HttpStatus::Conflict,
+                "Fresh battery evidence is not available yet. Exercise or reconnect the device, refresh, and retry.",
+            ));
         }
     }
     let mut outcome = StageStatus::Passed;
     for prompt in &stage.observations {
         let Some(answer) = input.observations.get(&prompt.id) else {
-            return (
-                StageStatus::Blocked,
+            return Err(ActionFailure::unchanged(
+                HttpStatus::BadRequest,
                 "A required watched observation was not answered.",
-            );
+            ));
         };
         let Some(choice) = prompt.choices.iter().find(|choice| choice.id == *answer) else {
-            return (
-                StageStatus::Blocked,
+            return Err(ActionFailure::unchanged(
+                HttpStatus::BadRequest,
                 "A watched observation used an answer outside the declared choices.",
-            );
+            ));
         };
         match choice.outcome.as_str() {
             "fail" => outcome = StageStatus::Failed,
             "unclear" if outcome != StageStatus::Failed => outcome = StageStatus::Blocked,
             "pass" => {}
             _ => {
-                return (
-                    StageStatus::Blocked,
+                return Err(ActionFailure::unchanged(
+                    HttpStatus::BadRequest,
                     "A watched observation outcome is not recognized.",
-                );
+                ));
             }
         }
     }
-    match outcome {
+    Ok(match outcome {
         StageStatus::Passed => (
             outcome,
             "The local companion recorded a complete read-only stage outcome.",
@@ -903,7 +901,7 @@ fn read_only_outcome<'a>(
             StageStatus::Blocked,
             "The watched observation was inconclusive.",
         ),
-    }
+    })
 }
 
 fn device_for_plan<'a>(
@@ -1403,6 +1401,82 @@ mod tests {
         assert!(session.run_id.is_none());
     }
 
+    #[test]
+    fn transient_telemetry_gap_remains_retryable() {
+        let mut view = qualification_fixture("rust-qualified-pair.json");
+        let stage = view
+            .plans
+            .iter()
+            .find(|plan| plan.device_id == "keyboard-test")
+            .expect("keyboard plan exists")
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-telemetry"))
+            .expect("telemetry stage exists")
+            .clone();
+        let keyboard = view
+            .receivers
+            .iter_mut()
+            .flat_map(|receiver| &mut receiver.devices)
+            .find(|device| device.device_id == "keyboard-test")
+            .expect("keyboard device exists");
+        keyboard.battery.availability = BatteryAvailability::Unknown;
+        keyboard.battery.percentage = None;
+        let input = ActionInput {
+            view_revision: 1,
+            confirmation: None,
+            observations: BTreeMap::from([("controls".to_owned(), "pass".to_owned())]),
+        };
+        let mut session = ServerState::default();
+
+        let failure = record_read_only_result(&view, &stage, &input, &mut session)
+            .expect_err("missing telemetry remains retryable");
+        assert!(matches!(failure.status, HttpStatus::Conflict));
+        assert!(!failure.state_changed);
+        assert!(failure.message.contains("refresh, and retry"));
+        assert!(session.results.is_empty());
+
+        let keyboard = view
+            .receivers
+            .iter_mut()
+            .flat_map(|receiver| &mut receiver.devices)
+            .find(|device| device.device_id == "keyboard-test")
+            .expect("keyboard device exists");
+        keyboard.battery.availability = BatteryAvailability::Reported;
+        keyboard.battery.percentage = Some(20);
+        assert!(record_read_only_result(&view, &stage, &input, &mut session).is_ok());
+        assert_eq!(session.results[&stage.stage_id].status, StageStatus::Passed);
+    }
+
+    #[test]
+    fn malformed_read_only_observation_does_not_poison_the_run() {
+        let view = qualification_fixture("rust-qualified-pair.json");
+        let stage = view
+            .plans
+            .iter()
+            .find(|plan| plan.device_id == "keyboard-test")
+            .expect("keyboard plan exists")
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-telemetry"))
+            .expect("telemetry stage exists")
+            .clone();
+        let input = ActionInput {
+            view_revision: 1,
+            confirmation: None,
+            observations: BTreeMap::new(),
+        };
+        let mut session = ServerState::default();
+
+        let failure = record_read_only_result(&view, &stage, &input, &mut session)
+            .expect_err("missing answer is rejected");
+        assert!(matches!(failure.status, HttpStatus::BadRequest));
+        assert!(!failure.state_changed);
+        assert!(session.results.is_empty());
+    }
+
     #[test]
     fn watched_answers_are_exact_and_reduce_to_one_verdict() {
         let stage = QualificationStage {

From d17bdb5d884a827861a75c9903d84f6666f9d759 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:21:00 +0400
Subject: [PATCH 14/67] fix(kernel): classify composite receiver activity

---
 driver/kernel/hyperflux-next-core.c        |  3 +-
 driver/kernel/hyperflux-next-internal.h    |  3 +-
 driver/kernel/hyperflux-next-observation.c |  9 ++----
 driver/kernel/hyperflux-next-passive.h     | 37 ++++++++++++++++++++++
 tests/c/kernel_protocol_smoke.c            | 28 ++++++++++++++++
 5 files changed, 72 insertions(+), 8 deletions(-)

diff --git a/driver/kernel/hyperflux-next-core.c b/driver/kernel/hyperflux-next-core.c
index f0144a9..ffca56c 100644
--- a/driver/kernel/hyperflux-next-core.c
+++ b/driver/kernel/hyperflux-next-core.c
@@ -278,7 +278,8 @@ static int hfx_raw_event(struct hid_device *hdev, struct hid_report *report,
 	(void)report;
 	if (!interface || !interface->receiver || !data || size <= 0)
 		return 0;
-	hfx_observe_activity(interface->receiver, interface->interface_number);
+	hfx_observe_activity(interface->receiver, interface->interface_number,
+			     data, size);
 	hfx_observe_passive(interface->receiver, interface->interface_number,
 			    data, size);
 	return 0;
diff --git a/driver/kernel/hyperflux-next-internal.h b/driver/kernel/hyperflux-next-internal.h
index e6ebded..f9da505 100644
--- a/driver/kernel/hyperflux-next-internal.h
+++ b/driver/kernel/hyperflux-next-internal.h
@@ -108,7 +108,8 @@ int hfx_session_device_register(struct hfx_receiver *receiver);
 void hfx_observation_emit(struct hfx_receiver *receiver, u32 kind,
 			  u32 endpoint_slot, u32 source, u32 confidence,
 			  u32 value, u32 auxiliary);
-void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number);
+void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number,
+			  const u8 *data, int size);
 void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 			 const u8 *data, int size);
 void hfx_observation_replay_cached_identities(struct hfx_receiver *receiver);
diff --git a/driver/kernel/hyperflux-next-observation.c b/driver/kernel/hyperflux-next-observation.c
index 2dabc0c..72c782d 100644
--- a/driver/kernel/hyperflux-next-observation.c
+++ b/driver/kernel/hyperflux-next-observation.c
@@ -46,17 +46,14 @@ void hfx_observation_emit(struct hfx_receiver *receiver, u32 kind,
 	spin_unlock_irqrestore(&receiver->observation_lock, flags);
 }
 
-void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number)
+void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number,
+			  const u8 *data, int size)
 {
 	unsigned long flags;
 	u64 now_ns = ktime_get_boottime_ns();
 	u32 slot;
 
-	if (interface_number == HFX_POINTER_INPUT_INTERFACE)
-		slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
-	else if (interface_number == HFX_KEYBOARD_INPUT_INTERFACE)
-		slot = HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE;
-	else
+	if (!hfx_activity_slot(interface_number, data, size, &slot))
 		return;
 
 	spin_lock_irqsave(&receiver->observation_lock, flags);
diff --git a/driver/kernel/hyperflux-next-passive.h b/driver/kernel/hyperflux-next-passive.h
index e35fee4..f179707 100644
--- a/driver/kernel/hyperflux-next-passive.h
+++ b/driver/kernel/hyperflux-next-passive.h
@@ -4,10 +4,47 @@
 
 #include <linux/types.h>
 
+#include "uapi/hyperflux_next.h"
+
 #define HFX_PASSIVE_REPORT_INTERFACE 1
 #define HFX_POINTER_INPUT_INTERFACE 0
 #define HFX_KEYBOARD_INPUT_INTERFACE 2
 
+#define HFX_COMPOSITE_KEYBOARD_REPORT 0x01
+#define HFX_COMPOSITE_CONSUMER_REPORT 0x02
+#define HFX_COMPOSITE_SYSTEM_REPORT 0x03
+#define HFX_COMPOSITE_POINTER_REPORT 0x0a
+
+static inline int hfx_activity_slot(int interface_number, const __u8 *data,
+				    int size, __u32 *slot)
+{
+	if (!data || size <= 0 || !slot)
+		return 0;
+	if (interface_number == HFX_POINTER_INPUT_INTERFACE) {
+		*slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
+		return 1;
+	}
+	if (interface_number == HFX_KEYBOARD_INPUT_INTERFACE) {
+		*slot = HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE;
+		return 1;
+	}
+	if (interface_number != HFX_PASSIVE_REPORT_INTERFACE)
+		return 0;
+
+	switch (data[0]) {
+	case HFX_COMPOSITE_KEYBOARD_REPORT:
+	case HFX_COMPOSITE_CONSUMER_REPORT:
+	case HFX_COMPOSITE_SYSTEM_REPORT:
+		*slot = HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE;
+		return 1;
+	case HFX_COMPOSITE_POINTER_REPORT:
+		*slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
+		return 1;
+	default:
+		return 0;
+	}
+}
+
 enum hfx_passive_kind {
 	HFX_PASSIVE_NONE = 0,
 	HFX_PASSIVE_POINTER_IDENTITY,
diff --git a/tests/c/kernel_protocol_smoke.c b/tests/c/kernel_protocol_smoke.c
index ef40d0d..ad80e3b 100644
--- a/tests/c/kernel_protocol_smoke.c
+++ b/tests/c/kernel_protocol_smoke.c
@@ -34,8 +34,13 @@ int main(void)
 {
 	struct hfx_uapi_frame frame = mouse_frame();
 	struct hfx_passive_report report;
+	__u32 activity_slot;
 	const __u8 pointer_identity[] = { 0x05, 0x3b, 0x01, 0x00, 0xcd };
 	const __u8 keyboard_status[] = { 0x09, 0x31, 0x32, 0x12, 0x34, 0x56 };
+	const __u8 keyboard_input[] = { HFX_COMPOSITE_KEYBOARD_REPORT, 0x00 };
+	const __u8 consumer_input[] = { HFX_COMPOSITE_CONSUMER_REPORT, 0x00 };
+	const __u8 system_input[] = { HFX_COMPOSITE_SYSTEM_REPORT, 0x00 };
+	const __u8 pointer_input[] = { HFX_COMPOSITE_POINTER_REPORT, 0x00 };
 
 	assert(hfx_wire_validate_frame(&frame, HFX_HW001_BACKEND_ID) ==
 	       HFX_WIRE_VALID);
@@ -66,5 +71,28 @@ int main(void)
 	assert(report.status_raw == 0x56);
 	assert(hfx_passive_parse(4, pointer_identity,
 				 sizeof(pointer_identity), &report) == HFX_PASSIVE_NONE);
+
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, keyboard_input,
+				 sizeof(keyboard_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, consumer_input,
+				 sizeof(consumer_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, system_input,
+				 sizeof(system_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, pointer_input,
+				 sizeof(pointer_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE);
+	assert(hfx_activity_slot(HFX_POINTER_INPUT_INTERFACE, pointer_input,
+				 sizeof(pointer_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE);
+	assert(hfx_activity_slot(HFX_KEYBOARD_INPUT_INTERFACE, keyboard_input,
+				 sizeof(keyboard_input), &activity_slot));
+	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
+	assert(!hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, keyboard_status,
+				  sizeof(keyboard_status), &activity_slot));
+	assert(!hfx_activity_slot(4, keyboard_input, sizeof(keyboard_input),
+				  &activity_slot));
 	return 0;
 }

From df1cdb3b4e0c3911e7e96394230703391c4020a7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 13:54:49 +0400
Subject: [PATCH 15/67] fix(kernel): bootstrap generation pairing inventory

---
 crates/hfx-daemon/src/observation.rs          |  31 ++++-
 crates/hfx-kernel-transport/src/generated.rs  |   3 +-
 crates/hfx-profiles/src/generated.rs          |   8 +-
 docs/generated/installation.md                |   4 +-
 docs/generated/supported-hardware.md          |   8 +-
 .../generated/hyperflux_receiver_profiles.inc |   4 +-
 driver/kernel/hyperflux-next-core.c           |  69 +++++++++-
 driver/kernel/hyperflux-next-internal.h       |   6 +-
 driver/kernel/hyperflux-next-observation.c    |  88 ++++++++++++-
 .../kernel/hyperflux-next-pairing-inventory.h |  99 ++++++++++++++
 driver/kernel/hyperflux-next-passive.h        |   9 +-
 driver/kernel/hyperflux-next-profile.c        |   5 +-
 driver/kernel/hyperflux-next-profile.h        |   6 +
 driver/kernel/uapi/hyperflux_next.h           |   3 +-
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  15 ++-
 packaging/generated/install-plan.json         |   7 +
 profiles/evidence/claims.json                 |   4 +-
 .../razer-hyperflux-v2-1532-00cf.json         |   4 +-
 schemas/hardware-profile.schema.json          |   9 ++
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  19 +--
 tests/c/kernel_protocol_smoke.c               | 122 +++++++++++++++---
 tests/cpp/kernel_profile_table_smoke.cpp      |   8 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_kernel_driver.py                   |  48 +++++++
 tools/hfxdev/generators/profiles.py           |  12 +-
 tools/hfxdev/profiles.py                      |  16 +++
 uapi/kernel-uapi.json                         |   3 +-
 29 files changed, 538 insertions(+), 82 deletions(-)
 create mode 100644 driver/kernel/hyperflux-next-pairing-inventory.h
 create mode 100644 tests/test_kernel_driver.py

diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index b98ff15..2e40096 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -15,9 +15,9 @@ use hfx_kernel_transport::{
     HFX_UAPI_OBSERVATION_KIND_ENDPOINT_BATTERY_RAW, HFX_UAPI_OBSERVATION_KIND_ENDPOINT_CONTACT_RAW,
     HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID, HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ROUTE_RAW,
     HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT, HFX_UAPI_OBSERVATION_KIND_RECEIVER_AVAILABLE,
-    HFX_UAPI_OBSERVATION_KIND_RECEIVER_SUSPENDED, HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT,
-    HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE, HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT,
-    RawKernelObservation,
+    HFX_UAPI_OBSERVATION_KIND_RECEIVER_SUSPENDED, HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE,
+    HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT, HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE,
+    HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT, RawKernelObservation,
 };
 use hfx_profiles::{
     PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord, RuntimeProfileCatalog,
@@ -201,6 +201,7 @@ impl PassiveObservationTranslator {
             HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE => "kernel-hid-passive-v1",
             HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT => "kernel-hid-input-v1",
             HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT => "kernel-power-management-v1",
+            HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE => "kernel-hid-feature-v1",
             value => return Err(PassiveTranslationError::UnsupportedSource(value)),
         };
         ObservationStamp::new(
@@ -616,6 +617,30 @@ mod tests {
             .expect("identity observation translates")
     }
 
+    #[test]
+    fn bounded_feature_inventory_uses_the_same_generation_identity_gate() {
+        let mut translator = translator();
+        let mut observation = raw(
+            1,
+            HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        observation.source = HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE;
+        observation.confidence = HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT;
+
+        let identity = translator
+            .translate(observation)
+            .expect("feature inventory identity translates");
+        assert_eq!(identity.disposition, PassiveDisposition::Applied);
+        assert!(matches!(
+            &identity.observations[0].kind,
+            LifecycleObservationKind::RegisterDevice(child)
+                if child.device_kind() == DeviceKind::Mouse
+                    && child.product_id().get() == 0x00cd
+        ));
+    }
+
     #[test]
     fn qualified_mouse_decoder_projects_identity_contact_route_and_battery() {
         let mut translator = translator();
diff --git a/crates/hfx-kernel-transport/src/generated.rs b/crates/hfx-kernel-transport/src/generated.rs
index 2ed2c3d..c6ce323 100644
--- a/crates/hfx-kernel-transport/src/generated.rs
+++ b/crates/hfx-kernel-transport/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// UAPI source SHA-256: 59b7156060ce299e568aa4abb75d35f4f7902f89ccb2f3263dca0869100cc864
+// UAPI source SHA-256: e93cdf3e8232d6178015125934b256b671e0560a2b934c193be29b250389e24f
 
 #[repr(C, align(8))]
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
@@ -64,6 +64,7 @@ pub const HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE: u32 = 2;
 pub const HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE: u32 = 1;
 pub const HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT: u32 = 2;
 pub const HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT: u32 = 3;
+pub const HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE: u32 = 4;
 
 pub const HFX_UAPI_OBSERVATION_CONFIDENCE_RAW: u32 = 1;
 pub const HFX_UAPI_OBSERVATION_CONFIDENCE_OBSERVED: u32 = 2;
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 6792622..c4356bc 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c
+// Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -78,7 +78,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c";
+    "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -378,8 +378,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "receiver.razer.hyperflux-v2.1532-00cf",
-        runtime_sha256: "473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a",
-        revision: 1,
+        runtime_sha256: "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6",
+        revision: 2,
         profile_kind: ProfileKind::Receiver,
         device_kind: DeviceKind::Receiver,
         vendor_id: Some(5426),
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 901e5d1..09689b9 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,11 +33,11 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `150` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `151` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
-| `kernel-source` | 13 | `-` |
+| `kernel-source` | 14 | `-` |
 | `dkms-configuration` | 1 | `-` |
 | `bridge-service` | 1 | `-` |
 | `activation-service` | 1 | `-` |
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 4c7239c..2bfe186 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c`
+Profile source: `d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -12,7 +12,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `f72d38a70e9f` | 7 | 7 |
 | **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `fcdd53fe104e` | 6 | 7 |
-| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `473bd889b810` | 4 | 2 |
+| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
 ## Composition Contract
@@ -84,7 +84,7 @@ Boundary: The mapping applies only to paired PID 0x00cd through the reviewed Hyp
 
 ### `claim.child.00cd.passive-identity-telemetry`
 
-Passive reports provide generation-bound mouse identity, contact, connection evidence, and bounded battery telemetry. Evidence: `hardware-qualified`; privacy: `public-summary`.
+Generation-bound pairing inventory and passive reports provide mouse identity, contact, connection evidence, and bounded battery telemetry. Evidence: `hardware-qualified`; privacy: `public-summary`.
 
 Boundary: Missing or stale evidence remains unknown; contact does not prove physical power or sleep.
 
@@ -96,7 +96,7 @@ Boundary: The transport map does not qualify another PID or another physical key
 
 ### `claim.child.0296.passive-identity-telemetry`
 
-Passive reports provide generation-bound keyboard identity, connection evidence, and bounded battery telemetry. Evidence: `hardware-qualified`; privacy: `public-summary`.
+Generation-bound pairing inventory and passive reports provide keyboard identity, connection evidence, and bounded battery telemetry. Evidence: `hardware-qualified`; privacy: `public-summary`.
 
 Boundary: External USB power does not establish a direct USB data route, battery capacity, or charging semantics.
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index d1c14eb..7b6e326 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,11 +1,11 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c */
+/* Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
 #endif
 
-HFX_RECEIVER_PROFILE(0x1532, 0x00cf, 1)
+HFX_RECEIVER_PROFILE(0x1532, 0x00cf, 1, HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1)
 
 #undef HFX_RECEIVER_PROFILE
diff --git a/driver/kernel/hyperflux-next-core.c b/driver/kernel/hyperflux-next-core.c
index ffca56c..6c0e582 100644
--- a/driver/kernel/hyperflux-next-core.c
+++ b/driver/kernel/hyperflux-next-core.c
@@ -7,6 +7,7 @@
 #include <linux/slab.h>
 
 #include "hyperflux-next-internal.h"
+#include "hyperflux-next-pairing-inventory.h"
 #include "hyperflux-next-passive.h"
 #include "hyperflux-next-version.h"
 
@@ -270,16 +271,75 @@ static void hfx_set_suspended(struct hfx_interface *interface, bool suspended)
 	}
 }
 
+static void hfx_pairing_inventory_bootstrap(
+	struct hfx_interface *interface,
+	const struct hfx_receiver_profile *profile)
+{
+	struct hfx_pairing_inventory inventory = { };
+	unsigned char *report;
+	bool conflict;
+	int parse_result;
+	int ret;
+
+	if (!interface || !interface->receiver || !profile ||
+	    profile->pairing_inventory_kind == HFX_PAIRING_INVENTORY_NONE)
+		return;
+	if (profile->pairing_inventory_kind !=
+	    HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1)
+		return;
+	if (interface->interface_number != HFX_PAIRING_INVENTORY_INTERFACE ||
+	    hfx_observation_identity_complete(interface->receiver))
+		return;
+
+	report = kzalloc(HFX_PAIRING_INVENTORY_REPORT_BYTES, GFP_KERNEL);
+	if (!report)
+		return;
+	report[0] = HFX_PAIRING_INVENTORY_REPORT_ID;
+	mutex_lock(&interface->receiver->transport_lock);
+	ret = hid_hw_raw_request(interface->hdev,
+				 HFX_PAIRING_INVENTORY_REPORT_ID, report,
+				 HFX_PAIRING_INVENTORY_REPORT_BYTES,
+				 HID_FEATURE_REPORT, HID_REQ_GET_REPORT);
+	mutex_unlock(&interface->receiver->transport_lock);
+	if (ret != HFX_PAIRING_INVENTORY_REPORT_BYTES) {
+		hid_warn(interface->hdev,
+			 "pairing inventory read failed: %d\n", ret);
+		goto out;
+	}
+
+	parse_result = hfx_pairing_inventory_parse(report, ret, &inventory);
+	if (parse_result != HFX_PAIRING_INVENTORY_OK) {
+		hid_warn(interface->hdev,
+			 "pairing inventory report rejected: %d\n",
+			 parse_result);
+		goto out;
+	}
+	conflict = hfx_observe_pairing_inventory(
+		interface->receiver, inventory.pointer_product_id,
+		inventory.keyboard_product_id);
+	if (conflict) {
+		hfx_session_revoke(interface->receiver,
+				   HFX_UAPI_REVOKE_REASON_GENERATION_CHANGE);
+		hid_warn(interface->hdev,
+			 "pairing inventory conflicts with passive identity\n");
+	} else {
+		hid_info(interface->hdev,
+			 "accepted generation-bound pairing inventory\n");
+	}
+out:
+	memzero_explicit(report, HFX_PAIRING_INVENTORY_REPORT_BYTES);
+	kfree(report);
+}
+
 static int hfx_raw_event(struct hid_device *hdev, struct hid_report *report,
 			 u8 *data, int size)
 {
 	struct hfx_interface *interface = hid_get_drvdata(hdev);
 
-	(void)report;
-	if (!interface || !interface->receiver || !data || size <= 0)
+	if (!interface || !interface->receiver || !report || !data || size <= 0)
 		return 0;
 	hfx_observe_activity(interface->receiver, interface->interface_number,
-			     data, size);
+			     report->id, size);
 	hfx_observe_passive(interface->receiver, interface->interface_number,
 			    data, size);
 	return 0;
@@ -325,6 +385,7 @@ static int hfx_probe(struct hid_device *hdev, const struct hid_device_id *id)
 	if (ret)
 		goto err_receiver;
 	interface->started = true;
+	hfx_pairing_inventory_bootstrap(interface, profile);
 	hid_info(hdev, "HyperFlux Next bound interface %d, generation %llu\n",
 		 interface_number, interface->receiver->generation);
 	return 0;
@@ -370,7 +431,7 @@ static int hfx_resume(struct hid_device *hdev)
 }
 
 static const struct hid_device_id hfx_devices[] = {
-#define HFX_RECEIVER_PROFILE(vendor, product, backend) \
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
 	{ HID_USB_DEVICE((vendor), (product)), .driver_data = (backend) },
 #include "generated/hyperflux_receiver_profiles.inc"
 #undef HFX_RECEIVER_PROFILE
diff --git a/driver/kernel/hyperflux-next-internal.h b/driver/kernel/hyperflux-next-internal.h
index f9da505..9c5a170 100644
--- a/driver/kernel/hyperflux-next-internal.h
+++ b/driver/kernel/hyperflux-next-internal.h
@@ -109,9 +109,13 @@ void hfx_observation_emit(struct hfx_receiver *receiver, u32 kind,
 			  u32 endpoint_slot, u32 source, u32 confidence,
 			  u32 value, u32 auxiliary);
 void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number,
-			  const u8 *data, int size);
+			  unsigned int report_id, int size);
 void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 			 const u8 *data, int size);
+bool hfx_observation_identity_complete(struct hfx_receiver *receiver);
+bool hfx_observe_pairing_inventory(struct hfx_receiver *receiver,
+				   u16 pointer_product_id,
+				   u16 keyboard_product_id);
 void hfx_observation_replay_cached_identities(struct hfx_receiver *receiver);
 bool hfx_observation_identity_conflicted(struct hfx_receiver *receiver);
 long hfx_observation_read(struct hfx_receiver *receiver, void __user *user_arg);
diff --git a/driver/kernel/hyperflux-next-observation.c b/driver/kernel/hyperflux-next-observation.c
index 72c782d..693b1d1 100644
--- a/driver/kernel/hyperflux-next-observation.c
+++ b/driver/kernel/hyperflux-next-observation.c
@@ -5,6 +5,7 @@
 #include <linux/uaccess.h>
 
 #include "hyperflux-next-internal.h"
+#include "hyperflux-next-pairing-inventory.h"
 #include "hyperflux-next-passive.h"
 
 static void hfx_observation_append_locked(struct hfx_receiver *receiver,
@@ -47,13 +48,13 @@ void hfx_observation_emit(struct hfx_receiver *receiver, u32 kind,
 }
 
 void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number,
-			  const u8 *data, int size)
+			  unsigned int report_id, int size)
 {
 	unsigned long flags;
 	u64 now_ns = ktime_get_boottime_ns();
 	u32 slot;
 
-	if (!hfx_activity_slot(interface_number, data, size, &slot))
+	if (!hfx_activity_slot(interface_number, report_id, size, &slot))
 		return;
 
 	spin_lock_irqsave(&receiver->observation_lock, flags);
@@ -72,7 +73,7 @@ void hfx_observe_activity(struct hfx_receiver *receiver, int interface_number,
 
 static bool hfx_observe_product_id_locked(struct hfx_receiver *receiver,
 					  u64 now_ns, u32 slot,
-					  u16 product_id)
+					  u16 product_id, u32 source)
 {
 	if (receiver->observed_product_id_valid[slot] &&
 	    receiver->observed_product_id[slot] != product_id) {
@@ -80,7 +81,7 @@ static bool hfx_observe_product_id_locked(struct hfx_receiver *receiver,
 		hfx_observation_append_locked(
 			receiver, now_ns,
 			HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT, slot,
-			HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE,
+			source,
 			HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT,
 			receiver->observed_product_id[slot], product_id);
 		return true;
@@ -90,11 +91,82 @@ static bool hfx_observe_product_id_locked(struct hfx_receiver *receiver,
 	hfx_observation_append_locked(
 		receiver, now_ns,
 		HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID, slot,
-		HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE,
+		source,
 		HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT, product_id, 0);
 	return false;
 }
 
+bool hfx_observation_identity_complete(struct hfx_receiver *receiver)
+{
+	unsigned long flags;
+	bool complete;
+
+	spin_lock_irqsave(&receiver->observation_lock, flags);
+	complete = !receiver->identity_conflict &&
+		receiver->observed_product_id_valid[
+			HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE] &&
+		receiver->observed_product_id_valid[
+			HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE];
+	spin_unlock_irqrestore(&receiver->observation_lock, flags);
+	return complete;
+}
+
+bool hfx_observe_pairing_inventory(struct hfx_receiver *receiver,
+				   u16 pointer_product_id,
+				   u16 keyboard_product_id)
+{
+	const u32 pointer_slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
+	const u32 keyboard_slot = HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE;
+	const struct hfx_pairing_inventory candidate = {
+		.pointer_product_id = pointer_product_id,
+		.keyboard_product_id = keyboard_product_id,
+	};
+	unsigned long flags;
+	u64 now_ns = ktime_get_boottime_ns();
+	bool pointer_conflict;
+	bool keyboard_conflict;
+
+	spin_lock_irqsave(&receiver->observation_lock, flags);
+	pointer_conflict = hfx_pairing_inventory_conflicts(
+		receiver->observed_product_id_valid[pointer_slot],
+		receiver->observed_product_id[pointer_slot], false, 0,
+		&candidate);
+	keyboard_conflict = hfx_pairing_inventory_conflicts(
+		false, 0,
+		receiver->observed_product_id_valid[keyboard_slot],
+		receiver->observed_product_id[keyboard_slot], &candidate);
+	if (pointer_conflict || keyboard_conflict) {
+		receiver->identity_conflict = true;
+		if (pointer_conflict)
+			hfx_observation_append_locked(
+				receiver, now_ns,
+				HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT,
+				pointer_slot,
+				HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE,
+				HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT,
+				receiver->observed_product_id[pointer_slot],
+				pointer_product_id);
+		if (keyboard_conflict)
+			hfx_observation_append_locked(
+				receiver, now_ns,
+				HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT,
+				keyboard_slot,
+				HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE,
+				HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT,
+				receiver->observed_product_id[keyboard_slot],
+				keyboard_product_id);
+	} else {
+		hfx_observe_product_id_locked(
+			receiver, now_ns, pointer_slot, pointer_product_id,
+			HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE);
+		hfx_observe_product_id_locked(
+			receiver, now_ns, keyboard_slot, keyboard_product_id,
+			HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE);
+	}
+	spin_unlock_irqrestore(&receiver->observation_lock, flags);
+	return pointer_conflict || keyboard_conflict;
+}
+
 bool hfx_observation_identity_conflicted(struct hfx_receiver *receiver)
 {
 	unsigned long flags;
@@ -148,7 +220,8 @@ void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 	case HFX_PASSIVE_POINTER_IDENTITY:
 		slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
 		conflict = hfx_observe_product_id_locked(receiver, now_ns, slot,
-							 report.product_id);
+							 report.product_id,
+							 HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE);
 		hfx_observation_append_locked(
 			receiver, now_ns,
 			HFX_UAPI_OBSERVATION_KIND_ENDPOINT_CONTACT_RAW, slot,
@@ -177,7 +250,8 @@ void hfx_observe_passive(struct hfx_receiver *receiver, int interface_number,
 	case HFX_PASSIVE_KEYBOARD_IDENTITY:
 		slot = HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE;
 		conflict = hfx_observe_product_id_locked(receiver, now_ns, slot,
-							 report.product_id);
+							 report.product_id,
+							 HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE);
 		hfx_observation_append_locked(
 			receiver, now_ns,
 			HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ROUTE_RAW, slot,
diff --git a/driver/kernel/hyperflux-next-pairing-inventory.h b/driver/kernel/hyperflux-next-pairing-inventory.h
new file mode 100644
index 0000000..bc0a653
--- /dev/null
+++ b/driver/kernel/hyperflux-next-pairing-inventory.h
@@ -0,0 +1,99 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef HYPERFLUX_NEXT_PAIRING_INVENTORY_H
+#define HYPERFLUX_NEXT_PAIRING_INVENTORY_H
+
+#ifdef __KERNEL__
+#include <linux/string.h>
+#include <linux/types.h>
+#else
+#include <stddef.h>
+#include <string.h>
+#endif
+
+#define HFX_PAIRING_INVENTORY_INTERFACE 4
+#define HFX_PAIRING_INVENTORY_REPORT_ID 0x01
+#define HFX_PAIRING_INVENTORY_REPORT_BYTES 512
+#define HFX_PAIRING_INVENTORY_ANCHOR 266
+
+enum hfx_pairing_inventory_result {
+	HFX_PAIRING_INVENTORY_OK = 0,
+	HFX_PAIRING_INVENTORY_LENGTH,
+	HFX_PAIRING_INVENTORY_BAD_REPORT_ID,
+	HFX_PAIRING_INVENTORY_BAD_ANCHOR,
+	HFX_PAIRING_INVENTORY_BAD_PADDING,
+	HFX_PAIRING_INVENTORY_BAD_MARKER,
+	HFX_PAIRING_INVENTORY_BAD_HEADER,
+	HFX_PAIRING_INVENTORY_BAD_PRODUCT_ID,
+};
+
+struct hfx_pairing_inventory {
+	unsigned short pointer_product_id;
+	unsigned short keyboard_product_id;
+};
+
+static inline int hfx_pairing_inventory_conflicts(
+	int pointer_valid, unsigned short pointer_product_id,
+	int keyboard_valid, unsigned short keyboard_product_id,
+	const struct hfx_pairing_inventory *candidate)
+{
+	if (!candidate)
+		return 1;
+	return (pointer_valid &&
+		pointer_product_id != candidate->pointer_product_id) ||
+	       (keyboard_valid &&
+		keyboard_product_id != candidate->keyboard_product_id);
+}
+
+static inline int hfx_pairing_inventory_product_id_valid(
+	unsigned short product_id)
+{
+	return product_id != 0 && product_id != 0xffffU;
+}
+
+static inline enum hfx_pairing_inventory_result
+hfx_pairing_inventory_parse(const unsigned char *report, size_t length,
+			    struct hfx_pairing_inventory *inventory)
+{
+	static const unsigned char anchor_prefix[16] = {
+		0x00, 0x00, 0xa5, 0x85, 0x01, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0x00,
+	};
+	static const unsigned char tail_header[16] = {
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xdf, 0xa6,
+		0x33, 0x4e, 0x01, 0x00, 0x04, 0xa3, 0x22, 0x00,
+	};
+	const size_t anchor = HFX_PAIRING_INVENTORY_ANCHOR;
+	unsigned short pointer_product_id;
+	unsigned short keyboard_product_id;
+	size_t index;
+
+	if (!report || !inventory ||
+	    length != HFX_PAIRING_INVENTORY_REPORT_BYTES)
+		return HFX_PAIRING_INVENTORY_LENGTH;
+	if (report[0] != HFX_PAIRING_INVENTORY_REPORT_ID)
+		return HFX_PAIRING_INVENTORY_BAD_REPORT_ID;
+	if (memcmp(&report[anchor - sizeof(anchor_prefix)], anchor_prefix,
+		   sizeof(anchor_prefix)))
+		return HFX_PAIRING_INVENTORY_BAD_ANCHOR;
+	for (index = anchor + 15; index < anchor + 20; index++)
+		if (report[index] != 0)
+			return HFX_PAIRING_INVENTORY_BAD_PADDING;
+	if (report[anchor + 20] != 0xff || report[anchor + 21] != 0xff)
+		return HFX_PAIRING_INVENTORY_BAD_MARKER;
+	if (memcmp(&report[anchor + 22], tail_header, sizeof(tail_header)))
+		return HFX_PAIRING_INVENTORY_BAD_HEADER;
+
+	pointer_product_id = ((unsigned short)report[anchor + 38] << 8) |
+		report[anchor + 39];
+	keyboard_product_id = ((unsigned short)report[anchor + 40] << 8) |
+		report[anchor + 41];
+	if (!hfx_pairing_inventory_product_id_valid(pointer_product_id) ||
+	    !hfx_pairing_inventory_product_id_valid(keyboard_product_id))
+		return HFX_PAIRING_INVENTORY_BAD_PRODUCT_ID;
+
+	inventory->pointer_product_id = pointer_product_id;
+	inventory->keyboard_product_id = keyboard_product_id;
+	return HFX_PAIRING_INVENTORY_OK;
+}
+
+#endif
diff --git a/driver/kernel/hyperflux-next-passive.h b/driver/kernel/hyperflux-next-passive.h
index f179707..5913557 100644
--- a/driver/kernel/hyperflux-next-passive.h
+++ b/driver/kernel/hyperflux-next-passive.h
@@ -15,10 +15,11 @@
 #define HFX_COMPOSITE_SYSTEM_REPORT 0x03
 #define HFX_COMPOSITE_POINTER_REPORT 0x0a
 
-static inline int hfx_activity_slot(int interface_number, const __u8 *data,
-				    int size, __u32 *slot)
+static inline int hfx_activity_slot(int interface_number,
+				    unsigned int report_id, int size,
+				    __u32 *slot)
 {
-	if (!data || size <= 0 || !slot)
+	if (size <= 0 || !slot)
 		return 0;
 	if (interface_number == HFX_POINTER_INPUT_INTERFACE) {
 		*slot = HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE;
@@ -31,7 +32,7 @@ static inline int hfx_activity_slot(int interface_number, const __u8 *data,
 	if (interface_number != HFX_PASSIVE_REPORT_INTERFACE)
 		return 0;
 
-	switch (data[0]) {
+	switch (report_id) {
 	case HFX_COMPOSITE_KEYBOARD_REPORT:
 	case HFX_COMPOSITE_CONSUMER_REPORT:
 	case HFX_COMPOSITE_SYSTEM_REPORT:
diff --git a/driver/kernel/hyperflux-next-profile.c b/driver/kernel/hyperflux-next-profile.c
index ce4e1d1..624e605 100644
--- a/driver/kernel/hyperflux-next-profile.c
+++ b/driver/kernel/hyperflux-next-profile.c
@@ -4,8 +4,9 @@
 
 #include "hyperflux-next-profile.h"
 
-#define HFX_RECEIVER_PROFILE(vendor, product, backend) \
-	{ .vendor_id = (vendor), .product_id = (product), .backend_id = (backend) },
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
+	{ .vendor_id = (vendor), .product_id = (product), .backend_id = (backend), \
+	  .pairing_inventory_kind = (inventory) },
 
 static const struct hfx_receiver_profile hfx_receiver_profiles[] = {
 #include "generated/hyperflux_receiver_profiles.inc"
diff --git a/driver/kernel/hyperflux-next-profile.h b/driver/kernel/hyperflux-next-profile.h
index bc088d4..e7bf178 100644
--- a/driver/kernel/hyperflux-next-profile.h
+++ b/driver/kernel/hyperflux-next-profile.h
@@ -4,10 +4,16 @@
 
 #include <linux/types.h>
 
+enum hfx_pairing_inventory_kind {
+	HFX_PAIRING_INVENTORY_NONE = 0,
+	HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1 = 1,
+};
+
 struct hfx_receiver_profile {
 	u16 vendor_id;
 	u16 product_id;
 	u32 backend_id;
+	u32 pairing_inventory_kind;
 };
 
 const struct hfx_receiver_profile *hfx_receiver_profile_find(u16 vendor_id,
diff --git a/driver/kernel/uapi/hyperflux_next.h b/driver/kernel/uapi/hyperflux_next.h
index 02c05cd..e4882bd 100644
--- a/driver/kernel/uapi/hyperflux_next.h
+++ b/driver/kernel/uapi/hyperflux_next.h
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* UAPI source SHA-256: 59b7156060ce299e568aa4abb75d35f4f7902f89ccb2f3263dca0869100cc864 */
+/* UAPI source SHA-256: e93cdf3e8232d6178015125934b256b671e0560a2b934c193be29b250389e24f */
 
 #ifndef _UAPI_HYPERFLUX_NEXT_H
 #define _UAPI_HYPERFLUX_NEXT_H
@@ -66,6 +66,7 @@
 #define HFX_UAPI_OBSERVATION_SOURCE_HID_PASSIVE 1U
 #define HFX_UAPI_OBSERVATION_SOURCE_HID_INPUT 2U
 #define HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT 3U
+#define HFX_UAPI_OBSERVATION_SOURCE_HID_FEATURE 4U
 
 #define HFX_UAPI_OBSERVATION_CONFIDENCE_RAW 1U
 #define HFX_UAPI_OBSERVATION_CONFIDENCE_OBSERVED 2U
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 738505b..0dc4993 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "6d7add956c9649e9e343598f6102c8191edcd5c57e2da488f0fedf448e76e27a",
+  "source_sha256": "53e22a40aefc7f86292f9d1e2c495c3cf38329c1bbacefd6004af4baa74c4b35",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index 2de476f..a393ff6 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -508,7 +508,7 @@
           "source_id": "engineering-laboratory"
         }
       ],
-      "summary": "Passive reports provide generation-bound mouse identity, contact, connection evidence, and bounded battery telemetry."
+      "summary": "Generation-bound pairing inventory and passive reports provide mouse identity, contact, connection evidence, and bounded battery telemetry."
     },
     {
       "evidence_level": "hardware-qualified",
@@ -562,7 +562,7 @@
           "source_id": "engineering-laboratory"
         }
       ],
-      "summary": "Passive reports provide generation-bound keyboard identity, connection evidence, and bounded battery telemetry."
+      "summary": "Generation-bound pairing inventory and passive reports provide keyboard identity, connection evidence, and bounded battery telemetry."
     },
     {
       "evidence_level": "hardware-qualified",
@@ -1301,8 +1301,8 @@
         "Receiver inventory does not imply child availability.",
         "The receiver and mat do not appear as addressable RGB controllers."
       ],
-      "revision": 1,
-      "runtime_sha256": "473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a",
+      "revision": 2,
+      "runtime_sha256": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/receivers/razer-hyperflux-v2-1532-00cf.json",
       "transport": {
@@ -1310,7 +1310,10 @@
         "backend": "structured-feature-set-report-v1",
         "backend_id": 1,
         "generation_bound": true,
-        "maximum_targets": 115
+        "maximum_targets": 115,
+        "pairing_inventory": {
+          "decoder": "razer-hyperflux-v2-feature-01-v1"
+        }
       }
     },
     {
@@ -1362,5 +1365,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c"
+  "source_sha256": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
 }
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index fa8234e..93c59eb 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -109,6 +109,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "kernel-source",
+      "source": "driver/kernel/hyperflux-next-pairing-inventory.h",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-pairing-inventory.h",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-passive.h",
diff --git a/profiles/evidence/claims.json b/profiles/evidence/claims.json
index 5fd2a9f..ab9b805 100644
--- a/profiles/evidence/claims.json
+++ b/profiles/evidence/claims.json
@@ -34,7 +34,7 @@
     },
     {
       "id": "claim.child.00cd.passive-identity-telemetry",
-      "summary": "Passive reports provide generation-bound mouse identity, contact, connection evidence, and bounded battery telemetry.",
+      "summary": "Generation-bound pairing inventory and passive reports provide mouse identity, contact, connection evidence, and bounded battery telemetry.",
       "evidence_level": "hardware-qualified",
       "privacy": "public-summary",
       "profile_ids": ["child.razer.basilisk-v3-pro-35k.00cd"],
@@ -54,7 +54,7 @@
     },
     {
       "id": "claim.child.0296.passive-identity-telemetry",
-      "summary": "Passive reports provide generation-bound keyboard identity, connection evidence, and bounded battery telemetry.",
+      "summary": "Generation-bound pairing inventory and passive reports provide keyboard identity, connection evidence, and bounded battery telemetry.",
       "evidence_level": "hardware-qualified",
       "privacy": "public-summary",
       "profile_ids": ["child.razer.deathstalker-v2-pro-tkl.0296"],
diff --git a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
index 54b1e4e..4b1588c 100644
--- a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
+++ b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
@@ -2,12 +2,12 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "receiver.razer.hyperflux-v2.1532-00cf",
-  "revision": 1,
+  "revision": 2,
   "kind": "receiver",
   "device_kind": "receiver",
   "identity": {"manufacturer": "Razer", "model_name": "Razer HyperFlux V2 Receiver", "authority": "usb", "vendor_id": 5426, "product_id": 207},
   "compatibility": {"protocol_family": "razer-hyperflux-v2", "supported_child_kinds": ["keyboard", "mouse"], "exact_child_combinations": false},
-  "transport": {"backend": "structured-feature-set-report-v1", "backend_id": 1, "maximum_targets": 115, "generation_bound": true, "application_raw_frames": false},
+  "transport": {"backend": "structured-feature-set-report-v1", "backend_id": 1, "maximum_targets": 115, "generation_bound": true, "application_raw_frames": false, "pairing_inventory": {"decoder": "razer-hyperflux-v2-feature-01-v1"}},
   "capabilities": [
     {"id": "identity.model", "support_level": "identified", "evidence_claims": ["claim.receiver.1532-00cf.generation-session"]},
     {"id": "identity.paired-product-id", "support_level": "read-only", "evidence_claims": ["claim.receiver.1532-00cf.generation-session"]},
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 75c37f4..d8a6242 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -72,10 +72,19 @@
         "maximum_targets": {"type": "integer", "minimum": 1, "maximum": 65535},
         "generation_bound": {"type": "boolean"},
         "application_raw_frames": {"type": "boolean"},
+        "pairing_inventory": {"$ref": "#/$defs/pairing-inventory"},
         "lighting": {"$ref": "#/$defs/lighting"},
         "passive": {"$ref": "#/$defs/passive"}
       }
     },
+    "pairing-inventory": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["decoder"],
+      "properties": {
+        "decoder": {"enum": ["razer-hyperflux-v2-feature-01-v1"]}
+      }
+    },
     "lighting": {
       "type": "object",
       "additionalProperties": false,
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 988fba1..a7827e0 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c
+// Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c";
+inline constexpr std::string_view profile_source_sha256 = "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -162,7 +162,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33", 1, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
     {"child.razer.deathstalker-v2-pro-tkl.0296", "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", 1, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
-    {"receiver.razer.hyperflux-v2.1532-00cf", "473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a", 1, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
+    {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
 }};
 
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index dfba73f..72ef6d3 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c'
+PROFILE_SOURCE_SHA256: Final = 'd2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -337,8 +337,8 @@
                       'source_refs': [{'paths': ['docs/qualification/HW-001.md',
                                                  'evidence-index/id9-legacy-readonly-capability-audit-20260711.md'],
                                        'source_id': 'engineering-laboratory'}],
-                      'summary': 'Passive reports provide generation-bound mouse identity, contact, connection '
-                                 'evidence, and bounded battery telemetry.'},
+                      'summary': 'Generation-bound pairing inventory and passive reports provide mouse identity, '
+                                 'contact, connection evidence, and bounded battery telemetry.'},
                      {'evidence_level': 'hardware-qualified',
                       'id': 'claim.child.0296.complete-keyboard-map',
                       'limitations': ['The transport map does not qualify another PID or another physical '
@@ -366,8 +366,8 @@
                       'source_refs': [{'paths': ['docs/qualification/HW-001.md',
                                                  'evidence-index/id9-legacy-readonly-capability-audit-20260711.md'],
                                        'source_id': 'engineering-laboratory'}],
-                      'summary': 'Passive reports provide generation-bound keyboard identity, connection evidence, and '
-                                 'bounded battery telemetry.'},
+                      'summary': 'Generation-bound pairing inventory and passive reports provide keyboard identity, '
+                                 'connection evidence, and bounded battery telemetry.'},
                      {'evidence_level': 'hardware-qualified',
                       'id': 'claim.children.complete-static-black',
                       'limitations': ['Visible black is an RGB value, not proof of firmware lighting-off or physical '
@@ -788,15 +788,16 @@
                'restrictions': ['Unknown children receive zero writable capabilities.',
                                 'Receiver inventory does not imply child availability.',
                                 'The receiver and mat do not appear as addressable RGB controllers.'],
-               'revision': 1,
-               'runtime_sha256': '473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a',
+               'revision': 2,
+               'runtime_sha256': 'ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/receivers/razer-hyperflux-v2-1532-00cf.json',
                'transport': {'application_raw_frames': False,
                              'backend': 'structured-feature-set-report-v1',
                              'backend_id': 1,
                              'generation_bound': True,
-                             'maximum_targets': 115}},
+                             'maximum_targets': 115,
+                             'pairing_inventory': {'decoder': 'razer-hyperflux-v2-feature-01-v1'}}},
               {'capabilities': [{'access': 'read',
                                  'evidence_claims': ['claim.surface.hard-edition.identity-indicator'],
                                  'id': 'identity.model',
@@ -823,7 +824,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c'}
+ 'source_sha256': 'd2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/c/kernel_protocol_smoke.c b/tests/c/kernel_protocol_smoke.c
index ad80e3b..e856586 100644
--- a/tests/c/kernel_protocol_smoke.c
+++ b/tests/c/kernel_protocol_smoke.c
@@ -3,9 +3,38 @@
 #include <assert.h>
 #include <string.h>
 
+#include "hyperflux-next-pairing-inventory.h"
 #include "hyperflux-next-passive.h"
 #include "hyperflux-next-wire.h"
 
+static void pairing_inventory_report(
+	unsigned char report[HFX_PAIRING_INVENTORY_REPORT_BYTES],
+	unsigned short pointer_product_id,
+	unsigned short keyboard_product_id)
+{
+	static const unsigned char prefix[16] = {
+		0x00, 0x00, 0xa5, 0x85, 0x01, 0x00, 0x00, 0x00,
+		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0x00,
+	};
+	static const unsigned char header[16] = {
+		0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xdf, 0xa6,
+		0x33, 0x4e, 0x01, 0x00, 0x04, 0xa3, 0x22, 0x00,
+	};
+	const size_t anchor = HFX_PAIRING_INVENTORY_ANCHOR;
+
+	memset(report, 0, HFX_PAIRING_INVENTORY_REPORT_BYTES);
+	report[0] = HFX_PAIRING_INVENTORY_REPORT_ID;
+	memcpy(&report[anchor - sizeof(prefix)], prefix, sizeof(prefix));
+	memset(&report[anchor], 'X', 15);
+	report[anchor + 20] = 0xff;
+	report[anchor + 21] = 0xff;
+	memcpy(&report[anchor + 22], header, sizeof(header));
+	report[anchor + 38] = pointer_product_id >> 8;
+	report[anchor + 39] = pointer_product_id;
+	report[anchor + 40] = keyboard_product_id >> 8;
+	report[anchor + 41] = keyboard_product_id;
+}
+
 static struct hfx_uapi_frame mouse_frame(void)
 {
 	struct hfx_uapi_frame frame;
@@ -33,14 +62,12 @@ static struct hfx_uapi_frame mouse_frame(void)
 int main(void)
 {
 	struct hfx_uapi_frame frame = mouse_frame();
+	struct hfx_pairing_inventory inventory;
 	struct hfx_passive_report report;
+	unsigned char inventory_report[HFX_PAIRING_INVENTORY_REPORT_BYTES];
 	__u32 activity_slot;
 	const __u8 pointer_identity[] = { 0x05, 0x3b, 0x01, 0x00, 0xcd };
 	const __u8 keyboard_status[] = { 0x09, 0x31, 0x32, 0x12, 0x34, 0x56 };
-	const __u8 keyboard_input[] = { HFX_COMPOSITE_KEYBOARD_REPORT, 0x00 };
-	const __u8 consumer_input[] = { HFX_COMPOSITE_CONSUMER_REPORT, 0x00 };
-	const __u8 system_input[] = { HFX_COMPOSITE_SYSTEM_REPORT, 0x00 };
-	const __u8 pointer_input[] = { HFX_COMPOSITE_POINTER_REPORT, 0x00 };
 
 	assert(hfx_wire_validate_frame(&frame, HFX_HW001_BACKEND_ID) ==
 	       HFX_WIRE_VALID);
@@ -72,27 +99,84 @@ int main(void)
 	assert(hfx_passive_parse(4, pointer_identity,
 				 sizeof(pointer_identity), &report) == HFX_PASSIVE_NONE);
 
-	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, keyboard_input,
-				 sizeof(keyboard_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE,
+				 HFX_COMPOSITE_KEYBOARD_REPORT, 16,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
-	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, consumer_input,
-				 sizeof(consumer_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE,
+				 HFX_COMPOSITE_CONSUMER_REPORT, 16,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
-	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, system_input,
-				 sizeof(system_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE,
+				 HFX_COMPOSITE_SYSTEM_REPORT, 16,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
-	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, pointer_input,
-				 sizeof(pointer_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE,
+				 HFX_COMPOSITE_POINTER_REPORT, 16,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE);
-	assert(hfx_activity_slot(HFX_POINTER_INPUT_INTERFACE, pointer_input,
-				 sizeof(pointer_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_POINTER_INPUT_INTERFACE, 0, 8,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE);
-	assert(hfx_activity_slot(HFX_KEYBOARD_INPUT_INTERFACE, keyboard_input,
-				 sizeof(keyboard_input), &activity_slot));
+	assert(hfx_activity_slot(HFX_KEYBOARD_INPUT_INTERFACE, 0, 8,
+				 &activity_slot));
 	assert(activity_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE);
-	assert(!hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, keyboard_status,
-				  sizeof(keyboard_status), &activity_slot));
-	assert(!hfx_activity_slot(4, keyboard_input, sizeof(keyboard_input),
+	assert(!hfx_activity_slot(HFX_PASSIVE_REPORT_INTERFACE, 9, 16,
+				  &activity_slot));
+	assert(!hfx_activity_slot(4, HFX_COMPOSITE_KEYBOARD_REPORT, 16,
 				  &activity_slot));
+
+	pairing_inventory_report(inventory_report, 0x1234, 0x5678);
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_OK);
+	assert(inventory.pointer_product_id == 0x1234);
+	assert(inventory.keyboard_product_id == 0x5678);
+	assert(!hfx_pairing_inventory_conflicts(1, 0x1234, 1, 0x5678,
+						&inventory));
+	assert(hfx_pairing_inventory_conflicts(1, 0x1235, 1, 0x5678,
+					       &inventory));
+	assert(hfx_pairing_inventory_conflicts(1, 0x1234, 1, 0x5679,
+					       &inventory));
+	assert(hfx_pairing_inventory_conflicts(0, 0, 0, 0, NULL));
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report) - 1,
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_LENGTH);
+	inventory_report[0] = 0;
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_REPORT_ID);
+	pairing_inventory_report(inventory_report, 0x1234, 0x5678);
+	inventory_report[HFX_PAIRING_INVENTORY_ANCHOR - 1] ^= 1;
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_ANCHOR);
+	pairing_inventory_report(inventory_report, 0x1234, 0x5678);
+	inventory_report[HFX_PAIRING_INVENTORY_ANCHOR + 15] = 1;
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_PADDING);
+	pairing_inventory_report(inventory_report, 0x1234, 0x5678);
+	inventory_report[HFX_PAIRING_INVENTORY_ANCHOR + 20] = 0;
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_MARKER);
+	pairing_inventory_report(inventory_report, 0x1234, 0x5678);
+	inventory_report[HFX_PAIRING_INVENTORY_ANCHOR + 22] ^= 1;
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_HEADER);
+	pairing_inventory_report(inventory_report, 0, 0x5678);
+	assert(hfx_pairing_inventory_parse(inventory_report,
+					   sizeof(inventory_report),
+					   &inventory) ==
+	       HFX_PAIRING_INVENTORY_BAD_PRODUCT_ID);
 	return 0;
 }
diff --git a/tests/cpp/kernel_profile_table_smoke.cpp b/tests/cpp/kernel_profile_table_smoke.cpp
index ec91320..2021f55 100644
--- a/tests/cpp/kernel_profile_table_smoke.cpp
+++ b/tests/cpp/kernel_profile_table_smoke.cpp
@@ -7,10 +7,13 @@ struct ReceiverMatch
     std::uint16_t vendor_id;
     std::uint16_t product_id;
     std::uint8_t backend_id;
+    std::uint8_t pairing_inventory_kind;
 };
 
-#define HFX_RECEIVER_PROFILE(vendor, product, backend) \
-    ReceiverMatch{vendor, product, backend},
+#define HFX_PAIRING_INVENTORY_NONE 0
+#define HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1 1
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
+    ReceiverMatch{vendor, product, backend, inventory},
 
 constexpr std::array receiver_matches = {
 #include "../../driver/kernel/generated/hyperflux_receiver_profiles.inc"
@@ -22,5 +25,6 @@ int main()
     static_assert(receiver_matches[0].vendor_id == 0x1532);
     static_assert(receiver_matches[0].product_id == 0x00cf);
     static_assert(receiver_matches[0].backend_id == 1);
+    static_assert(receiver_matches[0].pairing_inventory_kind == 1);
     return 0;
 }
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 07ce002..132dff0 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c"
+  "source_sha256": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
 }
diff --git a/tests/test_kernel_driver.py b/tests/test_kernel_driver.py
new file mode 100644
index 0000000..e43e69e
--- /dev/null
+++ b/tests/test_kernel_driver.py
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from pathlib import Path
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class KernelDriverContracts(unittest.TestCase):
+    def test_pairing_inventory_is_one_read_only_private_operation(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-core.c").read_text(encoding="utf-8")
+        start = source.index("static void hfx_pairing_inventory_bootstrap")
+        end = source.index("static int hfx_raw_event", start)
+        bootstrap = source[start:end]
+
+        self.assertEqual(bootstrap.count("hid_hw_raw_request"), 1)
+        self.assertIn("HID_FEATURE_REPORT", bootstrap)
+        self.assertIn("HID_REQ_GET_REPORT", bootstrap)
+        self.assertIn("memzero_explicit", bootstrap)
+        for forbidden in (
+            "HID_REQ_SET_REPORT",
+            "usb_control_msg",
+            "msleep",
+            "schedule_delayed_work",
+        ):
+            self.assertNotIn(forbidden, bootstrap)
+
+    def test_pairing_inventory_parser_does_not_bind_owner_child_ids(self) -> None:
+        source = (
+            ROOT / "driver/kernel/hyperflux-next-pairing-inventory.h"
+        ).read_text(encoding="utf-8")
+        self.assertNotIn("0x00cd", source.lower())
+        self.assertNotIn("0x0296", source.lower())
+
+    def test_composite_activity_uses_kernel_report_metadata(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-core.c").read_text(encoding="utf-8")
+        start = source.index("static int hfx_raw_event")
+        end = source.index("static int hfx_probe", start)
+        callback = source[start:end]
+        self.assertIn("report->id", callback)
+        self.assertNotIn("data[0]", callback)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index 8b5792a..d7245fb 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -606,9 +606,19 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
             continue
         identity = profile["identity"]
         transport = profile["transport"]
+        inventory_decoder = transport.get("pairing_inventory", {}).get("decoder")
+        inventory_kind = {
+            None: "HFX_PAIRING_INVENTORY_NONE",
+            "razer-hyperflux-v2-feature-01-v1": (
+                "HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1"
+            ),
+        }.get(inventory_decoder)
+        if inventory_kind is None:
+            raise ValueError(f"unsupported kernel pairing inventory decoder: {inventory_decoder}")
         lines.append(
             f'HFX_RECEIVER_PROFILE(0x{identity["vendor_id"]:04x}, '
-            f'0x{identity["product_id"]:04x}, {transport["backend_id"]})'
+            f'0x{identity["product_id"]:04x}, {transport["backend_id"]}, '
+            f'{inventory_kind})'
         )
     lines.extend(["", "#undef HFX_RECEIVER_PROFILE", ""])
     return "\n".join(lines)
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index fc997de..471311d 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -474,9 +474,25 @@ def _validate_passive(profile: dict[str, Any]) -> None:
                 "maximum_targets",
                 "generation_bound",
                 "application_raw_frames",
+                "pairing_inventory",
             },
             f"{profile['profile_id']} receiver transport",
         )
+        inventory = transport.get("pairing_inventory")
+        if inventory is not None:
+            if not isinstance(inventory, dict):
+                raise ModelError(
+                    f"{profile['profile_id']}: pairing inventory must be an object"
+                )
+            _expect_keys(
+                inventory,
+                {"decoder"},
+                f"{profile['profile_id']} pairing inventory",
+            )
+            if inventory.get("decoder") != "razer-hyperflux-v2-feature-01-v1":
+                raise ModelError(
+                    f"{profile['profile_id']}: unsupported pairing inventory decoder"
+                )
         return
     if kind != "child":
         if transport:
diff --git a/uapi/kernel-uapi.json b/uapi/kernel-uapi.json
index d24d7a4..d0149b5 100644
--- a/uapi/kernel-uapi.json
+++ b/uapi/kernel-uapi.json
@@ -91,7 +91,8 @@
       "values": [
         {"name": "hid_passive", "value": 1},
         {"name": "hid_input", "value": 2},
-        {"name": "power_management", "value": 3}
+        {"name": "power_management", "value": 3},
+        {"name": "hid_feature", "value": 4}
       ]
     },
     {

From 481107c76a652bb23b5cf555004d4976130f58d4 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 14:02:42 +0400
Subject: [PATCH 16/67] test(qualification): refresh receiver profile fixtures

---
 .../tests/fixtures/rust-qualified-mouse.json                  | 4 ++--
 .../tests/fixtures/rust-qualified-pair.json                   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 0551589..7a5e927 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c"
+    "profile_catalog_digest": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a"
+        "digest": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 8019d5a..a17eba3 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "ce03f5454202c2b497beaf3a0142adfaf11e0536d7b420736cefeaefe3d7761c"
+    "profile_catalog_digest": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "473bd889b810ae22bdfeb5258eadd46762aa6b0379bd57bcf6285273557b5b8a"
+        "digest": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
       },
       "lifecycle": "active",
       "devices": [

From 7ad924293ea5379bb056e6e9c7ea4a2f546ed0c9 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 16:31:55 +0400
Subject: [PATCH 17/67] fix: gate lifecycle restore on device readiness

---
 crates/hfx-daemon/src/manager.rs              |  78 +---
 crates/hfx-daemon/src/observation.rs          | 142 ++++--
 crates/hfx-daemon/src/restoration.rs          | 312 ++++++++++++-
 crates/hfx-ops/src/lib.rs                     |   1 +
 crates/hfx-ops/src/probe.rs                   |  98 +++-
 crates/hfx-ops/src/qualification.rs           |  38 +-
 .../src/qualification_event_evidence.rs       | 419 ++++++++++++++++++
 crates/hfx-ops/src/qualification_lifecycle.rs | 215 ++++++++-
 crates/hfx-ops/src/qualification_server.rs    |  10 +-
 crates/hfx-ops/src/qualification_state.rs     |  68 ++-
 10 files changed, 1227 insertions(+), 154 deletions(-)
 create mode 100644 crates/hfx-ops/src/qualification_event_evidence.rs

diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index 20140a8..dd018a8 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -13,7 +13,7 @@ use hfx_bridge::{
 };
 use hfx_core::{Clock, LifecycleError, RestorationError};
 use hfx_domain::{
-    DomainValueError, EvidenceClaimId, EvidenceConfidence, MonotonicMs, PresenceState, ReceiverId,
+    DomainValueError, EvidenceClaimId, EvidenceConfidence, MonotonicMs, ReceiverId,
     ReceiverLifecycleState, SequenceNumber,
 };
 use hfx_kernel_transport::{
@@ -431,46 +431,28 @@ impl LinuxRuntimeManager {
         translation: PassiveTranslation,
         backend: &mut ProductionBackend,
     ) -> Result<(), RuntimeTickError> {
-        let mut scheduled_returns = BTreeSet::new();
         for observation in translation.observations {
             let sequence = observation.stamp.sequence();
             let outcome = backend
                 .observe_lifecycle(observation)
                 .map_err(RuntimeTickError::Observation)?;
-            if let LifecycleObservationOutcome::Applied(applied) = outcome {
-                if matches!(
+            if let LifecycleObservationOutcome::Applied(applied) = outcome
+                && matches!(
                     applied.receiver_before,
                     ReceiverLifecycleState::Suspended | ReceiverLifecycleState::PartiallySuspended
-                ) && applied.receiver_after == ReceiverLifecycleState::Active
-                {
-                    self.restoration
-                        .schedule_system_resume(
-                            applied.receiver_id.clone(),
-                            applied.generation_id,
-                            sequence,
-                        )
-                        .map_err(RuntimeTickError::Restoration)?;
-                }
-                if is_device_return_transition(
-                    applied.device_presence_before,
-                    applied.device_presence_after,
-                ) && let Some(device_id) = applied.device_id
-                {
-                    scheduled_returns.insert(device_id.clone());
-                    self.restoration
-                        .schedule_device_return(
-                            applied.receiver_id,
-                            applied.generation_id,
-                            device_id,
-                            sequence,
-                        )
-                        .map_err(RuntimeTickError::Restoration)?;
-                }
+                )
+                && applied.receiver_after == ReceiverLifecycleState::Active
+            {
+                self.restoration
+                    .schedule_system_resume(
+                        applied.receiver_id.clone(),
+                        applied.generation_id,
+                        sequence,
+                    )
+                    .map_err(RuntimeTickError::Restoration)?;
             }
         }
-        if let Some(device_id) = translation.activity_resumption
-            && !scheduled_returns.contains(&device_id)
-        {
+        if let Some(device_id) = translation.restore_ready {
             self.restoration
                 .schedule_device_return(
                     receiver_id.clone(),
@@ -650,16 +632,6 @@ fn nonzero_interval(interval: Duration) -> Duration {
     }
 }
 
-const fn is_device_return_transition(
-    before: Option<PresenceState>,
-    after: Option<PresenceState>,
-) -> bool {
-    matches!(
-        before,
-        Some(PresenceState::Sleeping | PresenceState::Unavailable | PresenceState::Unknown)
-    ) && matches!(after, Some(PresenceState::Available))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -687,26 +659,4 @@ mod tests {
         assert_eq!(value.sequence().get(), 4);
         assert_eq!(value.observed_at_ms().get(), 5);
     }
-
-    #[test]
-    fn available_evidence_wakes_sleeping_unavailable_and_unknown_devices() {
-        for before in [
-            PresenceState::Sleeping,
-            PresenceState::Unavailable,
-            PresenceState::Unknown,
-        ] {
-            assert!(is_device_return_transition(
-                Some(before),
-                Some(PresenceState::Available)
-            ));
-        }
-        assert!(!is_device_return_transition(
-            Some(PresenceState::Available),
-            Some(PresenceState::Available)
-        ));
-        assert!(!is_device_return_transition(
-            None,
-            Some(PresenceState::Available)
-        ));
-    }
 }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index 2e40096..c25b65b 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -39,9 +39,10 @@ pub enum PassiveDisposition {
 pub struct PassiveTranslation {
     pub disposition: PassiveDisposition,
     pub observations: Vec<LifecycleObservation>,
-    /// One device whose first input report followed a bounded quiet interval.
-    /// This is a restoration hint, not a claim that the device was asleep.
-    pub activity_resumption: Option<LogicalDeviceId>,
+    /// One device whose first generation-bound input, or first input after a
+    /// bounded quiet interval, proves that its child route is ready for a
+    /// restoration attempt. This is not a claim that the device was asleep.
+    pub restore_ready: Option<LogicalDeviceId>,
 }
 
 impl PassiveTranslation {
@@ -49,15 +50,15 @@ impl PassiveTranslation {
         Self {
             disposition: PassiveDisposition::Applied,
             observations,
-            activity_resumption: None,
+            restore_ready: None,
         }
     }
 
-    fn resumed(observations: Vec<LifecycleObservation>, device_id: LogicalDeviceId) -> Self {
+    fn restore_ready(observations: Vec<LifecycleObservation>, device_id: LogicalDeviceId) -> Self {
         Self {
             disposition: PassiveDisposition::Applied,
             observations,
-            activity_resumption: Some(device_id),
+            restore_ready: Some(device_id),
         }
     }
 
@@ -65,7 +66,7 @@ impl PassiveTranslation {
         Self {
             disposition,
             observations: Vec::new(),
-            activity_resumption: None,
+            restore_ready: None,
         }
     }
 }
@@ -125,6 +126,7 @@ pub struct PassiveObservationTranslator {
     generation_id: GenerationId,
     catalog: RuntimeProfileCatalog,
     lanes: BTreeMap<u32, LaneBinding>,
+    receiver_was_suspended: bool,
 }
 
 impl PassiveObservationTranslator {
@@ -139,6 +141,7 @@ impl PassiveObservationTranslator {
             generation_id,
             catalog,
             lanes: BTreeMap::new(),
+            receiver_was_suspended: false,
         }
     }
 
@@ -215,15 +218,12 @@ impl PassiveObservationTranslator {
     }
 
     fn receiver_available(
-        &self,
+        &mut self,
         value: u32,
         stamp: ObservationStamp,
     ) -> Result<PassiveTranslation, PassiveTranslationError> {
         match value {
-            1 => Ok(PassiveTranslation::applied(vec![self.observation(
-                stamp,
-                LifecycleObservationKind::ReceiverState(ReceiverLifecycleState::Active),
-            )])),
+            1 => Ok(self.receiver_state(ReceiverLifecycleState::Active, stamp)),
             0 => Ok(PassiveTranslation::disposition(
                 PassiveDisposition::ReceiverUnavailable,
             )),
@@ -232,7 +232,7 @@ impl PassiveObservationTranslator {
     }
 
     fn receiver_suspended(
-        &self,
+        &mut self,
         value: u32,
         stamp: ObservationStamp,
     ) -> Result<PassiveTranslation, PassiveTranslationError> {
@@ -241,10 +241,25 @@ impl PassiveObservationTranslator {
             1 => ReceiverLifecycleState::Suspended,
             _ => return Err(PassiveTranslationError::InvalidObservationValue),
         };
-        Ok(PassiveTranslation::applied(vec![self.observation(
-            stamp,
-            LifecycleObservationKind::ReceiverState(state),
-        )]))
+        Ok(self.receiver_state(state, stamp))
+    }
+
+    fn receiver_state(
+        &mut self,
+        state: ReceiverLifecycleState,
+        stamp: ObservationStamp,
+    ) -> PassiveTranslation {
+        if state == ReceiverLifecycleState::Suspended {
+            self.receiver_was_suspended = true;
+        } else if state == ReceiverLifecycleState::Active && self.receiver_was_suspended {
+            for binding in self.lanes.values_mut() {
+                binding.last_activity_ms = None;
+            }
+            self.receiver_was_suspended = false;
+        }
+        PassiveTranslation::applied(vec![
+            self.observation(stamp, LifecycleObservationKind::ReceiverState(state)),
+        ])
     }
 
     fn product_identity(
@@ -334,7 +349,7 @@ impl PassiveObservationTranslator {
             ));
         };
         let observed_at_ms = stamp.observed_at_ms();
-        let resumed = binding.last_activity_ms.is_some_and(|prior| {
+        let restore_ready = binding.last_activity_ms.is_none_or(|prior| {
             observed_at_ms.get().saturating_sub(prior.get()) >= ACTIVITY_RESUMPTION_QUIET_MS
         });
         if binding
@@ -367,8 +382,8 @@ impl PassiveObservationTranslator {
                 EndpointFact::Freshness(FreshnessState::Fresh),
             ),
         ];
-        Ok(if resumed {
-            PassiveTranslation::resumed(observations, binding.device_id)
+        Ok(if restore_ready {
+            PassiveTranslation::restore_ready(observations, binding.device_id)
         } else {
             PassiveTranslation::applied(observations)
         })
@@ -688,6 +703,7 @@ mod tests {
                 ..
             }
         ));
+        assert_eq!(contact.restore_ready, None);
 
         let battery = translator
             .translate(raw(
@@ -702,6 +718,7 @@ mod tests {
             LifecycleObservationKind::BatteryReported { percentage, .. }
                 if percentage.get() == 50
         ));
+        assert_eq!(battery.restore_ready, None);
     }
 
     #[test]
@@ -782,7 +799,7 @@ mod tests {
     }
 
     #[test]
-    fn first_activity_after_quiet_emits_one_device_scoped_resumption() {
+    fn first_generation_activity_and_first_activity_after_quiet_emit_restore_readiness() {
         let mut translator = translator();
         identify(
             &mut translator,
@@ -794,7 +811,10 @@ mod tests {
         let first = translator
             .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("first activity translates");
-        assert_eq!(first.activity_resumption, None);
+        assert_eq!(
+            first.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            Some("paired-mouse-00cd")
+        );
 
         let resumed = translator
             .translate(activity(
@@ -804,10 +824,7 @@ mod tests {
             ))
             .expect("post-quiet activity translates");
         assert_eq!(
-            resumed
-                .activity_resumption
-                .as_ref()
-                .map(LogicalDeviceId::as_str),
+            resumed.restore_ready.as_ref().map(LogicalDeviceId::as_str),
             Some("paired-mouse-00cd")
         );
 
@@ -818,7 +835,7 @@ mod tests {
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("continuous activity translates");
-        assert_eq!(continuous.activity_resumption, None);
+        assert_eq!(continuous.restore_ready, None);
     }
 
     #[test]
@@ -857,21 +874,18 @@ mod tests {
             ))
             .expect("mouse resumes after identity replay");
         assert_eq!(
-            mouse
-                .activity_resumption
-                .as_ref()
-                .map(LogicalDeviceId::as_str),
+            mouse.restore_ready.as_ref().map(LogicalDeviceId::as_str),
             Some("paired-mouse-00cd")
         );
 
         let keyboard = translator
             .translate(activity(7, 1_001, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
             .expect("keyboard remains continuous");
-        assert_eq!(keyboard.activity_resumption, None);
+        assert_eq!(keyboard.restore_ready, None);
     }
 
     #[test]
-    fn a_new_generation_requires_prior_activity_before_resumption() {
+    fn a_new_generation_first_activity_is_restore_ready() {
         let mut next_generation = PassiveObservationTranslator::new(
             ReceiverId::try_from("receiver-test").expect("receiver id is valid"),
             GenerationId::try_from(8_u64).expect("generation is valid"),
@@ -890,7 +904,10 @@ mod tests {
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("first generation-bound activity translates");
-        assert_eq!(first.activity_resumption, None);
+        assert_eq!(
+            first.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            Some("paired-mouse-00cd")
+        );
     }
 
     #[test]
@@ -946,4 +963,61 @@ mod tests {
             ));
         }
     }
+
+    #[test]
+    fn short_same_generation_resume_requires_fresh_input_from_each_device() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        identify(
+            &mut translator,
+            2,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        translator
+            .translate(activity(3, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("initial mouse activity translates");
+        translator
+            .translate(activity(4, 1_001, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("initial keyboard activity translates");
+
+        for (sequence, observed_at_ms, raw_value) in [(5, 1_002, 1), (6, 1_003, 0)] {
+            let mut observation = raw_at(
+                sequence,
+                observed_at_ms,
+                HFX_UAPI_OBSERVATION_KIND_RECEIVER_SUSPENDED,
+                HFX_UAPI_ENDPOINT_SLOT_RECEIVER,
+                raw_value,
+            );
+            observation.source = HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT;
+            observation.confidence = HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT;
+            translator
+                .translate(observation)
+                .expect("power observation translates");
+        }
+
+        let mouse = translator
+            .translate(activity(7, 1_004, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("post-resume mouse activity translates");
+        assert_eq!(
+            mouse.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            Some("paired-mouse-00cd")
+        );
+        let keyboard = translator
+            .translate(activity(8, 1_005, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("post-resume keyboard activity translates");
+        assert_eq!(
+            keyboard.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            Some("paired-keyboard-0296")
+        );
+        let continuous = translator
+            .translate(activity(9, 1_006, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("continuous mouse activity translates");
+        assert_eq!(continuous.restore_ready, None);
+    }
 }
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 84a0d1d..bbbb01a 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -183,6 +183,7 @@ pub struct RestorationScheduler {
     max_triggers: usize,
     max_claims: usize,
     configured_receivers: BTreeSet<ReceiverId>,
+    ready_devices: BTreeSet<(ReceiverId, GenerationId, LogicalDeviceId)>,
     triggers: BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     claims: BTreeMap<RestoreClaimId, ScheduledClaim>,
 }
@@ -246,6 +247,7 @@ impl RestorationScheduler {
             max_triggers,
             max_claims,
             configured_receivers: BTreeSet::new(),
+            ready_devices: BTreeSet::new(),
             triggers: BTreeMap::new(),
             claims: BTreeMap::new(),
         })
@@ -285,6 +287,7 @@ impl RestorationScheduler {
         receiver_id: ReceiverId,
         generation_id: GenerationId,
     ) -> Result<(), RestorationScheduleError> {
+        self.clear_readiness(&receiver_id, generation_id);
         self.schedule(
             RestoreTriggerKind::ReceiverGeneration,
             receiver_id,
@@ -305,6 +308,7 @@ impl RestorationScheduler {
         generation_id: GenerationId,
         sequence: SequenceNumber,
     ) -> Result<(), RestorationScheduleError> {
+        self.clear_readiness(&receiver_id, generation_id);
         self.schedule(
             RestoreTriggerKind::SystemResume,
             receiver_id,
@@ -326,6 +330,8 @@ impl RestorationScheduler {
         device_id: LogicalDeviceId,
         sequence: SequenceNumber,
     ) -> Result<(), RestorationScheduleError> {
+        self.ready_devices
+            .insert((receiver_id.clone(), generation_id, device_id.clone()));
         self.schedule(
             RestoreTriggerKind::DeviceReturn,
             receiver_id,
@@ -343,6 +349,9 @@ impl RestorationScheduler {
         self.claims.retain(|_, scheduled| {
             scheduled.receiver_id != *receiver_id || scheduled.generation_id != generation_id
         });
+        self.ready_devices.retain(|(candidate, generation, _)| {
+            candidate != receiver_id || *generation != generation_id
+        });
     }
 
     /// Advances at most the generated number of due claims and one due trigger.
@@ -408,7 +417,7 @@ impl RestorationScheduler {
                 match controller.plan_restore(&scheduled.trigger) {
                     Ok(RestorePlanResult::Planned(records)) => {
                         for record in records {
-                            self.schedule_record(record, now)?;
+                            self.schedule_trigger_record(record, scheduled.trigger.kind, now)?;
                         }
                         report.triggers_planned += 1;
                     }
@@ -436,7 +445,7 @@ impl RestorationScheduler {
             } else {
                 report.claims_recovered += pending.len();
                 for record in pending {
-                    self.schedule_record(record, now)?;
+                    self.schedule_trigger_record(record, scheduled.trigger.kind, now)?;
                 }
             }
         }
@@ -532,7 +541,12 @@ impl RestorationScheduler {
             return Ok(());
         }
         if is_broad_trigger(kind) {
-            let woke = self.wake(&receiver_id, generation_id, None);
+            let woke = if readiness_gated_trigger(kind) {
+                self.park(&receiver_id, generation_id, None)?;
+                0
+            } else {
+                self.wake(&receiver_id, generation_id, None)
+            };
             self.triggers.retain(|_, scheduled| {
                 scheduled.trigger.receiver_id != receiver_id
                     || scheduled.trigger.generation_id != generation_id
@@ -600,6 +614,27 @@ impl RestorationScheduler {
         self.schedule_record_with_defer(record, due, 0)
     }
 
+    fn schedule_trigger_record(
+        &mut self,
+        record: RestoreRecord,
+        trigger_kind: RestoreTriggerKind,
+        now: MonotonicMs,
+    ) -> Result<(), RestorationScheduleError> {
+        let readiness_gated =
+            readiness_gated_trigger(trigger_kind) || readiness_gated_trigger(record.trigger_kind);
+        let due = if readiness_gated
+            && !self.ready_devices.contains(&(
+                record.receiver_id.clone(),
+                record.generation_id,
+                record.device_id.clone(),
+            )) {
+            parked_due()?
+        } else {
+            now
+        };
+        self.schedule_record(record, due)
+    }
+
     fn schedule_record_with_defer(
         &mut self,
         record: RestoreRecord,
@@ -645,6 +680,25 @@ impl RestorationScheduler {
         woken
     }
 
+    fn park(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: Option<&LogicalDeviceId>,
+    ) -> Result<usize, RestorationScheduleError> {
+        let due = parked_due()?;
+        let mut parked = 0;
+        for claim in self.claims.values_mut().filter(|claim| {
+            claim.receiver_id == *receiver_id
+                && claim.generation_id == generation_id
+                && device_id.is_none_or(|device_id| claim.device_id == *device_id)
+        }) {
+            claim.due = due;
+            parked += 1;
+        }
+        Ok(parked)
+    }
+
     fn has_pending_broad_trigger(
         &self,
         receiver_id: &ReceiverId,
@@ -656,6 +710,12 @@ impl RestorationScheduler {
                 && is_broad_trigger(scheduled.trigger.kind)
         })
     }
+
+    fn clear_readiness(&mut self, receiver_id: &ReceiverId, generation_id: GenerationId) {
+        self.ready_devices.retain(|(candidate, generation, _)| {
+            candidate != receiver_id || *generation != generation_id
+        });
+    }
 }
 
 const fn is_broad_trigger(kind: RestoreTriggerKind) -> bool {
@@ -667,6 +727,17 @@ const fn is_broad_trigger(kind: RestoreTriggerKind) -> bool {
     )
 }
 
+const fn readiness_gated_trigger(kind: RestoreTriggerKind) -> bool {
+    matches!(
+        kind,
+        RestoreTriggerKind::ReceiverGeneration | RestoreTriggerKind::SystemResume
+    )
+}
+
+fn parked_due() -> Result<MonotonicMs, RestorationScheduleError> {
+    MonotonicMs::try_from(u64::MAX).map_err(|_| RestorationScheduleError::TimeOverflow)
+}
+
 fn due_trigger_id(
     triggers: &BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     now: MonotonicMs,
@@ -710,7 +781,7 @@ fn deferred_due(
             | RestoreDeferReason::DeviceUnavailable
             | RestoreDeferReason::DeviceUnknown
     ) {
-        return MonotonicMs::try_from(u64::MAX).map_err(|_| RestorationScheduleError::TimeOverflow);
+        return parked_due();
     }
     let exponent = u32::from(defer_count.saturating_sub(1).min(6));
     let multiplier = 1_u64
@@ -895,6 +966,14 @@ mod tests {
     }
 
     fn record(claim: &str, status: RestoreRecordStatus) -> RestoreRecord {
+        record_for_device(claim, "mouse-1", status)
+    }
+
+    fn record_for_device(
+        claim: &str,
+        device_id: &str,
+        status: RestoreRecordStatus,
+    ) -> RestoreRecord {
         RestoreRecord {
             schema_version: PersistenceSchemaVersion::try_from(1_u16).expect("schema"),
             claim_id: id(claim),
@@ -902,7 +981,7 @@ mod tests {
             trigger_kind: RestoreTriggerKind::ServiceStart,
             receiver_id: id("receiver-1"),
             generation_id: generation(1),
-            device_id: id("mouse-1"),
+            device_id: id(device_id),
             intent_revision: IntentRevision::try_from(1_u64).expect("intent revision"),
             intent_digest: id(&"11".repeat(32)),
             revision: PersistenceRevision::try_from(1_u64).expect("revision"),
@@ -1412,6 +1491,42 @@ mod tests {
         assert_eq!(controller.plans.len(), 1);
     }
 
+    #[test]
+    fn service_restart_preserves_a_pending_generation_claims_readiness_gate() {
+        let mut prior = record("claim-prior", RestoreRecordStatus::Planned);
+        prior.trigger_kind = RestoreTriggerKind::ReceiverGeneration;
+        let mut controller = FakeController {
+            now: time(10),
+            plans: Vec::new(),
+            pending: vec![prior.clone()],
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_service_start(id("receiver-1"), generation(1))
+            .expect("service trigger schedules");
+
+        let report = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("pending generation claim recovers");
+
+        assert_eq!(report.claims_recovered, 1);
+        assert_eq!(controller.advance_calls, 0);
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&prior.claim_id)
+                .expect("claim remains parked")
+                .due
+                .get(),
+            u64::MAX
+        );
+    }
+
     #[test]
     fn advance_barrier_reloads_pending_claim_without_stopping_the_scheduler() {
         let planned = record("claim-prior", RestoreRecordStatus::Planned);
@@ -1480,6 +1595,193 @@ mod tests {
                 .kind,
             RestoreTriggerKind::SystemResume
         ));
+        assert!(scheduler.ready_devices.contains(&(
+            id("receiver-1"),
+            generation(1),
+            id("mouse-1")
+        )));
+    }
+
+    #[test]
+    fn receiver_generation_parks_each_sibling_until_its_exact_activity() {
+        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
+        let keyboard =
+            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
+        let mut controller = FakeController {
+            now: time(10),
+            plans: vec![Ok(RestorePlanResult::Planned(vec![
+                mouse.clone(),
+                keyboard.clone(),
+            ]))],
+            pending: Vec::new(),
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_receiver_generation(id("receiver-1"), generation(1))
+            .expect("generation trigger schedules");
+        scheduler
+            .process_due_trigger(
+                &mut controller,
+                time(10),
+                &mut RestorationTickReport::default(),
+            )
+            .expect("generation claims plan");
+
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("mouse claim")
+                .due
+                .get(),
+            u64::MAX
+        );
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&keyboard.claim_id)
+                .expect("keyboard claim")
+                .due
+                .get(),
+            u64::MAX
+        );
+
+        scheduler
+            .schedule_device_return(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(4_u64).expect("sequence"),
+            )
+            .expect("mouse readiness wakes its claim");
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("mouse claim")
+                .due
+                .get(),
+            0
+        );
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&keyboard.claim_id)
+                .expect("keyboard claim")
+                .due
+                .get(),
+            u64::MAX
+        );
+    }
+
+    #[test]
+    fn activity_before_generation_planning_is_retained_without_waking_a_sibling() {
+        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
+        let keyboard =
+            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
+        let mut controller = FakeController {
+            now: time(10),
+            plans: vec![Ok(RestorePlanResult::Planned(vec![
+                mouse.clone(),
+                keyboard.clone(),
+            ]))],
+            pending: Vec::new(),
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_receiver_generation(id("receiver-1"), generation(1))
+            .expect("generation trigger schedules");
+        scheduler
+            .schedule_device_return(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(4_u64).expect("sequence"),
+            )
+            .expect("early mouse readiness is retained");
+        scheduler
+            .process_due_trigger(
+                &mut controller,
+                time(10),
+                &mut RestorationTickReport::default(),
+            )
+            .expect("generation claims plan");
+
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("mouse claim")
+                .due,
+            time(10)
+        );
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&keyboard.claim_id)
+                .expect("keyboard claim")
+                .due
+                .get(),
+            u64::MAX
+        );
+    }
+
+    #[test]
+    fn system_resume_clears_old_readiness_and_reparks_existing_claims() {
+        let claim = record("claim-mouse", RestoreRecordStatus::Planned);
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_record(claim.clone(), time(0))
+            .expect("claim schedules");
+        scheduler
+            .ready_devices
+            .insert((id("receiver-1"), generation(1), id("mouse-1")));
+
+        scheduler
+            .schedule_system_resume(
+                id("receiver-1"),
+                generation(1),
+                SequenceNumber::try_from(5_u64).expect("sequence"),
+            )
+            .expect("resume trigger schedules");
+
+        assert!(scheduler.ready_devices.is_empty());
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&claim.claim_id)
+                .expect("claim remains parked")
+                .due
+                .get(),
+            u64::MAX
+        );
+        scheduler
+            .schedule_device_return(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(6_u64).expect("sequence"),
+            )
+            .expect("fresh activity wakes the claim");
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&claim.claim_id)
+                .expect("claim wakes")
+                .due
+                .get(),
+            0
+        );
     }
 
     #[test]
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index d64092f..159864b 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -7,6 +7,7 @@ mod assessment;
 mod configuration;
 mod probe;
 mod qualification;
+mod qualification_event_evidence;
 mod qualification_lifecycle;
 mod qualification_runner;
 mod qualification_server;
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 5dd88b6..1f87bdb 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -1,12 +1,18 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use hfx_domain::{ClientId, ClientName, ProtocolFeatureId, ProtocolVersion};
+use hfx_domain::{
+    ClientId, ClientName, EventBatchLimit, ProtocolFeatureId, ProtocolVersion, SequenceNumber,
+};
 use hfx_profiles::receiver_profile_by_usb_id;
-use hfx_protocol::{BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, IntegrationView};
+use hfx_protocol::{
+    BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, EventBatch, EventCursor,
+    IntegrationView,
+};
 use hfx_runtime::{
-    BRIDGE_SERVICE_UNIT, BRIDGE_SOCKET_PATH, KERNEL_MODULE_NAME, PRODUCT_VERSION, STATUS_TIMEOUT_MS,
+    BRIDGE_SERVICE_UNIT, BRIDGE_SOCKET_PATH, EVENT_CAPACITY, KERNEL_MODULE_NAME, PRODUCT_VERSION,
+    STATUS_TIMEOUT_MS,
 };
-use hfx_sdk::{HyperFluxClient, KernelRequestIdentitySource, SdkClientConfig};
+use hfx_sdk::{EventSubscription, HyperFluxClient, KernelRequestIdentitySource, SdkClientConfig};
 use serde::{Deserialize, Serialize};
 use std::fmt;
 use std::fs;
@@ -14,16 +20,19 @@ use std::io;
 use std::os::unix::net::UnixStream;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
+use std::sync::atomic::{AtomicU64, Ordering};
 use std::thread;
 use std::time::{Duration, Instant};
 
 const MAX_COMMAND_OUTPUT_BYTES: usize = 4_096;
 const MAX_USB_DEVICE_ENTRIES: usize = 256;
 const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
+const EVENT_SUBSCRIPTIONS_FEATURE: &str = "event-subscriptions";
 const INTEGRATION_VIEW_FEATURE: &str = "integration-view-projection";
 const STRUCTURED_DIAGNOSTICS_FEATURE: &str = "structured-diagnostics";
 const LEGACY_V2_BRIDGE_SERVICE_UNIT: &str = "hyperflux-bridge.service";
 const LEGACY_V2_KERNEL_MODULE_NAME: &str = "hid-razer-hyperflux-v2";
+static QUALIFICATION_CLIENT_SEQUENCE: AtomicU64 = AtomicU64::new(1);
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(rename_all = "kebab-case")]
@@ -153,6 +162,7 @@ pub struct BridgeHealth {
 pub struct BridgeIntegration {
     pub protocol_version: ProtocolVersion,
     pub view: IntegrationView,
+    pub events: EventBatch,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -379,18 +389,21 @@ impl<R: CommandRunner> RealSystemProbe<R> {
     /// Returns a bounded bridge-unavailable error when the local socket cannot
     /// be reached, negotiated, or queried.
     pub fn qualification_integration(&self) -> Result<BridgeIntegration, ProbeError> {
+        let client_id = qualification_client_id();
         let mut client = self.bridge_client(
-            "hyperflux-qualification",
+            &client_id,
             "HyperFlux Qualification Console",
-            &[INTEGRATION_VIEW_FEATURE],
+            &[INTEGRATION_VIEW_FEATURE, EVENT_SUBSCRIPTIONS_FEATURE],
         )?;
         let protocol_version = client.server_hello().selected_version;
         let view = client
             .integration_view()
             .map_err(|_| ProbeError::BridgeUnavailable)?;
+        let events = retained_events(&mut client)?;
         Ok(BridgeIntegration {
             protocol_version,
             view,
+            events,
         })
     }
 
@@ -488,6 +501,75 @@ impl<R: CommandRunner> SystemController for RealSystemProbe<R> {
     }
 }
 
+fn qualification_client_id() -> String {
+    let sequence = QUALIFICATION_CLIENT_SEQUENCE.fetch_add(1, Ordering::Relaxed);
+    format!("hyperflux-qualification-{}-{sequence}", std::process::id())
+}
+
+fn retained_events(
+    client: &mut HyperFluxClient<UnixStream, KernelRequestIdentitySource>,
+) -> Result<EventBatch, ProbeError> {
+    let max_events = EventBatchLimit::try_from(EventBatchLimit::MAX)
+        .map_err(|_| ProbeError::BridgeUnavailable)?;
+    let mut batch = client
+        .subscribe(EventSubscription {
+            subscription_id: None,
+            expected_cursor: None,
+            max_events,
+        })
+        .map_err(|_| ProbeError::BridgeUnavailable)?;
+    if batch.cursor_gap {
+        let replay_cursor = EventCursor {
+            stream_id: batch.next_cursor.stream_id.clone(),
+            stream_epoch: batch.next_cursor.stream_epoch,
+            projection_revision: batch.next_cursor.projection_revision,
+            sequence: SequenceNumber::try_from(batch.oldest_available.get().saturating_sub(1))
+                .map_err(|_| ProbeError::BridgeUnavailable)?,
+        };
+        batch = client
+            .subscribe(EventSubscription {
+                subscription_id: Some(batch.subscription_id),
+                expected_cursor: Some(replay_cursor),
+                max_events,
+            })
+            .map_err(|_| ProbeError::BridgeUnavailable)?;
+    }
+    if batch.cursor_gap {
+        return Err(ProbeError::BridgeUnavailable);
+    }
+    let subscription_id = batch.subscription_id.clone();
+    let oldest_available = batch.oldest_available;
+    let dropped_events = batch.dropped_events;
+    let mut events = std::mem::take(&mut batch.events);
+    while batch.has_more {
+        let previous_cursor = batch.next_cursor.clone();
+        batch = client
+            .subscribe(EventSubscription {
+                subscription_id: Some(subscription_id.clone()),
+                expected_cursor: Some(previous_cursor),
+                max_events,
+            })
+            .map_err(|_| ProbeError::BridgeUnavailable)?;
+        if batch.cursor_gap
+            || batch.subscription_id != subscription_id
+            || events.len().saturating_add(batch.events.len()) > usize::from(EVENT_CAPACITY)
+        {
+            return Err(ProbeError::BridgeUnavailable);
+        }
+        events.append(&mut batch.events);
+    }
+    Ok(EventBatch {
+        subscription_id,
+        next_cursor: batch.next_cursor,
+        events,
+        oldest_available,
+        latest_available: batch.latest_available,
+        dropped_events,
+        cursor_gap: false,
+        has_more: false,
+    })
+}
+
 fn bounded_identity(value: &str) -> Option<String> {
     if value.is_empty()
         || value.len() > 64
@@ -581,7 +663,7 @@ mod tests {
             "hyperflux-qualification",
             "HyperFlux Qualification Console",
             version,
-            &[INTEGRATION_VIEW_FEATURE],
+            &[INTEGRATION_VIEW_FEATURE, EVENT_SUBSCRIPTIONS_FEATURE],
         )
         .expect("qualification config");
 
@@ -599,7 +681,7 @@ mod tests {
                 .iter()
                 .map(ProtocolFeatureId::as_str)
                 .collect::<Vec<_>>(),
-            [INTEGRATION_VIEW_FEATURE]
+            [INTEGRATION_VIEW_FEATURE, EVENT_SUBSCRIPTIONS_FEATURE]
         );
     }
 
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 305dadb..95f464e 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1160,11 +1160,14 @@ fn unix_seconds_to_rfc3339(seconds: u64) -> String {
 mod tests {
     use super::*;
     use hfx_domain::{
-        BatteryPercent, EvidenceConfidence, FreshnessState, GenerationId, InventoryAvailability,
-        PairingState, PresenceState, ProductId, ProjectionRevision, ProtocolVersion, ReceiverId,
-        RestoreState, SequenceNumber, StreamEpoch, SupportLevel, TelemetryAvailability,
+        BatteryPercent, DroppedEventCount, EvidenceConfidence, FreshnessState, GenerationId,
+        InventoryAvailability, PairingState, PresenceState, ProductId, ProjectionRevision,
+        ProtocolVersion, ReceiverId, RestoreState, SequenceNumber, StreamEpoch, SubscriptionId,
+        SupportLevel, TelemetryAvailability,
+    };
+    use hfx_protocol::{
+        BatteryObservation, DeviceInventoryView, EventBatch, EventCursor, IntegrationView,
     };
-    use hfx_protocol::{BatteryObservation, DeviceInventoryView, EventCursor, IntegrationView};
     use std::path::PathBuf;
 
     fn catalog() -> RuntimeProfileCatalog {
@@ -1180,17 +1183,17 @@ mod tests {
         let child_profile = catalog
             .child(ProductId::try_from(0x00cd_u16).expect("PID is valid"))
             .expect("mouse profile exists");
+        let cursor = EventCursor {
+            stream_id: hfx_domain::StreamId::try_from("qualification-stream")
+                .expect("stream id is valid"),
+            stream_epoch: StreamEpoch::try_from(1_u64).expect("epoch is valid"),
+            projection_revision: ProjectionRevision::try_from(1_u32).expect("projection is valid"),
+            sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+        };
         BridgeIntegration {
             protocol_version: ProtocolVersion::try_from(5_u16).expect("protocol is valid"),
             view: IntegrationView {
-                cursor: EventCursor {
-                    stream_id: hfx_domain::StreamId::try_from("qualification-stream")
-                        .expect("stream id is valid"),
-                    stream_epoch: StreamEpoch::try_from(1_u64).expect("epoch is valid"),
-                    projection_revision: ProjectionRevision::try_from(1_u32)
-                        .expect("projection is valid"),
-                    sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
-                },
+                cursor: cursor.clone(),
                 receivers: vec![IntegrationReceiverView {
                     receiver_id: ReceiverId::try_from("receiver-test").expect("id is valid"),
                     generation_id: GenerationId::try_from(7_u64).expect("generation is valid"),
@@ -1235,6 +1238,17 @@ mod tests {
                     controllers: Vec::new(),
                 }],
             },
+            events: EventBatch {
+                subscription_id: SubscriptionId::try_from("qualification-subscription")
+                    .expect("subscription is valid"),
+                next_cursor: cursor,
+                events: Vec::new(),
+                oldest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+                latest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+                dropped_events: DroppedEventCount::try_from(0_u64).expect("drop count is valid"),
+                cursor_gap: false,
+                has_more: false,
+            },
         }
     }
 
diff --git a/crates/hfx-ops/src/qualification_event_evidence.rs b/crates/hfx-ops/src/qualification_event_evidence.rs
new file mode 100644
index 0000000..3ed993e
--- /dev/null
+++ b/crates/hfx-ops/src/qualification_event_evidence.rs
@@ -0,0 +1,419 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_domain::{EventKind, SequenceNumber};
+use hfx_protocol::{EventBatch, EventCursor};
+use sha2::{Digest, Sha256};
+use std::fmt;
+
+const CURSOR_EVIDENCE_PREFIX: &str = "bridge-cursor-sha256:";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum EventEvidenceError {
+    HistoryIncomplete,
+    AnchorUnavailable,
+    RestoreUnavailable,
+}
+
+impl fmt::Display for EventEvidenceError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::HistoryIncomplete => {
+                "The bridge event history is incomplete for this lifecycle checkpoint."
+            }
+            Self::AnchorUnavailable => {
+                "The retained lifecycle cursor is no longer available in the bridge event history."
+            }
+            Self::RestoreUnavailable => {
+                "The exact profile-bound restore event is not visible after this lifecycle checkpoint."
+            }
+        })
+    }
+}
+
+pub(crate) fn cursor_evidence(cursor: &EventCursor) -> String {
+    let encoded = serde_json::to_vec(cursor).unwrap_or_default();
+    format!("{CURSOR_EVIDENCE_PREFIX}{}", digest_hex(&encoded))
+}
+
+pub(crate) fn device_return_restore(
+    batch: &EventBatch,
+    evidence_refs: &[String],
+    receiver_id: &str,
+    generation_id: u64,
+    device_id: &str,
+) -> Result<String, EventEvidenceError> {
+    let anchor = latest_anchor_sequence(batch, evidence_refs)?;
+    let mut departed = false;
+    let mut returned = false;
+
+    for event in events_after(batch, anchor) {
+        if !matches_identity(event, receiver_id, generation_id, Some(device_id)) {
+            continue;
+        }
+        match event.kind {
+            EventKind::DeviceSleeping | EventKind::DeviceUnavailable => {
+                departed = true;
+                returned = false;
+            }
+            EventKind::DeviceAvailable if departed => returned = true,
+            EventKind::RestoreCompleted if returned && event.transaction_id.as_ref().is_some() => {
+                return Ok(restore_evidence(event.sequence.get(), device_id));
+            }
+            _ => {}
+        }
+    }
+    Err(EventEvidenceError::RestoreUnavailable)
+}
+
+pub(crate) fn renewed_generation_restores(
+    batch: &EventBatch,
+    evidence_refs: &[String],
+    receiver_id: &str,
+    generation_id: u64,
+    device_ids: &[String],
+) -> Result<Vec<String>, EventEvidenceError> {
+    let anchor = latest_anchor_sequence(batch, evidence_refs)?;
+    let generation_start = events_after(batch, anchor)
+        .find(|event| {
+            matches_identity(event, receiver_id, generation_id, None)
+                && matches!(
+                    event.kind,
+                    EventKind::GenerationReplaced | EventKind::ReceiverAvailable
+                )
+        })
+        .map(|event| event.sequence.get())
+        .ok_or(EventEvidenceError::RestoreUnavailable)?;
+    all_device_restores_after(
+        batch,
+        generation_start,
+        receiver_id,
+        generation_id,
+        device_ids,
+    )
+}
+
+pub(crate) fn resumed_generation_restores(
+    batch: &EventBatch,
+    evidence_refs: &[String],
+    receiver_id: &str,
+    generation_id: u64,
+    device_ids: &[String],
+) -> Result<Vec<String>, EventEvidenceError> {
+    let anchor = latest_anchor_sequence(batch, evidence_refs)?;
+    let suspended = events_after(batch, anchor)
+        .find(|event| {
+            event.kind == EventKind::ReceiverSuspended && matches_receiver(event, receiver_id)
+        })
+        .map(|event| event.sequence.get())
+        .ok_or(EventEvidenceError::RestoreUnavailable)?;
+    let resumed = events_after(batch, suspended)
+        .find(|event| {
+            matches_identity(event, receiver_id, generation_id, None)
+                && matches!(
+                    event.kind,
+                    EventKind::GenerationReplaced | EventKind::ReceiverAvailable
+                )
+        })
+        .map(|event| event.sequence.get())
+        .ok_or(EventEvidenceError::RestoreUnavailable)?;
+    all_device_restores_after(batch, resumed, receiver_id, generation_id, device_ids)
+}
+
+fn all_device_restores_after(
+    batch: &EventBatch,
+    anchor: u64,
+    receiver_id: &str,
+    generation_id: u64,
+    device_ids: &[String],
+) -> Result<Vec<String>, EventEvidenceError> {
+    let mut evidence = Vec::with_capacity(device_ids.len());
+    for device_id in device_ids {
+        let event = events_after(batch, anchor)
+            .find(|event| {
+                event.kind == EventKind::RestoreCompleted
+                    && event.transaction_id.as_ref().is_some()
+                    && matches_identity(event, receiver_id, generation_id, Some(device_id.as_str()))
+            })
+            .ok_or(EventEvidenceError::RestoreUnavailable)?;
+        evidence.push(restore_evidence(event.sequence.get(), device_id));
+    }
+    Ok(evidence)
+}
+
+fn latest_anchor_sequence(
+    batch: &EventBatch,
+    evidence_refs: &[String],
+) -> Result<u64, EventEvidenceError> {
+    if batch.cursor_gap || batch.has_more {
+        return Err(EventEvidenceError::HistoryIncomplete);
+    }
+    let lower = batch.oldest_available.get().saturating_sub(1);
+    let upper = batch.latest_available.get();
+    for evidence in evidence_refs
+        .iter()
+        .rev()
+        .filter(|value| value.starts_with(CURSOR_EVIDENCE_PREFIX))
+    {
+        for sequence in lower..=upper {
+            let Some(candidate) = cursor_at(&batch.next_cursor, sequence) else {
+                continue;
+            };
+            if cursor_evidence(&candidate) == *evidence {
+                return Ok(sequence);
+            }
+        }
+    }
+    Err(EventEvidenceError::AnchorUnavailable)
+}
+
+fn cursor_at(template: &EventCursor, sequence: u64) -> Option<EventCursor> {
+    Some(EventCursor {
+        stream_id: template.stream_id.clone(),
+        stream_epoch: template.stream_epoch,
+        projection_revision: template.projection_revision,
+        sequence: SequenceNumber::try_from(sequence).ok()?,
+    })
+}
+
+fn events_after(
+    batch: &EventBatch,
+    anchor: u64,
+) -> impl Iterator<Item = &hfx_protocol::BridgeEvent> {
+    batch
+        .events
+        .iter()
+        .filter(move |event| event.sequence.get() > anchor)
+}
+
+fn matches_identity(
+    event: &hfx_protocol::BridgeEvent,
+    receiver_id: &str,
+    generation_id: u64,
+    device_id: Option<&str>,
+) -> bool {
+    matches_receiver(event, receiver_id)
+        && event.generation_id.map(hfx_domain::GenerationId::get) == Some(generation_id)
+        && device_id.is_none_or(|expected| {
+            event
+                .device_id
+                .as_ref()
+                .map(hfx_domain::LogicalDeviceId::as_str)
+                == Some(expected)
+        })
+}
+
+fn matches_receiver(event: &hfx_protocol::BridgeEvent, receiver_id: &str) -> bool {
+    event
+        .receiver_id
+        .as_ref()
+        .map(hfx_domain::ReceiverId::as_str)
+        == Some(receiver_id)
+}
+
+fn restore_evidence(sequence: u64, device_id: &str) -> String {
+    format!("bridge-restore-event:{sequence}:{device_id}")
+}
+
+fn digest_hex(value: &[u8]) -> String {
+    let digest = Sha256::digest(value);
+    let mut encoded = String::with_capacity(64);
+    for byte in digest {
+        use std::fmt::Write as _;
+        let _ = write!(encoded, "{byte:02x}");
+    }
+    encoded
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        DroppedEventCount, GenerationId, LogicalDeviceId, ProjectionRevision, ReceiverId,
+        StreamEpoch, StreamId, SubscriptionId, TransactionId,
+    };
+    use hfx_protocol::BridgeEvent;
+
+    fn cursor(sequence: u64) -> EventCursor {
+        EventCursor {
+            stream_id: StreamId::try_from("qualification-event-test").expect("stream id"),
+            stream_epoch: StreamEpoch::try_from(1_u64).expect("stream epoch"),
+            projection_revision: ProjectionRevision::try_from(1_u32).expect("projection revision"),
+            sequence: SequenceNumber::try_from(sequence).expect("sequence"),
+        }
+    }
+
+    fn event(
+        sequence: u64,
+        kind: EventKind,
+        generation: u64,
+        device_id: Option<&str>,
+        terminal_transaction: bool,
+    ) -> BridgeEvent {
+        BridgeEvent {
+            sequence: SequenceNumber::try_from(sequence).expect("sequence"),
+            kind,
+            receiver_id: Some(ReceiverId::try_from("receiver-test").expect("receiver id")),
+            generation_id: Some(GenerationId::try_from(generation).expect("generation")),
+            device_id: device_id.map(|value| LogicalDeviceId::try_from(value).expect("device id")),
+            lease_id: None,
+            transaction_id: terminal_transaction.then(|| {
+                TransactionId::try_from(format!("restore-transaction-{sequence}"))
+                    .expect("transaction id")
+            }),
+            finding_id: None,
+        }
+    }
+
+    fn batch(events: Vec<BridgeEvent>) -> EventBatch {
+        let latest = events.last().map_or(1_u64, |event| event.sequence.get());
+        EventBatch {
+            subscription_id: SubscriptionId::try_from("qualification-event-subscription")
+                .expect("subscription id"),
+            next_cursor: cursor(latest),
+            events,
+            oldest_available: SequenceNumber::try_from(1_u64).expect("oldest sequence"),
+            latest_available: SequenceNumber::try_from(latest).expect("latest sequence"),
+            dropped_events: DroppedEventCount::try_from(0_u64).expect("dropped count"),
+            cursor_gap: false,
+            has_more: false,
+        }
+    }
+
+    #[test]
+    fn exact_device_return_chain_is_accepted() {
+        let events = batch(vec![
+            event(2, EventKind::DeviceUnavailable, 7, Some("keyboard"), false),
+            event(3, EventKind::DeviceAvailable, 7, Some("keyboard"), false),
+            event(4, EventKind::RestoreCompleted, 7, Some("keyboard"), true),
+        ]);
+        assert_eq!(
+            device_return_restore(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                7,
+                "keyboard",
+            ),
+            Ok("bridge-restore-event:4:keyboard".to_owned())
+        );
+    }
+
+    #[test]
+    fn device_return_rejects_missing_anchor_and_wrong_identity() {
+        let events = batch(vec![
+            event(2, EventKind::DeviceUnavailable, 7, Some("keyboard"), false),
+            event(3, EventKind::DeviceAvailable, 7, Some("keyboard"), false),
+            event(4, EventKind::RestoreCompleted, 7, Some("mouse"), true),
+        ]);
+        assert_eq!(
+            device_return_restore(&events, &[], "receiver-test", 7, "keyboard"),
+            Err(EventEvidenceError::AnchorUnavailable)
+        );
+        assert_eq!(
+            device_return_restore(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                7,
+                "keyboard",
+            ),
+            Err(EventEvidenceError::RestoreUnavailable)
+        );
+    }
+
+    #[test]
+    fn incomplete_history_is_never_accepted() {
+        let mut events = batch(vec![event(
+            2,
+            EventKind::RestoreCompleted,
+            7,
+            Some("keyboard"),
+            true,
+        )]);
+        events.cursor_gap = true;
+        assert_eq!(
+            resumed_generation_restores(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                7,
+                &["keyboard".to_owned()],
+            ),
+            Err(EventEvidenceError::HistoryIncomplete)
+        );
+    }
+
+    #[test]
+    fn system_resume_requires_a_receiver_boundary_before_exact_restores() {
+        let devices = ["keyboard".to_owned(), "mouse".to_owned()];
+        let without_boundary = batch(vec![
+            event(2, EventKind::RestoreCompleted, 8, Some("keyboard"), true),
+            event(3, EventKind::RestoreCompleted, 8, Some("mouse"), true),
+        ]);
+        assert_eq!(
+            resumed_generation_restores(
+                &without_boundary,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                8,
+                &devices,
+            ),
+            Err(EventEvidenceError::RestoreUnavailable)
+        );
+
+        let with_boundary = batch(vec![
+            event(2, EventKind::ReceiverSuspended, 7, None, false),
+            event(3, EventKind::GenerationReplaced, 8, None, false),
+            event(4, EventKind::ReceiverAvailable, 8, None, false),
+            event(5, EventKind::RestoreCompleted, 8, Some("keyboard"), true),
+            event(6, EventKind::RestoreCompleted, 8, Some("mouse"), true),
+        ]);
+        assert_eq!(
+            resumed_generation_restores(
+                &with_boundary,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                8,
+                &devices,
+            ),
+            Ok(vec![
+                "bridge-restore-event:5:keyboard".to_owned(),
+                "bridge-restore-event:6:mouse".to_owned(),
+            ])
+        );
+    }
+
+    #[test]
+    fn renewed_generation_requires_every_device_restore() {
+        let mut events = batch(vec![
+            event(2, EventKind::GenerationReplaced, 8, None, false),
+            event(3, EventKind::RestoreCompleted, 8, Some("keyboard"), true),
+            event(4, EventKind::RestoreCompleted, 8, Some("mouse"), true),
+        ]);
+        let devices = ["keyboard".to_owned(), "mouse".to_owned()];
+        assert_eq!(
+            renewed_generation_restores(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                8,
+                &devices,
+            ),
+            Ok(vec![
+                "bridge-restore-event:3:keyboard".to_owned(),
+                "bridge-restore-event:4:mouse".to_owned(),
+            ])
+        );
+        events.events[2].generation_id = Some(GenerationId::try_from(9_u64).expect("generation"));
+        assert_eq!(
+            renewed_generation_restores(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                8,
+                &devices,
+            ),
+            Err(EventEvidenceError::RestoreUnavailable)
+        );
+    }
+}
diff --git a/crates/hfx-ops/src/qualification_lifecycle.rs b/crates/hfx-ops/src/qualification_lifecycle.rs
index 38f0531..5c1c842 100644
--- a/crates/hfx-ops/src/qualification_lifecycle.rs
+++ b/crates/hfx-ops/src/qualification_lifecycle.rs
@@ -1,15 +1,18 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::qualification::{StageCheckpoint, StageProgress};
+use crate::qualification_event_evidence::{
+    cursor_evidence, device_return_restore, renewed_generation_restores,
+    resumed_generation_restores,
+};
 use crate::qualification_runner::{ObservationVerdict, RunnerTransition};
 use crate::{
     BatteryAvailability, BridgeIntegration, CompanionState, PresenceView, ProfileBindingView,
     QualificationPlan, QualificationStage, QualificationView, ReceiverLifecycleView, ReceiverView,
     RiskLevel, StageResult, StageStatus, qualification_generated_at,
 };
-use hfx_domain::{
-    ControllerAvailability, InventoryAvailability, ReceiverLifecycleState, RestoreState,
-};
+use hfx_domain::{ControllerAvailability, InventoryAvailability, ReceiverLifecycleState};
+use hfx_protocol::EventBatch;
 use rustix::time::{ClockId, clock_gettime};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -80,10 +83,10 @@ pub(crate) struct LifecycleObservation {
     receiver_profile: Option<ProfileBindingView>,
     receiver_lifecycle: Option<ReceiverLifecycleState>,
     stable_restore_enabled: bool,
-    restore_state: Option<RestoreState>,
     selected: Option<ObservedDevice>,
     siblings: Vec<ObservedDevice>,
     cursor_ref: Option<String>,
+    events: Option<EventBatch>,
 }
 
 pub(crate) enum PreparedLifecycleAction {
@@ -289,10 +292,10 @@ pub(crate) fn observe_lifecycle(
             .map(profile_binding),
         receiver_lifecycle: receiver.map(|receiver| receiver.lifecycle),
         stable_restore_enabled: receiver.is_some_and(|receiver| receiver.stable_restore_enabled),
-        restore_state: receiver.map(|receiver| receiver.restore_state),
         selected,
         siblings,
-        cursor_ref: integration.map(|value| cursor_evidence(&value.view)),
+        cursor_ref: integration.map(|value| cursor_evidence(&value.view.cursor)),
+        events: integration.map(|value| value.events.clone()),
     }
 }
 
@@ -444,11 +447,44 @@ pub(crate) fn reconcile_system_resume(
     {
         return Ok(None);
     }
+    let device_ids = run
+        .plans
+        .iter()
+        .map(|plan| plan.device_id.clone())
+        .collect::<Vec<_>>();
+    let generation = observation
+        .generation_id
+        .ok_or_else(|| LifecycleRunnerError::new("The resumed receiver has no generation."))?;
+    let restore_evidence = observation
+        .events
+        .as_ref()
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The bridge event history is unavailable for this lifecycle checkpoint.",
+            )
+        })
+        .and_then(|events| {
+            resumed_generation_restores(
+                events,
+                &run.active
+                    .as_ref()
+                    .expect("active lifecycle stage exists")
+                    .evidence_refs,
+                &observation.receiver_id,
+                generation,
+                &device_ids,
+            )
+            .map_err(|error| LifecycleRunnerError::new(error.to_string()))
+        });
+    let Ok(restore_evidence) = restore_evidence else {
+        return Ok(None);
+    };
     let active = run.active.as_mut().expect("active lifecycle stage exists");
     active.phase = LifecyclePhase::SystemResumeObservation;
     active
         .evidence_refs
         .push(format!("system-suspend-gap-ms:{suspended_ms}"));
+    active.evidence_refs.extend(restore_evidence);
     if let Some(cursor) = &observation.cursor_ref {
         active.evidence_refs.push(cursor.clone());
     }
@@ -634,13 +670,30 @@ fn record_device_return(
     observation: &LifecycleObservation,
 ) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
     validate_ready_identity_for_active(&run, observation)?;
-    if observation.restore_state != Some(RestoreState::Succeeded) {
+    if !observation.stable_restore_enabled {
         return Err(LifecycleRunnerError::new(
-            "The controller returned, but one successful stable restore is not visible yet.",
+            "The controller returned, but stable restoration is no longer enabled.",
         ));
     }
+    let active = run.active.as_ref().expect("active lifecycle stage exists");
+    let restore_evidence = device_return_restore(
+        observation.events.as_ref().ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The bridge event history is unavailable for this lifecycle checkpoint.",
+            )
+        })?,
+        &active.evidence_refs,
+        &observation.receiver_id,
+        active.baseline_generation_id,
+        &active.device_id,
+    )
+    .map_err(|error| LifecycleRunnerError::new(error.to_string()))?;
     let active = run.active.as_mut().expect("active lifecycle stage exists");
     active.evidence_refs.push("device-return:ready".to_owned());
+    active.evidence_refs.push(restore_evidence);
+    if let Some(cursor) = &observation.cursor_ref {
+        active.evidence_refs.push(cursor.clone());
+    }
     let checkpoint = if active.device_kind == "keyboard" {
         active.phase = LifecyclePhase::SuspendAuthorization;
         system_suspend_checkpoint(active.evidence_refs.clone())
@@ -673,6 +726,9 @@ fn record_receiver_departure(
     active
         .evidence_refs
         .push("receiver-departure:observed".to_owned());
+    if let Some(cursor) = &observation.cursor_ref {
+        active.evidence_refs.push(cursor.clone());
+    }
     let evidence = active.evidence_refs.clone();
     let has_siblings = run.plans.len() > 1;
     Ok(PreparedLifecycleAction::Record {
@@ -695,8 +751,26 @@ fn record_receiver_return(
             "Receiver return did not create a newer generation.",
         ));
     }
+    let device_ids = run
+        .plans
+        .iter()
+        .map(|plan| plan.device_id.clone())
+        .collect::<Vec<_>>();
+    let restore_evidence = renewed_generation_restores(
+        observation.events.as_ref().ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The bridge event history is unavailable for this lifecycle checkpoint.",
+            )
+        })?,
+        &active.evidence_refs,
+        &observation.receiver_id,
+        generation,
+        &device_ids,
+    )
+    .map_err(|error| LifecycleRunnerError::new(error.to_string()))?;
     let mut evidence = active.evidence_refs.clone();
     evidence.push(format!("receiver-generation:{generation}"));
+    evidence.extend(restore_evidence);
     evidence.push("stable-restore:succeeded".to_owned());
     if let Some(cursor) = &observation.cursor_ref {
         evidence.push(cursor.clone());
@@ -731,6 +805,9 @@ fn prepare_system_suspend(
     active
         .evidence_refs
         .push("system-suspend:authorized".to_owned());
+    if let Some(cursor) = &observation.cursor_ref {
+        active.evidence_refs.push(cursor.clone());
+    }
     let checkpoint = StageCheckpoint {
         checkpoint_id: "system-resume-pending".to_owned(),
         instructions: vec![
@@ -830,11 +907,9 @@ fn validate_restored_identity(
             "The active receiver generation does not satisfy this lifecycle checkpoint.",
         ));
     }
-    if !observation.stable_restore_enabled
-        || observation.restore_state != Some(RestoreState::Succeeded)
-    {
+    if !observation.stable_restore_enabled {
         return Err(LifecycleRunnerError::new(
-            "The exact generation is ready, but stable restoration has not terminally succeeded.",
+            "The exact generation is ready, but stable restoration is no longer enabled.",
         ));
     }
     Ok(())
@@ -1249,11 +1324,6 @@ fn finished(status: StageStatus, summary: &str, evidence_refs: Vec<String>) -> R
     }
 }
 
-fn cursor_evidence(view: &hfx_protocol::IntegrationView) -> String {
-    let encoded = serde_json::to_vec(&view.cursor).unwrap_or_default();
-    format!("bridge-cursor-sha256:{}", digest_hex(&encoded))
-}
-
 fn clock_milliseconds(clock: ClockId) -> Result<u64, LifecycleRunnerError> {
     let stamp = clock_gettime(clock);
     let seconds = u64::try_from(stamp.tv_sec).map_err(|_| {
@@ -1285,6 +1355,11 @@ fn valid_digest(value: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use hfx_domain::{
+        DroppedEventCount, EventKind, GenerationId, LogicalDeviceId, ProjectionRevision,
+        ReceiverId, SequenceNumber, StreamEpoch, StreamId, SubscriptionId, TransactionId,
+    };
+    use hfx_protocol::{BridgeEvent, EventCursor};
     use std::path::PathBuf;
 
     fn fixture_path(name: &str) -> PathBuf {
@@ -1354,7 +1429,6 @@ mod tests {
             receiver_profile: run.receiver.profile.clone(),
             receiver_lifecycle: Some(ReceiverLifecycleState::Active),
             stable_restore_enabled: true,
-            restore_state: Some(RestoreState::Succeeded),
             selected: Some(observed_device(
                 run,
                 selected_device_id,
@@ -1369,7 +1443,8 @@ mod tests {
                     observed_device(run, &plan.device_id, InventoryAvailability::Available, true)
                 })
                 .collect(),
-            cursor_ref: Some("bridge-cursor-sha256:test".to_owned()),
+            cursor_ref: Some(cursor_evidence(&test_cursor(0))),
+            events: Some(test_events(run, selected_device_id, generation_id)),
         }
     }
 
@@ -1381,10 +1456,108 @@ mod tests {
             receiver_profile: None,
             receiver_lifecycle: None,
             stable_restore_enabled: false,
-            restore_state: None,
             selected: None,
             siblings: Vec::new(),
-            cursor_ref: Some("bridge-cursor-sha256:absent".to_owned()),
+            cursor_ref: Some(cursor_evidence(&test_cursor(0))),
+            events: Some(test_events(
+                run,
+                &run.active
+                    .as_ref()
+                    .expect("active lifecycle stage exists")
+                    .device_id,
+                run.receiver.generation_id,
+            )),
+        }
+    }
+
+    fn test_cursor(sequence: u64) -> EventCursor {
+        EventCursor {
+            stream_id: StreamId::try_from("lifecycle-test-stream").expect("stream id"),
+            stream_epoch: StreamEpoch::try_from(1_u64).expect("stream epoch"),
+            projection_revision: ProjectionRevision::try_from(1_u32).expect("projection revision"),
+            sequence: SequenceNumber::try_from(sequence).expect("sequence"),
+        }
+    }
+
+    fn test_events(
+        run: &LifecycleRunState,
+        selected_device_id: &str,
+        generation_id: u64,
+    ) -> EventBatch {
+        let receiver_id =
+            ReceiverId::try_from(run.receiver.receiver_id.as_str()).expect("receiver");
+        let baseline = GenerationId::try_from(run.receiver.generation_id).expect("generation");
+        let renewed = GenerationId::try_from(generation_id).expect("generation");
+        let mut sequence = 0_u64;
+        let mut events = Vec::new();
+        let mut push = |kind: EventKind,
+                        generation: GenerationId,
+                        device_id: Option<&str>,
+                        transaction: bool| {
+            sequence += 1;
+            events.push(BridgeEvent {
+                sequence: SequenceNumber::try_from(sequence).expect("sequence"),
+                kind,
+                receiver_id: Some(receiver_id.clone()),
+                generation_id: Some(generation),
+                device_id: device_id
+                    .map(|value| LogicalDeviceId::try_from(value).expect("logical device id")),
+                lease_id: None,
+                transaction_id: transaction.then(|| {
+                    TransactionId::try_from(format!("restore-test-{sequence}"))
+                        .expect("transaction id")
+                }),
+                finding_id: None,
+            });
+        };
+        push(
+            EventKind::DeviceSleeping,
+            baseline,
+            Some(selected_device_id),
+            false,
+        );
+        push(
+            EventKind::DeviceAvailable,
+            baseline,
+            Some(selected_device_id),
+            false,
+        );
+        push(
+            EventKind::RestoreCompleted,
+            baseline,
+            Some(selected_device_id),
+            true,
+        );
+        for plan in &run.plans {
+            push(
+                EventKind::RestoreCompleted,
+                baseline,
+                Some(&plan.device_id),
+                true,
+            );
+        }
+        push(EventKind::ReceiverSuspended, baseline, None, false);
+        push(EventKind::GenerationReplaced, renewed, None, false);
+        push(EventKind::ReceiverAvailable, renewed, None, false);
+        for plan in &run.plans {
+            push(
+                EventKind::RestoreCompleted,
+                renewed,
+                Some(&plan.device_id),
+                true,
+            );
+        }
+        let cursor = test_cursor(sequence);
+        EventBatch {
+            subscription_id: SubscriptionId::try_from("lifecycle-test-subscription")
+                .expect("subscription id"),
+            next_cursor: cursor,
+            events,
+            oldest_available: SequenceNumber::try_from(1_u64).expect("sequence"),
+            latest_available: SequenceNumber::try_from(sequence).expect("sequence"),
+            dropped_events: DroppedEventCount::try_from(0_u64).expect("drop count"),
+            cursor_gap: false,
+            has_more: false,
         }
     }
 
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index bf10d5d..88db3e6 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -11,7 +11,8 @@ use crate::qualification_runner::{
     prepare_lighting_stage, reconcile_pending_lighting,
 };
 use crate::qualification_state::{
-    QualificationSessionState, QualificationStateError, default_state_path, load_state, save_state,
+    QualificationSessionState, QualificationStateError, archive_stale_state, default_state_path,
+    load_state, save_state,
 };
 use crate::{
     BatteryAvailability, CompanionAction, PresenceView, QualificationStage, QualificationView,
@@ -136,7 +137,12 @@ pub fn serve_qualification_console(
         .ok_or(QualificationServerError::StateUnavailable)?;
     let mut state = match load_state(state_file) {
         Ok(Some(state)) => state,
-        Ok(None) | Err(QualificationStateError::Stale) => ServerState::default(),
+        Ok(None) => ServerState::default(),
+        Err(QualificationStateError::Stale) => {
+            archive_stale_state(state_file)
+                .map_err(|_| QualificationServerError::StateUnavailable)?;
+            ServerState::default()
+        }
         Err(_) => return Err(QualificationServerError::StateUnavailable),
     };
     save_state(state_file, &state).map_err(|_| QualificationServerError::StateUnavailable)?;
diff --git a/crates/hfx-ops/src/qualification_state.rs b/crates/hfx-ops/src/qualification_state.rs
index e53c152..4c4c51a 100644
--- a/crates/hfx-ops/src/qualification_state.rs
+++ b/crates/hfx-ops/src/qualification_state.rs
@@ -16,6 +16,9 @@ use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
 use std::path::{Path, PathBuf};
 
 const SESSION_SCHEMA: &str = "hyperflux-qualification-session-v2";
+// Bump this only when persisted checkpoints cannot be interpreted safely by
+// the current coordinator. Ordinary implementation fixes must remain resumable.
+const COORDINATOR_STATE_CONTRACT: &str = "hyperflux-qualification-coordinator-state-v1";
 const MAX_SESSION_BYTES: u64 = 256 * 1024;
 const MAX_STAGE_RESULTS: usize = 64;
 
@@ -128,7 +131,9 @@ impl fmt::Display for QualificationStateError {
         formatter.write_str(match self {
             Self::Io(_) => "qualification checkpoint state could not be stored safely",
             Self::Invalid => "qualification checkpoint state is invalid",
-            Self::Stale => "qualification checkpoint state belongs to a different build",
+            Self::Stale => {
+                "qualification checkpoint state belongs to an incompatible coordinator contract"
+            }
             Self::TooLarge => "qualification checkpoint state exceeds its size bound",
             Self::Insecure => "qualification checkpoint state is not private",
         })
@@ -228,6 +233,30 @@ pub(crate) fn save_state(
     Ok(())
 }
 
+pub(crate) fn archive_stale_state(path: &Path) -> Result<PathBuf, QualificationStateError> {
+    let payload = fs::read(path)?;
+    if payload.len() as u64 > MAX_SESSION_BYTES {
+        return Err(QualificationStateError::TooLarge);
+    }
+    let parent = path.parent().ok_or(QualificationStateError::Invalid)?;
+    let digest = digest_hex(&Sha256::digest(&payload));
+    let archive = parent.join(format!("qualification-session.incompatible-{digest}.json"));
+    match fs::symlink_metadata(&archive) {
+        Ok(metadata)
+            if metadata.file_type().is_file()
+                && metadata.uid() == rustix::process::geteuid().as_raw()
+                && metadata.mode().trailing_zeros() >= 6
+                && fs::read(&archive)? == payload => {}
+        Ok(_) => return Err(QualificationStateError::Insecure),
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {
+            write_private_file(&archive, &payload)?;
+            fs::File::open(parent)?.sync_all()?;
+        }
+        Err(error) => return Err(error.into()),
+    }
+    Ok(archive)
+}
+
 fn temporary_path(path: &Path) -> PathBuf {
     let mut name = path.as_os_str().to_owned();
     name.push(format!(".{}.tmp", std::process::id()));
@@ -236,14 +265,15 @@ fn temporary_path(path: &Path) -> PathBuf {
 
 fn coordinator_sha256() -> String {
     let mut digest = Sha256::new();
-    digest.update(include_bytes!("qualification.rs"));
-    digest.update(include_bytes!("qualification_lifecycle.rs"));
-    digest.update(include_bytes!("qualification_runner.rs"));
-    digest.update(include_bytes!("qualification_server.rs"));
-    digest.update(include_bytes!("qualification_state.rs"));
-    digest.update(option_env!("HFX_SOURCE_REVISION").unwrap_or("development-unbound"));
+    digest.update(SESSION_SCHEMA.as_bytes());
+    digest.update([0]);
+    digest.update(COORDINATOR_STATE_CONTRACT.as_bytes());
+    digest_hex(&digest.finalize())
+}
+
+fn digest_hex(value: &[u8]) -> String {
     let mut encoded = String::with_capacity(64);
-    for byte in digest.finalize() {
+    for byte in value {
         write!(&mut encoded, "{byte:02x}").expect("writing to a string cannot fail");
     }
     encoded
@@ -306,6 +336,28 @@ mod tests {
         fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
     }
 
+    #[test]
+    fn stale_state_is_archived_once_without_data_loss() {
+        let path = test_path("archive-stale");
+        let _ = fs::remove_dir_all(path.parent().expect("parent"));
+        save_state(&path, &QualificationSessionState::default()).expect("state saves");
+        let mut stale: serde_json::Value =
+            serde_json::from_slice(&fs::read(&path).expect("state reads")).expect("state parses");
+        stale["coordinator_sha256"] = serde_json::Value::String("0".repeat(64));
+        let payload = serde_json::to_vec_pretty(&stale).expect("stale state serializes");
+        fs::write(&path, &payload).expect("stale state writes");
+        assert!(matches!(
+            load_state(&path),
+            Err(QualificationStateError::Stale)
+        ));
+
+        let first = archive_stale_state(&path).expect("stale state archives");
+        let second = archive_stale_state(&path).expect("same state reuses archive");
+        assert_eq!(first, second);
+        assert_eq!(fs::read(first).expect("archive reads"), payload);
+        fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
+    }
+
     #[test]
     fn state_rejects_world_readable_files() {
         let path = test_path("permissions");

From e3426102a8babc57c4e358016bf01b0dd143deb1 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:18:51 +0400
Subject: [PATCH 18/67] fix: make resume restoration ordering durable

---
 crates/hfx-daemon/src/manager.rs              |  33 ++-
 crates/hfx-daemon/src/observation.rs          |  54 +++-
 crates/hfx-daemon/src/restoration.rs          |  64 ++++-
 crates/hfx-ops/src/qualification.rs           |  78 +++++-
 crates/hfx-ops/src/qualification_lifecycle.rs | 256 +++++++++++++++++-
 crates/hfx-ops/src/qualification_server.rs    |  85 +++++-
 crates/hfx-ops/src/qualification_state.rs     |  42 ++-
 7 files changed, 573 insertions(+), 39 deletions(-)

diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index dd018a8..b3a8d71 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -436,20 +436,29 @@ impl LinuxRuntimeManager {
             let outcome = backend
                 .observe_lifecycle(observation)
                 .map_err(RuntimeTickError::Observation)?;
-            if let LifecycleObservationOutcome::Applied(applied) = outcome
-                && matches!(
+            if let LifecycleObservationOutcome::Applied(applied) = outcome {
+                let was_suspended = matches!(
                     applied.receiver_before,
                     ReceiverLifecycleState::Suspended | ReceiverLifecycleState::PartiallySuspended
-                )
-                && applied.receiver_after == ReceiverLifecycleState::Active
-            {
-                self.restoration
-                    .schedule_system_resume(
-                        applied.receiver_id.clone(),
-                        applied.generation_id,
-                        sequence,
-                    )
-                    .map_err(RuntimeTickError::Restoration)?;
+                );
+                let is_suspended = matches!(
+                    applied.receiver_after,
+                    ReceiverLifecycleState::Suspended | ReceiverLifecycleState::PartiallySuspended
+                );
+                if !was_suspended && is_suspended {
+                    self.restoration
+                        .schedule_system_suspend(&applied.receiver_id, applied.generation_id)
+                        .map_err(RuntimeTickError::Restoration)?;
+                } else if was_suspended && applied.receiver_after == ReceiverLifecycleState::Active
+                {
+                    self.restoration
+                        .schedule_system_resume(
+                            applied.receiver_id.clone(),
+                            applied.generation_id,
+                            sequence,
+                        )
+                        .map_err(RuntimeTickError::Restoration)?;
+                }
             }
         }
         if let Some(device_id) = translation.restore_ready {
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index c25b65b..1f7fdcd 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -250,11 +250,13 @@ impl PassiveObservationTranslator {
         stamp: ObservationStamp,
     ) -> PassiveTranslation {
         if state == ReceiverLifecycleState::Suspended {
-            self.receiver_was_suspended = true;
-        } else if state == ReceiverLifecycleState::Active && self.receiver_was_suspended {
-            for binding in self.lanes.values_mut() {
-                binding.last_activity_ms = None;
+            if !self.receiver_was_suspended {
+                for binding in self.lanes.values_mut() {
+                    binding.last_activity_ms = None;
+                }
             }
+            self.receiver_was_suspended = true;
+        } else if state == ReceiverLifecycleState::Active {
             self.receiver_was_suspended = false;
         }
         PassiveTranslation::applied(vec![
@@ -1020,4 +1022,48 @@ mod tests {
             .expect("continuous mouse activity translates");
         assert_eq!(continuous.restore_ready, None);
     }
+
+    #[test]
+    fn activity_between_suspend_and_active_remains_the_one_readiness_signal() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        translator
+            .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("initial activity translates");
+
+        for (sequence, observed_at_ms, raw_value) in [(3, 1_001, 1), (5, 1_003, 0)] {
+            let mut observation = raw_at(
+                sequence,
+                observed_at_ms,
+                HFX_UAPI_OBSERVATION_KIND_RECEIVER_SUSPENDED,
+                HFX_UAPI_ENDPOINT_SLOT_RECEIVER,
+                raw_value,
+            );
+            observation.source = HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT;
+            observation.confidence = HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT;
+            translator
+                .translate(observation)
+                .expect("power observation translates");
+
+            if raw_value == 1 {
+                let early = translator
+                    .translate(activity(4, 1_002, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+                    .expect("pre-active input translates");
+                assert_eq!(
+                    early.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+                    Some("paired-mouse-00cd")
+                );
+            }
+        }
+
+        let continuous = translator
+            .translate(activity(6, 1_004, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("post-active input remains continuous");
+        assert_eq!(continuous.restore_ready, None);
+    }
 }
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index bbbb01a..85129a8 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -297,7 +297,25 @@ impl RestorationScheduler {
         )
     }
 
-    /// Wakes matching claims and enqueues one exact system-resume trigger.
+    /// Invalidates pre-suspend readiness and parks this generation's claims.
+    /// Fresh device input observed after this boundary remains eligible when
+    /// the matching resume trigger arrives.
+    ///
+    /// # Errors
+    ///
+    /// Returns a generated-time failure.
+    pub fn schedule_system_suspend(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> Result<(), RestorationScheduleError> {
+        self.clear_readiness(receiver_id, generation_id);
+        self.park(receiver_id, generation_id, None)?;
+        Ok(())
+    }
+
+    /// Enqueues one exact system-resume trigger while retaining readiness
+    /// observed after the matching suspend boundary.
     ///
     /// # Errors
     ///
@@ -308,7 +326,6 @@ impl RestorationScheduler {
         generation_id: GenerationId,
         sequence: SequenceNumber,
     ) -> Result<(), RestorationScheduleError> {
-        self.clear_readiness(&receiver_id, generation_id);
         self.schedule(
             RestoreTriggerKind::SystemResume,
             receiver_id,
@@ -543,7 +560,7 @@ impl RestorationScheduler {
         if is_broad_trigger(kind) {
             let woke = if readiness_gated_trigger(kind) {
                 self.park(&receiver_id, generation_id, None)?;
-                0
+                self.wake_ready_devices(&receiver_id, generation_id)
             } else {
                 self.wake(&receiver_id, generation_id, None)
             };
@@ -680,6 +697,25 @@ impl RestorationScheduler {
         woken
     }
 
+    fn wake_ready_devices(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> usize {
+        let devices = self
+            .ready_devices
+            .iter()
+            .filter(|(candidate, generation, _)| {
+                candidate == receiver_id && *generation == generation_id
+            })
+            .map(|(_, _, device_id)| device_id.clone())
+            .collect::<Vec<_>>();
+        devices
+            .iter()
+            .map(|device_id| self.wake(receiver_id, generation_id, Some(device_id)))
+            .sum()
+    }
+
     fn park(
         &mut self,
         receiver_id: &ReceiverId,
@@ -1737,7 +1773,7 @@ mod tests {
     }
 
     #[test]
-    fn system_resume_clears_old_readiness_and_reparks_existing_claims() {
+    fn suspend_clears_old_readiness_but_resume_keeps_post_suspend_activity() {
         let claim = record("claim-mouse", RestoreRecordStatus::Planned);
         let mut scheduler = scheduler();
         scheduler
@@ -1748,12 +1784,8 @@ mod tests {
             .insert((id("receiver-1"), generation(1), id("mouse-1")));
 
         scheduler
-            .schedule_system_resume(
-                id("receiver-1"),
-                generation(1),
-                SequenceNumber::try_from(5_u64).expect("sequence"),
-            )
-            .expect("resume trigger schedules");
+            .schedule_system_suspend(&id("receiver-1"), generation(1))
+            .expect("suspend boundary records");
 
         assert!(scheduler.ready_devices.is_empty());
         assert_eq!(
@@ -1773,6 +1805,18 @@ mod tests {
                 SequenceNumber::try_from(6_u64).expect("sequence"),
             )
             .expect("fresh activity wakes the claim");
+        scheduler
+            .schedule_system_resume(
+                id("receiver-1"),
+                generation(1),
+                SequenceNumber::try_from(7_u64).expect("sequence"),
+            )
+            .expect("resume trigger schedules");
+        assert!(scheduler.ready_devices.contains(&(
+            id("receiver-1"),
+            generation(1),
+            id("mouse-1")
+        )));
         assert_eq!(
             scheduler
                 .claims
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 95f464e..5cc6813 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -17,6 +17,7 @@ use std::time::{SystemTime, UNIX_EPOCH};
 pub const QUALIFICATION_API_VERSION: u16 = 1;
 pub const QUALIFICATION_SCHEMA: &str = "hyperflux-local-qualification-v1";
 pub const QUALIFICATION_ENDPOINT: &str = "http://127.0.0.1:47821";
+pub(crate) const SYSTEM_RESUME_RETRY_EVIDENCE: &str = "system-resume-retry:ready";
 
 mod generation_id_wire {
     use hfx_domain::GenerationId;
@@ -854,7 +855,8 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
         .flat_map(|group| &group.stages)
         .filter_map(|stage| {
             let id = stage.action_id.clone()?;
-            let confirmation = if stage.status == StageStatus::AwaitingObservation {
+            let resume_retry = resume_retry_ready(stage);
+            let confirmation = if stage.status == StageStatus::AwaitingObservation || resume_retry {
                 if stage.risk == RiskLevel::SystemLifecycle && stage.observations.is_empty() {
                     Some(ActionConfirmation {
                         phrase: "authorize one supervised system suspend".to_owned(),
@@ -889,6 +891,9 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
                 label: match stage.status {
                     StageStatus::AwaitingObservation => "Record watched result",
                     StageStatus::Running => "Running bounded step",
+                    StageStatus::Failed | StageStatus::Blocked if resume_retry => {
+                        "Retry supervised resume"
+                    }
                     _ => match stage.kind {
                         StageKind::Automatic => "Run read-only check",
                         StageKind::WatchedObservation if stage.risk == RiskLevel::ReadOnly => {
@@ -904,7 +909,7 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
                 enabled: matches!(
                     stage.status,
                     StageStatus::Ready | StageStatus::AwaitingObservation
-                ),
+                ) || resume_retry,
                 risk: stage.risk,
                 confirmation,
             })
@@ -912,6 +917,17 @@ fn actions_for_plan(plan: &QualificationPlan) -> Vec<CompanionAction> {
         .collect()
 }
 
+pub(crate) fn resume_retry_ready(stage: &QualificationStage) -> bool {
+    matches!(stage.status, StageStatus::Failed | StageStatus::Blocked)
+        && stage.risk == RiskLevel::SystemLifecycle
+        && stage.result.as_ref().is_some_and(|result| {
+            result
+                .evidence_refs
+                .iter()
+                .any(|evidence| evidence == SYSTEM_RESUME_RETRY_EVIDENCE)
+        })
+}
+
 pub(crate) fn apply_stage_results(
     view: &mut QualificationView,
     results: &BTreeMap<String, StageProgress>,
@@ -1691,6 +1707,64 @@ mod tests {
         assert!(!lighting_action.enabled);
     }
 
+    #[test]
+    fn measured_resume_failure_exposes_only_the_exact_suspend_retry() {
+        let integration = paired_integration();
+        let mut view = build_qualification_view(
+            &system(),
+            Some(&integration),
+            &catalog(),
+            RunnerCapabilities {
+                read_only_actions: RunnerAvailability::Available,
+                supervised_lighting: RunnerAvailability::Available,
+                device_lifecycle: RunnerAvailability::Available,
+                system_lifecycle: RunnerAvailability::Available,
+            },
+            1,
+            "2026-07-22T12:00:00Z".to_owned(),
+        );
+        let keyboard = view
+            .plans
+            .iter_mut()
+            .find(|plan| plan.device_id.contains("keyboard"))
+            .expect("keyboard plan exists");
+        let lifecycle = keyboard
+            .groups
+            .iter_mut()
+            .flat_map(|group| &mut group.stages)
+            .find(|stage| stage.stage_id.ends_with("-lifecycle"))
+            .expect("lifecycle stage exists");
+        lifecycle.status = StageStatus::Failed;
+        lifecycle.result = Some(StageResult {
+            summary: "The watched resume result failed.".to_owned(),
+            completed_at: "2026-07-23T11:50:45Z".to_owned(),
+            evidence_refs: vec![SYSTEM_RESUME_RETRY_EVIDENCE.to_owned()],
+        });
+        lifecycle.observations.clear();
+        assert!(resume_retry_ready(lifecycle));
+        let lifecycle_id = lifecycle.stage_id.clone();
+        view.actions = actions_for_plans(&view.plans);
+
+        let lifecycle = view
+            .plans
+            .iter()
+            .flat_map(|plan| &plan.groups)
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id == lifecycle_id)
+            .expect("keyboard lifecycle remains visible");
+        let action = action_for_stage(&view, lifecycle);
+        assert!(action.enabled);
+        assert_eq!(action.label, "Retry supervised resume");
+        assert_eq!(
+            action
+                .confirmation
+                .as_ref()
+                .expect("retry requires authorization")
+                .phrase,
+            "authorize one supervised system suspend"
+        );
+    }
+
     #[test]
     fn identical_models_on_two_receivers_have_distinct_stage_and_action_ids() {
         let mut integration = integration();
diff --git a/crates/hfx-ops/src/qualification_lifecycle.rs b/crates/hfx-ops/src/qualification_lifecycle.rs
index 5c1c842..0ad2ebc 100644
--- a/crates/hfx-ops/src/qualification_lifecycle.rs
+++ b/crates/hfx-ops/src/qualification_lifecycle.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::qualification::{StageCheckpoint, StageProgress};
+use crate::qualification::{SYSTEM_RESUME_RETRY_EVIDENCE, StageCheckpoint, StageProgress};
 use crate::qualification_event_evidence::{
     cursor_evidence, device_return_restore, renewed_generation_restores,
     resumed_generation_restores,
@@ -382,8 +382,23 @@ pub(crate) fn prepare_lifecycle_checkpoint(
         ));
     }
     if verdict != ObservationVerdict::Pass {
-        let evidence = active.evidence_refs.clone();
-        run.active = None;
+        let retryable_resume = checkpoint.checkpoint_id == "system-resume-observation";
+        let mut evidence = active.evidence_refs.clone();
+        if retryable_resume
+            && !evidence
+                .iter()
+                .any(|value| value == SYSTEM_RESUME_RETRY_EVIDENCE)
+        {
+            evidence.push(SYSTEM_RESUME_RETRY_EVIDENCE.to_owned());
+        }
+        if retryable_resume {
+            let active = run.active.as_mut().expect("active lifecycle stage exists");
+            active.phase = LifecyclePhase::SuspendAuthorization;
+            active.suspend_stamp = None;
+            active.evidence_refs.clone_from(&evidence);
+        } else {
+            run.active = None;
+        }
         let (status, summary) = if verdict == ObservationVerdict::Fail {
             (
                 StageStatus::Failed,
@@ -395,10 +410,12 @@ pub(crate) fn prepare_lifecycle_checkpoint(
                 "The watched lifecycle result was inconclusive; no physical step was repeated.",
             )
         };
-        return Ok(PreparedLifecycleAction::Record {
-            run,
-            transition: finished(status, summary, evidence),
-        });
+        let transition = if retryable_resume {
+            retryable_failure(status, summary, evidence)
+        } else {
+            finished(status, summary, evidence)
+        };
+        return Ok(PreparedLifecycleAction::Record { run, transition });
     }
     match checkpoint.checkpoint_id.as_str() {
         "device-departure" => record_device_departure(run, observation),
@@ -413,6 +430,79 @@ pub(crate) fn prepare_lifecycle_checkpoint(
     }
 }
 
+pub(crate) fn recover_retryable_resume_failure(
+    run: &mut LifecycleRunState,
+    stage_id: &str,
+    progress: &mut StageProgress,
+) -> Result<bool, LifecycleRunnerError> {
+    if run.active.is_some()
+        || progress.checkpoint.is_some()
+        || !matches!(progress.status, StageStatus::Failed | StageStatus::Blocked)
+    {
+        return Ok(false);
+    }
+    let Some(result) = progress.result.as_mut() else {
+        return Ok(false);
+    };
+    let measured_resume = result
+        .evidence_refs
+        .iter()
+        .any(|value| value == "system-suspend:authorized")
+        && result
+            .evidence_refs
+            .iter()
+            .any(|value| value.starts_with("system-suspend-gap-ms:"));
+    if !measured_resume {
+        return Ok(false);
+    }
+    let plan = run
+        .plans
+        .iter()
+        .find(|plan| {
+            plan.groups
+                .iter()
+                .flat_map(|group| &group.stages)
+                .any(|stage| stage.stage_id == stage_id && stage.risk == RiskLevel::SystemLifecycle)
+        })
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The failed resume result is not bound to a retained system lifecycle stage.",
+            )
+        })?;
+    let device = run
+        .receiver
+        .devices
+        .iter()
+        .find(|device| device.device_id == plan.device_id)
+        .ok_or_else(|| {
+            LifecycleRunnerError::new(
+                "The failed resume result has no retained controller identity.",
+            )
+        })?;
+    if !result
+        .evidence_refs
+        .iter()
+        .any(|value| value == SYSTEM_RESUME_RETRY_EVIDENCE)
+    {
+        result
+            .evidence_refs
+            .push(SYSTEM_RESUME_RETRY_EVIDENCE.to_owned());
+    }
+    let evidence_refs = result.evidence_refs.clone();
+    progress.checkpoint = Some(system_suspend_checkpoint(evidence_refs.clone()));
+    run.active = Some(LifecycleStageState {
+        stage_id: stage_id.to_owned(),
+        device_id: plan.device_id.clone(),
+        device_kind: device.kind.clone(),
+        phase: LifecyclePhase::SuspendAuthorization,
+        baseline_generation_id: run.receiver.generation_id,
+        evidence_refs,
+        suspend_stamp: None,
+    });
+    run.validate()?;
+    Ok(true)
+}
+
 pub(crate) fn reconcile_system_resume(
     mut run: LifecycleRunState,
     observation: &LifecycleObservation,
@@ -1324,6 +1414,25 @@ fn finished(status: StageStatus, summary: &str, evidence_refs: Vec<String>) -> R
     }
 }
 
+fn retryable_failure(
+    status: StageStatus,
+    summary: &str,
+    evidence_refs: Vec<String>,
+) -> RunnerTransition {
+    RunnerTransition {
+        progress: StageProgress {
+            status,
+            result: Some(StageResult {
+                summary: summary.to_owned(),
+                completed_at: qualification_generated_at(),
+                evidence_refs: evidence_refs.clone(),
+            }),
+            checkpoint: Some(system_suspend_checkpoint(evidence_refs)),
+        },
+        hardware_write_executed: false,
+    }
+}
+
 fn clock_milliseconds(clock: ClockId) -> Result<u64, LifecycleRunnerError> {
     let stamp = clock_gettime(clock);
     let seconds = u64::try_from(stamp.tv_sec).map_err(|_| {
@@ -1783,6 +1892,139 @@ mod tests {
         }
     }
 
+    #[test]
+    fn failed_resume_keeps_only_a_fresh_suspend_retry_checkpoint() {
+        let (run, stage, departure) = start_stage("keyboard-test");
+        let (run, device_return) = advance_to_device_return(run, &stage, &departure.progress);
+        let ready = observation(
+            &run,
+            "keyboard-test",
+            7,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (run, authorization) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &device_return.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("device return reaches suspend authorization"),
+        );
+        let (suspended, _) = unwrap_suspend(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &authorization.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("suspend checkpoint prepares"),
+        );
+        let baseline = suspended
+            .active
+            .as_ref()
+            .and_then(|active| active.suspend_stamp.clone())
+            .expect("suspend stamp exists");
+        let resume_stamp = SuspendStamp {
+            boot_id_sha256: baseline.boot_id_sha256,
+            suspend_gap_ms: baseline.suspend_gap_ms + MINIMUM_SUSPEND_GAP_MS,
+        };
+        let (run, resume) = reconcile_system_resume(suspended, &ready, &resume_stamp)
+            .expect("resume reconciles")
+            .expect("resume checkpoint exists");
+        let (run, failed) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &resume.progress,
+                ObservationVerdict::Fail,
+                &ready,
+            )
+            .expect("physical failure records"),
+        );
+
+        assert_eq!(failed.progress.status, StageStatus::Failed);
+        assert_eq!(
+            failed
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("retry checkpoint exists")
+                .checkpoint_id,
+            "system-suspend-authorization"
+        );
+        assert!(
+            failed
+                .progress
+                .result
+                .as_ref()
+                .expect("failure remains recorded")
+                .evidence_refs
+                .iter()
+                .any(|value| value == SYSTEM_RESUME_RETRY_EVIDENCE)
+        );
+        assert_eq!(
+            run.active.as_ref().expect("retry remains active").phase,
+            LifecyclePhase::SuspendAuthorization
+        );
+        assert!(
+            run.active
+                .as_ref()
+                .expect("retry remains active")
+                .suspend_stamp
+                .is_none()
+        );
+
+        let (_, pending) = unwrap_suspend(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &failed.progress,
+                ObservationVerdict::Pass,
+                &ready,
+            )
+            .expect("explicit retry prepares one new suspend"),
+        );
+        assert_eq!(pending.progress.status, StageStatus::Running);
+    }
+
+    #[test]
+    fn legacy_terminal_resume_failure_upgrades_to_the_same_retry_contract() {
+        let (mut run, stage, _) = start_stage("keyboard-test");
+        run.active = None;
+        let mut progress = finished(
+            StageStatus::Failed,
+            "A watched lifecycle result did not match the required physical state.",
+            vec![
+                "system-suspend:authorized".to_owned(),
+                "system-suspend-gap-ms:9496".to_owned(),
+            ],
+        )
+        .progress;
+
+        assert!(
+            recover_retryable_resume_failure(&mut run, &stage.stage_id, &mut progress)
+                .expect("legacy failure upgrades")
+        );
+        assert_eq!(progress.status, StageStatus::Failed);
+        assert_eq!(
+            progress
+                .checkpoint
+                .as_ref()
+                .expect("retry checkpoint exists")
+                .checkpoint_id,
+            "system-suspend-authorization"
+        );
+        assert_eq!(
+            run.active.as_ref().expect("retry is retained").phase,
+            LifecyclePhase::SuspendAuthorization
+        );
+        run.validate().expect("upgraded retry remains valid");
+    }
+
     #[test]
     fn keyboard_suspend_is_separately_authorized_and_same_boot_bound() {
         let (run, stage, departure) = start_stage("keyboard-test");
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index 88db3e6..d264f0b 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::qualification::{StageProgress, apply_stage_results};
+use crate::qualification::{StageProgress, apply_stage_results, resume_retry_ready};
 use crate::qualification_lifecycle::{
     PreparedLifecycleAction, capture_lifecycle_run, current_suspend_stamp,
     identity_transition_matches, observe_lifecycle, overlay_lifecycle_run,
-    prepare_lifecycle_checkpoint, reconcile_system_resume, start_lifecycle_stage,
+    prepare_lifecycle_checkpoint, reconcile_system_resume, recover_retryable_resume_failure,
+    start_lifecycle_stage,
 };
 use crate::qualification_runner::{
     ObservationVerdict, PreparedLightingAction, new_transaction_id, prepare_lighting_checkpoint,
@@ -145,6 +146,11 @@ pub fn serve_qualification_console(
         }
         Err(_) => return Err(QualificationServerError::StateUnavailable),
     };
+    if recover_retryable_resume_state(&mut state)
+        .map_err(|_| QualificationServerError::StateUnavailable)?
+    {
+        state.revision = state.revision.saturating_add(1);
+    }
     save_state(state_file, &state).map_err(|_| QualificationServerError::StateUnavailable)?;
     let probe = RealSystemProbe::default();
     for connection in listener.incoming() {
@@ -162,6 +168,20 @@ pub fn serve_qualification_console(
     Ok(())
 }
 
+fn recover_retryable_resume_state(
+    state: &mut ServerState,
+) -> Result<bool, crate::qualification_lifecycle::LifecycleRunnerError> {
+    let Some(run) = state.lifecycle_run.as_mut() else {
+        return Ok(false);
+    };
+    for (stage_id, progress) in &mut state.results {
+        if recover_retryable_resume_failure(run, stage_id, progress)? {
+            return Ok(true);
+        }
+    }
+    Ok(false)
+}
+
 fn canonical_asset_root(path: &Path) -> Result<PathBuf, QualificationServerError> {
     let root = fs::canonicalize(path).map_err(|_| QualificationServerError::AssetRootInvalid)?;
     if !root.is_dir() || !root.join("index.html").is_file() {
@@ -547,7 +567,7 @@ fn apply_lifecycle_action(
         let (run, transition) = start_lifecycle_stage(run, stage, &observation)
             .map_err(|error| ActionFailure::unchanged(HttpStatus::Conflict, error.to_string()))?;
         PreparedLifecycleAction::Record { run, transition }
-    } else if stage.status == StageStatus::AwaitingObservation {
+    } else if stage.status == StageStatus::AwaitingObservation || resume_retry_ready(stage) {
         let verdict = observation_verdict(stage, input)
             .map_err(|message| ActionFailure::unchanged(HttpStatus::BadRequest, message))?;
         let current = session.results.get(&stage.stage_id).ok_or_else(|| {
@@ -1407,6 +1427,65 @@ mod tests {
         assert!(session.run_id.is_none());
     }
 
+    #[test]
+    fn server_upgrades_a_measured_terminal_resume_failure_once() {
+        let mut view = qualification_fixture("rust-qualified-pair.json");
+        for group in view.plans.iter_mut().flat_map(|plan| &mut plan.groups) {
+            for stage in &mut group.stages {
+                stage.status = if group.group_id == "lifecycle" {
+                    StageStatus::Ready
+                } else {
+                    StageStatus::Passed
+                };
+            }
+        }
+        let stage = view
+            .plans
+            .iter()
+            .find(|plan| plan.device_id == "keyboard-test")
+            .expect("keyboard plan exists")
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-lifecycle"))
+            .expect("keyboard lifecycle exists")
+            .clone();
+        let mut run = capture_lifecycle_run(&view, &stage).expect("run captures");
+        run.active = None;
+        let mut session = ServerState {
+            results: BTreeMap::from([(
+                stage.stage_id.clone(),
+                StageProgress {
+                    status: StageStatus::Failed,
+                    result: Some(StageResult {
+                        summary: "A watched lifecycle result did not match.".to_owned(),
+                        completed_at: "2026-07-23T11:50:45Z".to_owned(),
+                        evidence_refs: vec![
+                            "system-suspend:authorized".to_owned(),
+                            "system-suspend-gap-ms:9496".to_owned(),
+                        ],
+                    }),
+                    checkpoint: None,
+                },
+            )]),
+            lifecycle_run: Some(run),
+            ..ServerState::default()
+        };
+
+        assert!(recover_retryable_resume_state(&mut session).expect("state upgrades"));
+        assert!(!recover_retryable_resume_state(&mut session).expect("upgrade is idempotent"));
+        let progress = &session.results[&stage.stage_id];
+        assert_eq!(progress.status, StageStatus::Failed);
+        assert_eq!(
+            progress
+                .checkpoint
+                .as_ref()
+                .expect("retry checkpoint exists")
+                .checkpoint_id,
+            "system-suspend-authorization"
+        );
+    }
+
     #[test]
     fn transient_telemetry_gap_remains_retryable() {
         let mut view = qualification_fixture("rust-qualified-pair.json");
diff --git a/crates/hfx-ops/src/qualification_state.rs b/crates/hfx-ops/src/qualification_state.rs
index 4c4c51a..0692b58 100644
--- a/crates/hfx-ops/src/qualification_state.rs
+++ b/crates/hfx-ops/src/qualification_state.rs
@@ -19,6 +19,8 @@ const SESSION_SCHEMA: &str = "hyperflux-qualification-session-v2";
 // Bump this only when persisted checkpoints cannot be interpreted safely by
 // the current coordinator. Ordinary implementation fixes must remain resumable.
 const COORDINATOR_STATE_CONTRACT: &str = "hyperflux-qualification-coordinator-state-v1";
+const LEGACY_SOURCE_BOUND_COORDINATOR_SHA256: &str =
+    "912f0a7cd4cba79f2293e0fc664ef42e2bba5e36b549cecea596580aea739858";
 const MAX_SESSION_BYTES: u64 = 256 * 1024;
 const MAX_STAGE_RESULTS: usize = 64;
 
@@ -191,8 +193,11 @@ pub(crate) fn load_state(
         return Err(QualificationStateError::TooLarge);
     }
     let payload = fs::read(path)?;
-    let state: QualificationSessionState =
+    let mut state: QualificationSessionState =
         serde_json::from_slice(&payload).map_err(|_| QualificationStateError::Invalid)?;
+    if state.coordinator_sha256 == LEGACY_SOURCE_BOUND_COORDINATOR_SHA256 {
+        state.coordinator_sha256 = coordinator_sha256();
+    }
     state.validate()?;
     Ok(Some(state))
 }
@@ -358,6 +363,41 @@ mod tests {
         fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
     }
 
+    #[test]
+    fn exact_legacy_source_bound_coordinator_migrates_without_losing_results() {
+        let path = test_path("legacy-coordinator");
+        let _ = fs::remove_dir_all(path.parent().expect("parent"));
+        let mut state = QualificationSessionState {
+            revision: 19,
+            run_id: Some("local-preserved".to_owned()),
+            results: BTreeMap::from([(
+                "keyboard-profile-identity".to_owned(),
+                StageProgress {
+                    status: crate::StageStatus::Passed,
+                    result: None,
+                    checkpoint: None,
+                },
+            )]),
+            ..QualificationSessionState::default()
+        };
+        state.coordinator_sha256 = LEGACY_SOURCE_BOUND_COORDINATOR_SHA256.to_owned();
+        fs::create_dir_all(path.parent().expect("parent")).expect("parent creates");
+        write_private_file(
+            &path,
+            &serde_json::to_vec_pretty(&state).expect("legacy state serializes"),
+        )
+        .expect("legacy state writes");
+
+        let migrated = load_state(&path)
+            .expect("legacy state loads")
+            .expect("legacy state exists");
+        assert_eq!(migrated.coordinator_sha256, coordinator_sha256());
+        assert_eq!(migrated.revision, 19);
+        assert_eq!(migrated.run_id.as_deref(), Some("local-preserved"));
+        assert_eq!(migrated.results, state.results);
+        fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
+    }
+
     #[test]
     fn state_rejects_world_readable_files() {
         let path = test_path("permissions");

From 9e1c7b6724302b3ef8742c32e0a68bb43a2e9499 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 17:47:14 +0400
Subject: [PATCH 19/67] fix: serialize retryable lifecycle actions

---
 crates/hfx-ops/src/qualification.rs | 95 +++++++++++++++++++++++------
 1 file changed, 78 insertions(+), 17 deletions(-)

diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 5cc6813..a34bf35 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1043,6 +1043,14 @@ fn order_receiver_lifecycle_stages(plans: &mut [QualificationPlan]) {
             .filter(|group| group.group_id != "lifecycle")
             .flat_map(|group| &group.stages)
             .all(|stage| stage.status == StageStatus::Passed);
+        let resume_retry_id = plans
+            .iter()
+            .filter(|plan| plan.receiver_id == receiver_id)
+            .flat_map(|plan| &plan.groups)
+            .filter(|group| group.group_id == "lifecycle")
+            .flat_map(|group| &group.stages)
+            .find(|stage| resume_retry_ready(stage))
+            .map(|stage| stage.stage_id.clone());
         let mut active_seen = false;
         for stage in plans
             .iter_mut()
@@ -1051,6 +1059,17 @@ fn order_receiver_lifecycle_stages(plans: &mut [QualificationPlan]) {
             .filter(|group| group.group_id == "lifecycle")
             .flat_map(|group| &mut group.stages)
         {
+            if let Some(retry_id) = &resume_retry_id {
+                if stage.stage_id != *retry_id
+                    && (!matches!(
+                        stage.status,
+                        StageStatus::Passed | StageStatus::Failed | StageStatus::Blocked
+                    ) || resume_retry_ready(stage))
+                {
+                    stage.status = StageStatus::Locked;
+                }
+                continue;
+            }
             if matches!(
                 stage.status,
                 StageStatus::Passed | StageStatus::Failed | StageStatus::Blocked
@@ -1723,27 +1742,53 @@ mod tests {
             1,
             "2026-07-22T12:00:00Z".to_owned(),
         );
-        let keyboard = view
+        let completed = StageResult {
+            summary: "Prerequisite passed.".to_owned(),
+            completed_at: "2026-07-23T11:40:00Z".to_owned(),
+            evidence_refs: vec!["local-read-only:test".to_owned()],
+        };
+        let mut results = view
             .plans
-            .iter_mut()
+            .iter()
+            .flat_map(|plan| &plan.groups)
+            .flat_map(|group| &group.stages)
+            .filter(|stage| !stage.stage_id.ends_with("-lifecycle"))
+            .map(|stage| {
+                (
+                    stage.stage_id.clone(),
+                    StageProgress {
+                        status: StageStatus::Passed,
+                        result: Some(completed.clone()),
+                        checkpoint: None,
+                    },
+                )
+            })
+            .collect::<BTreeMap<_, _>>();
+        let lifecycle_id = view
+            .plans
+            .iter()
             .find(|plan| plan.device_id.contains("keyboard"))
-            .expect("keyboard plan exists");
-        let lifecycle = keyboard
+            .expect("keyboard plan exists")
             .groups
-            .iter_mut()
-            .flat_map(|group| &mut group.stages)
+            .iter()
+            .flat_map(|group| &group.stages)
             .find(|stage| stage.stage_id.ends_with("-lifecycle"))
-            .expect("lifecycle stage exists");
-        lifecycle.status = StageStatus::Failed;
-        lifecycle.result = Some(StageResult {
-            summary: "The watched resume result failed.".to_owned(),
-            completed_at: "2026-07-23T11:50:45Z".to_owned(),
-            evidence_refs: vec![SYSTEM_RESUME_RETRY_EVIDENCE.to_owned()],
-        });
-        lifecycle.observations.clear();
-        assert!(resume_retry_ready(lifecycle));
-        let lifecycle_id = lifecycle.stage_id.clone();
-        view.actions = actions_for_plans(&view.plans);
+            .expect("lifecycle stage exists")
+            .stage_id
+            .clone();
+        results.insert(
+            lifecycle_id.clone(),
+            StageProgress {
+                status: StageStatus::Failed,
+                result: Some(StageResult {
+                    summary: "The watched resume result failed.".to_owned(),
+                    completed_at: "2026-07-23T11:50:45Z".to_owned(),
+                    evidence_refs: vec![SYSTEM_RESUME_RETRY_EVIDENCE.to_owned()],
+                }),
+                checkpoint: None,
+            },
+        );
+        apply_stage_results(&mut view, &results, Some("run-generation-7"));
 
         let lifecycle = view
             .plans
@@ -1763,6 +1808,22 @@ mod tests {
                 .phrase,
             "authorize one supervised system suspend"
         );
+        let mouse_lifecycle = view
+            .plans
+            .iter()
+            .find(|plan| plan.device_id.contains("mouse"))
+            .expect("mouse plan exists")
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-lifecycle"))
+            .expect("mouse lifecycle exists");
+        assert_eq!(mouse_lifecycle.status, StageStatus::Locked);
+        assert!(!action_for_stage(&view, mouse_lifecycle).enabled);
+        assert_eq!(
+            view.actions.iter().filter(|action| action.enabled).count(),
+            1
+        );
     }
 
     #[test]

From 90b8e6dedd218cdcd0839f262a1fc9c94df5f1af Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:49:39 +0400
Subject: [PATCH 20/67] fix: preserve keyboard activity while externally
 powered

---
 apps/device-qualification/assets/app.js       | 11 +++--
 .../tests/fixtures/rust-qualified-mouse.json  |  2 +-
 .../tests/fixtures/rust-qualified-pair.json   |  6 +--
 crates/hfx-daemon/src/observation.rs          | 46 ++++++++++++++++++-
 crates/hfx-profiles/src/generated.rs          | 15 ++++--
 docs/generated/supported-hardware.md          |  4 +-
 .../generated/hyperflux_receiver_profiles.inc |  2 +-
 generated/knowledge/catalog.json              |  2 +-
 generated/profiles/catalog.json               | 15 +++---
 .../razer-deathstalker-v2-pro-tkl-0296.json   |  6 +--
 schemas/hardware-profile.schema.json          |  3 +-
 .../hyperflux/generated/profile_catalog.hpp   |  6 +--
 .../generated/profile_catalog.py              | 14 +++---
 .../generated/profile-compositions.json       |  2 +-
 tests/test_device_qualification_console.py    |  5 ++
 tests/test_profiles.py                        |  7 +++
 tools/hfxdev/generators/profiles.py           |  3 ++
 tools/hfxdev/profiles.py                      | 17 ++++++-
 18 files changed, 126 insertions(+), 40 deletions(-)

diff --git a/apps/device-qualification/assets/app.js b/apps/device-qualification/assets/app.js
index 06219e6..6af1acc 100644
--- a/apps/device-qualification/assets/app.js
+++ b/apps/device-qualification/assets/app.js
@@ -467,9 +467,14 @@ function supportLabel(verdict, support) {
 }
 
 function batteryLabel(battery) {
-  return battery.availability === "reported" && battery.percentage !== null
-    ? `${battery.percentage}% battery`
-    : `Battery ${labelize(battery.availability)}`;
+  if (battery.availability === "reported" && battery.percentage !== null) {
+    return `${battery.percentage}% battery`;
+  }
+  return {
+    unknown: "Waiting for battery report",
+    stale: "Battery report is out of date",
+    unavailable: "Battery report unavailable",
+  }[battery.availability] || "Battery report unavailable";
 }
 
 function riskCode(risk) {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 7a5e927..e737ddb 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
+    "profile_catalog_digest": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index a17eba3..9f2e79e 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
+    "profile_catalog_digest": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
   },
   "receivers": [
     {
@@ -127,7 +127,7 @@
           "product_id": 662,
           "profile": {
             "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-            "digest": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6"
+            "digest": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -444,7 +444,7 @@
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-        "digest": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6"
+        "digest": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index 1f7fdcd..e90fdb3 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -29,6 +29,7 @@ use std::fmt;
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum PassiveDisposition {
     Applied,
+    IgnoredIndeterminateSemantic,
     IgnoredUnknownLane,
     IgnoredUnqualifiedSemantic,
     ReceiverUnavailable,
@@ -464,8 +465,12 @@ impl PassiveObservationTranslator {
             RouteState::Available
         } else if passive.route_unavailable.contains(&value) {
             RouteState::Unavailable
+        } else if passive.route_indeterminate.contains(&value) {
+            return PassiveTranslation::disposition(
+                PassiveDisposition::IgnoredIndeterminateSemantic,
+            );
         } else {
-            RouteState::Unknown
+            return PassiveTranslation::disposition(PassiveDisposition::IgnoredUnqualifiedSemantic);
         };
         PassiveTranslation::applied(self.route_observations(binding, stamp, state))
     }
@@ -734,7 +739,7 @@ mod tests {
         );
         for (sequence, raw_value, expected) in [
             (2, 3, RouteState::Available),
-            (3, 0x0101, RouteState::Unavailable),
+            (3, 2, RouteState::Unavailable),
         ] {
             let translated = translator
                 .translate(raw(
@@ -758,6 +763,43 @@ mod tests {
         }
     }
 
+    #[test]
+    fn externally_powered_keyboard_route_cannot_override_observed_activity() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        let active = translator
+            .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("keyboard activity translates");
+        assert!(matches!(
+            &active.observations[0].kind,
+            LifecycleObservationKind::Route {
+                value: RouteState::Available,
+                ..
+            }
+        ));
+
+        let mut external_power = raw(
+            3,
+            HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ROUTE_RAW,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0101,
+        );
+        external_power.auxiliary = 2;
+        let route = translator
+            .translate(external_power)
+            .expect("indeterminate external-power route is bounded");
+        assert_eq!(
+            route.disposition,
+            PassiveDisposition::IgnoredIndeterminateSemantic
+        );
+        assert!(route.observations.is_empty());
+    }
+
     #[test]
     fn unknown_child_keeps_identity_and_activity_but_inherits_no_decoder() {
         let mut translator = translator();
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index c4356bc..2420c4f 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf
+// Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -40,6 +40,7 @@ pub struct PassiveTelemetryRecord {
     pub contact_on_mat: &'static [u32],
     pub route_available: &'static [u32],
     pub route_unavailable: &'static [u32],
+    pub route_indeterminate: &'static [u32],
     pub report_implies_route_available: bool,
 }
 
@@ -78,7 +79,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf";
+    "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -159,6 +160,7 @@ const PASSIVE_CONTACT_OFF_MAT_0: &[u32] = &[0];
 const PASSIVE_CONTACT_ON_MAT_0: &[u32] = &[1];
 const PASSIVE_ROUTE_AVAILABLE_0: &[u32] = &[];
 const PASSIVE_ROUTE_UNAVAILABLE_0: &[u32] = &[];
+const PASSIVE_ROUTE_INDETERMINATE_0: &[u32] = &[];
 
 const CAPABILITIES_1: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -239,7 +241,8 @@ const CARRIERS_1: &[u16] = &[
 const PASSIVE_CONTACT_OFF_MAT_1: &[u32] = &[];
 const PASSIVE_CONTACT_ON_MAT_1: &[u32] = &[];
 const PASSIVE_ROUTE_AVAILABLE_1: &[u32] = &[0, 3];
-const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2, 257];
+const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2];
+const PASSIVE_ROUTE_INDETERMINATE_1: &[u32] = &[257];
 
 const CAPABILITIES_2: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -320,6 +323,7 @@ pub const PROFILES: &[ProfileRecord] = &[
             contact_on_mat: PASSIVE_CONTACT_ON_MAT_0,
             route_available: PASSIVE_ROUTE_AVAILABLE_0,
             route_unavailable: PASSIVE_ROUTE_UNAVAILABLE_0,
+            route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_0,
             report_implies_route_available: true,
         }),
         presentation: Some(PresentationRecord {
@@ -334,8 +338,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "child.razer.deathstalker-v2-pro-tkl.0296",
-        runtime_sha256: "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
-        revision: 1,
+        runtime_sha256: "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
+        revision: 2,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Keyboard,
         vendor_id: Some(5426),
@@ -364,6 +368,7 @@ pub const PROFILES: &[ProfileRecord] = &[
             contact_on_mat: PASSIVE_CONTACT_ON_MAT_1,
             route_available: PASSIVE_ROUTE_AVAILABLE_1,
             route_unavailable: PASSIVE_ROUTE_UNAVAILABLE_1,
+            route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_1,
             report_implies_route_available: false,
         }),
         presentation: Some(PresentationRecord {
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 2bfe186..7848cff 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf`
+Profile source: `274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -11,7 +11,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `f72d38a70e9f` | 7 | 7 |
-| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `fcdd53fe104e` | 6 | 7 |
+| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `88e5b7d79e54` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index 7b6e326..908adcf 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf */
+/* Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 0dc4993..affaf26 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "53e22a40aefc7f86292f9d1e2c495c3cf38329c1bbacefd6004af4baa74c4b35",
+  "source_sha256": "9e26f940202ae7e5f9b097cf2e8741eb0e96212ef86bb62eeb74585172f0ede1",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index a393ff6..8a309cf 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1087,10 +1087,11 @@
       "restrictions": [
         "Another DeathStalker name, PID, or physical layout inherits no map.",
         "OpenRGB owns key names, geometry, and ANSI or ISO presentation.",
-        "External power does not establish a direct USB data route or charging state."
+        "External power does not establish a direct USB data route or charging state.",
+        "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."
       ],
-      "revision": 1,
-      "runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
+      "revision": 2,
+      "runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json",
       "transport": {
@@ -1215,9 +1216,11 @@
               0,
               3
             ],
-            "unavailable": [
-              2,
+            "indeterminate": [
               257
+            ],
+            "unavailable": [
+              2
             ]
           }
         }
@@ -1365,5 +1368,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
+  "source_sha256": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
 }
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index 675b26e..2e71f97 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
-  "revision": 1,
+  "revision": 2,
   "kind": "child",
   "device_kind": "keyboard",
   "identity": {"manufacturer": "Razer", "model_name": "Razer DeathStalker V2 Pro Tenkeyless", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 662},
@@ -13,7 +13,7 @@
       "endpoint_lane": "keyboard",
       "battery_encoding": "linear-255",
       "contact": null,
-      "route": {"available": [0, 3], "unavailable": [2, 257]},
+      "route": {"available": [0, 3], "unavailable": [2], "indeterminate": [257]},
       "report_implies_route_available": false
     }
   },
@@ -34,5 +34,5 @@
     {"id": "telemetry.connection-evidence", "support_level": "telemetry-qualified", "evidence_claims": ["claim.child.0296.passive-identity-telemetry"]}
   ],
   "evidence_claims": ["claim.child.0296.complete-keyboard-map", "claim.child.0296.passive-identity-telemetry", "claim.children.complete-static-black", "claim.children.software-effect-frame-continuity", "claim.children.static-off-brightness", "claim.presentation.openrgb-1.0rc3-model-layouts"],
-  "restrictions": ["Another DeathStalker name, PID, or physical layout inherits no map.", "OpenRGB owns key names, geometry, and ANSI or ISO presentation.", "External power does not establish a direct USB data route or charging state."]
+  "restrictions": ["Another DeathStalker name, PID, or physical layout inherits no map.", "OpenRGB owns key names, geometry, and ANSI or ISO presentation.", "External power does not establish a direct USB data route or charging state.", "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."]
 }
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index d8a6242..40aeaab 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -134,7 +134,8 @@
       "required": ["available", "unavailable"],
       "properties": {
         "available": {"$ref": "#/$defs/raw-values"},
-        "unavailable": {"$ref": "#/$defs/raw-values"}
+        "unavailable": {"$ref": "#/$defs/raw-values"},
+        "indeterminate": {"$ref": "#/$defs/raw-values"}
       }
     },
     "raw-values": {
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index a7827e0..4bea8d5 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf
+// Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf";
+inline constexpr std::string_view profile_source_sha256 = "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -161,7 +161,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33", 1, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
-    {"child.razer.deathstalker-v2-pro-tkl.0296", "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", 1, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
+    {"child.razer.deathstalker-v2-pro-tkl.0296", "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", 2, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
     {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
 }};
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 72ef6d3..a5d6049 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'd2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf'
+PROFILE_SOURCE_SHA256: Final = '274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -631,9 +631,11 @@
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
                'restrictions': ['Another DeathStalker name, PID, or physical layout inherits no map.',
                                 'OpenRGB owns key names, geometry, and ANSI or ISO presentation.',
-                                'External power does not establish a direct USB data route or charging state.'],
-               'revision': 1,
-               'runtime_sha256': 'fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6',
+                                'External power does not establish a direct USB data route or charging state.',
+                                'Receiver route value 0x0101 is indeterminate and cannot override observed keyboard '
+                                'activity.'],
+               'revision': 2,
+               'runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-deathstalker-v2-pro-tkl-0296.json',
                'transport': {'lighting': {'application_index_to_carrier': [0,
@@ -747,7 +749,7 @@
                                          'contact': None,
                                          'endpoint_lane': 'keyboard',
                                          'report_implies_route_available': False,
-                                         'route': {'available': [0, 3], 'unavailable': [2, 257]}}}},
+                                         'route': {'available': [0, 3], 'indeterminate': [257], 'unavailable': [2]}}}},
               {'capabilities': [{'access': 'read',
                                  'evidence_claims': ['claim.receiver.1532-00cf.generation-session'],
                                  'id': 'identity.model',
@@ -824,7 +826,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'd2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf'}
+ 'source_sha256': '274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 132dff0..cf35666 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "d2cfc5380a0a96562ef73ad7d7efae60f48b41bf50d93df0e39b9919facef5cf"
+  "source_sha256": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
 }
diff --git a/tests/test_device_qualification_console.py b/tests/test_device_qualification_console.py
index 90f4e5e..34208b6 100644
--- a/tests/test_device_qualification_console.py
+++ b/tests/test_device_qualification_console.py
@@ -146,6 +146,11 @@ def test_console_explains_a_v2_installation_without_calling_next_broken(self) ->
         self.assertIn("This computer is running HyperFlux V2", application)
         self.assertIn("working V2 installation as a broken Next bridge", application)
 
+    def test_battery_copy_distinguishes_startup_waiting_from_unavailable(self) -> None:
+        application = (APP / "assets" / "app.js").read_text(encoding="utf-8")
+        self.assertIn('unknown: "Waiting for battery report"', application)
+        self.assertIn('unavailable: "Battery report unavailable"', application)
+
     def test_operational_layout_has_bounded_responsive_and_accessibility_rules(self) -> None:
         html = (APP / "index.html").read_text(encoding="utf-8")
         css = (APP / "assets" / "app.css").read_text(encoding="utf-8")
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index 274fe0e..25e4885 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -154,6 +154,13 @@ def test_passive_decoder_is_lane_bound_disjoint_and_profile_local(self) -> None:
         with self.assertRaisesRegex(ModelError, "route values must be disjoint"):
             _validate_profiles(profiles, capabilities, claims)
 
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        keyboard["transport"]["passive"]["route"]["indeterminate"].append(3)
+        keyboard["transport"]["passive"]["route"]["indeterminate"].sort()
+        with self.assertRaisesRegex(ModelError, "route values must be disjoint"):
+            _validate_profiles(profiles, capabilities, claims)
+
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         del mouse["transport"]["passive"]
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index d7245fb..709a9a6 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -178,6 +178,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "    pub contact_on_mat: &'static [u32],",
         "    pub route_available: &'static [u32],",
         "    pub route_unavailable: &'static [u32],",
+        "    pub route_indeterminate: &'static [u32],",
         "    pub report_implies_route_available: bool,",
         "}",
         "",
@@ -253,6 +254,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 ("CONTACT_ON_MAT", contact["on_mat"]),
                 ("ROUTE_AVAILABLE", passive["route"]["available"]),
                 ("ROUTE_UNAVAILABLE", passive["route"]["unavailable"]),
+                ("ROUTE_INDETERMINATE", passive["route"].get("indeterminate", [])),
             ):
                 rendered = ", ".join(str(value) for value in values)
                 lines.append(f"const PASSIVE_{suffix}_{index}: &[u32] = &[{rendered}];")
@@ -294,6 +296,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 f"            contact_on_mat: PASSIVE_CONTACT_ON_MAT_{index},",
                 f"            route_available: PASSIVE_ROUTE_AVAILABLE_{index},",
                 f"            route_unavailable: PASSIVE_ROUTE_UNAVAILABLE_{index},",
+                f"            route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_{index},",
                 f"            report_implies_route_available: {route_implied},",
                 "        }),",
             ]
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 471311d..8262830 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -532,11 +532,24 @@ def _validate_passive(profile: dict[str, Any]) -> None:
         raise ModelError(f"{profile['profile_id']}: keyboard cannot declare mouse contact")
 
     route = passive["route"]
-    if not isinstance(route, dict) or set(route) != {"available", "unavailable"}:
+    route_keys = {"available", "unavailable", "indeterminate"}
+    if (
+        not isinstance(route, dict)
+        or not {"available", "unavailable"}.issubset(route)
+        or not set(route).issubset(route_keys)
+    ):
         raise ModelError(f"{profile['profile_id']}: route decoder is incomplete")
     available = _raw_values(route["available"], f"{profile['profile_id']} available routes")
     unavailable = _raw_values(route["unavailable"], f"{profile['profile_id']} unavailable routes")
-    if set(available) & set(unavailable):
+    indeterminate = _raw_values(
+        route.get("indeterminate", []),
+        f"{profile['profile_id']} indeterminate routes",
+    )
+    if (
+        set(available) & set(unavailable)
+        or set(available) & set(indeterminate)
+        or set(unavailable) & set(indeterminate)
+    ):
         raise ModelError(f"{profile['profile_id']}: route values must be disjoint")
     if "telemetry.connection-evidence" in capability_ids and not (
         available or unavailable or passive["report_implies_route_available"]

From b6d3955838cafdea4b755f319acae71edb888b96 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 18:50:02 +0400
Subject: [PATCH 21/67] build: select pinned verification automatically

---
 docs/generated/development-environment.md |  2 +
 tests/test_governance.py                  |  4 ++
 tools/hfxdev/ci.py                        |  3 ++
 tools/hfxdev/cli.py                       | 45 ++++++++++++++++++++++-
 tools/hfxdev/generators/development.py    |  5 +++
 5 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/docs/generated/development-environment.md b/docs/generated/development-environment.md
index cad3208..8251f48 100644
--- a/docs/generated/development-environment.md
+++ b/docs/generated/development-environment.md
@@ -36,6 +36,8 @@ Then run either software lane without network access:
 ./hfx verify --all
 ```
 
+These commands use the host directly when it exactly matches the repository pins. Otherwise they select the canonical pinned container automatically, so a rolling distribution update cannot create a false verification failure. Use `--host-toolchain` only when diagnosing the host environment itself.
+
 ## Network Boundary
 
 Container construction may read the immutable Arch snapshot and install the exact Rust toolchain. Post-create preparation may fetch only cataloged repositories and locked Rust crates. Verification reuses those workspace-local inputs without network access; missing, dirty, or mismatched inputs fail with a remediation command.
diff --git a/tests/test_governance.py b/tests/test_governance.py
index b601532..e96850a 100644
--- a/tests/test_governance.py
+++ b/tests/test_governance.py
@@ -242,6 +242,10 @@ def test_ci_invocations_separate_fetch_from_networkless_execution(self, _which)
         self.assertIn("CARGO_NET_OFFLINE=false cargo fetch --locked", prepare_command)
         self.assertIn("CARGO_NET_OFFLINE=false", prepare_command)
         self.assertIn("CARGO_NET_OFFLINE=true", " ".join(verify.command))
+        self.assertIn(
+            "HFX_PINNED_VERIFICATION_ENVIRONMENT=1",
+            " ".join(verify.command),
+        )
         self.assertIn("--changed-from " + "a" * 40, " ".join(verify.command))
 
     @patch("hfxdev.ci.shutil.which", return_value="/usr/bin/podman")
diff --git a/tools/hfxdev/ci.py b/tools/hfxdev/ci.py
index fc1b504..e5bb51d 100644
--- a/tools/hfxdev/ci.py
+++ b/tools/hfxdev/ci.py
@@ -22,6 +22,7 @@
     r"^[a-z0-9][a-z0-9._/-]*(?::[A-Za-z0-9._-]+)?(?:@sha256:[0-9a-f]{64})?$"
 )
 REVISION = re.compile(r"^[0-9a-f]{40}$")
+PINNED_VERIFICATION_ENVIRONMENT = "HFX_PINNED_VERIFICATION_ENVIRONMENT"
 
 
 @dataclass(frozen=True)
@@ -197,6 +198,8 @@ def container_invocation(
             f"{root}:{environment.workspace_path}:rw",
         ]
     )
+    if operation == "verify":
+        command.extend(("--env", f"{PINNED_VERIFICATION_ENVIRONMENT}=1"))
     if linked_git is not None:
         command.extend(("--volume", f"{linked_git}:{linked_git}:ro"))
     command.extend(("--workdir", environment.workspace_path, image))
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 055c39c..3d9a5a0 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -3,11 +3,14 @@
 from __future__ import annotations
 
 import argparse
+import os
 from pathlib import Path
 import sys
+import time
 
 from .actions_summary import write_actions_summary
-from .ci import container_invocation, run_container
+from .ci import PINNED_VERIFICATION_ENVIRONMENT, container_invocation, run_container
+from .governance import load_github_governance
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
 from .distribution_package import build_distribution_package
@@ -46,6 +49,11 @@ def _parser() -> argparse.ArgumentParser:
         help="select tests from changes since a Git revision; unknown paths fail closed",
     )
     verify.add_argument("--output", type=Path, help="empty directory for structured evidence")
+    verify.add_argument(
+        "--host-toolchain",
+        action="store_true",
+        help="require the host toolchain instead of selecting the pinned container",
+    )
 
     generate = commands.add_parser("generate", help="regenerate canonical derived files")
     generate.add_argument("--check", action="store_true", help="reserved for compatibility; verify performs the check")
@@ -170,8 +178,43 @@ def main(arguments: list[str] | None = None) -> int:
     try:
         if args.command == "verify":
             from .verify import RUNNERS
+            from .toolchains import verify_current_toolchain
 
             lane = "fast" if args.fast else "full-software"
+            running_pinned = os.environ.get(PINNED_VERIFICATION_ENVIRONMENT) == "1"
+            if not args.host_toolchain and not running_pinned:
+                try:
+                    verify_current_toolchain(root)
+                except ModelError:
+                    output = args.output
+                    if output is None:
+                        output = Path("build") / "verification" / (
+                            f"pinned-{os.getpid()}-{time.time_ns()}"
+                        )
+                    elif output.is_absolute():
+                        try:
+                            output = output.resolve().relative_to(root.resolve())
+                        except ValueError as error:
+                            raise ModelError(
+                                "container verification output must stay below the repository"
+                            ) from error
+                    changed_from = None
+                    if args.changed_from is not None:
+                        changed_from, _ = git_changed_paths(root, args.changed_from)
+                    invocation = container_invocation(
+                        root,
+                        image=load_github_governance(root).development_image,
+                        operation="verify",
+                        lane="fast" if args.fast else "full",
+                        output=output,
+                        changed_from=changed_from,
+                    )
+                    print(
+                        "HyperFlux Next verification environment: pinned container "
+                        "(host package versions are independent)",
+                        flush=True,
+                    )
+                    return run_container(invocation)
             outcome = run_verification(
                 root,
                 load_test_catalog(root),
diff --git a/tools/hfxdev/generators/development.py b/tools/hfxdev/generators/development.py
index 43fe721..cadac1c 100644
--- a/tools/hfxdev/generators/development.py
+++ b/tools/hfxdev/generators/development.py
@@ -141,6 +141,11 @@ def markdown(environment: DevelopmentEnvironment, upstreams: list[dict[str, Any]
             "./hfx verify --all",
             "```",
             "",
+            "These commands use the host directly when it exactly matches the repository pins. "
+            "Otherwise they select the canonical pinned container automatically, so a rolling "
+            "distribution update cannot create a false verification failure. Use "
+            "`--host-toolchain` only when diagnosing the host environment itself.",
+            "",
             "## Network Boundary",
             "",
             "Container construction may read the immutable Arch snapshot and install the exact "

From a037b3e33e41c246d0e46fa671e1e432bbbcf68e Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 20:39:53 +0400
Subject: [PATCH 22/67] fix: settle retained-route lifecycle restores

---
 .../tests/fixtures/rust-qualified-mouse.json  |   6 +-
 .../tests/fixtures/rust-qualified-pair.json   |   6 +-
 crates/hfx-daemon/src/manager.rs              |   8 +-
 crates/hfx-daemon/src/observation.rs          |  81 ++-
 crates/hfx-daemon/src/restoration.rs          | 154 +++++-
 crates/hfx-ops/src/lib.rs                     |   1 +
 .../src/qualification_event_evidence.rs       |  57 +-
 crates/hfx-ops/src/qualification_lifecycle.rs | 190 ++++++-
 crates/hfx-ops/src/qualification_migration.rs | 502 ++++++++++++++++++
 crates/hfx-ops/src/qualification_server.rs    |  53 +-
 crates/hfx-ops/src/qualification_state.rs     | 143 ++++-
 crates/hfx-profiles/src/catalog.rs            |  26 +-
 crates/hfx-profiles/src/generated.rs          |  55 +-
 crates/hfx-profiles/tests/catalog.rs          |  23 +-
 docs/generated/supported-hardware.md          |   4 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  32 +-
 .../razer-basilisk-v3-pro-35k-00cd.json       |  10 +-
 .../razer-deathstalker-v2-pro-tkl-0296.json   |   3 +
 schemas/hardware-profile.schema.json          |  31 +-
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  20 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_profiles.py                        |  86 +++
 tools/hfxdev/generators/profiles.py           |  72 +++
 tools/hfxdev/profiles.py                      | 123 ++++-
 27 files changed, 1587 insertions(+), 111 deletions(-)
 create mode 100644 crates/hfx-ops/src/qualification_migration.rs

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index e737ddb..ec11d9b 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
+    "profile_catalog_digest": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
   },
   "receivers": [
     {
@@ -38,7 +38,7 @@
           "product_id": 205,
           "profile": {
             "id": "child.razer.basilisk-v3-pro-35k.00cd",
-            "digest": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33"
+            "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -130,7 +130,7 @@
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
-        "digest": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33"
+        "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 9f2e79e..8069b6d 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
+    "profile_catalog_digest": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
   },
   "receivers": [
     {
@@ -38,7 +38,7 @@
           "product_id": 205,
           "profile": {
             "id": "child.razer.basilisk-v3-pro-35k.00cd",
-            "digest": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33"
+            "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -214,7 +214,7 @@
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
-        "digest": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33"
+        "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index b3a8d71..3e91954 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -461,13 +461,15 @@ impl LinuxRuntimeManager {
                 }
             }
         }
-        if let Some(device_id) = translation.restore_ready {
+        if let Some(readiness) = translation.restore_ready {
             self.restoration
-                .schedule_device_return(
+                .schedule_device_return_at(
                     receiver_id.clone(),
                     generation_id,
-                    device_id,
+                    readiness.device_id,
                     SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?,
+                    backend.now(),
+                    readiness.settle_ms,
                 )
                 .map_err(RuntimeTickError::Restoration)?;
         }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index e90fdb3..fd1e0b2 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -20,7 +20,8 @@ use hfx_kernel_transport::{
     HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT, RawKernelObservation,
 };
 use hfx_profiles::{
-    PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord, RuntimeProfileCatalog,
+    LifecyclePolicyRecord, PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord,
+    RuntimeProfileCatalog,
 };
 use hfx_runtime::ACTIVITY_RESUMPTION_QUIET_MS;
 use std::collections::BTreeMap;
@@ -36,6 +37,12 @@ pub enum PassiveDisposition {
     IdentityConflict,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct DeviceRestoreReadiness {
+    pub device_id: LogicalDeviceId,
+    pub settle_ms: u64,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct PassiveTranslation {
     pub disposition: PassiveDisposition,
@@ -43,7 +50,7 @@ pub struct PassiveTranslation {
     /// One device whose first generation-bound input, or first input after a
     /// bounded quiet interval, proves that its child route is ready for a
     /// restoration attempt. This is not a claim that the device was asleep.
-    pub restore_ready: Option<LogicalDeviceId>,
+    pub restore_ready: Option<DeviceRestoreReadiness>,
 }
 
 impl PassiveTranslation {
@@ -55,11 +62,18 @@ impl PassiveTranslation {
         }
     }
 
-    fn restore_ready(observations: Vec<LifecycleObservation>, device_id: LogicalDeviceId) -> Self {
+    fn restore_ready(
+        observations: Vec<LifecycleObservation>,
+        device_id: LogicalDeviceId,
+        settle_ms: u64,
+    ) -> Self {
         Self {
             disposition: PassiveDisposition::Applied,
             observations,
-            restore_ready: Some(device_id),
+            restore_ready: Some(DeviceRestoreReadiness {
+                device_id,
+                settle_ms,
+            }),
         }
     }
 
@@ -119,6 +133,7 @@ struct LaneBinding {
     device_id: LogicalDeviceId,
     endpoint_id: EndpointId,
     passive: Option<PassiveTelemetryRecord>,
+    lifecycle: Option<LifecyclePolicyRecord>,
     last_activity_ms: Option<MonotonicMs>,
 }
 
@@ -305,6 +320,7 @@ impl PassiveObservationTranslator {
             device_id: device_id.clone(),
             endpoint_id: endpoint_id.clone(),
             passive: profile.and_then(|profile| profile.passive),
+            lifecycle: profile.and_then(|profile| profile.lifecycle),
             last_activity_ms,
         };
         let child = ChildIdentity::new(device_id.clone(), device_kind, product_id)?;
@@ -386,7 +402,13 @@ impl PassiveObservationTranslator {
             ),
         ];
         Ok(if restore_ready {
-            PassiveTranslation::restore_ready(observations, binding.device_id)
+            PassiveTranslation::restore_ready(
+                observations,
+                binding.device_id,
+                binding
+                    .lifecycle
+                    .map_or(0, |policy| policy.device_return_settle_ms),
+            )
         } else {
             PassiveTranslation::applied(observations)
         })
@@ -856,9 +878,19 @@ mod tests {
             .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("first activity translates");
         assert_eq!(
-            first.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            first
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
+        assert_eq!(
+            first
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.settle_ms),
+            Some(1_000)
+        );
 
         let resumed = translator
             .translate(activity(
@@ -868,7 +900,10 @@ mod tests {
             ))
             .expect("post-quiet activity translates");
         assert_eq!(
-            resumed.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            resumed
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
 
@@ -918,7 +953,10 @@ mod tests {
             ))
             .expect("mouse resumes after identity replay");
         assert_eq!(
-            mouse.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            mouse
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
 
@@ -949,7 +987,10 @@ mod tests {
             ))
             .expect("first generation-bound activity translates");
         assert_eq!(
-            first.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            first
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
     }
@@ -1049,16 +1090,29 @@ mod tests {
             .translate(activity(7, 1_004, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("post-resume mouse activity translates");
         assert_eq!(
-            mouse.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            mouse
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
         let keyboard = translator
             .translate(activity(8, 1_005, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
             .expect("post-resume keyboard activity translates");
         assert_eq!(
-            keyboard.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+            keyboard
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.device_id.as_str()),
             Some("paired-keyboard-0296")
         );
+        assert_eq!(
+            keyboard
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.settle_ms),
+            Some(0)
+        );
         let continuous = translator
             .translate(activity(9, 1_006, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("continuous mouse activity translates");
@@ -1097,7 +1151,10 @@ mod tests {
                     .translate(activity(4, 1_002, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
                     .expect("pre-active input translates");
                 assert_eq!(
-                    early.restore_ready.as_ref().map(LogicalDeviceId::as_str),
+                    early
+                        .restore_ready
+                        .as_ref()
+                        .map(|readiness| readiness.device_id.as_str()),
                     Some("paired-mouse-00cd")
                 );
             }
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 85129a8..6bab2c6 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -183,7 +183,7 @@ pub struct RestorationScheduler {
     max_triggers: usize,
     max_claims: usize,
     configured_receivers: BTreeSet<ReceiverId>,
-    ready_devices: BTreeSet<(ReceiverId, GenerationId, LogicalDeviceId)>,
+    ready_devices: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), MonotonicMs>,
     triggers: BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     claims: BTreeMap<RestoreClaimId, ScheduledClaim>,
 }
@@ -247,7 +247,7 @@ impl RestorationScheduler {
             max_triggers,
             max_claims,
             configured_receivers: BTreeSet::new(),
-            ready_devices: BTreeSet::new(),
+            ready_devices: BTreeMap::new(),
             triggers: BTreeMap::new(),
             claims: BTreeMap::new(),
         })
@@ -347,14 +347,45 @@ impl RestorationScheduler {
         device_id: LogicalDeviceId,
         sequence: SequenceNumber,
     ) -> Result<(), RestorationScheduleError> {
+        self.schedule_device_return_at(
+            receiver_id,
+            generation_id,
+            device_id,
+            sequence,
+            immediate_due()?,
+            0,
+        )
+    }
+
+    /// Enqueues one exact return after a profile-owned wake-settle interval.
+    /// The schedule timestamp comes from the same monotonic clock used by the
+    /// actor tick, keeping the deadline valid across suspend boundaries.
+    ///
+    /// # Errors
+    ///
+    /// Returns a time, trigger-capacity, or generated-identity failure.
+    pub fn schedule_device_return_at(
+        &mut self,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        device_id: LogicalDeviceId,
+        sequence: SequenceNumber,
+        scheduled_at: MonotonicMs,
+        settle_ms: u64,
+    ) -> Result<(), RestorationScheduleError> {
+        let due = due_after(scheduled_at, settle_ms)?;
+        let readiness = (receiver_id.clone(), generation_id, device_id.clone());
         self.ready_devices
-            .insert((receiver_id.clone(), generation_id, device_id.clone()));
-        self.schedule(
+            .entry(readiness)
+            .and_modify(|existing| *existing = (*existing).max(due))
+            .or_insert(due);
+        self.schedule_at(
             RestoreTriggerKind::DeviceReturn,
             receiver_id,
             generation_id,
             Some(device_id),
             Some(sequence),
+            due,
         )
     }
 
@@ -366,7 +397,7 @@ impl RestorationScheduler {
         self.claims.retain(|_, scheduled| {
             scheduled.receiver_id != *receiver_id || scheduled.generation_id != generation_id
         });
-        self.ready_devices.retain(|(candidate, generation, _)| {
+        self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
     }
@@ -553,6 +584,25 @@ impl RestorationScheduler {
         generation_id: GenerationId,
         target_device_id: Option<LogicalDeviceId>,
         sequence: Option<SequenceNumber>,
+    ) -> Result<(), RestorationScheduleError> {
+        self.schedule_at(
+            kind,
+            receiver_id,
+            generation_id,
+            target_device_id,
+            sequence,
+            immediate_due()?,
+        )
+    }
+
+    fn schedule_at(
+        &mut self,
+        kind: RestoreTriggerKind,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        target_device_id: Option<LogicalDeviceId>,
+        sequence: Option<SequenceNumber>,
+        due: MonotonicMs,
     ) -> Result<(), RestorationScheduleError> {
         if !self.enabled {
             return Ok(());
@@ -562,7 +612,7 @@ impl RestorationScheduler {
                 self.park(&receiver_id, generation_id, None)?;
                 self.wake_ready_devices(&receiver_id, generation_id)
             } else {
-                self.wake(&receiver_id, generation_id, None)
+                self.wake(&receiver_id, generation_id, None, immediate_due()?)
             };
             self.triggers.retain(|_, scheduled| {
                 scheduled.trigger.receiver_id != receiver_id
@@ -573,7 +623,7 @@ impl RestorationScheduler {
                 return Ok(());
             }
         } else if kind == RestoreTriggerKind::DeviceReturn {
-            let woke = self.wake(&receiver_id, generation_id, target_device_id.as_ref());
+            let woke = self.wake(&receiver_id, generation_id, target_device_id.as_ref(), due);
             if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
                 return Ok(());
             }
@@ -615,8 +665,7 @@ impl RestorationScheduler {
                     generation_id,
                     target_device_id,
                 },
-                due: MonotonicMs::try_from(0_u64)
-                    .map_err(|_| RestorationScheduleError::TimeOverflow)?,
+                due,
                 sequence,
             },
         );
@@ -639,13 +688,15 @@ impl RestorationScheduler {
     ) -> Result<(), RestorationScheduleError> {
         let readiness_gated =
             readiness_gated_trigger(trigger_kind) || readiness_gated_trigger(record.trigger_kind);
-        let due = if readiness_gated
-            && !self.ready_devices.contains(&(
-                record.receiver_id.clone(),
-                record.generation_id,
-                record.device_id.clone(),
-            )) {
-            parked_due()?
+        let readiness = (
+            record.receiver_id.clone(),
+            record.generation_id,
+            record.device_id.clone(),
+        );
+        let due = if readiness_gated {
+            self.ready_devices
+                .get(&readiness)
+                .map_or_else(parked_due, |ready_at| Ok(now.max(*ready_at)))?
         } else {
             now
         };
@@ -684,6 +735,7 @@ impl RestorationScheduler {
         receiver_id: &ReceiverId,
         generation_id: GenerationId,
         device_id: Option<&LogicalDeviceId>,
+        due: MonotonicMs,
     ) -> usize {
         let mut woken = 0;
         for claim in self.claims.values_mut().filter(|claim| {
@@ -691,7 +743,7 @@ impl RestorationScheduler {
                 && claim.generation_id == generation_id
                 && device_id.is_none_or(|device_id| claim.device_id == *device_id)
         }) {
-            claim.due = MonotonicMs::try_from(0_u64).expect("zero monotonic time is valid");
+            claim.due = due;
             woken += 1;
         }
         woken
@@ -705,14 +757,14 @@ impl RestorationScheduler {
         let devices = self
             .ready_devices
             .iter()
-            .filter(|(candidate, generation, _)| {
+            .filter(|((candidate, generation, _), _)| {
                 candidate == receiver_id && *generation == generation_id
             })
-            .map(|(_, _, device_id)| device_id.clone())
+            .map(|((_, _, device_id), due)| (device_id.clone(), *due))
             .collect::<Vec<_>>();
         devices
             .iter()
-            .map(|device_id| self.wake(receiver_id, generation_id, Some(device_id)))
+            .map(|(device_id, due)| self.wake(receiver_id, generation_id, Some(device_id), *due))
             .sum()
     }
 
@@ -748,7 +800,7 @@ impl RestorationScheduler {
     }
 
     fn clear_readiness(&mut self, receiver_id: &ReceiverId, generation_id: GenerationId) {
-        self.ready_devices.retain(|(candidate, generation, _)| {
+        self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
     }
@@ -774,6 +826,10 @@ fn parked_due() -> Result<MonotonicMs, RestorationScheduleError> {
     MonotonicMs::try_from(u64::MAX).map_err(|_| RestorationScheduleError::TimeOverflow)
 }
 
+fn immediate_due() -> Result<MonotonicMs, RestorationScheduleError> {
+    MonotonicMs::try_from(0_u64).map_err(|_| RestorationScheduleError::TimeOverflow)
+}
+
 fn due_trigger_id(
     triggers: &BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     now: MonotonicMs,
@@ -1631,7 +1687,7 @@ mod tests {
                 .kind,
             RestoreTriggerKind::SystemResume
         ));
-        assert!(scheduler.ready_devices.contains(&(
+        assert!(scheduler.ready_devices.contains_key(&(
             id("receiver-1"),
             generation(1),
             id("mouse-1")
@@ -1781,7 +1837,7 @@ mod tests {
             .expect("claim schedules");
         scheduler
             .ready_devices
-            .insert((id("receiver-1"), generation(1), id("mouse-1")));
+            .insert((id("receiver-1"), generation(1), id("mouse-1")), time(0));
 
         scheduler
             .schedule_system_suspend(&id("receiver-1"), generation(1))
@@ -1812,7 +1868,7 @@ mod tests {
                 SequenceNumber::try_from(7_u64).expect("sequence"),
             )
             .expect("resume trigger schedules");
-        assert!(scheduler.ready_devices.contains(&(
+        assert!(scheduler.ready_devices.contains_key(&(
             id("receiver-1"),
             generation(1),
             id("mouse-1")
@@ -1854,6 +1910,56 @@ mod tests {
         );
     }
 
+    #[test]
+    fn profile_owned_return_settle_delays_only_the_exact_device() {
+        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
+        let keyboard =
+            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_record(mouse.clone(), parked_due().expect("parked due"))
+            .expect("mouse claim schedules");
+        scheduler
+            .schedule_record(keyboard.clone(), parked_due().expect("parked due"))
+            .expect("keyboard claim schedules");
+
+        scheduler
+            .schedule_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                1_000,
+            )
+            .expect("settled mouse return schedules");
+        scheduler
+            .schedule_device_return(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+            )
+            .expect("default keyboard return schedules");
+
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("mouse claim")
+                .due,
+            time(2_000)
+        );
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&keyboard.claim_id)
+                .expect("keyboard claim")
+                .due,
+            time(0)
+        );
+    }
+
     #[test]
     fn deferred_claim_waits_for_backoff_but_device_return_wakes_it() {
         let deferred = record(
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 159864b..09d864e 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -9,6 +9,7 @@ mod probe;
 mod qualification;
 mod qualification_event_evidence;
 mod qualification_lifecycle;
+mod qualification_migration;
 mod qualification_runner;
 mod qualification_server;
 mod qualification_state;
diff --git a/crates/hfx-ops/src/qualification_event_evidence.rs b/crates/hfx-ops/src/qualification_event_evidence.rs
index 3ed993e..ef7db81 100644
--- a/crates/hfx-ops/src/qualification_event_evidence.rs
+++ b/crates/hfx-ops/src/qualification_event_evidence.rs
@@ -14,6 +14,12 @@ pub(crate) enum EventEvidenceError {
     RestoreUnavailable,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum DeviceReturnEvidenceMode {
+    ReceiverTransition,
+    WatchedRetainedRoute,
+}
+
 impl fmt::Display for EventEvidenceError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter.write_str(match self {
@@ -41,6 +47,7 @@ pub(crate) fn device_return_restore(
     receiver_id: &str,
     generation_id: u64,
     device_id: &str,
+    mode: DeviceReturnEvidenceMode,
 ) -> Result<String, EventEvidenceError> {
     let anchor = latest_anchor_sequence(batch, evidence_refs)?;
     let mut departed = false;
@@ -50,6 +57,12 @@ pub(crate) fn device_return_restore(
         if !matches_identity(event, receiver_id, generation_id, Some(device_id)) {
             continue;
         }
+        if mode == DeviceReturnEvidenceMode::WatchedRetainedRoute
+            && event.kind == EventKind::RestoreCompleted
+            && event.transaction_id.as_ref().is_some()
+        {
+            return Ok(restore_evidence(event.sequence.get(), device_id));
+        }
         match event.kind {
             EventKind::DeviceSleeping | EventKind::DeviceUnavailable => {
                 departed = true;
@@ -293,6 +306,7 @@ mod tests {
                 "receiver-test",
                 7,
                 "keyboard",
+                DeviceReturnEvidenceMode::ReceiverTransition,
             ),
             Ok("bridge-restore-event:4:keyboard".to_owned())
         );
@@ -306,7 +320,14 @@ mod tests {
             event(4, EventKind::RestoreCompleted, 7, Some("mouse"), true),
         ]);
         assert_eq!(
-            device_return_restore(&events, &[], "receiver-test", 7, "keyboard"),
+            device_return_restore(
+                &events,
+                &[],
+                "receiver-test",
+                7,
+                "keyboard",
+                DeviceReturnEvidenceMode::ReceiverTransition,
+            ),
             Err(EventEvidenceError::AnchorUnavailable)
         );
         assert_eq!(
@@ -316,6 +337,40 @@ mod tests {
                 "receiver-test",
                 7,
                 "keyboard",
+                DeviceReturnEvidenceMode::ReceiverTransition,
+            ),
+            Err(EventEvidenceError::RestoreUnavailable)
+        );
+    }
+
+    #[test]
+    fn watched_retained_route_requires_a_newer_terminal_restore() {
+        let events = batch(vec![event(
+            2,
+            EventKind::RestoreCompleted,
+            7,
+            Some("mouse"),
+            true,
+        )]);
+        assert_eq!(
+            device_return_restore(
+                &events,
+                &[cursor_evidence(&cursor(1))],
+                "receiver-test",
+                7,
+                "mouse",
+                DeviceReturnEvidenceMode::WatchedRetainedRoute,
+            ),
+            Ok("bridge-restore-event:2:mouse".to_owned())
+        );
+        assert_eq!(
+            device_return_restore(
+                &events,
+                &[cursor_evidence(&cursor(2))],
+                "receiver-test",
+                7,
+                "mouse",
+                DeviceReturnEvidenceMode::WatchedRetainedRoute,
             ),
             Err(EventEvidenceError::RestoreUnavailable)
         );
diff --git a/crates/hfx-ops/src/qualification_lifecycle.rs b/crates/hfx-ops/src/qualification_lifecycle.rs
index 0ad2ebc..d68a8a5 100644
--- a/crates/hfx-ops/src/qualification_lifecycle.rs
+++ b/crates/hfx-ops/src/qualification_lifecycle.rs
@@ -2,7 +2,7 @@
 
 use crate::qualification::{SYSTEM_RESUME_RETRY_EVIDENCE, StageCheckpoint, StageProgress};
 use crate::qualification_event_evidence::{
-    cursor_evidence, device_return_restore, renewed_generation_restores,
+    DeviceReturnEvidenceMode, cursor_evidence, device_return_restore, renewed_generation_restores,
     resumed_generation_restores,
 };
 use crate::qualification_runner::{ObservationVerdict, RunnerTransition};
@@ -12,6 +12,7 @@ use crate::{
     RiskLevel, StageResult, StageStatus, qualification_generated_at,
 };
 use hfx_domain::{ControllerAvailability, InventoryAvailability, ReceiverLifecycleState};
+use hfx_profiles::{PowerOffDepartureEvidence, profile_by_id};
 use hfx_protocol::EventBatch;
 use rustix::time::{ClockId, clock_gettime};
 use serde::{Deserialize, Serialize};
@@ -728,13 +729,17 @@ fn record_device_departure(
 ) -> Result<PreparedLifecycleAction, LifecycleRunnerError> {
     validate_same_generation(&run, observation)?;
     let selected = selected_observation(&run, observation)?;
-    if selected.controller_ready
-        || !matches!(
+    let receiver_state_departure = !selected.controller_ready
+        && matches!(
             selected.availability,
             InventoryAvailability::Sleeping
                 | InventoryAvailability::Unavailable
                 | InventoryAvailability::ReceiverUnavailable
-        )
+        );
+    let retained_route_departure = selected.controller_ready
+        && selected.availability == InventoryAvailability::Available
+        && retained_route_departure_allowed(&run)?;
+    if (!receiver_state_departure && !retained_route_departure)
         || !siblings_ready(&run, observation)
     {
         return Err(LifecycleRunnerError::new(
@@ -743,10 +748,14 @@ fn record_device_departure(
     }
     let active = run.active.as_mut().expect("active lifecycle stage exists");
     active.phase = LifecyclePhase::DeviceReturn;
-    active.evidence_refs.push(format!(
-        "device-departure:{}",
-        selected.availability.as_str()
-    ));
+    active.evidence_refs.push(if retained_route_departure {
+        "device-departure:watched-physical-retained-route".to_owned()
+    } else {
+        format!("device-departure:{}", selected.availability.as_str())
+    });
+    if let Some(cursor) = &observation.cursor_ref {
+        active.evidence_refs.push(cursor.clone());
+    }
     let evidence = active.evidence_refs.clone();
     let has_siblings = run.plans.len() > 1;
     Ok(PreparedLifecycleAction::Record {
@@ -766,6 +775,15 @@ fn record_device_return(
         ));
     }
     let active = run.active.as_ref().expect("active lifecycle stage exists");
+    let evidence_mode = if active
+        .evidence_refs
+        .iter()
+        .any(|value| value == "device-departure:watched-physical-retained-route")
+    {
+        DeviceReturnEvidenceMode::WatchedRetainedRoute
+    } else {
+        DeviceReturnEvidenceMode::ReceiverTransition
+    };
     let restore_evidence = device_return_restore(
         observation.events.as_ref().ok_or_else(|| {
             LifecycleRunnerError::new(
@@ -776,6 +794,7 @@ fn record_device_return(
         &observation.receiver_id,
         active.baseline_generation_id,
         &active.device_id,
+        evidence_mode,
     )
     .map_err(|error| LifecycleRunnerError::new(error.to_string()))?;
     let active = run.active.as_mut().expect("active lifecycle stage exists");
@@ -1147,6 +1166,27 @@ fn expected_device<'a>(
         .ok_or_else(|| LifecycleRunnerError::new("The expected controller identity is missing."))
 }
 
+fn retained_route_departure_allowed(run: &LifecycleRunState) -> Result<bool, LifecycleRunnerError> {
+    let active = run.active.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The retained lifecycle campaign has no active stage.")
+    })?;
+    let expected = expected_device(run, &active.device_id)?;
+    let binding = expected.profile.as_ref().ok_or_else(|| {
+        LifecycleRunnerError::new("The lifecycle target has no exact profile binding.")
+    })?;
+    let profile = profile_by_id(&binding.id).ok_or_else(|| {
+        LifecycleRunnerError::new("The lifecycle target profile is absent from this build.")
+    })?;
+    if profile.runtime_sha256 != binding.digest {
+        return Err(LifecycleRunnerError::new(
+            "The lifecycle target profile digest does not match this build.",
+        ));
+    }
+    Ok(profile.lifecycle.is_some_and(|policy| {
+        policy.power_off_departure_evidence == PowerOffDepartureEvidence::WatchedRetainedRoute
+    }))
+}
+
 fn observed_device(
     receiver: &hfx_protocol::IntegrationReceiverView,
     device_id: &str,
@@ -1238,18 +1278,32 @@ fn receiver_has_exact_device(receiver: &ReceiverView, expected: &crate::DeviceVi
 
 fn device_departure_checkpoint(run: &LifecycleRunState) -> StageCheckpoint {
     let has_siblings = run.plans.len() > 1;
+    let retained_route = retained_route_departure_allowed(run).unwrap_or(false);
+    let (instructions, prompt) = if retained_route {
+        (
+            vec![
+                "Switch the selected controller off with its physical power control. Keep every sibling controller awake."
+                    .to_owned(),
+                "Confirm the selected controller is unlit. Its receiver route may remain listed for this exact profile; do not wait for an invented disconnect."
+                    .to_owned(),
+            ],
+            "Is the selected controller physically powered off and unlit?",
+        )
+    } else {
+        (
+            vec![
+                "Power off the selected controller or allow it to enter its normal sleep state. Keep every sibling controller awake."
+                    .to_owned(),
+                "Wait until the selected controller is unlit, then record this checkpoint once."
+                    .to_owned(),
+            ],
+            "Is the selected controller asleep or powered off?",
+        )
+    };
     StageCheckpoint {
         checkpoint_id: "device-departure".to_owned(),
-        instructions: vec![
-            "Power off the selected controller or allow it to enter its normal sleep state. Keep every sibling controller awake."
-                .to_owned(),
-            "Wait until the selected controller is unlit, then record this checkpoint once."
-                .to_owned(),
-        ],
-        observations: lifecycle_observations(
-            "Is the selected controller asleep or powered off?",
-            has_siblings,
-        ),
+        instructions,
+        observations: lifecycle_observations(prompt, has_siblings),
         evidence_refs: run
             .active
             .as_ref()
@@ -1738,6 +1792,106 @@ mod tests {
         assert!(error.to_string().contains("identity and lighting"));
     }
 
+    #[test]
+    fn retained_route_departure_requires_the_exact_profile_policy() {
+        let (mut run, stage, departure) = start_stage("mouse-test");
+        let mouse_profile = profile_by_id("child.razer.basilisk-v3-pro-35k.00cd")
+            .expect("qualified mouse profile exists");
+        let expected = run
+            .receiver
+            .devices
+            .iter_mut()
+            .find(|device| device.device_id == "mouse-test")
+            .expect("mouse exists");
+        expected.profile = Some(ProfileBindingView {
+            id: mouse_profile.id.to_owned(),
+            digest: mouse_profile.runtime_sha256.to_owned(),
+        });
+        let retained_prompt = device_departure_checkpoint(&run);
+        assert!(
+            retained_prompt
+                .instructions
+                .iter()
+                .any(|value| value.contains("receiver route may remain listed"))
+        );
+        assert_eq!(
+            retained_prompt.observations[0].prompt,
+            "Is the selected controller physically powered off and unlit?"
+        );
+        let retained = observation(
+            &run,
+            "mouse-test",
+            run.receiver.generation_id,
+            InventoryAvailability::Available,
+            true,
+        );
+        let (accepted, transition) = unwrap_record(
+            prepare_lifecycle_checkpoint(
+                run,
+                &stage,
+                &departure.progress,
+                ObservationVerdict::Pass,
+                &retained,
+            )
+            .expect("watched retained-route departure records"),
+        );
+        let evidence = &accepted
+            .active
+            .as_ref()
+            .expect("stage remains active")
+            .evidence_refs;
+        assert!(
+            evidence
+                .iter()
+                .any(|value| value == "device-departure:watched-physical-retained-route")
+        );
+        assert!(
+            evidence
+                .last()
+                .is_some_and(|value| value.starts_with("bridge-cursor-sha256:"))
+        );
+        assert_eq!(
+            transition
+                .progress
+                .checkpoint
+                .as_ref()
+                .expect("return checkpoint")
+                .checkpoint_id,
+            "device-return"
+        );
+
+        let (mut run, stage, departure) = start_stage("mouse-test");
+        let keyboard_profile = profile_by_id("child.razer.deathstalker-v2-pro-tkl.0296")
+            .expect("qualified keyboard profile exists");
+        let expected = run
+            .receiver
+            .devices
+            .iter_mut()
+            .find(|device| device.device_id == "mouse-test")
+            .expect("mouse exists");
+        expected.profile = Some(ProfileBindingView {
+            id: keyboard_profile.id.to_owned(),
+            digest: keyboard_profile.runtime_sha256.to_owned(),
+        });
+        let retained = observation(
+            &run,
+            "mouse-test",
+            run.receiver.generation_id,
+            InventoryAvailability::Available,
+            true,
+        );
+        let Err(error) = prepare_lifecycle_checkpoint(
+            run,
+            &stage,
+            &departure.progress,
+            ObservationVerdict::Pass,
+            &retained,
+        ) else {
+            panic!("a profile without retained-route policy stays strict");
+        };
+        assert!(error.to_string().contains("has not departed cleanly"));
+    }
+
     #[test]
     fn mouse_lifecycle_accepts_only_a_newer_profile_bound_generation() {
         let (run, stage, departure) = start_stage("mouse-test");
diff --git a/crates/hfx-ops/src/qualification_migration.rs b/crates/hfx-ops/src/qualification_migration.rs
new file mode 100644
index 0000000..3e1fdb6
--- /dev/null
+++ b/crates/hfx-ops/src/qualification_migration.rs
@@ -0,0 +1,502 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#[cfg(test)]
+use crate::qualification::StageProgress;
+use crate::qualification::StageStatus;
+use crate::qualification_lifecycle::LifecycleRunState;
+use crate::qualification_state::{QualificationSessionState, QualificationStageAuthority};
+use crate::{
+    QualificationGroup, QualificationPlan, QualificationStage, QualificationView, ReceiverView,
+};
+use hfx_profiles::{PROFILE_SOURCE_SHA256, RuntimeProfile, RuntimeProfileCatalog};
+use sha2::{Digest, Sha256};
+use std::collections::BTreeMap;
+use std::fmt::Write as _;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum StageRole {
+    Identity,
+    Telemetry,
+    Map,
+    Lighting,
+    Lifecycle,
+}
+
+impl StageRole {
+    fn from_stage_id(stage_id: &str) -> Option<Self> {
+        [
+            ("-identity", Self::Identity),
+            ("-telemetry", Self::Telemetry),
+            ("-map", Self::Map),
+            ("-lighting", Self::Lighting),
+            ("-lifecycle", Self::Lifecycle),
+        ]
+        .into_iter()
+        .find_map(|(suffix, role)| stage_id.ends_with(suffix).then_some(role))
+    }
+
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Identity => "identity",
+            Self::Telemetry => "telemetry",
+            Self::Map => "map",
+            Self::Lighting => "lighting",
+            Self::Lifecycle => "lifecycle",
+        }
+    }
+}
+
+/// Carries forward only profile stages whose exact predecessor, hardware
+/// generation, and immutable stage contract are explicitly authorized.
+pub(crate) fn migrate_profile_catalog_state(
+    mut stale: QualificationSessionState,
+    current_view: &QualificationView,
+    catalog: &RuntimeProfileCatalog,
+    current_fingerprint: [u8; 32],
+) -> Option<QualificationSessionState> {
+    let current_authorities = qualification_stage_authorities(current_view);
+    if current_authorities.is_empty() {
+        return None;
+    }
+    let old_authorities = if stale.stage_authorities.is_empty() {
+        stale
+            .lifecycle_run
+            .as_ref()
+            .map(stage_authorities_from_lifecycle)
+            .unwrap_or_default()
+    } else {
+        stale.stage_authorities.clone()
+    };
+    if old_authorities.is_empty() {
+        return None;
+    }
+    let mut preserved = BTreeMap::new();
+
+    for (stage_id, current_authority) in &current_authorities {
+        let Some(old_authority) = old_authorities.get(stage_id) else {
+            continue;
+        };
+        if !same_stage_authority(old_authority, current_authority) {
+            continue;
+        }
+        let Some(profile) = catalog
+            .iter()
+            .find(|profile| profile.profile_id.as_str() == current_authority.profile_id)
+        else {
+            continue;
+        };
+        if profile.runtime_digest.as_str() != current_authority.profile_digest {
+            continue;
+        }
+        let Some(role) = StageRole::from_stage_id(stage_id) else {
+            continue;
+        };
+        if !allowed_roles(
+            profile,
+            &old_authority.profile_digest,
+            &current_authority.profile_digest,
+        )
+        .contains(&role)
+        {
+            continue;
+        }
+        let Some(progress) = stale.results.get(stage_id) else {
+            continue;
+        };
+        if progress.status != StageStatus::Passed || progress.result.is_none() {
+            continue;
+        }
+        let mut progress = progress.clone();
+        if old_authority.profile_digest != current_authority.profile_digest {
+            progress
+                .result
+                .as_mut()
+                .expect("passed result was checked")
+                .evidence_refs
+                .push(format!(
+                    "profile-migration:{}:{}:{}",
+                    old_authority.profile_digest,
+                    current_authority.profile_digest,
+                    role.as_str()
+                ));
+        }
+        preserved.insert(stage_id.clone(), progress);
+    }
+
+    if preserved.is_empty() {
+        return None;
+    }
+    PROFILE_SOURCE_SHA256.clone_into(&mut stale.profile_catalog_sha256);
+    stale.revision = stale.revision.saturating_add(1);
+    stale.identity_fingerprint = Some(current_fingerprint);
+    stale.results = preserved;
+    stale.stage_authorities = current_authorities;
+    stale.pending_transaction = None;
+    stale.lifecycle_run = None;
+    Some(stale)
+}
+
+pub(crate) fn qualification_stage_authorities(
+    view: &QualificationView,
+) -> BTreeMap<String, QualificationStageAuthority> {
+    stage_authorities(&view.receivers, &view.plans)
+}
+
+fn stage_authorities_from_lifecycle(
+    run: &LifecycleRunState,
+) -> BTreeMap<String, QualificationStageAuthority> {
+    stage_authorities(std::slice::from_ref(&run.receiver), &run.plans)
+}
+
+fn stage_authorities(
+    receivers: &[ReceiverView],
+    plans: &[QualificationPlan],
+) -> BTreeMap<String, QualificationStageAuthority> {
+    let mut authorities = BTreeMap::new();
+    for plan in plans {
+        let Some(receiver) = receivers.iter().find(|receiver| {
+            receiver.receiver_id == plan.receiver_id && receiver.generation_id == plan.generation_id
+        }) else {
+            continue;
+        };
+        let Some(receiver_profile) = &receiver.profile else {
+            continue;
+        };
+        let Some(device) = receiver
+            .devices
+            .iter()
+            .find(|device| device.device_id == plan.device_id)
+        else {
+            continue;
+        };
+        let Some(profile) = &device.profile else {
+            continue;
+        };
+        if plan.profile_binding.as_ref() != Some(profile) {
+            continue;
+        }
+        for (group, stage) in plan_stages(plan) {
+            let authority = QualificationStageAuthority {
+                receiver_id: receiver.receiver_id.clone(),
+                generation_id: receiver.generation_id,
+                receiver_profile_id: receiver_profile.id.clone(),
+                receiver_profile_digest: receiver_profile.digest.clone(),
+                device_id: device.device_id.clone(),
+                product_id: device.product_id,
+                profile_id: profile.id.clone(),
+                profile_digest: profile.digest.clone(),
+                stage_contract_sha256: stage_contract_sha256(group, stage),
+            };
+            if authorities
+                .insert(stage.stage_id.clone(), authority)
+                .is_some()
+            {
+                return BTreeMap::new();
+            }
+        }
+    }
+    authorities
+}
+
+fn same_stage_authority(
+    old: &QualificationStageAuthority,
+    current: &QualificationStageAuthority,
+) -> bool {
+    old.receiver_id == current.receiver_id
+        && old.generation_id == current.generation_id
+        && old.receiver_profile_id == current.receiver_profile_id
+        && old.receiver_profile_digest == current.receiver_profile_digest
+        && old.device_id == current.device_id
+        && old.product_id == current.product_id
+        && old.profile_id == current.profile_id
+        && old.stage_contract_sha256 == current.stage_contract_sha256
+}
+
+fn allowed_roles(
+    profile: &RuntimeProfile,
+    old_digest: &str,
+    current_digest: &str,
+) -> Vec<StageRole> {
+    if old_digest == current_digest {
+        return vec![
+            StageRole::Identity,
+            StageRole::Telemetry,
+            StageRole::Map,
+            StageRole::Lighting,
+            StageRole::Lifecycle,
+        ];
+    }
+    profile
+        .qualification_migrations
+        .iter()
+        .find(|migration| migration.from_runtime_digest.as_str() == old_digest)
+        .map(|migration| {
+            migration
+                .preserve_stage_roles
+                .iter()
+                .filter_map(|role| match *role {
+                    "telemetry" => Some(StageRole::Telemetry),
+                    "map" => Some(StageRole::Map),
+                    "lighting" => Some(StageRole::Lighting),
+                    _ => None,
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+fn plan_stages(
+    plan: &QualificationPlan,
+) -> impl Iterator<Item = (&QualificationGroup, &QualificationStage)> {
+    plan.groups
+        .iter()
+        .flat_map(|group| group.stages.iter().map(move |stage| (group, stage)))
+}
+
+fn stage_contract_sha256(group: &QualificationGroup, stage: &QualificationStage) -> String {
+    let encoded = serde_json::to_vec(&(
+        &group.group_id,
+        &group.title,
+        &group.description,
+        &stage.stage_id,
+        &stage.title,
+        &stage.description,
+        stage.kind,
+        stage.risk,
+        &stage.capabilities,
+        &stage.instructions,
+        &stage.observations,
+        &stage.action_id,
+    ))
+    .expect("qualification stage contracts contain no fallible values");
+    let digest = Sha256::digest(encoded);
+    let mut value = String::with_capacity(64);
+    for byte in digest {
+        write!(&mut value, "{byte:02x}").expect("writing to a string cannot fail");
+    }
+    value
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::StageResult;
+    use crate::qualification_lifecycle::capture_lifecycle_run;
+    use std::fs;
+
+    fn fixture(name: &str) -> QualificationView {
+        serde_json::from_slice(
+            &fs::read(
+                PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                    .join("../../apps/device-qualification/tests/fixtures")
+                    .join(name),
+            )
+            .expect("fixture reads"),
+        )
+        .expect("fixture parses")
+    }
+
+    use std::path::PathBuf;
+
+    fn passed(summary: &str) -> StageProgress {
+        StageProgress {
+            status: StageStatus::Passed,
+            result: Some(StageResult {
+                summary: summary.to_owned(),
+                completed_at: "2026-07-23T10:00:00Z".to_owned(),
+                evidence_refs: vec!["physical:test".to_owned()],
+            }),
+            checkpoint: None,
+        }
+    }
+
+    fn captured_run(view: &QualificationView) -> LifecycleRunState {
+        let mut captured = view.clone();
+        for group in captured.plans.iter_mut().flat_map(|plan| &mut plan.groups) {
+            if group.group_id != "lifecycle" {
+                for stage in &mut group.stages {
+                    stage.status = StageStatus::Passed;
+                }
+            }
+        }
+        let lifecycle_stage = captured.plans[0]
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-lifecycle"))
+            .expect("lifecycle stage")
+            .clone();
+        capture_lifecycle_run(&captured, &lifecycle_stage).expect("run captures")
+    }
+
+    fn replace_profile_digest(run: &mut LifecycleRunState, device_id: &str, digest: &str) {
+        run.plans
+            .iter_mut()
+            .find(|plan| plan.device_id == device_id)
+            .and_then(|plan| plan.profile_binding.as_mut())
+            .expect("plan profile binding")
+            .digest = digest.to_owned();
+        run.receiver
+            .devices
+            .iter_mut()
+            .find(|device| device.device_id == device_id)
+            .and_then(|device| device.profile.as_mut())
+            .expect("device profile binding")
+            .digest = digest.to_owned();
+    }
+
+    #[test]
+    fn migration_preserves_only_allowlisted_identical_passed_stage_contracts() {
+        let catalog = RuntimeProfileCatalog::load().expect("catalog loads");
+        let current = fixture("rust-qualified-pair.json");
+        let mut old_run = captured_run(&current);
+
+        replace_profile_digest(
+            &mut old_run,
+            "mouse-test",
+            "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
+        );
+        replace_profile_digest(
+            &mut old_run,
+            "keyboard-test",
+            "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
+        );
+
+        let all_stages = current
+            .plans
+            .iter()
+            .flat_map(|plan| &plan.groups)
+            .flat_map(|group| &group.stages)
+            .map(|stage| stage.stage_id.clone())
+            .collect::<Vec<_>>();
+        let mut stale = QualificationSessionState {
+            profile_catalog_sha256: "0".repeat(64),
+            identity_fingerprint: Some([1; 32]),
+            run_id: Some("local-preserved".to_owned()),
+            results: all_stages
+                .iter()
+                .map(|stage_id| (stage_id.clone(), passed(stage_id)))
+                .collect(),
+            lifecycle_run: Some(old_run),
+            pending_transaction: None,
+            hardware_write_executed: true,
+            ..QualificationSessionState::default()
+        };
+        stale.profile_catalog_sha256 = "0".repeat(64);
+
+        let migrated = migrate_profile_catalog_state(stale, &current, &catalog, [2; 32])
+            .expect("state migrates");
+        assert_eq!(migrated.run_id.as_deref(), Some("local-preserved"));
+        assert!(migrated.hardware_write_executed);
+        assert_eq!(migrated.identity_fingerprint, Some([2; 32]));
+        assert!(migrated.lifecycle_run.is_none());
+        assert!(migrated.pending_transaction.is_none());
+        assert_eq!(migrated.results.len(), 5);
+        let roles = migrated
+            .results
+            .keys()
+            .map(|stage_id| {
+                let device = if stage_id.starts_with("mouse-") {
+                    "mouse"
+                } else {
+                    "keyboard"
+                };
+                let role = StageRole::from_stage_id(stage_id)
+                    .expect("generated stage role")
+                    .as_str();
+                format!("{device}:{role}")
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(
+            roles,
+            [
+                "keyboard:lighting",
+                "keyboard:map",
+                "mouse:lighting",
+                "mouse:map",
+                "mouse:telemetry",
+            ]
+        );
+        assert!(migrated.results.values().all(|progress| {
+            progress
+                .result
+                .as_ref()
+                .is_some_and(|result| result.evidence_refs.len() == 2)
+        }));
+    }
+
+    #[test]
+    fn migration_rejects_unknown_predecessor_and_changed_contract() {
+        let catalog = RuntimeProfileCatalog::load().expect("catalog loads");
+        let current = fixture("rust-qualified-mouse.json");
+        let mut old_run = captured_run(&current);
+        old_run.plans[0]
+            .profile_binding
+            .as_mut()
+            .expect("binding")
+            .digest = "0".repeat(64);
+        old_run.receiver.devices[0]
+            .profile
+            .as_mut()
+            .expect("profile")
+            .digest = "0".repeat(64);
+        let stage_id = current.plans[0].groups[1].stages[0].stage_id.clone();
+        let stale = QualificationSessionState {
+            profile_catalog_sha256: "0".repeat(64),
+            results: BTreeMap::from([(stage_id, passed("old"))]),
+            lifecycle_run: Some(old_run),
+            ..QualificationSessionState::default()
+        };
+        assert!(migrate_profile_catalog_state(stale, &current, &catalog, [2; 32]).is_none());
+
+        let mut old_run = captured_run(&current);
+        old_run.plans[0].groups[1].stages[0]
+            .description
+            .push_str(" changed");
+        let stage_id = current.plans[0].groups[1].stages[0].stage_id.clone();
+        let stale = QualificationSessionState {
+            profile_catalog_sha256: "0".repeat(64),
+            results: BTreeMap::from([(stage_id, passed("old"))]),
+            lifecycle_run: Some(old_run),
+            ..QualificationSessionState::default()
+        };
+        assert!(migrate_profile_catalog_state(stale, &current, &catalog, [2; 32]).is_none());
+    }
+
+    #[test]
+    fn persisted_stage_authority_supports_migration_before_lifecycle_starts() {
+        let catalog = RuntimeProfileCatalog::load().expect("catalog loads");
+        let current = fixture("rust-qualified-mouse.json");
+        let mut old_run = captured_run(&current);
+        replace_profile_digest(
+            &mut old_run,
+            "mouse-test",
+            "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
+        );
+        let stage_id = current.plans[0]
+            .groups
+            .iter()
+            .flat_map(|group| &group.stages)
+            .find(|stage| stage.stage_id.ends_with("-telemetry"))
+            .expect("telemetry stage")
+            .stage_id
+            .clone();
+        let stale = QualificationSessionState {
+            profile_catalog_sha256: "0".repeat(64),
+            results: BTreeMap::from([(stage_id.clone(), passed("telemetry"))]),
+            stage_authorities: stage_authorities_from_lifecycle(&old_run),
+            lifecycle_run: None,
+            ..QualificationSessionState::default()
+        };
+
+        let migrated = migrate_profile_catalog_state(stale, &current, &catalog, [3; 32])
+            .expect("state migrates from persisted authority");
+        assert_eq!(migrated.results.len(), 1);
+        assert!(migrated.results.contains_key(&stage_id));
+        assert!(migrated.lifecycle_run.is_none());
+        assert_eq!(
+            migrated.stage_authorities,
+            qualification_stage_authorities(&current)
+        );
+    }
+}
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index d264f0b..63ac994 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -7,13 +7,16 @@ use crate::qualification_lifecycle::{
     prepare_lifecycle_checkpoint, reconcile_system_resume, recover_retryable_resume_failure,
     start_lifecycle_stage,
 };
+use crate::qualification_migration::{
+    migrate_profile_catalog_state, qualification_stage_authorities,
+};
 use crate::qualification_runner::{
     ObservationVerdict, PreparedLightingAction, new_transaction_id, prepare_lighting_checkpoint,
     prepare_lighting_stage, reconcile_pending_lighting,
 };
 use crate::qualification_state::{
-    QualificationSessionState, QualificationStateError, archive_stale_state, default_state_path,
-    load_state, save_state,
+    QualificationSessionState, QualificationStateCompatibility, QualificationStateError,
+    archive_stale_state, default_state_path, load_state_with_compatibility, save_state,
 };
 use crate::{
     BatteryAvailability, CompanionAction, PresenceView, QualificationStage, QualificationView,
@@ -132,12 +135,22 @@ pub fn serve_qualification_console(
         RuntimeProfileCatalog::load().map_err(|_| QualificationServerError::CatalogInvalid)?;
     let listener = TcpListener::bind(SocketAddrV4::new(Ipv4Addr::LOCALHOST, config.port))
         .map_err(QualificationServerError::BindFailed)?;
+    let probe = RealSystemProbe::default();
     let state_file = config
         .state_file
         .as_deref()
         .ok_or(QualificationServerError::StateUnavailable)?;
-    let mut state = match load_state(state_file) {
-        Ok(Some(state)) => state,
+    let mut state = match load_state_with_compatibility(state_file) {
+        Ok(Some((state, QualificationStateCompatibility::Current))) => state,
+        Ok(Some((state, QualificationStateCompatibility::ProfileCatalogStale))) => {
+            archive_stale_state(state_file)
+                .map_err(|_| QualificationServerError::StateUnavailable)?;
+            let current_view = base_live_view(&probe, &catalog, state.revision.saturating_add(1));
+            let fingerprint = identity_fingerprint(&current_view)
+                .map_err(|_| QualificationServerError::StateUnavailable)?;
+            migrate_profile_catalog_state(state, &current_view, &catalog, fingerprint)
+                .unwrap_or_default()
+        }
         Ok(None) => ServerState::default(),
         Err(QualificationStateError::Stale) => {
             archive_stale_state(state_file)
@@ -152,7 +165,6 @@ pub fn serve_qualification_console(
         state.revision = state.revision.saturating_add(1);
     }
     save_state(state_file, &state).map_err(|_| QualificationServerError::StateUnavailable)?;
-    let probe = RealSystemProbe::default();
     for connection in listener.incoming() {
         let mut stream = connection.map_err(QualificationServerError::ConnectionFailed)?;
         let _ = handle_connection(
@@ -271,8 +283,15 @@ fn live_view(
         state.revision.max(1),
         qualification_generated_at(),
     );
+    let stage_authorities = qualification_stage_authorities(&view);
+    let mut changed = state.stage_authorities != stage_authorities;
+    if changed {
+        state.stage_authorities = stage_authorities;
+    }
     let fingerprint = identity_fingerprint(&view)?;
-    let mut changed = refresh_identity_binding(state, fingerprint, &view);
+    if refresh_identity_binding(state, fingerprint, &view) {
+        changed = true;
+    }
     if reconcile_pending(probe, &view, state) {
         changed = true;
     }
@@ -291,6 +310,28 @@ fn live_view(
     Ok(view)
 }
 
+fn base_live_view(
+    probe: &RealSystemProbe,
+    catalog: &RuntimeProfileCatalog,
+    revision: u64,
+) -> QualificationView {
+    let system = probe.snapshot();
+    let integration = probe.qualification_integration().ok();
+    build_qualification_view(
+        &system,
+        integration.as_ref(),
+        catalog,
+        RunnerCapabilities {
+            read_only_actions: RunnerAvailability::Available,
+            supervised_lighting: RunnerAvailability::Available,
+            device_lifecycle: RunnerAvailability::Available,
+            system_lifecycle: RunnerAvailability::Available,
+        },
+        revision.max(1),
+        qualification_generated_at(),
+    )
+}
+
 fn refresh_identity_binding(
     state: &mut ServerState,
     fingerprint: [u8; 32],
diff --git a/crates/hfx-ops/src/qualification_state.rs b/crates/hfx-ops/src/qualification_state.rs
index 0692b58..211893b 100644
--- a/crates/hfx-ops/src/qualification_state.rs
+++ b/crates/hfx-ops/src/qualification_state.rs
@@ -23,6 +23,21 @@ const LEGACY_SOURCE_BOUND_COORDINATOR_SHA256: &str =
     "912f0a7cd4cba79f2293e0fc664ef42e2bba5e36b549cecea596580aea739858";
 const MAX_SESSION_BYTES: u64 = 256 * 1024;
 const MAX_STAGE_RESULTS: usize = 64;
+const MAX_STAGE_AUTHORITIES: usize = 64;
+
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub(crate) struct QualificationStageAuthority {
+    pub receiver_id: String,
+    pub generation_id: u64,
+    pub receiver_profile_id: String,
+    pub receiver_profile_digest: String,
+    pub device_id: String,
+    pub product_id: u16,
+    pub profile_id: String,
+    pub profile_digest: String,
+    pub stage_contract_sha256: String,
+}
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -36,6 +51,8 @@ pub(crate) struct QualificationSessionState {
     pub identity_fingerprint: Option<[u8; 32]>,
     pub run_id: Option<String>,
     pub results: BTreeMap<String, StageProgress>,
+    #[serde(default)]
+    pub stage_authorities: BTreeMap<String, QualificationStageAuthority>,
     pub pending_transaction: Option<PendingLightingTransaction>,
     pub lifecycle_run: Option<LifecycleRunState>,
     pub hardware_write_executed: bool,
@@ -53,6 +70,7 @@ impl Default for QualificationSessionState {
             identity_fingerprint: None,
             run_id: None,
             results: BTreeMap::new(),
+            stage_authorities: BTreeMap::new(),
             pending_transaction: None,
             lifecycle_run: None,
             hardware_write_executed: false,
@@ -61,22 +79,15 @@ impl Default for QualificationSessionState {
 }
 
 impl QualificationSessionState {
-    fn validate(&self) -> Result<(), QualificationStateError> {
+    fn validate_shape(&self) -> Result<(), QualificationStateError> {
         if !valid_digest(&self.coordinator_sha256)
             || !valid_digest(&self.runtime_sha256)
             || !valid_digest(&self.profile_catalog_sha256)
         {
             return Err(QualificationStateError::Invalid);
         }
-        if self.schema != SESSION_SCHEMA
-            || self.product_version != PRODUCT_VERSION
-            || self.coordinator_sha256 != coordinator_sha256()
-            || self.runtime_sha256 != LINUX_RUNTIME_SHA256
-            || self.profile_catalog_sha256 != PROFILE_SOURCE_SHA256
-        {
-            return Err(QualificationStateError::Stale);
-        }
         if self.results.len() > MAX_STAGE_RESULTS
+            || self.stage_authorities.len() > MAX_STAGE_AUTHORITIES
             || self.run_id.as_deref().is_some_and(|value| {
                 value.is_empty()
                     || value.len() > 96
@@ -105,6 +116,17 @@ impl QualificationSessionState {
                         byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.')
                     })
             })
+            || self.stage_authorities.iter().any(|(stage_id, authority)| {
+                !valid_identifier(stage_id, 128)
+                    || !valid_identifier(&authority.receiver_id, 128)
+                    || authority.generation_id == 0
+                    || !valid_identifier(&authority.receiver_profile_id, 128)
+                    || !valid_digest(&authority.receiver_profile_digest)
+                    || !valid_identifier(&authority.device_id, 128)
+                    || !valid_identifier(&authority.profile_id, 128)
+                    || !valid_digest(&authority.profile_digest)
+                    || !valid_digest(&authority.stage_contract_sha256)
+            })
         {
             return Err(QualificationStateError::Invalid);
         }
@@ -117,6 +139,43 @@ impl QualificationSessionState {
         }
         Ok(())
     }
+
+    fn compatibility(&self) -> Result<QualificationStateCompatibility, QualificationStateError> {
+        if self.schema != SESSION_SCHEMA
+            || self.product_version != PRODUCT_VERSION
+            || self.coordinator_sha256 != coordinator_sha256()
+            || self.runtime_sha256 != LINUX_RUNTIME_SHA256
+        {
+            return Err(QualificationStateError::Stale);
+        }
+        if self.profile_catalog_sha256 == PROFILE_SOURCE_SHA256 {
+            Ok(QualificationStateCompatibility::Current)
+        } else {
+            Ok(QualificationStateCompatibility::ProfileCatalogStale)
+        }
+    }
+
+    fn validate(&self) -> Result<(), QualificationStateError> {
+        self.validate_shape()?;
+        if self.compatibility()? != QualificationStateCompatibility::Current {
+            return Err(QualificationStateError::Stale);
+        }
+        Ok(())
+    }
+}
+
+fn valid_identifier(value: &str, maximum: usize) -> bool {
+    !value.is_empty()
+        && value.len() <= maximum
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':'))
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum QualificationStateCompatibility {
+    Current,
+    ProfileCatalogStale,
 }
 
 #[derive(Debug)]
@@ -175,9 +234,25 @@ pub(crate) fn default_state_path() -> Result<PathBuf, QualificationStateError> {
         .join("qualification-session.json"))
 }
 
+#[cfg(test)]
 pub(crate) fn load_state(
     path: &Path,
 ) -> Result<Option<QualificationSessionState>, QualificationStateError> {
+    let Some((state, compatibility)) = load_state_with_compatibility(path)? else {
+        return Ok(None);
+    };
+    if compatibility != QualificationStateCompatibility::Current {
+        return Err(QualificationStateError::Stale);
+    }
+    Ok(Some(state))
+}
+
+pub(crate) fn load_state_with_compatibility(
+    path: &Path,
+) -> Result<
+    Option<(QualificationSessionState, QualificationStateCompatibility)>,
+    QualificationStateError,
+> {
     let metadata = match fs::symlink_metadata(path) {
         Ok(metadata) => metadata,
         Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(None),
@@ -198,8 +273,9 @@ pub(crate) fn load_state(
     if state.coordinator_sha256 == LEGACY_SOURCE_BOUND_COORDINATOR_SHA256 {
         state.coordinator_sha256 = coordinator_sha256();
     }
-    state.validate()?;
-    Ok(Some(state))
+    state.validate_shape()?;
+    let compatibility = state.compatibility()?;
+    Ok(Some((state, compatibility)))
 }
 
 pub(crate) fn save_state(
@@ -363,6 +439,51 @@ mod tests {
         fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
     }
 
+    #[test]
+    fn only_a_profile_catalog_change_is_exposed_for_guarded_migration() {
+        let path = test_path("profile-catalog-stale");
+        let _ = fs::remove_dir_all(path.parent().expect("parent"));
+        save_state(&path, &QualificationSessionState::default()).expect("state saves");
+        let mut stale: serde_json::Value =
+            serde_json::from_slice(&fs::read(&path).expect("state reads")).expect("state parses");
+        stale
+            .as_object_mut()
+            .expect("state object")
+            .remove("stage_authorities");
+        stale["profile_catalog_sha256"] = serde_json::Value::String("0".repeat(64));
+        fs::write(
+            &path,
+            serde_json::to_vec_pretty(&stale).expect("state serializes"),
+        )
+        .expect("state writes");
+
+        let (candidate, compatibility) = load_state_with_compatibility(&path)
+            .expect("candidate loads")
+            .expect("candidate exists");
+        assert_eq!(
+            compatibility,
+            QualificationStateCompatibility::ProfileCatalogStale
+        );
+        assert_eq!(candidate.profile_catalog_sha256, "0".repeat(64));
+        assert!(candidate.stage_authorities.is_empty());
+        assert!(matches!(
+            load_state(&path),
+            Err(QualificationStateError::Stale)
+        ));
+
+        stale["runtime_sha256"] = serde_json::Value::String("1".repeat(64));
+        fs::write(
+            &path,
+            serde_json::to_vec_pretty(&stale).expect("state serializes"),
+        )
+        .expect("state writes");
+        assert!(matches!(
+            load_state_with_compatibility(&path),
+            Err(QualificationStateError::Stale)
+        ));
+        fs::remove_dir_all(path.parent().expect("parent")).expect("test state removes");
+    }
+
     #[test]
     fn exact_legacy_source_bound_coordinator_migrates_without_losing_results() {
         let path = test_path("legacy-coordinator");
diff --git a/crates/hfx-profiles/src/catalog.rs b/crates/hfx-profiles/src/catalog.rs
index 3fbb7c8..0a1b63e 100644
--- a/crates/hfx-profiles/src/catalog.rs
+++ b/crates/hfx-profiles/src/catalog.rs
@@ -1,7 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{
-    LightingTopology, PROFILES, PassiveTelemetryRecord, PresentationRecord, ProfileRecord,
+    LifecyclePolicyRecord, LightingTopology, PROFILES, PassiveTelemetryRecord, PresentationRecord,
+    ProfileRecord, QualificationMigrationRecord,
 };
 use hfx_domain::{
     CapabilityId, CarrierIndex, DeviceKind, DomainValueError, LedCount, ProductId, ProfileDigest,
@@ -101,6 +102,12 @@ pub struct RuntimePresentation {
     pub transport_variant: &'static str,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RuntimeQualificationMigration {
+    pub from_runtime_digest: ProfileDigest,
+    pub preserve_stage_roles: &'static [&'static str],
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct RuntimeProfile {
     pub profile_id: ProfileId,
@@ -121,6 +128,8 @@ pub struct RuntimeProfile {
     pub capabilities: Vec<RuntimeCapability>,
     pub lighting: Option<RuntimeLightingTopology>,
     pub passive: Option<PassiveTelemetryRecord>,
+    pub lifecycle: Option<LifecyclePolicyRecord>,
+    pub qualification_migrations: Vec<RuntimeQualificationMigration>,
     pub presentation: Option<RuntimePresentation>,
 }
 
@@ -259,10 +268,25 @@ fn convert_profile(record: &ProfileRecord) -> Result<RuntimeProfile, ProfileCata
             .collect::<Result<Vec<_>, ProfileCatalogError>>()?,
         lighting: record.lighting.map(convert_lighting).transpose()?,
         passive: record.passive,
+        lifecycle: record.lifecycle,
+        qualification_migrations: record
+            .qualification_migrations
+            .iter()
+            .map(convert_qualification_migration)
+            .collect::<Result<Vec<_>, _>>()?,
         presentation: record.presentation.map(convert_presentation),
     })
 }
 
+fn convert_qualification_migration(
+    migration: &QualificationMigrationRecord,
+) -> Result<RuntimeQualificationMigration, ProfileCatalogError> {
+    Ok(RuntimeQualificationMigration {
+        from_runtime_digest: ProfileDigest::try_from(migration.from_runtime_sha256)?,
+        preserve_stage_roles: migration.preserve_stage_roles,
+    })
+}
+
 fn convert_presentation(presentation: PresentationRecord) -> RuntimePresentation {
     RuntimePresentation {
         upstream_id: presentation.upstream_id,
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 2420c4f..140492a 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e
+// Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -44,6 +44,24 @@ pub struct PassiveTelemetryRecord {
     pub report_implies_route_available: bool,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum PowerOffDepartureEvidence {
+    ReceiverState,
+    WatchedRetainedRoute,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct LifecyclePolicyRecord {
+    pub power_off_departure_evidence: PowerOffDepartureEvidence,
+    pub device_return_settle_ms: u64,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct QualificationMigrationRecord {
+    pub from_runtime_sha256: &'static str,
+    pub preserve_stage_roles: &'static [&'static str],
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct PresentationRecord {
     pub upstream_id: &'static str,
@@ -75,11 +93,13 @@ pub struct ProfileRecord {
     pub capabilities: &'static [CapabilityRecord],
     pub lighting: Option<LightingTopology>,
     pub passive: Option<PassiveTelemetryRecord>,
+    pub lifecycle: Option<LifecyclePolicyRecord>,
+    pub qualification_migrations: &'static [QualificationMigrationRecord],
     pub presentation: Option<PresentationRecord>,
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e";
+    "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -162,6 +182,12 @@ const PASSIVE_ROUTE_AVAILABLE_0: &[u32] = &[];
 const PASSIVE_ROUTE_UNAVAILABLE_0: &[u32] = &[];
 const PASSIVE_ROUTE_INDETERMINATE_0: &[u32] = &[];
 
+const QUALIFICATION_MIGRATIONS_0: &[QualificationMigrationRecord] =
+    &[QualificationMigrationRecord {
+        from_runtime_sha256: "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    }];
+
 const CAPABILITIES_1: &[CapabilityRecord] = &[
     CapabilityRecord {
         id: "identity.model",
@@ -244,6 +270,12 @@ const PASSIVE_ROUTE_AVAILABLE_1: &[u32] = &[0, 3];
 const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2];
 const PASSIVE_ROUTE_INDETERMINATE_1: &[u32] = &[257];
 
+const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] =
+    &[QualificationMigrationRecord {
+        from_runtime_sha256: "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
+        preserve_stage_roles: &["lighting", "map"],
+    }];
+
 const CAPABILITIES_2: &[CapabilityRecord] = &[
     CapabilityRecord {
         id: "identity.model",
@@ -277,6 +309,8 @@ const CAPABILITIES_2: &[CapabilityRecord] = &[
     },
 ];
 
+const QUALIFICATION_MIGRATIONS_2: &[QualificationMigrationRecord] = &[];
+
 const CAPABILITIES_3: &[CapabilityRecord] = &[
     CapabilityRecord {
         id: "identity.model",
@@ -290,11 +324,13 @@ const CAPABILITIES_3: &[CapabilityRecord] = &[
     },
 ];
 
+const QUALIFICATION_MIGRATIONS_3: &[QualificationMigrationRecord] = &[];
+
 pub const PROFILES: &[ProfileRecord] = &[
     ProfileRecord {
         id: "child.razer.basilisk-v3-pro-35k.00cd",
-        runtime_sha256: "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
-        revision: 1,
+        runtime_sha256: "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
+        revision: 2,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Mouse,
         vendor_id: Some(5426),
@@ -326,6 +362,11 @@ pub const PROFILES: &[ProfileRecord] = &[
             route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_0,
             report_implies_route_available: true,
         }),
+        lifecycle: Some(LifecyclePolicyRecord {
+            power_off_departure_evidence: PowerOffDepartureEvidence::WatchedRetainedRoute,
+            device_return_settle_ms: 1000,
+        }),
+        qualification_migrations: QUALIFICATION_MIGRATIONS_0,
         presentation: Some(PresentationRecord {
             upstream_id: "openrgb",
             owner: "OpenRGB",
@@ -371,6 +412,8 @@ pub const PROFILES: &[ProfileRecord] = &[
             route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_1,
             report_implies_route_available: false,
         }),
+        lifecycle: None,
+        qualification_migrations: QUALIFICATION_MIGRATIONS_1,
         presentation: Some(PresentationRecord {
             upstream_id: "openrgb",
             owner: "OpenRGB",
@@ -400,6 +443,8 @@ pub const PROFILES: &[ProfileRecord] = &[
         capabilities: CAPABILITIES_2,
         lighting: None,
         passive: None,
+        lifecycle: None,
+        qualification_migrations: QUALIFICATION_MIGRATIONS_2,
         presentation: None,
     },
     ProfileRecord {
@@ -421,6 +466,8 @@ pub const PROFILES: &[ProfileRecord] = &[
         capabilities: CAPABILITIES_3,
         lighting: None,
         passive: None,
+        lifecycle: None,
+        qualification_migrations: QUALIFICATION_MIGRATIONS_3,
         presentation: None,
     },
 ];
diff --git a/crates/hfx-profiles/tests/catalog.rs b/crates/hfx-profiles/tests/catalog.rs
index f522ca9..e068b3f 100644
--- a/crates/hfx-profiles/tests/catalog.rs
+++ b/crates/hfx-profiles/tests/catalog.rs
@@ -2,8 +2,8 @@
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind};
 use hfx_profiles::{
-    PROFILES, RuntimeProfileCatalog, child_profile_by_product_id, profile_by_id,
-    receiver_profile_by_usb_id,
+    PROFILES, PowerOffDepartureEvidence, RuntimeProfileCatalog, child_profile_by_product_id,
+    profile_by_id, receiver_profile_by_usb_id,
 };
 
 #[test]
@@ -25,7 +25,26 @@ fn receiver_and_children_resolve_independently() {
     assert_eq!(mouse.receiver_protocols, &["razer-hyperflux-v2"]);
     assert_eq!(mouse.routes, &[RouteKind::HyperfluxWireless]);
     assert!(mouse.required_sibling_kinds.is_empty());
+    let lifecycle = mouse
+        .lifecycle
+        .expect("mouse lifecycle policy is exact-profile bound");
+    assert_eq!(
+        lifecycle.power_off_departure_evidence,
+        PowerOffDepartureEvidence::WatchedRetainedRoute
+    );
+    assert_eq!(lifecycle.device_return_settle_ms, 1_000);
+    assert_eq!(mouse.qualification_migrations.len(), 1);
+    assert_eq!(
+        mouse.qualification_migrations[0].preserve_stage_roles,
+        &["lighting", "map", "telemetry"]
+    );
     assert_eq!(keyboard.device_kind, DeviceKind::Keyboard);
+    assert_eq!(keyboard.lifecycle, None);
+    assert_eq!(keyboard.qualification_migrations.len(), 1);
+    assert_eq!(
+        keyboard.qualification_migrations[0].preserve_stage_roles,
+        &["lighting", "map"]
+    );
     assert_ne!(mouse.id, keyboard.id);
 }
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 7848cff..e7d44f1 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e`
+Profile source: `f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -10,7 +10,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
-| **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `f72d38a70e9f` | 7 | 7 |
+| **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `1a9dde39c257` | 7 | 7 |
 | **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `88e5b7d79e54` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index 908adcf..a48e446 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e */
+/* Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index affaf26..fb40ab3 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "9e26f940202ae7e5f9b097cf2e8741eb0e96212ef86bb62eeb74585172f0ede1",
+  "source_sha256": "a9e3b139674eeb159ab19c8ac5c48f81931e921e00676c4b64843b46df160b9a",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index 8a309cf..b97f9b0 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -890,16 +890,31 @@
         "upstream_id": "openrgb"
       },
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+      "qualification_migrations": [
+        {
+          "from_runtime_sha256": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        }
+      ],
       "restrictions": [
         "Another Basilisk name or PID inherits no map.",
         "OpenRGB owns zone labels and geometry presentation.",
-        "Contact, inactivity, darkness, and power-off remain distinct facts."
+        "Contact, inactivity, darkness, and power-off remain distinct facts.",
+        "A physical mouse power-off can retain the receiver route; watched qualification records that physical boundary without inventing a disconnect."
       ],
-      "revision": 1,
-      "runtime_sha256": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
+      "revision": 2,
+      "runtime_sha256": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-basilisk-v3-pro-35k-00cd.json",
       "transport": {
+        "lifecycle": {
+          "device_return_settle_ms": 1000,
+          "power_off_departure_evidence": "watched-retained-route"
+        },
         "lighting": {
           "application_index_to_carrier": [
             1,
@@ -1084,6 +1099,15 @@
         "upstream_id": "openrgb"
       },
       "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+      "qualification_migrations": [
+        {
+          "from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
+          "preserve_stage_roles": [
+            "lighting",
+            "map"
+          ]
+        }
+      ],
       "restrictions": [
         "Another DeathStalker name, PID, or physical layout inherits no map.",
         "OpenRGB owns key names, geometry, and ANSI or ISO presentation.",
@@ -1368,5 +1392,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
+  "source_sha256": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
 }
diff --git a/profiles/children/razer-basilisk-v3-pro-35k-00cd.json b/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
index 9808404..948e819 100644
--- a/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
+++ b/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
-  "revision": 1,
+  "revision": 2,
   "kind": "child",
   "device_kind": "mouse",
   "identity": {"manufacturer": "Razer", "model_name": "Razer Basilisk V3 Pro 35K", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 205},
@@ -15,8 +15,12 @@
       "contact": {"off_mat": [0], "on_mat": [1]},
       "route": {"available": [], "unavailable": []},
       "report_implies_route_available": true
-    }
+    },
+    "lifecycle": {"power_off_departure_evidence": "watched-retained-route", "device_return_settle_ms": 1000}
   },
+  "qualification_migrations": [
+    {"from_runtime_sha256": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33", "preserve_stage_roles": ["lighting", "map", "telemetry"]}
+  ],
   "presentation": {"upstream_id": "openrgb", "owner": "OpenRGB", "project_version": "1.0rc3", "source_commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "model_key": "basilisk_v3_pro_35k_wireless_device", "layout_key": null, "transport_variant": "wireless"},
   "capabilities": [
     {"id": "identity.model", "support_level": "identified", "evidence_claims": ["claim.child.00cd.passive-identity-telemetry"]},
@@ -35,5 +39,5 @@
     {"id": "telemetry.mouse-contact", "support_level": "telemetry-qualified", "evidence_claims": ["claim.child.00cd.passive-identity-telemetry"]}
   ],
   "evidence_claims": ["claim.child.00cd.complete-led-map", "claim.child.00cd.passive-identity-telemetry", "claim.children.complete-static-black", "claim.children.software-effect-frame-continuity", "claim.children.static-off-brightness", "claim.presentation.openrgb-1.0rc3-model-layouts"],
-  "restrictions": ["Another Basilisk name or PID inherits no map.", "OpenRGB owns zone labels and geometry presentation.", "Contact, inactivity, darkness, and power-off remain distinct facts."]
+  "restrictions": ["Another Basilisk name or PID inherits no map.", "OpenRGB owns zone labels and geometry presentation.", "Contact, inactivity, darkness, and power-off remain distinct facts.", "A physical mouse power-off can retain the receiver route; watched qualification records that physical boundary without inventing a disconnect."]
 }
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index 2e71f97..450f954 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -17,6 +17,9 @@
       "report_implies_route_available": false
     }
   },
+  "qualification_migrations": [
+    {"from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", "preserve_stage_roles": ["lighting", "map"]}
+  ],
   "presentation": {"upstream_id": "openrgb", "owner": "OpenRGB", "project_version": "1.0rc3", "source_commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "model_key": "deathstalker_v2_pro_tkl_wireless_device", "layout_key": "razer_deathstalker_v2_pro_tkl_layout", "transport_variant": "wireless"},
   "capabilities": [
     {"id": "identity.model", "support_level": "identified", "evidence_claims": ["claim.child.0296.passive-identity-telemetry"]},
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 40aeaab..412263d 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -27,6 +27,11 @@
     },
     "compatibility": {"type": "object"},
     "transport": {"$ref": "#/$defs/transport"},
+    "qualification_migrations": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/qualification-migration"}
+    },
     "presentation": {
       "type": "object",
       "additionalProperties": false,
@@ -74,7 +79,8 @@
         "application_raw_frames": {"type": "boolean"},
         "pairing_inventory": {"$ref": "#/$defs/pairing-inventory"},
         "lighting": {"$ref": "#/$defs/lighting"},
-        "passive": {"$ref": "#/$defs/passive"}
+        "passive": {"$ref": "#/$defs/passive"},
+        "lifecycle": {"$ref": "#/$defs/lifecycle-policy"}
       }
     },
     "pairing-inventory": {
@@ -119,6 +125,29 @@
         "report_implies_route_available": {"type": "boolean"}
       }
     },
+    "lifecycle-policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["power_off_departure_evidence", "device_return_settle_ms"],
+      "properties": {
+        "power_off_departure_evidence": {"enum": ["receiver-state", "watched-retained-route"]},
+        "device_return_settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000}
+      }
+    },
+    "qualification-migration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["from_runtime_sha256", "preserve_stage_roles"],
+      "properties": {
+        "from_runtime_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "preserve_stage_roles": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["telemetry", "map", "lighting"]}
+        }
+      }
+    },
     "contact-decoder": {
       "type": "object",
       "additionalProperties": false,
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 4bea8d5..d287e8a 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e
+// Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e";
+inline constexpr std::string_view profile_source_sha256 = "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -160,7 +160,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 }};
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
-    {"child.razer.basilisk-v3-pro-35k.00cd", "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33", 1, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
+    {"child.razer.basilisk-v3-pro-35k.00cd", "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", 2, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
     {"child.razer.deathstalker-v2-pro-tkl.0296", "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", 2, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
     {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index a5d6049..d7bbb03 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e'
+PROFILE_SOURCE_SHA256: Final = 'f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -535,14 +535,20 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.basilisk-v3-pro-35k.00cd',
+               'qualification_migrations': [{'from_runtime_sha256': 'f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']}],
                'restrictions': ['Another Basilisk name or PID inherits no map.',
                                 'OpenRGB owns zone labels and geometry presentation.',
-                                'Contact, inactivity, darkness, and power-off remain distinct facts.'],
-               'revision': 1,
-               'runtime_sha256': 'f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33',
+                                'Contact, inactivity, darkness, and power-off remain distinct facts.',
+                                'A physical mouse power-off can retain the receiver route; watched qualification '
+                                'records that physical boundary without inventing a disconnect.'],
+               'revision': 2,
+               'runtime_sha256': '1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-basilisk-v3-pro-35k-00cd.json',
-               'transport': {'lighting': {'application_index_to_carrier': [1, 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
+               'transport': {'lifecycle': {'device_return_settle_ms': 1000,
+                                           'power_off_departure_evidence': 'watched-retained-route'},
+                             'lighting': {'application_index_to_carrier': [1, 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
                                           'application_slot_count': 13,
                                           'carrier_count': 13,
                                           'columns': 13,
@@ -629,6 +635,8 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
+               'qualification_migrations': [{'from_runtime_sha256': 'fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6',
+                                             'preserve_stage_roles': ['lighting', 'map']}],
                'restrictions': ['Another DeathStalker name, PID, or physical layout inherits no map.',
                                 'OpenRGB owns key names, geometry, and ANSI or ISO presentation.',
                                 'External power does not establish a direct USB data route or charging state.',
@@ -826,7 +834,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e'}
+ 'source_sha256': 'f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index cf35666..02e722c 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "274d8ff1af5c762e4601b3f9538930f870e705d18887208388c2dae6d201ac4e"
+  "source_sha256": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
 }
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index 25e4885..b4f879a 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -12,6 +12,7 @@
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / "tools"))
 
+from hfxdev.generators.profiles import _rust_qualification_migrations
 from hfxdev.model import ModelError
 from hfxdev.profiles import (
     _runtime_profile_digest,
@@ -174,6 +175,91 @@ def test_passive_semantics_participate_in_runtime_profile_digest(self) -> None:
         mouse["transport"]["passive"]["contact"]["on_mat"] = [2]
         self.assertNotEqual(_runtime_profile_digest(mouse, capabilities), before)
 
+    def test_lifecycle_policy_is_bounded_profile_local_and_digest_bound(self) -> None:
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        before = _runtime_profile_digest(mouse, capabilities)
+        mouse["transport"]["lifecycle"]["device_return_settle_ms"] = 1_001
+        _validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(_runtime_profile_digest(mouse, capabilities), before)
+
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        mouse["transport"]["lifecycle"]["device_return_settle_ms"] = 0
+        with self.assertRaisesRegex(ModelError, "requires a positive settle time"):
+            _validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        mouse["transport"]["passive"]["route"]["unavailable"] = [2]
+        with self.assertRaisesRegex(ModelError, "contradicts passive route evidence"):
+            _validate_profiles(profiles, capabilities, claims)
+
+    def test_qualification_migrations_are_exact_and_do_not_change_runtime_identity(self) -> None:
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        with_migration = _runtime_profile_digest(mouse, capabilities)
+        del mouse["qualification_migrations"]
+        self.assertEqual(_runtime_profile_digest(mouse, capabilities), with_migration)
+
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        mouse["qualification_migrations"][0]["preserve_stage_roles"] = ["identity"]
+        with self.assertRaisesRegex(ModelError, "unsupported stage roles: identity"):
+            _validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        mouse["qualification_migrations"][0]["from_runtime_sha256"] = (
+            _runtime_profile_digest(mouse, capabilities)
+        )
+        with self.assertRaisesRegex(ModelError, "already equals the current runtime profile"):
+            _validate_profiles(profiles, capabilities, claims)
+
+    def test_qualification_migration_rust_is_rustfmt_stable(self) -> None:
+        migration = {
+            "from_runtime_sha256": "a" * 64,
+            "preserve_stage_roles": ["lighting", "map"],
+        }
+        self.assertEqual(
+            _rust_qualification_migrations(0, []),
+            [
+                "const QUALIFICATION_MIGRATIONS_0: &[QualificationMigrationRecord] = &[];",
+                "",
+            ],
+        )
+        self.assertEqual(
+            _rust_qualification_migrations(1, [migration]),
+            [
+                "const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] =",
+                "    &[QualificationMigrationRecord {",
+                f'        from_runtime_sha256: "{"a" * 64}",',
+                '        preserve_stage_roles: &["lighting", "map"],',
+                "    }];",
+                "",
+            ],
+        )
+        second = {
+            "from_runtime_sha256": "b" * 64,
+            "preserve_stage_roles": ["telemetry"],
+        }
+        self.assertEqual(
+            _rust_qualification_migrations(2, [migration, second]),
+            [
+                "const QUALIFICATION_MIGRATIONS_2: &[QualificationMigrationRecord] = &[",
+                "    QualificationMigrationRecord {",
+                f'        from_runtime_sha256: "{"a" * 64}",',
+                '        preserve_stage_roles: &["lighting", "map"],',
+                "    },",
+                "    QualificationMigrationRecord {",
+                f'        from_runtime_sha256: "{"b" * 64}",',
+                '        preserve_stage_roles: &["telemetry"],',
+                "    },",
+                "];",
+                "",
+            ],
+        )
+
     def test_candidate_names_never_grant_writes_or_guess_pids(self) -> None:
         snapshots: dict[str, list[dict]] = {}
         for candidate in self.inputs.candidates:
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index 709a9a6..ca27984 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -24,6 +24,39 @@ def _rust_variants(type_name: str, values: list[str]) -> str:
     return "&[" + ", ".join(f"{type_name}::{_variant(value)}" for value in values) + "]"
 
 
+def _rust_qualification_migrations(index: int, migrations: list[dict[str, Any]]) -> list[str]:
+    declaration = (
+        f"const QUALIFICATION_MIGRATIONS_{index}: &[QualificationMigrationRecord]"
+    )
+    if not migrations:
+        return [f"{declaration} = &[];", ""]
+
+    if len(migrations) == 1:
+        migration = migrations[0]
+        return [
+            f"{declaration} =",
+            "    &[QualificationMigrationRecord {",
+            f'        from_runtime_sha256: "{migration["from_runtime_sha256"]}",',
+            "        preserve_stage_roles: "
+            f"{_rust_strings(migration['preserve_stage_roles'])},",
+            "    }];",
+            "",
+        ]
+
+    lines = [f"{declaration} = &["]
+    for migration in migrations:
+        lines.extend(
+            [
+                "    QualificationMigrationRecord {",
+                f'        from_runtime_sha256: "{migration["from_runtime_sha256"]}",',
+                "        preserve_stage_roles: "
+                f"{_rust_strings(migration['preserve_stage_roles'])},",
+                "    },",
+            ]
+        )
+    return [*lines, "];", ""]
+
+
 def _wrapped_numbers(values: list[int], *, indent: str = "    ", width: int = 100) -> list[str]:
     lines: list[str] = []
     current = indent
@@ -183,6 +216,24 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum PowerOffDepartureEvidence {",
+        "    ReceiverState,",
+        "    WatchedRetainedRoute,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct LifecyclePolicyRecord {",
+        "    pub power_off_departure_evidence: PowerOffDepartureEvidence,",
+        "    pub device_return_settle_ms: u64,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct QualificationMigrationRecord {",
+        "    pub from_runtime_sha256: &'static str,",
+        "    pub preserve_stage_roles: &'static [&'static str],",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct PresentationRecord {",
         "    pub upstream_id: &'static str,",
         "    pub owner: &'static str,",
@@ -213,6 +264,8 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "    pub capabilities: &'static [CapabilityRecord],",
         "    pub lighting: Option<LightingTopology>,",
         "    pub passive: Option<PassiveTelemetryRecord>,",
+        "    pub lifecycle: Option<LifecyclePolicyRecord>,",
+        "    pub qualification_migrations: &'static [QualificationMigrationRecord],",
         "    pub presentation: Option<PresentationRecord>,",
         "}",
         "",
@@ -259,6 +312,11 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 rendered = ", ".join(str(value) for value in values)
                 lines.append(f"const PASSIVE_{suffix}_{index}: &[u32] = &[{rendered}];")
             lines.append("")
+        lines.extend(
+            _rust_qualification_migrations(
+                index, profile.get("qualification_migrations", [])
+            )
+        )
     lines.extend(["pub const PROFILES: &[ProfileRecord] = &[",])
     for index, profile in enumerate(catalog["profiles"]):
         identity = profile["identity"]
@@ -302,6 +360,18 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
             ]
         else:
             passive_lines = ["        passive: None,"]
+        lifecycle = profile.get("transport", {}).get("lifecycle")
+        if lifecycle:
+            departure = _variant(lifecycle["power_off_departure_evidence"])
+            lifecycle_lines = [
+                "        lifecycle: Some(LifecyclePolicyRecord {",
+                "            power_off_departure_evidence: "
+                f"PowerOffDepartureEvidence::{departure},",
+                f"            device_return_settle_ms: {lifecycle['device_return_settle_ms']},",
+                "        }),",
+            ]
+        else:
+            lifecycle_lines = ["        lifecycle: None,"]
         presentation = profile.get("presentation")
         if presentation:
             layout_key = (
@@ -356,6 +426,8 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                     else [f"        lighting: {lighting_value},"]
                 ),
                 *passive_lines,
+                *lifecycle_lines,
+                f"        qualification_migrations: QUALIFICATION_MIGRATIONS_{index},",
                 *presentation_lines,
                 "    },",
             ]
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 8262830..6fa5bdb 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -28,6 +28,7 @@
     "identity",
     "compatibility",
     "transport",
+    "qualification_migrations",
     "presentation",
     "capabilities",
     "evidence_claims",
@@ -73,6 +74,14 @@
     "route",
     "report_implies_route_available",
 }
+LIFECYCLE_KEYS = {
+    "power_off_departure_evidence",
+    "device_return_settle_ms",
+}
+POWER_OFF_DEPARTURE_EVIDENCE = {"receiver-state", "watched-retained-route"}
+MAX_DEVICE_RETURN_SETTLE_MS = 30_000
+QUALIFICATION_MIGRATION_KEYS = {"from_runtime_sha256", "preserve_stage_roles"}
+QUALIFICATION_MIGRATION_STAGE_ROLES = {"lighting", "map", "telemetry"}
 PASSIVE_TELEMETRY_CAPABILITIES = {
     "presence.passive-evidence",
     "route.hyperflux-wireless",
@@ -83,6 +92,7 @@
 UPSTREAM_ID_PATTERN = re.compile(r"^[a-z][a-z0-9-]{0,63}$")
 PRESENTATION_KEY_PATTERN = re.compile(r"^[a-z][a-z0-9_]{0,127}$")
 GIT_COMMIT_PATTERN = re.compile(r"^[0-9a-f]{40}$")
+DIGEST_PATTERN = re.compile(r"^[0-9a-f]{64}$")
 
 
 @dataclass(frozen=True)
@@ -498,13 +508,18 @@ def _validate_passive(profile: dict[str, Any]) -> None:
         if transport:
             raise ModelError(f"{profile['profile_id']}: surface transport is not allowed")
         return
-    _expect_keys(transport, {"lighting", "passive"}, f"{profile['profile_id']} child transport")
+    _expect_keys(
+        transport,
+        {"lighting", "passive", "lifecycle"},
+        f"{profile['profile_id']} child transport",
+    )
     passive = transport.get("passive")
     capability_ids = {item["id"] for item in profile["capabilities"]}
     needs_passive = bool(capability_ids & PASSIVE_TELEMETRY_CAPABILITIES)
     if passive is None:
         if needs_passive:
             raise ModelError(f"{profile['profile_id']}: passive telemetry requires a decoder")
+        _validate_lifecycle_policy(profile, transport, passive)
         return
     if not isinstance(passive, dict):
         raise ModelError(f"{profile['profile_id']}: passive decoder must be an object")
@@ -555,6 +570,111 @@ def _validate_passive(profile: dict[str, Any]) -> None:
         available or unavailable or passive["report_implies_route_available"]
     ):
         raise ModelError(f"{profile['profile_id']}: connection evidence has no route decoder")
+    _validate_lifecycle_policy(profile, transport, passive)
+
+
+def _validate_lifecycle_policy(
+    profile: dict[str, Any],
+    transport: dict[str, Any],
+    passive: object,
+) -> None:
+    lifecycle = transport.get("lifecycle")
+    if lifecycle is None:
+        return
+    if not isinstance(lifecycle, dict):
+        raise ModelError(f"{profile['profile_id']}: lifecycle policy must be an object")
+    _expect_keys(lifecycle, LIFECYCLE_KEYS, f"{profile['profile_id']} lifecycle policy")
+    missing = sorted(LIFECYCLE_KEYS - set(lifecycle))
+    if missing:
+        raise ModelError(
+            f"{profile['profile_id']}: incomplete lifecycle policy: {', '.join(missing)}"
+        )
+    departure = lifecycle["power_off_departure_evidence"]
+    if departure not in POWER_OFF_DEPARTURE_EVIDENCE:
+        raise ModelError(f"{profile['profile_id']}: unsupported power-off departure evidence")
+    settle_ms = lifecycle["device_return_settle_ms"]
+    if (
+        isinstance(settle_ms, bool)
+        or not isinstance(settle_ms, int)
+        or not 0 <= settle_ms <= MAX_DEVICE_RETURN_SETTLE_MS
+    ):
+        raise ModelError(f"{profile['profile_id']}: device-return settle time is out of bounds")
+    if departure == "watched-retained-route":
+        if (
+            not isinstance(passive, dict)
+            or not passive["report_implies_route_available"]
+            or passive["route"]["unavailable"]
+        ):
+            raise ModelError(
+                f"{profile['profile_id']}: retained-route departure contradicts passive route evidence"
+            )
+        if settle_ms == 0:
+            raise ModelError(
+                f"{profile['profile_id']}: retained-route return requires a positive settle time"
+            )
+
+
+def _validate_qualification_migrations(
+    profile: dict[str, Any], capability_index: dict[str, dict[str, Any]]
+) -> None:
+    migrations = profile.get("qualification_migrations")
+    if migrations is None:
+        return
+    identifier = profile["profile_id"]
+    if profile["kind"] != "child":
+        raise ModelError(f"{identifier}: qualification migrations are child-profile only")
+    if profile["revision"] < 2:
+        raise ModelError(f"{identifier}: qualification migrations require a revised profile")
+    if not isinstance(migrations, list) or not migrations:
+        raise ModelError(f"{identifier}: qualification migrations must be a non-empty list")
+
+    capability_ids = {item["id"] for item in profile["capabilities"]}
+    available_roles: set[str] = set()
+    if capability_ids & PASSIVE_TELEMETRY_CAPABILITIES:
+        available_roles.add("telemetry")
+    if capability_ids & {"lighting.per-key", "lighting.per-led"}:
+        available_roles.add("map")
+    if capability_ids & {
+        "lighting.brightness",
+        "lighting.complete-black",
+        "lighting.off",
+        "lighting.software-effect-frames",
+        "lighting.static",
+    }:
+        available_roles.add("lighting")
+
+    current_digest = _runtime_profile_digest(profile, capability_index)
+    predecessors: list[str] = []
+    for index, migration in enumerate(migrations):
+        label = f"{identifier} qualification migration {index}"
+        if not isinstance(migration, dict):
+            raise ModelError(f"{label}: expected an object")
+        _expect_keys(migration, QUALIFICATION_MIGRATION_KEYS, label)
+        missing = sorted(QUALIFICATION_MIGRATION_KEYS - set(migration))
+        if missing:
+            raise ModelError(f"{label}: incomplete migration: {', '.join(missing)}")
+        predecessor = migration["from_runtime_sha256"]
+        if not isinstance(predecessor, str) or DIGEST_PATTERN.fullmatch(predecessor) is None:
+            raise ModelError(f"{label}: predecessor must be a lowercase SHA-256 digest")
+        if predecessor == current_digest:
+            raise ModelError(f"{label}: predecessor already equals the current runtime profile")
+        roles = _expect_unique_string_list(
+            migration["preserve_stage_roles"],
+            f"{label} preserved stage roles",
+            allow_empty=False,
+        )
+        unknown_roles = sorted(set(roles) - QUALIFICATION_MIGRATION_STAGE_ROLES)
+        if unknown_roles:
+            raise ModelError(f"{label}: unsupported stage roles: {', '.join(unknown_roles)}")
+        unavailable_roles = sorted(set(roles) - available_roles)
+        if unavailable_roles:
+            raise ModelError(
+                f"{label}: profile does not expose stages for: {', '.join(unavailable_roles)}"
+            )
+        predecessors.append(predecessor)
+    require_unique(predecessors, f"{identifier} qualification migration predecessor")
+    if predecessors != sorted(predecessors):
+        raise ModelError(f"{identifier}: qualification migrations must be sorted by predecessor")
 
 
 def _validate_presentation(profile: dict[str, Any]) -> None:
@@ -729,6 +849,7 @@ def _validate_profiles(
             raise ModelError(f"{identifier}: surface profile exposes an unqualified write")
         _validate_lighting(profile)
         _validate_passive(profile)
+        _validate_qualification_migrations(profile, capability_index)
     require_unique(identities, "profile hardware identity")
 
 

From 577171b4e1cf98091d1de0e216c947858cb79e55 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 21:22:34 +0400
Subject: [PATCH 23/67] fix: migrate qualification stages across regenerated
 ids

---
 crates/hfx-ops/src/qualification_migration.rs | 57 ++++++++++++++++---
 1 file changed, 49 insertions(+), 8 deletions(-)

diff --git a/crates/hfx-ops/src/qualification_migration.rs b/crates/hfx-ops/src/qualification_migration.rs
index 3e1fdb6..544b34c 100644
--- a/crates/hfx-ops/src/qualification_migration.rs
+++ b/crates/hfx-ops/src/qualification_migration.rs
@@ -73,12 +73,11 @@ pub(crate) fn migrate_profile_catalog_state(
     let mut preserved = BTreeMap::new();
 
     for (stage_id, current_authority) in &current_authorities {
-        let Some(old_authority) = old_authorities.get(stage_id) else {
+        let Some((old_stage_id, old_authority)) =
+            matching_old_authority(stage_id, current_authority, &old_authorities)
+        else {
             continue;
         };
-        if !same_stage_authority(old_authority, current_authority) {
-            continue;
-        }
         let Some(profile) = catalog
             .iter()
             .find(|profile| profile.profile_id.as_str() == current_authority.profile_id)
@@ -100,7 +99,7 @@ pub(crate) fn migrate_profile_catalog_state(
         {
             continue;
         }
-        let Some(progress) = stale.results.get(stage_id) else {
+        let Some(progress) = stale.results.get(old_stage_id) else {
             continue;
         };
         if progress.status != StageStatus::Passed || progress.result.is_none() {
@@ -212,6 +211,22 @@ fn same_stage_authority(
         && old.stage_contract_sha256 == current.stage_contract_sha256
 }
 
+fn matching_old_authority<'a>(
+    current_stage_id: &str,
+    current: &QualificationStageAuthority,
+    old_authorities: &'a BTreeMap<String, QualificationStageAuthority>,
+) -> Option<(&'a str, &'a QualificationStageAuthority)> {
+    let role = StageRole::from_stage_id(current_stage_id)?;
+    let mut matches = old_authorities.iter().filter(|(stage_id, authority)| {
+        StageRole::from_stage_id(stage_id) == Some(role) && same_stage_authority(authority, current)
+    });
+    let (stage_id, authority) = matches.next()?;
+    if matches.next().is_some() {
+        return None;
+    }
+    Some((stage_id.as_str(), authority))
+}
+
 fn allowed_roles(
     profile: &RuntimeProfile,
     old_digest: &str,
@@ -254,11 +269,15 @@ fn plan_stages(
 }
 
 fn stage_contract_sha256(group: &QualificationGroup, stage: &QualificationStage) -> String {
+    let role = match StageRole::from_stage_id(&stage.stage_id) {
+        Some(role) => role.as_str(),
+        None => stage.stage_id.as_str(),
+    };
     let encoded = serde_json::to_vec(&(
         &group.group_id,
         &group.title,
         &group.description,
-        &stage.stage_id,
+        role,
         &stage.title,
         &stage.description,
         stage.kind,
@@ -266,7 +285,6 @@ fn stage_contract_sha256(group: &QualificationGroup, stage: &QualificationStage)
         &stage.capabilities,
         &stage.instructions,
         &stage.observations,
-        &stage.action_id,
     ))
     .expect("qualification stage contracts contain no fallible values");
     let digest = Sha256::digest(encoded);
@@ -345,6 +363,23 @@ mod tests {
             .digest = digest.to_owned();
     }
 
+    fn replace_stage_ids(run: &mut LifecycleRunState) -> BTreeMap<String, String> {
+        let mut replacements = BTreeMap::new();
+        for plan in &mut run.plans {
+            for stage in plan.groups.iter_mut().flat_map(|group| &mut group.stages) {
+                let role = StageRole::from_stage_id(&stage.stage_id)
+                    .expect("generated stage role")
+                    .as_str();
+                let current_id = stage.stage_id.clone();
+                let predecessor_id = format!("predecessor-{}-{role}", plan.device_id);
+                stage.stage_id.clone_from(&predecessor_id);
+                stage.action_id = Some(format!("run:{predecessor_id}"));
+                replacements.insert(current_id, predecessor_id);
+            }
+        }
+        replacements
+    }
+
     #[test]
     fn migration_preserves_only_allowlisted_identical_passed_stage_contracts() {
         let catalog = RuntimeProfileCatalog::load().expect("catalog loads");
@@ -361,6 +396,7 @@ mod tests {
             "keyboard-test",
             "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
         );
+        let predecessor_stage_ids = replace_stage_ids(&mut old_run);
 
         let all_stages = current
             .plans
@@ -375,7 +411,12 @@ mod tests {
             run_id: Some("local-preserved".to_owned()),
             results: all_stages
                 .iter()
-                .map(|stage_id| (stage_id.clone(), passed(stage_id)))
+                .map(|stage_id| {
+                    let predecessor_id = predecessor_stage_ids
+                        .get(stage_id)
+                        .expect("predecessor stage id");
+                    (predecessor_id.clone(), passed(predecessor_id))
+                })
                 .collect(),
             lifecycle_run: Some(old_run),
             pending_transaction: None,

From 7667a1cb22e0cbd5b1f9293619f2cb8e767e64b8 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Thu, 23 Jul 2026 22:39:40 +0400
Subject: [PATCH 24/67] fix: settle keyboard lifecycle restores

---
 .../tests/fixtures/rust-qualified-mouse.json  |  2 +-
 .../tests/fixtures/rust-qualified-pair.json   |  6 ++---
 crates/hfx-daemon/src/observation.rs          | 16 ++++++++++++-
 crates/hfx-profiles/src/generated.rs          | 24 ++++++++++++-------
 crates/hfx-profiles/tests/catalog.rs          | 15 ++++++++++--
 docs/generated/supported-hardware.md          |  4 ++--
 .../generated/hyperflux_receiver_profiles.inc |  2 +-
 generated/knowledge/catalog.json              |  2 +-
 generated/profiles/catalog.json               | 18 +++++++++++---
 .../razer-deathstalker-v2-pro-tkl-0296.json   |  6 +++--
 .../hyperflux/generated/profile_catalog.hpp   |  6 ++---
 .../generated/profile_catalog.py              | 16 ++++++++-----
 .../generated/profile-compositions.json       |  2 +-
 tests/test_profiles.py                        | 11 +++++++++
 14 files changed, 96 insertions(+), 34 deletions(-)

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index ec11d9b..f2ff158 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
+    "profile_catalog_digest": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 8069b6d..9feb166 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
+    "profile_catalog_digest": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
   },
   "receivers": [
     {
@@ -127,7 +127,7 @@
           "product_id": 662,
           "profile": {
             "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-            "digest": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c"
+            "digest": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -444,7 +444,7 @@
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-        "digest": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c"
+        "digest": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index fd1e0b2..0520236 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -959,6 +959,13 @@ mod tests {
                 .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
+        assert_eq!(
+            mouse
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.settle_ms),
+            Some(1_000)
+        );
 
         let keyboard = translator
             .translate(activity(7, 1_001, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
@@ -1096,6 +1103,13 @@ mod tests {
                 .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
+        assert_eq!(
+            mouse
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.settle_ms),
+            Some(1_000)
+        );
         let keyboard = translator
             .translate(activity(8, 1_005, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
             .expect("post-resume keyboard activity translates");
@@ -1111,7 +1125,7 @@ mod tests {
                 .restore_ready
                 .as_ref()
                 .map(|readiness| readiness.settle_ms),
-            Some(0)
+            Some(1_000)
         );
         let continuous = translator
             .translate(activity(9, 1_006, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 140492a..ea7944e 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a
+// Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -99,7 +99,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a";
+    "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -270,11 +270,16 @@ const PASSIVE_ROUTE_AVAILABLE_1: &[u32] = &[0, 3];
 const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2];
 const PASSIVE_ROUTE_INDETERMINATE_1: &[u32] = &[257];
 
-const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] =
-    &[QualificationMigrationRecord {
+const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] = &[
+    QualificationMigrationRecord {
+        from_runtime_sha256: "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    },
+    QualificationMigrationRecord {
         from_runtime_sha256: "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
         preserve_stage_roles: &["lighting", "map"],
-    }];
+    },
+];
 
 const CAPABILITIES_2: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -379,8 +384,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "child.razer.deathstalker-v2-pro-tkl.0296",
-        runtime_sha256: "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
-        revision: 2,
+        runtime_sha256: "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
+        revision: 3,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Keyboard,
         vendor_id: Some(5426),
@@ -412,7 +417,10 @@ pub const PROFILES: &[ProfileRecord] = &[
             route_indeterminate: PASSIVE_ROUTE_INDETERMINATE_1,
             report_implies_route_available: false,
         }),
-        lifecycle: None,
+        lifecycle: Some(LifecyclePolicyRecord {
+            power_off_departure_evidence: PowerOffDepartureEvidence::ReceiverState,
+            device_return_settle_ms: 1000,
+        }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_1,
         presentation: Some(PresentationRecord {
             upstream_id: "openrgb",
diff --git a/crates/hfx-profiles/tests/catalog.rs b/crates/hfx-profiles/tests/catalog.rs
index e068b3f..767c9b5 100644
--- a/crates/hfx-profiles/tests/catalog.rs
+++ b/crates/hfx-profiles/tests/catalog.rs
@@ -39,10 +39,21 @@ fn receiver_and_children_resolve_independently() {
         &["lighting", "map", "telemetry"]
     );
     assert_eq!(keyboard.device_kind, DeviceKind::Keyboard);
-    assert_eq!(keyboard.lifecycle, None);
-    assert_eq!(keyboard.qualification_migrations.len(), 1);
+    let lifecycle = keyboard
+        .lifecycle
+        .expect("keyboard lifecycle policy is exact-profile bound");
+    assert_eq!(
+        lifecycle.power_off_departure_evidence,
+        PowerOffDepartureEvidence::ReceiverState
+    );
+    assert_eq!(lifecycle.device_return_settle_ms, 1_000);
+    assert_eq!(keyboard.qualification_migrations.len(), 2);
     assert_eq!(
         keyboard.qualification_migrations[0].preserve_stage_roles,
+        &["lighting", "map", "telemetry"]
+    );
+    assert_eq!(
+        keyboard.qualification_migrations[1].preserve_stage_roles,
         &["lighting", "map"]
     );
     assert_ne!(mouse.id, keyboard.id);
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index e7d44f1..c7b469f 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a`
+Profile source: `2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -11,7 +11,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `1a9dde39c257` | 7 | 7 |
-| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `88e5b7d79e54` | 6 | 7 |
+| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `8c96caf63c96` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index a48e446..ed2cc56 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a */
+/* Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27 */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index fb40ab3..7eeaf9e 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "a9e3b139674eeb159ab19c8ac5c48f81931e921e00676c4b64843b46df160b9a",
+  "source_sha256": "ae82f5ec8b0741d36f7667a84833cf8e05e3693e8495af325a3dd2d1f193ea43",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index b97f9b0..e82e957 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1100,6 +1100,14 @@
       },
       "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
       "qualification_migrations": [
+        {
+          "from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        },
         {
           "from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
           "preserve_stage_roles": [
@@ -1114,11 +1122,15 @@
         "External power does not establish a direct USB data route or charging state.",
         "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."
       ],
-      "revision": 2,
-      "runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
+      "revision": 3,
+      "runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json",
       "transport": {
+        "lifecycle": {
+          "device_return_settle_ms": 1000,
+          "power_off_departure_evidence": "receiver-state"
+        },
         "lighting": {
           "application_index_to_carrier": [
             0,
@@ -1392,5 +1404,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
+  "source_sha256": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
 }
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index 450f954..c2f2eb4 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
-  "revision": 2,
+  "revision": 3,
   "kind": "child",
   "device_kind": "keyboard",
   "identity": {"manufacturer": "Razer", "model_name": "Razer DeathStalker V2 Pro Tenkeyless", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 662},
@@ -15,9 +15,11 @@
       "contact": null,
       "route": {"available": [0, 3], "unavailable": [2], "indeterminate": [257]},
       "report_implies_route_available": false
-    }
+    },
+    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 1000}
   },
   "qualification_migrations": [
+    {"from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", "preserve_stage_roles": ["lighting", "map"]}
   ],
   "presentation": {"upstream_id": "openrgb", "owner": "OpenRGB", "project_version": "1.0rc3", "source_commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "model_key": "deathstalker_v2_pro_tkl_wireless_device", "layout_key": "razer_deathstalker_v2_pro_tkl_layout", "transport_variant": "wireless"},
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index d287e8a..eb29542 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a
+// Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a";
+inline constexpr std::string_view profile_source_sha256 = "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -161,7 +161,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", 2, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
-    {"child.razer.deathstalker-v2-pro-tkl.0296", "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", 2, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
+    {"child.razer.deathstalker-v2-pro-tkl.0296", "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d", 3, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
     {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
 }};
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index d7bbb03..508e96e 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a'
+PROFILE_SOURCE_SHA256: Final = '2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -635,18 +635,22 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
-               'qualification_migrations': [{'from_runtime_sha256': 'fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6',
+               'qualification_migrations': [{'from_runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
+                                            {'from_runtime_sha256': 'fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6',
                                              'preserve_stage_roles': ['lighting', 'map']}],
                'restrictions': ['Another DeathStalker name, PID, or physical layout inherits no map.',
                                 'OpenRGB owns key names, geometry, and ANSI or ISO presentation.',
                                 'External power does not establish a direct USB data route or charging state.',
                                 'Receiver route value 0x0101 is indeterminate and cannot override observed keyboard '
                                 'activity.'],
-               'revision': 2,
-               'runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
+               'revision': 3,
+               'runtime_sha256': '8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-deathstalker-v2-pro-tkl-0296.json',
-               'transport': {'lighting': {'application_index_to_carrier': [0,
+               'transport': {'lifecycle': {'device_return_settle_ms': 1000,
+                                           'power_off_departure_evidence': 'receiver-state'},
+                             'lighting': {'application_index_to_carrier': [0,
                                                                            1,
                                                                            2,
                                                                            3,
@@ -834,7 +838,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a'}
+ 'source_sha256': '2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 02e722c..35b5968 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "f75f7ebd0caaec5469fdfddb55fb8e1182bc1d0adf53a5f9f28c8d35c6f4f62a"
+  "source_sha256": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
 }
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index b4f879a..41f1e1f 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -195,6 +195,17 @@ def test_lifecycle_policy_is_bounded_profile_local_and_digest_bound(self) -> Non
         with self.assertRaisesRegex(ModelError, "contradicts passive route evidence"):
             _validate_profiles(profiles, capabilities, claims)
 
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        before = _runtime_profile_digest(keyboard, capabilities)
+        keyboard["transport"]["lifecycle"]["device_return_settle_ms"] = 1_001
+        _validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
+        self.assertEqual(
+            keyboard["transport"]["lifecycle"]["power_off_departure_evidence"],
+            "receiver-state",
+        )
+
     def test_qualification_migrations_are_exact_and_do_not_change_runtime_identity(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")

From 5ac41833ade47b5e5597d4188af14416560e63dc Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 08:40:54 +0400
Subject: [PATCH 25/67] fix: confirm keyboard return readiness

---
 crates/hfx-daemon/src/lib.rs                  |   3 +-
 crates/hfx-daemon/src/manager.rs              |  29 ++-
 crates/hfx-daemon/src/observation.rs          | 165 ++++++++++++++--
 crates/hfx-daemon/src/restoration.rs          | 179 ++++++++++++++++++
 crates/hfx-profiles/src/generated.rs          |  31 ++-
 crates/hfx-profiles/tests/catalog.rs          |  25 ++-
 docs/generated/supported-hardware.md          |   4 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  20 +-
 .../razer-deathstalker-v2-pro-tkl-0296.json   |   5 +-
 schemas/hardware-profile.schema.json          |  17 +-
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  14 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_profiles.py                        |  19 ++
 tools/hfxdev/generators/profiles.py           |  25 +++
 tools/hfxdev/profiles.py                      |  47 ++++-
 18 files changed, 537 insertions(+), 58 deletions(-)

diff --git a/crates/hfx-daemon/src/lib.rs b/crates/hfx-daemon/src/lib.rs
index 8b842d3..77c6d14 100644
--- a/crates/hfx-daemon/src/lib.rs
+++ b/crates/hfx-daemon/src/lib.rs
@@ -28,7 +28,8 @@ pub use logging::{
 };
 pub use manager::{LinuxRuntimeManager, RuntimeTickError, RuntimeTickReport};
 pub use observation::{
-    PassiveDisposition, PassiveObservationTranslator, PassiveTranslation, PassiveTranslationError,
+    DeviceRestoreReadinessPhase, PassiveDisposition, PassiveObservationTranslator,
+    PassiveTranslation, PassiveTranslationError,
 };
 pub use production::{
     ProductionBackend, ProductionBuildError, ProductionComposition, ProductionTransport,
diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index 3e91954..949d069 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{
-    EndpointCandidate, EndpointDiscovery, EndpointDiscoveryError, PassiveDisposition,
-    PassiveObservationTranslator, PassiveTranslation, PassiveTranslationError, ProductionBackend,
-    ReceiverIdentityAuthority, ReceiverIdentityError, RestorationScheduleError,
+    DeviceRestoreReadinessPhase, EndpointCandidate, EndpointDiscovery, EndpointDiscoveryError,
+    PassiveDisposition, PassiveObservationTranslator, PassiveTranslation, PassiveTranslationError,
+    ProductionBackend, ReceiverIdentityAuthority, ReceiverIdentityError, RestorationScheduleError,
     RestorationScheduler, RestorationTickReport, WriterAuthorityError, derive_capability_digest,
 };
 use hfx_bridge::{
@@ -462,16 +462,29 @@ impl LinuxRuntimeManager {
             }
         }
         if let Some(readiness) = translation.restore_ready {
-            self.restoration
-                .schedule_device_return_at(
+            let sequence =
+                SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?;
+            match readiness.phase {
+                DeviceRestoreReadinessPhase::Timed => self.restoration.schedule_device_return_at(
                     receiver_id.clone(),
                     generation_id,
                     readiness.device_id,
-                    SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?,
+                    sequence,
                     backend.now(),
                     readiness.settle_ms,
-                )
-                .map_err(RuntimeTickError::Restoration)?;
+                ),
+                DeviceRestoreReadinessPhase::Confirmed => {
+                    self.restoration.confirm_device_return_at(
+                        receiver_id.clone(),
+                        generation_id,
+                        readiness.device_id,
+                        sequence,
+                        backend.now(),
+                        readiness.settle_ms,
+                    )
+                }
+            }
+            .map_err(RuntimeTickError::Restoration)?;
         }
         Ok(())
     }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index 0520236..bb5ba6c 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -20,8 +20,8 @@ use hfx_kernel_transport::{
     HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT, RawKernelObservation,
 };
 use hfx_profiles::{
-    LifecyclePolicyRecord, PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord,
-    RuntimeProfileCatalog,
+    DeviceReturnConfirmationEvidence, LifecyclePolicyRecord, PassiveBatteryEncoding,
+    PassiveEndpointLane, PassiveTelemetryRecord, RuntimeProfileCatalog,
 };
 use hfx_runtime::ACTIVITY_RESUMPTION_QUIET_MS;
 use std::collections::BTreeMap;
@@ -41,6 +41,13 @@ pub enum PassiveDisposition {
 pub struct DeviceRestoreReadiness {
     pub device_id: LogicalDeviceId,
     pub settle_ms: u64,
+    pub phase: DeviceRestoreReadinessPhase,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DeviceRestoreReadinessPhase {
+    Timed,
+    Confirmed,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -66,6 +73,7 @@ impl PassiveTranslation {
         observations: Vec<LifecycleObservation>,
         device_id: LogicalDeviceId,
         settle_ms: u64,
+        phase: DeviceRestoreReadinessPhase,
     ) -> Self {
         Self {
             disposition: PassiveDisposition::Applied,
@@ -73,6 +81,7 @@ impl PassiveTranslation {
             restore_ready: Some(DeviceRestoreReadiness {
                 device_id,
                 settle_ms,
+                phase,
             }),
         }
     }
@@ -135,6 +144,7 @@ struct LaneBinding {
     passive: Option<PassiveTelemetryRecord>,
     lifecycle: Option<LifecyclePolicyRecord>,
     last_activity_ms: Option<MonotonicMs>,
+    return_confirmation_deadline_ms: Option<MonotonicMs>,
 }
 
 pub struct PassiveObservationTranslator {
@@ -269,6 +279,7 @@ impl PassiveObservationTranslator {
             if !self.receiver_was_suspended {
                 for binding in self.lanes.values_mut() {
                     binding.last_activity_ms = None;
+                    binding.return_confirmation_deadline_ms = None;
                 }
             }
             self.receiver_was_suspended = true;
@@ -311,10 +322,10 @@ impl PassiveObservationTranslator {
             device_kind.as_str()
         ))?;
         let endpoint_id = EndpointId::try_from(format!("hyperflux-{}", lane_name(lane)))?;
-        let last_activity_ms = self
-            .lanes
-            .get(&slot)
-            .and_then(|binding| binding.last_activity_ms);
+        let prior = self.lanes.get(&slot);
+        let last_activity_ms = prior.and_then(|binding| binding.last_activity_ms);
+        let return_confirmation_deadline_ms =
+            prior.and_then(|binding| binding.return_confirmation_deadline_ms);
         let binding = LaneBinding {
             product_id,
             device_id: device_id.clone(),
@@ -322,6 +333,7 @@ impl PassiveObservationTranslator {
             passive: profile.and_then(|profile| profile.passive),
             lifecycle: profile.and_then(|profile| profile.lifecycle),
             last_activity_ms,
+            return_confirmation_deadline_ms,
         };
         let child = ChildIdentity::new(device_id.clone(), device_kind, product_id)?;
         let endpoint = EndpointIdentity::new(
@@ -377,6 +389,26 @@ impl PassiveObservationTranslator {
         {
             binding.last_activity_ms = Some(observed_at_ms);
         }
+        let readiness = restore_ready.then(|| {
+            let settle_ms = binding
+                .lifecycle
+                .map_or(0, |policy| policy.device_return_settle_ms);
+            if binding
+                .lifecycle
+                .and_then(|policy| policy.device_return_confirmation)
+                .is_some()
+            {
+                let deadline = observed_at_ms.get().saturating_add(settle_ms);
+                binding.return_confirmation_deadline_ms = MonotonicMs::try_from(deadline).ok();
+            } else {
+                binding.return_confirmation_deadline_ms = None;
+            }
+            (
+                binding.device_id.clone(),
+                settle_ms,
+                DeviceRestoreReadinessPhase::Timed,
+            )
+        });
         let binding = binding.clone();
         let observations = vec![
             self.endpoint_observation(
@@ -401,26 +433,20 @@ impl PassiveObservationTranslator {
                 EndpointFact::Freshness(FreshnessState::Fresh),
             ),
         ];
-        Ok(if restore_ready {
-            PassiveTranslation::restore_ready(
-                observations,
-                binding.device_id,
-                binding
-                    .lifecycle
-                    .map_or(0, |policy| policy.device_return_settle_ms),
-            )
+        Ok(if let Some((device_id, settle_ms, phase)) = readiness {
+            PassiveTranslation::restore_ready(observations, device_id, settle_ms, phase)
         } else {
             PassiveTranslation::applied(observations)
         })
     }
 
     fn battery(
-        &self,
+        &mut self,
         slot: u32,
         value: u32,
         stamp: ObservationStamp,
     ) -> Result<PassiveTranslation, PassiveTranslationError> {
-        let Some(binding) = self.lanes.get(&slot) else {
+        let Some(binding) = self.lanes.get_mut(&slot) else {
             return Ok(PassiveTranslation::disposition(
                 PassiveDisposition::IgnoredUnknownLane,
             ));
@@ -438,6 +464,20 @@ impl PassiveObservationTranslator {
                     .map_err(|_| PassiveTranslationError::InvalidObservationValue)?
             }
         };
+        let confirmation_settle_ms = binding
+            .lifecycle
+            .and_then(|policy| policy.device_return_confirmation)
+            .filter(|confirmation| {
+                confirmation.evidence == DeviceReturnConfirmationEvidence::BatteryReport
+            })
+            .and_then(|confirmation| {
+                binding
+                    .return_confirmation_deadline_ms
+                    .filter(|deadline| stamp.observed_at_ms() <= *deadline)
+                    .map(|_| confirmation.settle_ms)
+            });
+        binding.return_confirmation_deadline_ms = None;
+        let binding = binding.clone();
         let mut observations = vec![self.observation(
             stamp.clone(),
             LifecycleObservationKind::BatteryReported {
@@ -446,9 +486,18 @@ impl PassiveObservationTranslator {
             },
         )];
         if passive.report_implies_route_available {
-            observations.extend(self.route_observations(binding, stamp, RouteState::Available));
+            observations.extend(self.route_observations(&binding, stamp, RouteState::Available));
         }
-        Ok(PassiveTranslation::applied(observations))
+        Ok(if let Some(settle_ms) = confirmation_settle_ms {
+            PassiveTranslation::restore_ready(
+                observations,
+                binding.device_id,
+                settle_ms,
+                DeviceRestoreReadinessPhase::Confirmed,
+            )
+        } else {
+            PassiveTranslation::applied(observations)
+        })
     }
 
     fn contact(&self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
@@ -891,6 +940,13 @@ mod tests {
                 .map(|readiness| readiness.settle_ms),
             Some(1_000)
         );
+        assert_eq!(
+            first
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.phase),
+            Some(DeviceRestoreReadinessPhase::Timed)
+        );
 
         let resumed = translator
             .translate(activity(
@@ -917,6 +973,77 @@ mod tests {
         assert_eq!(continuous.restore_ready, None);
     }
 
+    #[test]
+    fn keyboard_battery_confirms_one_pending_return_before_the_fallback() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+
+        let candidate = translator
+            .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("keyboard activity opens a bounded return window");
+        let readiness = candidate
+            .restore_ready
+            .expect("keyboard activity schedules a fallback");
+        assert_eq!(readiness.settle_ms, 5_000);
+        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Timed);
+
+        let confirmed = translator
+            .translate(raw_at(
+                3,
+                2_900,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_BATTERY_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+                128,
+            ))
+            .expect("fresh keyboard battery evidence confirms return readiness");
+        let readiness = confirmed
+            .restore_ready
+            .expect("the first fresh battery report confirms the child route");
+        assert_eq!(readiness.settle_ms, 250);
+        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Confirmed);
+
+        let repeated = translator
+            .translate(raw_at(
+                4,
+                3_000,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_BATTERY_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+                128,
+            ))
+            .expect("repeated battery evidence remains telemetry only");
+        assert_eq!(repeated.restore_ready, None);
+    }
+
+    #[test]
+    fn late_keyboard_battery_cannot_reopen_an_expired_return_window() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        translator
+            .translate(activity(2, 1_000, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
+            .expect("keyboard activity opens a bounded return window");
+
+        let late = translator
+            .translate(raw_at(
+                3,
+                6_001,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_BATTERY_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+                128,
+            ))
+            .expect("late battery evidence remains valid telemetry");
+        assert_eq!(late.restore_ready, None);
+    }
+
     #[test]
     fn identity_replay_preserves_activity_continuity_and_sibling_isolation() {
         let mut translator = translator();
@@ -1125,7 +1252,7 @@ mod tests {
                 .restore_ready
                 .as_ref()
                 .map(|readiness| readiness.settle_ms),
-            Some(1_000)
+            Some(5_000)
         );
         let continuous = translator
             .translate(activity(9, 1_006, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 6bab2c6..775aeb1 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -389,6 +389,61 @@ impl RestorationScheduler {
         )
     }
 
+    /// Advances one pending device-return fallback after stronger profile-owned
+    /// child evidence arrives. Confirmation can only move the exact device
+    /// earlier; repeated evidence cannot postpone it or affect a sibling.
+    ///
+    /// # Errors
+    ///
+    /// Returns a time, trigger-capacity, or generated-identity failure.
+    pub fn confirm_device_return_at(
+        &mut self,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        device_id: LogicalDeviceId,
+        sequence: SequenceNumber,
+        confirmed_at: MonotonicMs,
+        settle_ms: u64,
+    ) -> Result<(), RestorationScheduleError> {
+        if !self.enabled {
+            return Ok(());
+        }
+        let due = due_after(confirmed_at, settle_ms)?;
+        let readiness = (receiver_id.clone(), generation_id, device_id.clone());
+        let due = *self
+            .ready_devices
+            .entry(readiness)
+            .and_modify(|existing| *existing = (*existing).min(due))
+            .or_insert(due);
+
+        let woke = self.wake_earlier(&receiver_id, generation_id, &device_id, due);
+        let matching_triggers = self
+            .triggers
+            .iter()
+            .filter_map(|(trigger_id, scheduled)| {
+                (scheduled.trigger.receiver_id == receiver_id
+                    && scheduled.trigger.generation_id == generation_id
+                    && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
+                    && scheduled.trigger.target_device_id.as_ref() == Some(&device_id))
+                .then_some(trigger_id.clone())
+            })
+            .collect::<Vec<_>>();
+        for trigger_id in matching_triggers {
+            self.triggers.remove(&trigger_id);
+        }
+        if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
+            return Ok(());
+        }
+        self.schedule_at(
+            RestoreTriggerKind::DeviceReturn,
+            receiver_id,
+            generation_id,
+            Some(device_id),
+            Some(sequence),
+            due,
+        )
+    }
+
     pub fn retire_generation(&mut self, receiver_id: &ReceiverId, generation_id: GenerationId) {
         self.triggers.retain(|_, scheduled| {
             scheduled.trigger.receiver_id != *receiver_id
@@ -749,6 +804,25 @@ impl RestorationScheduler {
         woken
     }
 
+    fn wake_earlier(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: &LogicalDeviceId,
+        due: MonotonicMs,
+    ) -> usize {
+        let mut woken = 0;
+        for claim in self.claims.values_mut().filter(|claim| {
+            claim.receiver_id == *receiver_id
+                && claim.generation_id == generation_id
+                && claim.device_id == *device_id
+        }) {
+            claim.due = claim.due.min(due);
+            woken += 1;
+        }
+        woken
+    }
+
     fn wake_ready_devices(
         &mut self,
         receiver_id: &ReceiverId,
@@ -1960,6 +2034,111 @@ mod tests {
         );
     }
 
+    #[test]
+    fn profile_owned_return_confirmation_advances_only_the_exact_device() {
+        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
+        let keyboard =
+            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_record(mouse.clone(), parked_due().expect("parked due"))
+            .expect("mouse claim schedules");
+        scheduler
+            .schedule_record(keyboard.clone(), parked_due().expect("parked due"))
+            .expect("keyboard claim schedules");
+
+        scheduler
+            .schedule_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+            )
+            .expect("mouse fallback schedules");
+        scheduler
+            .confirm_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+            )
+            .expect("mouse confirmation advances the fallback");
+        scheduler
+            .confirm_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(12_u64).expect("sequence"),
+                time(3_000),
+                250,
+            )
+            .expect("repeated confirmation cannot postpone the claim");
+
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("mouse claim")
+                .due,
+            time(3_150)
+        );
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&keyboard.claim_id)
+                .expect("keyboard claim")
+                .due,
+            parked_due().expect("parked due")
+        );
+    }
+
+    #[test]
+    fn repeated_return_confirmation_coalesces_without_postponing_a_trigger() {
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+            )
+            .expect("fallback trigger schedules");
+        scheduler
+            .confirm_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+            )
+            .expect("confirmation advances the trigger");
+        scheduler
+            .confirm_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(12_u64).expect("sequence"),
+                time(3_000),
+                250,
+            )
+            .expect("repeated confirmation coalesces");
+
+        assert_eq!(scheduler.triggers.len(), 1);
+        let trigger = scheduler.triggers.values().next().expect("one trigger");
+        assert_eq!(trigger.due, time(3_150));
+        assert_eq!(
+            trigger.sequence,
+            Some(SequenceNumber::try_from(12_u64).expect("sequence"))
+        );
+    }
+
     #[test]
     fn deferred_claim_waits_for_backoff_but_device_return_wakes_it() {
         let deferred = record(
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index ea7944e..b391705 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27
+// Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -50,10 +50,22 @@ pub enum PowerOffDepartureEvidence {
     WatchedRetainedRoute,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DeviceReturnConfirmationEvidence {
+    BatteryReport,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct DeviceReturnConfirmationRecord {
+    pub evidence: DeviceReturnConfirmationEvidence,
+    pub settle_ms: u64,
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct LifecyclePolicyRecord {
     pub power_off_departure_evidence: PowerOffDepartureEvidence,
     pub device_return_settle_ms: u64,
+    pub device_return_confirmation: Option<DeviceReturnConfirmationRecord>,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -99,7 +111,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27";
+    "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -275,6 +287,10 @@ const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] = &[
         from_runtime_sha256: "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
         preserve_stage_roles: &["lighting", "map", "telemetry"],
     },
+    QualificationMigrationRecord {
+        from_runtime_sha256: "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    },
     QualificationMigrationRecord {
         from_runtime_sha256: "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
         preserve_stage_roles: &["lighting", "map"],
@@ -370,6 +386,7 @@ pub const PROFILES: &[ProfileRecord] = &[
         lifecycle: Some(LifecyclePolicyRecord {
             power_off_departure_evidence: PowerOffDepartureEvidence::WatchedRetainedRoute,
             device_return_settle_ms: 1000,
+            device_return_confirmation: None,
         }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_0,
         presentation: Some(PresentationRecord {
@@ -384,8 +401,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "child.razer.deathstalker-v2-pro-tkl.0296",
-        runtime_sha256: "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
-        revision: 3,
+        runtime_sha256: "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
+        revision: 4,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Keyboard,
         vendor_id: Some(5426),
@@ -419,7 +436,11 @@ pub const PROFILES: &[ProfileRecord] = &[
         }),
         lifecycle: Some(LifecyclePolicyRecord {
             power_off_departure_evidence: PowerOffDepartureEvidence::ReceiverState,
-            device_return_settle_ms: 1000,
+            device_return_settle_ms: 5000,
+            device_return_confirmation: Some(DeviceReturnConfirmationRecord {
+                evidence: DeviceReturnConfirmationEvidence::BatteryReport,
+                settle_ms: 250,
+            }),
         }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_1,
         presentation: Some(PresentationRecord {
diff --git a/crates/hfx-profiles/tests/catalog.rs b/crates/hfx-profiles/tests/catalog.rs
index 767c9b5..76dbf58 100644
--- a/crates/hfx-profiles/tests/catalog.rs
+++ b/crates/hfx-profiles/tests/catalog.rs
@@ -2,8 +2,8 @@
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind};
 use hfx_profiles::{
-    PROFILES, PowerOffDepartureEvidence, RuntimeProfileCatalog, child_profile_by_product_id,
-    profile_by_id, receiver_profile_by_usb_id,
+    DeviceReturnConfirmationEvidence, PROFILES, PowerOffDepartureEvidence, RuntimeProfileCatalog,
+    child_profile_by_product_id, profile_by_id, receiver_profile_by_usb_id,
 };
 
 #[test]
@@ -33,6 +33,7 @@ fn receiver_and_children_resolve_independently() {
         PowerOffDepartureEvidence::WatchedRetainedRoute
     );
     assert_eq!(lifecycle.device_return_settle_ms, 1_000);
+    assert_eq!(lifecycle.device_return_confirmation, None);
     assert_eq!(mouse.qualification_migrations.len(), 1);
     assert_eq!(
         mouse.qualification_migrations[0].preserve_stage_roles,
@@ -46,14 +47,30 @@ fn receiver_and_children_resolve_independently() {
         lifecycle.power_off_departure_evidence,
         PowerOffDepartureEvidence::ReceiverState
     );
-    assert_eq!(lifecycle.device_return_settle_ms, 1_000);
-    assert_eq!(keyboard.qualification_migrations.len(), 2);
+    assert_eq!(lifecycle.device_return_settle_ms, 5_000);
+    let confirmation = lifecycle
+        .device_return_confirmation
+        .expect("keyboard return uses child confirmation evidence");
+    assert_eq!(
+        confirmation.evidence,
+        DeviceReturnConfirmationEvidence::BatteryReport
+    );
+    assert_eq!(confirmation.settle_ms, 250);
+    assert_eq!(keyboard.qualification_migrations.len(), 3);
     assert_eq!(
         keyboard.qualification_migrations[0].preserve_stage_roles,
         &["lighting", "map", "telemetry"]
     );
     assert_eq!(
         keyboard.qualification_migrations[1].preserve_stage_roles,
+        &["lighting", "map", "telemetry"]
+    );
+    assert_eq!(
+        keyboard.qualification_migrations[1].from_runtime_sha256,
+        "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
+    );
+    assert_eq!(
+        keyboard.qualification_migrations[2].preserve_stage_roles,
         &["lighting", "map"]
     );
     assert_ne!(mouse.id, keyboard.id);
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index c7b469f..2b47a4f 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27`
+Profile source: `bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -11,7 +11,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `1a9dde39c257` | 7 | 7 |
-| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `8c96caf63c96` | 6 | 7 |
+| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `31f80ff672cb` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index ed2cc56..b744856 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27 */
+/* Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6 */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 7eeaf9e..55a85f0 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "ae82f5ec8b0741d36f7667a84833cf8e05e3693e8495af325a3dd2d1f193ea43",
+  "source_sha256": "2a99386fed3b579533e638b54f5c67419f413645b9e2a7e962e08fe18062d8e2",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index e82e957..4969a44 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1108,6 +1108,14 @@
             "telemetry"
           ]
         },
+        {
+          "from_runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        },
         {
           "from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6",
           "preserve_stage_roles": [
@@ -1122,13 +1130,17 @@
         "External power does not establish a direct USB data route or charging state.",
         "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."
       ],
-      "revision": 3,
-      "runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d",
+      "revision": 4,
+      "runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json",
       "transport": {
         "lifecycle": {
-          "device_return_settle_ms": 1000,
+          "device_return_confirmation": {
+            "evidence": "battery-report",
+            "settle_ms": 250
+          },
+          "device_return_settle_ms": 5000,
           "power_off_departure_evidence": "receiver-state"
         },
         "lighting": {
@@ -1404,5 +1416,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
+  "source_sha256": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
 }
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index c2f2eb4..db0dfd8 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
-  "revision": 3,
+  "revision": 4,
   "kind": "child",
   "device_kind": "keyboard",
   "identity": {"manufacturer": "Razer", "model_name": "Razer DeathStalker V2 Pro Tenkeyless", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 662},
@@ -16,10 +16,11 @@
       "route": {"available": [0, 3], "unavailable": [2], "indeterminate": [257]},
       "report_implies_route_available": false
     },
-    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 1000}
+    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 5000, "device_return_confirmation": {"evidence": "battery-report", "settle_ms": 250}}
   },
   "qualification_migrations": [
     {"from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
+    {"from_runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", "preserve_stage_roles": ["lighting", "map"]}
   ],
   "presentation": {"upstream_id": "openrgb", "owner": "OpenRGB", "project_version": "1.0rc3", "source_commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "model_key": "deathstalker_v2_pro_tkl_wireless_device", "layout_key": "razer_deathstalker_v2_pro_tkl_layout", "transport_variant": "wireless"},
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 412263d..130960a 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -131,7 +131,22 @@
       "required": ["power_off_departure_evidence", "device_return_settle_ms"],
       "properties": {
         "power_off_departure_evidence": {"enum": ["receiver-state", "watched-retained-route"]},
-        "device_return_settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000}
+        "device_return_settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000},
+        "device_return_confirmation": {
+          "oneOf": [
+            {"type": "null"},
+            {"$ref": "#/$defs/device-return-confirmation"}
+          ]
+        }
+      }
+    },
+    "device-return-confirmation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["evidence", "settle_ms"],
+      "properties": {
+        "evidence": {"enum": ["battery-report"]},
+        "settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000}
       }
     },
     "qualification-migration": {
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index eb29542..0a0a662 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27
+// Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27";
+inline constexpr std::string_view profile_source_sha256 = "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -161,7 +161,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", 2, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
-    {"child.razer.deathstalker-v2-pro-tkl.0296", "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d", 3, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
+    {"child.razer.deathstalker-v2-pro-tkl.0296", "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb", 4, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
     {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
 }};
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 508e96e..52aba6b 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27'
+PROFILE_SOURCE_SHA256: Final = 'bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -637,6 +637,8 @@
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
                'qualification_migrations': [{'from_runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
+                                            {'from_runtime_sha256': '8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
                                             {'from_runtime_sha256': 'fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6',
                                              'preserve_stage_roles': ['lighting', 'map']}],
                'restrictions': ['Another DeathStalker name, PID, or physical layout inherits no map.',
@@ -644,11 +646,13 @@
                                 'External power does not establish a direct USB data route or charging state.',
                                 'Receiver route value 0x0101 is indeterminate and cannot override observed keyboard '
                                 'activity.'],
-               'revision': 3,
-               'runtime_sha256': '8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d',
+               'revision': 4,
+               'runtime_sha256': '31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-deathstalker-v2-pro-tkl-0296.json',
-               'transport': {'lifecycle': {'device_return_settle_ms': 1000,
+               'transport': {'lifecycle': {'device_return_confirmation': {'evidence': 'battery-report',
+                                                                          'settle_ms': 250},
+                                           'device_return_settle_ms': 5000,
                                            'power_off_departure_evidence': 'receiver-state'},
                              'lighting': {'application_index_to_carrier': [0,
                                                                            1,
@@ -838,7 +842,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27'}
+ 'source_sha256': 'bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 35b5968..9f3c7a1 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
+  "source_sha256": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
 }
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index 41f1e1f..a35b6e1 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -206,6 +206,25 @@ def test_lifecycle_policy_is_bounded_profile_local_and_digest_bound(self) -> Non
             "receiver-state",
         )
 
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        before = _runtime_profile_digest(keyboard, capabilities)
+        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["settle_ms"] = 251
+        _validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
+
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["evidence"] = "activity"
+        with self.assertRaisesRegex(ModelError, "unsupported return confirmation evidence"):
+            _validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["settle_ms"] = 5_000
+        with self.assertRaisesRegex(ModelError, "confirmation must precede"):
+            _validate_profiles(profiles, capabilities, claims)
+
     def test_qualification_migrations_are_exact_and_do_not_change_runtime_identity(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index ca27984..17bd6b9 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -222,9 +222,21 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum DeviceReturnConfirmationEvidence {",
+        "    BatteryReport,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct DeviceReturnConfirmationRecord {",
+        "    pub evidence: DeviceReturnConfirmationEvidence,",
+        "    pub settle_ms: u64,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct LifecyclePolicyRecord {",
         "    pub power_off_departure_evidence: PowerOffDepartureEvidence,",
         "    pub device_return_settle_ms: u64,",
+        "    pub device_return_confirmation: Option<DeviceReturnConfirmationRecord>,",
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
@@ -363,11 +375,24 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         lifecycle = profile.get("transport", {}).get("lifecycle")
         if lifecycle:
             departure = _variant(lifecycle["power_off_departure_evidence"])
+            confirmation = lifecycle.get("device_return_confirmation")
+            if confirmation:
+                confirmation_evidence = _variant(confirmation["evidence"])
+                confirmation_lines = [
+                    "            device_return_confirmation: Some(DeviceReturnConfirmationRecord {",
+                    "                evidence: DeviceReturnConfirmationEvidence::"
+                    f"{confirmation_evidence},",
+                    f"                settle_ms: {confirmation['settle_ms']},",
+                    "            }),",
+                ]
+            else:
+                confirmation_lines = ["            device_return_confirmation: None,"]
             lifecycle_lines = [
                 "        lifecycle: Some(LifecyclePolicyRecord {",
                 "            power_off_departure_evidence: "
                 f"PowerOffDepartureEvidence::{departure},",
                 f"            device_return_settle_ms: {lifecycle['device_return_settle_ms']},",
+                *confirmation_lines,
                 "        }),",
             ]
         else:
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 6fa5bdb..34695fe 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -77,8 +77,15 @@
 LIFECYCLE_KEYS = {
     "power_off_departure_evidence",
     "device_return_settle_ms",
+    "device_return_confirmation",
+}
+LIFECYCLE_REQUIRED_KEYS = {
+    "power_off_departure_evidence",
+    "device_return_settle_ms",
 }
 POWER_OFF_DEPARTURE_EVIDENCE = {"receiver-state", "watched-retained-route"}
+DEVICE_RETURN_CONFIRMATION_KEYS = {"evidence", "settle_ms"}
+DEVICE_RETURN_CONFIRMATION_EVIDENCE = {"battery-report"}
 MAX_DEVICE_RETURN_SETTLE_MS = 30_000
 QUALIFICATION_MIGRATION_KEYS = {"from_runtime_sha256", "preserve_stage_roles"}
 QUALIFICATION_MIGRATION_STAGE_ROLES = {"lighting", "map", "telemetry"}
@@ -584,7 +591,7 @@ def _validate_lifecycle_policy(
     if not isinstance(lifecycle, dict):
         raise ModelError(f"{profile['profile_id']}: lifecycle policy must be an object")
     _expect_keys(lifecycle, LIFECYCLE_KEYS, f"{profile['profile_id']} lifecycle policy")
-    missing = sorted(LIFECYCLE_KEYS - set(lifecycle))
+    missing = sorted(LIFECYCLE_REQUIRED_KEYS - set(lifecycle))
     if missing:
         raise ModelError(
             f"{profile['profile_id']}: incomplete lifecycle policy: {', '.join(missing)}"
@@ -612,6 +619,44 @@ def _validate_lifecycle_policy(
             raise ModelError(
                 f"{profile['profile_id']}: retained-route return requires a positive settle time"
             )
+    confirmation = lifecycle.get("device_return_confirmation")
+    if confirmation is None:
+        return
+    if not isinstance(confirmation, dict):
+        raise ModelError(
+            f"{profile['profile_id']}: device-return confirmation must be an object or null"
+        )
+    _expect_keys(
+        confirmation,
+        DEVICE_RETURN_CONFIRMATION_KEYS,
+        f"{profile['profile_id']} device-return confirmation",
+    )
+    missing = sorted(DEVICE_RETURN_CONFIRMATION_KEYS - set(confirmation))
+    if missing:
+        raise ModelError(
+            f"{profile['profile_id']}: incomplete device-return confirmation: "
+            f"{', '.join(missing)}"
+        )
+    evidence = confirmation["evidence"]
+    if evidence not in DEVICE_RETURN_CONFIRMATION_EVIDENCE:
+        raise ModelError(f"{profile['profile_id']}: unsupported return confirmation evidence")
+    confirmation_settle_ms = confirmation["settle_ms"]
+    if (
+        isinstance(confirmation_settle_ms, bool)
+        or not isinstance(confirmation_settle_ms, int)
+        or not 0 <= confirmation_settle_ms <= MAX_DEVICE_RETURN_SETTLE_MS
+    ):
+        raise ModelError(
+            f"{profile['profile_id']}: return confirmation settle time is out of bounds"
+        )
+    if settle_ms == 0 or confirmation_settle_ms >= settle_ms:
+        raise ModelError(
+            f"{profile['profile_id']}: confirmation must precede a positive return fallback"
+        )
+    if evidence == "battery-report" and not isinstance(passive, dict):
+        raise ModelError(
+            f"{profile['profile_id']}: battery confirmation requires a passive decoder"
+        )
 
 
 def _validate_qualification_migrations(

From 037423b7802ea6741a16fbc349cb9e682f3d7d2b Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 08:44:32 +0400
Subject: [PATCH 26/67] test: refresh qualification profile fixtures

---
 .../tests/fixtures/rust-qualified-mouse.json                | 2 +-
 .../tests/fixtures/rust-qualified-pair.json                 | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index f2ff158..57ddaf4 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
+    "profile_catalog_digest": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 9feb166..72a0791 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "2d492c62e9b7dfbe6cd037161ae7cee8737875f36835fe3436d93707e77aba27"
+    "profile_catalog_digest": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
   },
   "receivers": [
     {
@@ -127,7 +127,7 @@
           "product_id": 662,
           "profile": {
             "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-            "digest": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
+            "digest": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -444,7 +444,7 @@
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-        "digest": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
+        "digest": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",

From 758fc8f01445b1db8a0875891904257f90e6b9da Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 09:31:08 +0400
Subject: [PATCH 27/67] fix: reassert confirmed device returns

---
 .../tests/fixtures/rust-qualified-mouse.json  |   2 +-
 .../tests/fixtures/rust-qualified-pair.json   |   6 +-
 crates/hfx-daemon/src/manager.rs              |  22 +-
 crates/hfx-daemon/src/observation.rs          |  73 +-
 crates/hfx-daemon/src/restoration.rs          | 676 +++++++++++++++++-
 crates/hfx-profiles/src/generated.rs          |  14 +-
 crates/hfx-profiles/tests/catalog.rs          |  34 +-
 docs/generated/supported-hardware.md          |   4 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  15 +-
 .../razer-deathstalker-v2-pro-tkl-0296.json   |   5 +-
 schemas/hardware-profile.schema.json          |   5 +-
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  13 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_profiles.py                        |  17 +
 tools/hfxdev/generators/profiles.py           |   3 +
 tools/hfxdev/profiles.py                      |   6 +-
 19 files changed, 806 insertions(+), 101 deletions(-)

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 57ddaf4..e7836fa 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
+    "profile_catalog_digest": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 72a0791..7d5779f 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
+    "profile_catalog_digest": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
   },
   "receivers": [
     {
@@ -127,7 +127,7 @@
           "product_id": 662,
           "profile": {
             "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-            "digest": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb"
+            "digest": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -444,7 +444,7 @@
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-        "digest": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb"
+        "digest": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index 949d069..5a051d5 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -465,22 +465,26 @@ impl LinuxRuntimeManager {
             let sequence =
                 SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?;
             match readiness.phase {
-                DeviceRestoreReadinessPhase::Timed => self.restoration.schedule_device_return_at(
-                    receiver_id.clone(),
-                    generation_id,
-                    readiness.device_id,
-                    sequence,
-                    backend.now(),
-                    readiness.settle_ms,
-                ),
+                DeviceRestoreReadinessPhase::Timed => {
+                    self.restoration.schedule_device_return_with_policy_at(
+                        receiver_id.clone(),
+                        generation_id,
+                        readiness.device_id,
+                        sequence,
+                        backend.now(),
+                        readiness.settle_ms,
+                        readiness.reassert_at_fallback,
+                    )
+                }
                 DeviceRestoreReadinessPhase::Confirmed => {
-                    self.restoration.confirm_device_return_at(
+                    self.restoration.confirm_device_return_with_policy_at(
                         receiver_id.clone(),
                         generation_id,
                         readiness.device_id,
                         sequence,
                         backend.now(),
                         readiness.settle_ms,
+                        readiness.reassert_at_fallback,
                     )
                 }
             }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index bb5ba6c..c6abf70 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -42,6 +42,7 @@ pub struct DeviceRestoreReadiness {
     pub device_id: LogicalDeviceId,
     pub settle_ms: u64,
     pub phase: DeviceRestoreReadinessPhase,
+    pub reassert_at_fallback: bool,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -74,6 +75,7 @@ impl PassiveTranslation {
         device_id: LogicalDeviceId,
         settle_ms: u64,
         phase: DeviceRestoreReadinessPhase,
+        reassert_at_fallback: bool,
     ) -> Self {
         Self {
             disposition: PassiveDisposition::Applied,
@@ -82,6 +84,7 @@ impl PassiveTranslation {
                 device_id,
                 settle_ms,
                 phase,
+                reassert_at_fallback,
             }),
         }
     }
@@ -390,14 +393,13 @@ impl PassiveObservationTranslator {
             binding.last_activity_ms = Some(observed_at_ms);
         }
         let readiness = restore_ready.then(|| {
-            let settle_ms = binding
-                .lifecycle
-                .map_or(0, |policy| policy.device_return_settle_ms);
-            if binding
-                .lifecycle
-                .and_then(|policy| policy.device_return_confirmation)
-                .is_some()
-            {
+            let (settle_ms, confirmation) = binding.lifecycle.map_or((0, None), |policy| {
+                (
+                    policy.device_return_settle_ms,
+                    policy.device_return_confirmation,
+                )
+            });
+            if confirmation.is_some() {
                 let deadline = observed_at_ms.get().saturating_add(settle_ms);
                 binding.return_confirmation_deadline_ms = MonotonicMs::try_from(deadline).ok();
             } else {
@@ -407,6 +409,7 @@ impl PassiveObservationTranslator {
                 binding.device_id.clone(),
                 settle_ms,
                 DeviceRestoreReadinessPhase::Timed,
+                confirmation.is_some_and(|policy| policy.reassert_at_fallback),
             )
         });
         let binding = binding.clone();
@@ -433,11 +436,19 @@ impl PassiveObservationTranslator {
                 EndpointFact::Freshness(FreshnessState::Fresh),
             ),
         ];
-        Ok(if let Some((device_id, settle_ms, phase)) = readiness {
-            PassiveTranslation::restore_ready(observations, device_id, settle_ms, phase)
-        } else {
-            PassiveTranslation::applied(observations)
-        })
+        Ok(
+            if let Some((device_id, settle_ms, phase, reassert_at_fallback)) = readiness {
+                PassiveTranslation::restore_ready(
+                    observations,
+                    device_id,
+                    settle_ms,
+                    phase,
+                    reassert_at_fallback,
+                )
+            } else {
+                PassiveTranslation::applied(observations)
+            },
+        )
     }
 
     fn battery(
@@ -464,7 +475,7 @@ impl PassiveObservationTranslator {
                     .map_err(|_| PassiveTranslationError::InvalidObservationValue)?
             }
         };
-        let confirmation_settle_ms = binding
+        let confirmation = binding
             .lifecycle
             .and_then(|policy| policy.device_return_confirmation)
             .filter(|confirmation| {
@@ -474,7 +485,7 @@ impl PassiveObservationTranslator {
                 binding
                     .return_confirmation_deadline_ms
                     .filter(|deadline| stamp.observed_at_ms() <= *deadline)
-                    .map(|_| confirmation.settle_ms)
+                    .map(|_| (confirmation.settle_ms, confirmation.reassert_at_fallback))
             });
         binding.return_confirmation_deadline_ms = None;
         let binding = binding.clone();
@@ -488,16 +499,19 @@ impl PassiveObservationTranslator {
         if passive.report_implies_route_available {
             observations.extend(self.route_observations(&binding, stamp, RouteState::Available));
         }
-        Ok(if let Some(settle_ms) = confirmation_settle_ms {
-            PassiveTranslation::restore_ready(
-                observations,
-                binding.device_id,
-                settle_ms,
-                DeviceRestoreReadinessPhase::Confirmed,
-            )
-        } else {
-            PassiveTranslation::applied(observations)
-        })
+        Ok(
+            if let Some((settle_ms, reassert_at_fallback)) = confirmation {
+                PassiveTranslation::restore_ready(
+                    observations,
+                    binding.device_id,
+                    settle_ms,
+                    DeviceRestoreReadinessPhase::Confirmed,
+                    reassert_at_fallback,
+                )
+            } else {
+                PassiveTranslation::applied(observations)
+            },
+        )
     }
 
     fn contact(&self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
@@ -947,6 +961,13 @@ mod tests {
                 .map(|readiness| readiness.phase),
             Some(DeviceRestoreReadinessPhase::Timed)
         );
+        assert_eq!(
+            first
+                .restore_ready
+                .as_ref()
+                .map(|readiness| readiness.reassert_at_fallback),
+            Some(false)
+        );
 
         let resumed = translator
             .translate(activity(
@@ -991,6 +1012,7 @@ mod tests {
             .expect("keyboard activity schedules a fallback");
         assert_eq!(readiness.settle_ms, 5_000);
         assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Timed);
+        assert!(readiness.reassert_at_fallback);
 
         let confirmed = translator
             .translate(raw_at(
@@ -1006,6 +1028,7 @@ mod tests {
             .expect("the first fresh battery report confirms the child route");
         assert_eq!(readiness.settle_ms, 250);
         assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Confirmed);
+        assert!(readiness.reassert_at_fallback);
 
         let repeated = translator
             .translate(raw_at(
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 775aeb1..a91dddd 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -67,6 +67,20 @@ struct ScheduledTrigger {
     trigger: RestoreTrigger,
     due: MonotonicMs,
     sequence: Option<SequenceNumber>,
+    purpose: ScheduledTriggerPurpose,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum ScheduledTriggerPurpose {
+    Primary,
+    Reassertion,
+}
+
+#[derive(Clone, Copy, Debug)]
+struct DeviceReturnWindow {
+    fallback_due: MonotonicMs,
+    sequence: SequenceNumber,
+    confirmed: bool,
 }
 
 #[derive(Clone, Debug)]
@@ -184,6 +198,7 @@ pub struct RestorationScheduler {
     max_claims: usize,
     configured_receivers: BTreeSet<ReceiverId>,
     ready_devices: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), MonotonicMs>,
+    return_windows: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), DeviceReturnWindow>,
     triggers: BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     claims: BTreeMap<RestoreClaimId, ScheduledClaim>,
 }
@@ -248,6 +263,7 @@ impl RestorationScheduler {
             max_claims,
             configured_receivers: BTreeSet::new(),
             ready_devices: BTreeMap::new(),
+            return_windows: BTreeMap::new(),
             triggers: BTreeMap::new(),
             claims: BTreeMap::new(),
         })
@@ -373,12 +389,74 @@ impl RestorationScheduler {
         scheduled_at: MonotonicMs,
         settle_ms: u64,
     ) -> Result<(), RestorationScheduleError> {
+        self.schedule_device_return_with_policy_at(
+            receiver_id,
+            generation_id,
+            device_id,
+            sequence,
+            scheduled_at,
+            settle_ms,
+            false,
+        )
+    }
+
+    /// Enqueues one exact return and records whether stronger child evidence
+    /// should preserve one bounded late reassertion at the original fallback.
+    /// The policy is generated from the matching child profile.
+    ///
+    /// # Errors
+    ///
+    /// Returns a time, trigger-capacity, or generated-identity failure.
+    #[allow(clippy::too_many_arguments)]
+    pub fn schedule_device_return_with_policy_at(
+        &mut self,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        device_id: LogicalDeviceId,
+        sequence: SequenceNumber,
+        scheduled_at: MonotonicMs,
+        settle_ms: u64,
+        reassert_at_fallback: bool,
+    ) -> Result<(), RestorationScheduleError> {
+        if !self.enabled {
+            return Ok(());
+        }
         let due = due_after(scheduled_at, settle_ms)?;
         let readiness = (receiver_id.clone(), generation_id, device_id.clone());
         self.ready_devices
-            .entry(readiness)
+            .entry(readiness.clone())
             .and_modify(|existing| *existing = (*existing).max(due))
             .or_insert(due);
+        if reassert_at_fallback {
+            let replace_window = self
+                .return_windows
+                .get(&readiness)
+                .is_none_or(|window| sequence > window.sequence);
+            if replace_window {
+                self.remove_device_return_triggers(
+                    &receiver_id,
+                    generation_id,
+                    &device_id,
+                    Some(ScheduledTriggerPurpose::Reassertion),
+                );
+                self.return_windows.insert(
+                    readiness,
+                    DeviceReturnWindow {
+                        fallback_due: due,
+                        sequence,
+                        confirmed: false,
+                    },
+                );
+            }
+        } else {
+            self.return_windows.remove(&readiness);
+            self.remove_device_return_triggers(
+                &receiver_id,
+                generation_id,
+                &device_id,
+                Some(ScheduledTriggerPurpose::Reassertion),
+            );
+        }
         self.schedule_at(
             RestoreTriggerKind::DeviceReturn,
             receiver_id,
@@ -404,19 +482,62 @@ impl RestorationScheduler {
         sequence: SequenceNumber,
         confirmed_at: MonotonicMs,
         settle_ms: u64,
+    ) -> Result<(), RestorationScheduleError> {
+        self.confirm_device_return_with_policy_at(
+            receiver_id,
+            generation_id,
+            device_id,
+            sequence,
+            confirmed_at,
+            settle_ms,
+            false,
+        )
+    }
+
+    /// Advances one exact pending fallback and, when the generated child
+    /// policy requests it, preserves one late reassertion at the original
+    /// deadline. Repeated confirmations are idempotent.
+    ///
+    /// # Errors
+    ///
+    /// Returns a time, trigger-capacity, or generated-identity failure.
+    #[allow(clippy::too_many_arguments)]
+    pub fn confirm_device_return_with_policy_at(
+        &mut self,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        device_id: LogicalDeviceId,
+        sequence: SequenceNumber,
+        confirmed_at: MonotonicMs,
+        settle_ms: u64,
+        reassert_at_fallback: bool,
     ) -> Result<(), RestorationScheduleError> {
         if !self.enabled {
             return Ok(());
         }
-        let due = due_after(confirmed_at, settle_ms)?;
+        let confirmed_due = due_after(confirmed_at, settle_ms)?;
         let readiness = (receiver_id.clone(), generation_id, device_id.clone());
-        let due = *self
+        let fallback_due = if reassert_at_fallback {
+            let Some(window) = self.return_windows.get(&readiness) else {
+                return Ok(());
+            };
+            if sequence < window.sequence || window.confirmed {
+                return Ok(());
+            }
+            Some(window.fallback_due)
+        } else {
+            None
+        };
+        let due = self
             .ready_devices
-            .entry(readiness)
-            .and_modify(|existing| *existing = (*existing).min(due))
-            .or_insert(due);
-
-        let woke = self.wake_earlier(&receiver_id, generation_id, &device_id, due);
+            .get(&readiness)
+            .map_or(confirmed_due, |existing| (*existing).min(confirmed_due));
+        let has_matching_claim = self.claims.values().any(|claim| {
+            claim.receiver_id == receiver_id
+                && claim.generation_id == generation_id
+                && claim.device_id == device_id
+        });
+        let has_broad_trigger = self.has_pending_broad_trigger(&receiver_id, generation_id);
         let matching_triggers = self
             .triggers
             .iter()
@@ -424,24 +545,72 @@ impl RestorationScheduler {
                 (scheduled.trigger.receiver_id == receiver_id
                     && scheduled.trigger.generation_id == generation_id
                     && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
-                    && scheduled.trigger.target_device_id.as_ref() == Some(&device_id))
-                .then_some(trigger_id.clone())
+                    && scheduled.trigger.target_device_id.as_ref() == Some(&device_id)
+                    && scheduled.purpose == ScheduledTriggerPurpose::Primary)
+                    .then_some(trigger_id.clone())
             })
             .collect::<Vec<_>>();
+        let has_reassertion = self.triggers.values().any(|scheduled| {
+            scheduled.trigger.receiver_id == receiver_id
+                && scheduled.trigger.generation_id == generation_id
+                && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
+                && scheduled.trigger.target_device_id.as_ref() == Some(&device_id)
+                && scheduled.purpose == ScheduledTriggerPurpose::Reassertion
+        });
+        let needs_primary = !has_matching_claim && !has_broad_trigger;
+        let needs_reassertion = fallback_due.is_some_and(|fallback| fallback > due);
+        let remaining = self.triggers.len().saturating_sub(matching_triggers.len());
+        let additions =
+            usize::from(needs_primary) + usize::from(needs_reassertion && !has_reassertion);
+        if remaining
+            .checked_add(additions)
+            .is_none_or(|total| total > self.max_triggers)
+        {
+            return Err(RestorationScheduleError::TriggerCapacity);
+        }
+
+        if reassert_at_fallback {
+            self.return_windows
+                .get_mut(&readiness)
+                .ok_or(RestorationScheduleError::Identifier)?
+                .confirmed = true;
+        }
+        self.ready_devices.insert(readiness.clone(), due);
+        let woke = self.wake_earlier(&receiver_id, generation_id, &device_id, due);
+        debug_assert_eq!(woke > 0, has_matching_claim);
         for trigger_id in matching_triggers {
             self.triggers.remove(&trigger_id);
         }
-        if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
-            return Ok(());
+        if needs_primary {
+            self.schedule_at(
+                RestoreTriggerKind::DeviceReturn,
+                receiver_id.clone(),
+                generation_id,
+                Some(device_id.clone()),
+                Some(sequence),
+                due,
+            )?;
         }
-        self.schedule_at(
-            RestoreTriggerKind::DeviceReturn,
-            receiver_id,
-            generation_id,
-            Some(device_id),
-            Some(sequence),
-            due,
-        )
+        if let Some(fallback_due) = fallback_due.filter(|fallback| *fallback > due) {
+            self.schedule_at_with_purpose(
+                RestoreTriggerKind::DeviceReturn,
+                receiver_id,
+                generation_id,
+                Some(device_id),
+                Some(sequence),
+                fallback_due,
+                ScheduledTriggerPurpose::Reassertion,
+            )?;
+        } else if reassert_at_fallback {
+            self.return_windows.remove(&readiness);
+            self.remove_device_return_triggers(
+                &receiver_id,
+                generation_id,
+                &device_id,
+                Some(ScheduledTriggerPurpose::Reassertion),
+            );
+        }
+        Ok(())
     }
 
     pub fn retire_generation(&mut self, receiver_id: &ReceiverId, generation_id: GenerationId) {
@@ -455,6 +624,9 @@ impl RestorationScheduler {
         self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
+        self.return_windows.retain(|(candidate, generation, _), _| {
+            candidate != receiver_id || *generation != generation_id
+        });
     }
 
     /// Advances at most the generated number of due claims and one due trigger.
@@ -504,6 +676,20 @@ impl RestorationScheduler {
                 .triggers
                 .remove(&trigger_id)
                 .ok_or(RestorationScheduleError::Identifier)?;
+            if let Some(device_id) = scheduled.trigger.target_device_id.as_ref() {
+                let readiness = (
+                    scheduled.trigger.receiver_id.clone(),
+                    scheduled.trigger.generation_id,
+                    device_id.clone(),
+                );
+                if scheduled.purpose == ScheduledTriggerPurpose::Reassertion
+                    || self.return_windows.get(&readiness).is_some_and(|window| {
+                        !window.confirmed && window.fallback_due <= scheduled.due
+                    })
+                {
+                    self.return_windows.remove(&readiness);
+                }
+            }
             let newly_configured = !self
                 .configured_receivers
                 .contains(&scheduled.trigger.receiver_id);
@@ -540,8 +726,10 @@ impl RestorationScheduler {
                         for record in recovered {
                             self.schedule_record(record, now)?;
                         }
-                        scheduled.due = due_after(now, self.retry_interval_ms)?;
-                        self.triggers.insert(trigger_id, scheduled);
+                        if scheduled.purpose == ScheduledTriggerPurpose::Primary {
+                            scheduled.due = due_after(now, self.retry_interval_ms)?;
+                            self.triggers.insert(trigger_id, scheduled);
+                        }
                     }
                     Err(error) => return Err(error.into()),
                 }
@@ -658,10 +846,37 @@ impl RestorationScheduler {
         target_device_id: Option<LogicalDeviceId>,
         sequence: Option<SequenceNumber>,
         due: MonotonicMs,
+    ) -> Result<(), RestorationScheduleError> {
+        self.schedule_at_with_purpose(
+            kind,
+            receiver_id,
+            generation_id,
+            target_device_id,
+            sequence,
+            due,
+            ScheduledTriggerPurpose::Primary,
+        )
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    fn schedule_at_with_purpose(
+        &mut self,
+        kind: RestoreTriggerKind,
+        receiver_id: ReceiverId,
+        generation_id: GenerationId,
+        target_device_id: Option<LogicalDeviceId>,
+        sequence: Option<SequenceNumber>,
+        due: MonotonicMs,
+        purpose: ScheduledTriggerPurpose,
     ) -> Result<(), RestorationScheduleError> {
         if !self.enabled {
             return Ok(());
         }
+        if purpose == ScheduledTriggerPurpose::Reassertion
+            && kind != RestoreTriggerKind::DeviceReturn
+        {
+            return Err(RestorationScheduleError::InvalidConfiguration);
+        }
         if is_broad_trigger(kind) {
             let woke = if readiness_gated_trigger(kind) {
                 self.park(&receiver_id, generation_id, None)?;
@@ -677,7 +892,9 @@ impl RestorationScheduler {
             if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
                 return Ok(());
             }
-        } else if kind == RestoreTriggerKind::DeviceReturn {
+        } else if kind == RestoreTriggerKind::DeviceReturn
+            && purpose == ScheduledTriggerPurpose::Primary
+        {
             let woke = self.wake(&receiver_id, generation_id, target_device_id.as_ref(), due);
             if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
                 return Ok(());
@@ -686,7 +903,8 @@ impl RestorationScheduler {
                 (scheduled.trigger.receiver_id == receiver_id
                     && scheduled.trigger.generation_id == generation_id
                     && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
-                    && scheduled.trigger.target_device_id == target_device_id)
+                    && scheduled.trigger.target_device_id == target_device_id
+                    && scheduled.purpose == ScheduledTriggerPurpose::Primary)
                     .then(|| (trigger_id.clone(), scheduled.sequence))
             });
             if let Some((existing_id, existing_sequence)) = same_scope {
@@ -695,6 +913,21 @@ impl RestorationScheduler {
                 }
                 self.triggers.remove(&existing_id);
             }
+        } else if kind == RestoreTriggerKind::DeviceReturn {
+            let same_scope = self.triggers.iter().find_map(|(trigger_id, scheduled)| {
+                (scheduled.trigger.receiver_id == receiver_id
+                    && scheduled.trigger.generation_id == generation_id
+                    && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
+                    && scheduled.trigger.target_device_id == target_device_id
+                    && scheduled.purpose == ScheduledTriggerPurpose::Reassertion)
+                    .then(|| (trigger_id.clone(), scheduled.due))
+            });
+            if let Some((existing_id, existing_due)) = same_scope {
+                if existing_due <= due {
+                    return Ok(());
+                }
+                self.triggers.remove(&existing_id);
+            }
         }
         let trigger_id = trigger_id(
             kind,
@@ -703,6 +936,7 @@ impl RestorationScheduler {
             target_device_id.as_ref(),
             sequence,
             (kind == RestoreTriggerKind::ServiceStart).then_some(&self.process_nonce),
+            purpose,
         )?;
         if self.triggers.contains_key(&trigger_id) {
             return Ok(());
@@ -722,6 +956,7 @@ impl RestorationScheduler {
                 },
                 due,
                 sequence,
+                purpose,
             },
         );
         Ok(())
@@ -877,6 +1112,30 @@ impl RestorationScheduler {
         self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
+        self.return_windows.retain(|(candidate, generation, _), _| {
+            candidate != receiver_id || *generation != generation_id
+        });
+        self.triggers.retain(|_, scheduled| {
+            scheduled.trigger.receiver_id != *receiver_id
+                || scheduled.trigger.generation_id != generation_id
+                || scheduled.trigger.kind != RestoreTriggerKind::DeviceReturn
+        });
+    }
+
+    fn remove_device_return_triggers(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: &LogicalDeviceId,
+        purpose: Option<ScheduledTriggerPurpose>,
+    ) {
+        self.triggers.retain(|_, scheduled| {
+            scheduled.trigger.receiver_id != *receiver_id
+                || scheduled.trigger.generation_id != generation_id
+                || scheduled.trigger.kind != RestoreTriggerKind::DeviceReturn
+                || scheduled.trigger.target_device_id.as_ref() != Some(device_id)
+                || purpose.is_some_and(|purpose| scheduled.purpose != purpose)
+        });
     }
 }
 
@@ -974,6 +1233,7 @@ fn trigger_id(
     target_device_id: Option<&LogicalDeviceId>,
     sequence: Option<SequenceNumber>,
     process_nonce: Option<&[u8; 32]>,
+    purpose: ScheduledTriggerPurpose,
 ) -> Result<RestoreTriggerId, RestorationScheduleError> {
     let mut digest = Sha256::new();
     digest.update(b"hyperflux-restoration-trigger-v1\0");
@@ -989,6 +1249,9 @@ fn trigger_id(
     if let Some(nonce) = process_nonce {
         digest.update(nonce);
     }
+    if purpose == ScheduledTriggerPurpose::Reassertion {
+        digest_field(&mut digest, b"device-return-reassertion")?;
+    }
     let encoded = digest
         .finalize()
         .iter()
@@ -2139,6 +2402,371 @@ mod tests {
         );
     }
 
+    #[test]
+    fn confirmed_return_preserves_one_late_reassertion_without_touching_a_sibling() {
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("keyboard fallback schedules");
+        scheduler
+            .schedule_device_return_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(1_000),
+                4_000,
+            )
+            .expect("mouse return schedules independently");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(12_u64).expect("sequence"),
+                time(2_900),
+                250,
+                true,
+            )
+            .expect("keyboard confirmation advances one attempt");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(13_u64).expect("sequence"),
+                time(3_000),
+                250,
+                true,
+            )
+            .expect("repeated keyboard confirmation is idempotent");
+
+        let mut keyboard = scheduler
+            .triggers
+            .values()
+            .filter(|scheduled| {
+                scheduled.trigger.target_device_id.as_ref() == Some(&id("keyboard-1"))
+            })
+            .collect::<Vec<_>>();
+        keyboard.sort_by_key(|scheduled| scheduled.due);
+        assert_eq!(keyboard.len(), 2);
+        assert_eq!(keyboard[0].due, time(3_150));
+        assert_eq!(keyboard[0].purpose, ScheduledTriggerPurpose::Primary);
+        assert_eq!(keyboard[1].due, time(6_000));
+        assert_eq!(keyboard[1].purpose, ScheduledTriggerPurpose::Reassertion);
+
+        let mouse = scheduler
+            .triggers
+            .values()
+            .find(|scheduled| scheduled.trigger.target_device_id.as_ref() == Some(&id("mouse-1")))
+            .expect("mouse trigger remains present");
+        assert_eq!(mouse.due, time(5_000));
+        assert_eq!(mouse.purpose, ScheduledTriggerPurpose::Primary);
+        assert_eq!(scheduler.triggers.len(), 3);
+    }
+
+    #[test]
+    fn two_stage_confirmation_fails_atomically_when_trigger_capacity_is_exhausted() {
+        let mut scheduler = RestorationScheduler::new(
+            true,
+            Some(session()),
+            [0x55; 32],
+            LeaseDurationMs::try_from(10_000_u32).expect("lease"),
+            30_000,
+            1_000,
+            4,
+            1,
+            2,
+        )
+        .expect("bounded scheduler");
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("one fallback fits");
+
+        assert_eq!(
+            scheduler.confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+                true,
+            ),
+            Err(RestorationScheduleError::TriggerCapacity)
+        );
+
+        assert_eq!(scheduler.triggers.len(), 1);
+        let trigger = scheduler
+            .triggers
+            .values()
+            .next()
+            .expect("fallback remains");
+        assert_eq!(trigger.due, time(6_000));
+        assert_eq!(trigger.purpose, ScheduledTriggerPurpose::Primary);
+        let readiness = (id("receiver-1"), generation(1), id("keyboard-1"));
+        assert_eq!(scheduler.ready_devices.get(&readiness), Some(&time(6_000)));
+        assert!(
+            !scheduler
+                .return_windows
+                .get(&readiness)
+                .expect("window remains")
+                .confirmed
+        );
+    }
+
+    #[test]
+    fn unconfirmed_return_keeps_only_its_original_fallback() {
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("keyboard fallback schedules");
+
+        assert_eq!(scheduler.triggers.len(), 1);
+        let trigger = scheduler.triggers.values().next().expect("one fallback");
+        assert_eq!(trigger.due, time(6_000));
+        assert_eq!(trigger.purpose, ScheduledTriggerPurpose::Primary);
+
+        let mut controller = FakeController {
+            now: time(6_000),
+            plans: vec![Ok(RestorePlanResult::NoStableIntents)],
+            pending: Vec::new(),
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        scheduler
+            .process_due_trigger(
+                &mut controller,
+                time(6_000),
+                &mut RestorationTickReport::default(),
+            )
+            .expect("the original fallback is consumed once");
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.return_windows.is_empty());
+    }
+
+    #[test]
+    fn suspend_and_generation_retirement_clear_both_return_stages() {
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("keyboard fallback schedules");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+                true,
+            )
+            .expect("keyboard confirmation schedules both stages");
+        scheduler
+            .schedule_system_suspend(&id("receiver-1"), generation(1))
+            .expect("suspend invalidates the return window");
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.ready_devices.is_empty());
+        assert!(scheduler.return_windows.is_empty());
+
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(2),
+                id("keyboard-1"),
+                SequenceNumber::try_from(12_u64).expect("sequence"),
+                time(7_000),
+                5_000,
+                true,
+            )
+            .expect("new-generation fallback schedules");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(2),
+                id("keyboard-1"),
+                SequenceNumber::try_from(13_u64).expect("sequence"),
+                time(8_000),
+                250,
+                true,
+            )
+            .expect("new-generation confirmation schedules");
+        scheduler.retire_generation(&id("receiver-1"), generation(2));
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.ready_devices.is_empty());
+        assert!(scheduler.return_windows.is_empty());
+    }
+
+    #[test]
+    fn terminal_early_restore_allows_exactly_one_late_reassertion() {
+        let early = record_for_device("claim-early", "keyboard-1", RestoreRecordStatus::Planned);
+        let late = record_for_device("claim-late", "keyboard-1", RestoreRecordStatus::Planned);
+        let early_terminal = record_for_device(
+            "claim-early",
+            "keyboard-1",
+            RestoreRecordStatus::Invalidated(hfx_core::RestoreInvalidation {
+                reason: hfx_domain::RestoreInvalidationReason::IntentChanged,
+            }),
+        );
+        let late_terminal = record_for_device(
+            "claim-late",
+            "keyboard-1",
+            RestoreRecordStatus::Invalidated(hfx_core::RestoreInvalidation {
+                reason: hfx_domain::RestoreInvalidationReason::IntentChanged,
+            }),
+        );
+        let mut controller = FakeController {
+            now: time(3_150),
+            plans: vec![
+                Ok(RestorePlanResult::Planned(vec![early.clone()])),
+                Ok(RestorePlanResult::Planned(vec![late.clone()])),
+            ],
+            pending: Vec::new(),
+            advances: vec![
+                Ok(RestoreAdvanceResult::Queued(early)),
+                Ok(RestoreAdvanceResult::Queued(late)),
+            ],
+            dispatches: vec![Ok(early_terminal), Ok(late_terminal)],
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("fallback schedules");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+                true,
+            )
+            .expect("confirmation schedules both stages");
+
+        let early_report = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("early restore completes");
+        assert_eq!(early_report.triggers_planned, 1);
+        assert_eq!(early_report.claims_terminal, 1);
+        assert_eq!(scheduler.triggers.len(), 1);
+
+        controller.now = time(6_000);
+        let late_report = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("late reassertion completes");
+        assert_eq!(late_report.triggers_planned, 1);
+        assert_eq!(late_report.claims_terminal, 1);
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.return_windows.is_empty());
+        assert_eq!(controller.dispatch_calls, 2);
+    }
+
+    #[test]
+    fn late_reassertion_recovers_an_unfinished_early_claim_without_a_third_trigger() {
+        let early = record_for_device("claim-early", "keyboard-1", RestoreRecordStatus::Planned);
+        let mut controller = FakeController {
+            now: time(3_150),
+            plans: vec![
+                Ok(RestorePlanResult::Planned(vec![early.clone()])),
+                Err(RestorationError::PriorClaimUnresolved),
+            ],
+            pending: Vec::new(),
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                5_000,
+                true,
+            )
+            .expect("fallback schedules");
+        scheduler
+            .confirm_device_return_with_policy_at(
+                id("receiver-1"),
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(11_u64).expect("sequence"),
+                time(2_900),
+                250,
+                true,
+            )
+            .expect("confirmation schedules both stages");
+
+        scheduler
+            .process_due_trigger(
+                &mut controller,
+                time(3_150),
+                &mut RestorationTickReport::default(),
+            )
+            .expect("early claim plans but remains unfinished");
+        controller.pending = vec![early];
+        let mut report = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, time(6_000), &mut report)
+            .expect("late reassertion recovers the early claim");
+
+        assert_eq!(report.claims_recovered, 1);
+        assert_eq!(scheduler.claims.len(), 1);
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.return_windows.is_empty());
+    }
+
     #[test]
     fn deferred_claim_waits_for_backoff_but_device_return_wakes_it() {
         let deferred = record(
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index b391705..2ee326c 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6
+// Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -59,6 +59,7 @@ pub enum DeviceReturnConfirmationEvidence {
 pub struct DeviceReturnConfirmationRecord {
     pub evidence: DeviceReturnConfirmationEvidence,
     pub settle_ms: u64,
+    pub reassert_at_fallback: bool,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -111,7 +112,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6";
+    "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f";
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -283,6 +284,10 @@ const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2];
 const PASSIVE_ROUTE_INDETERMINATE_1: &[u32] = &[257];
 
 const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] = &[
+    QualificationMigrationRecord {
+        from_runtime_sha256: "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    },
     QualificationMigrationRecord {
         from_runtime_sha256: "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
         preserve_stage_roles: &["lighting", "map", "telemetry"],
@@ -401,8 +406,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "child.razer.deathstalker-v2-pro-tkl.0296",
-        runtime_sha256: "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
-        revision: 4,
+        runtime_sha256: "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
+        revision: 5,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Keyboard,
         vendor_id: Some(5426),
@@ -440,6 +445,7 @@ pub const PROFILES: &[ProfileRecord] = &[
             device_return_confirmation: Some(DeviceReturnConfirmationRecord {
                 evidence: DeviceReturnConfirmationEvidence::BatteryReport,
                 settle_ms: 250,
+                reassert_at_fallback: true,
             }),
         }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_1,
diff --git a/crates/hfx-profiles/tests/catalog.rs b/crates/hfx-profiles/tests/catalog.rs
index 76dbf58..839ed0b 100644
--- a/crates/hfx-profiles/tests/catalog.rs
+++ b/crates/hfx-profiles/tests/catalog.rs
@@ -56,23 +56,29 @@ fn receiver_and_children_resolve_independently() {
         DeviceReturnConfirmationEvidence::BatteryReport
     );
     assert_eq!(confirmation.settle_ms, 250);
-    assert_eq!(keyboard.qualification_migrations.len(), 3);
+    assert!(confirmation.reassert_at_fallback);
+    assert_eq!(keyboard.qualification_migrations.len(), 4);
+    let current_migration = keyboard
+        .qualification_migrations
+        .iter()
+        .find(|migration| {
+            migration.from_runtime_sha256
+                == "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb"
+        })
+        .expect("the immediately preceding keyboard profile remains qualified");
     assert_eq!(
-        keyboard.qualification_migrations[0].preserve_stage_roles,
+        current_migration.preserve_stage_roles,
         &["lighting", "map", "telemetry"]
     );
-    assert_eq!(
-        keyboard.qualification_migrations[1].preserve_stage_roles,
-        &["lighting", "map", "telemetry"]
-    );
-    assert_eq!(
-        keyboard.qualification_migrations[1].from_runtime_sha256,
-        "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d"
-    );
-    assert_eq!(
-        keyboard.qualification_migrations[2].preserve_stage_roles,
-        &["lighting", "map"]
-    );
+    let oldest_migration = keyboard
+        .qualification_migrations
+        .iter()
+        .find(|migration| {
+            migration.from_runtime_sha256
+                == "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6"
+        })
+        .expect("the original map qualification remains available");
+    assert_eq!(oldest_migration.preserve_stage_roles, &["lighting", "map"]);
     assert_ne!(mouse.id, keyboard.id);
 }
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 2b47a4f..ae1abba 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6`
+Profile source: `cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -11,7 +11,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `1a9dde39c257` | 7 | 7 |
-| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `31f80ff672cb` | 6 | 7 |
+| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `133bcdf39640` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index b744856..8ddb01b 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6 */
+/* Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 55a85f0..0c0f0c6 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "2a99386fed3b579533e638b54f5c67419f413645b9e2a7e962e08fe18062d8e2",
+  "source_sha256": "c6cfe3c3fc0e88643948be4e8d9961a6f4c6a280042b7d6d1dcb0a3568216e4a",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index 4969a44..ed140f2 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1100,6 +1100,14 @@
       },
       "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
       "qualification_migrations": [
+        {
+          "from_runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        },
         {
           "from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c",
           "preserve_stage_roles": [
@@ -1130,14 +1138,15 @@
         "External power does not establish a direct USB data route or charging state.",
         "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."
       ],
-      "revision": 4,
-      "runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
+      "revision": 5,
+      "runtime_sha256": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json",
       "transport": {
         "lifecycle": {
           "device_return_confirmation": {
             "evidence": "battery-report",
+            "reassert_at_fallback": true,
             "settle_ms": 250
           },
           "device_return_settle_ms": 5000,
@@ -1416,5 +1425,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
+  "source_sha256": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
 }
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index db0dfd8..f3b57e3 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
-  "revision": 4,
+  "revision": 5,
   "kind": "child",
   "device_kind": "keyboard",
   "identity": {"manufacturer": "Razer", "model_name": "Razer DeathStalker V2 Pro Tenkeyless", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 662},
@@ -16,9 +16,10 @@
       "route": {"available": [0, 3], "unavailable": [2], "indeterminate": [257]},
       "report_implies_route_available": false
     },
-    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 5000, "device_return_confirmation": {"evidence": "battery-report", "settle_ms": 250}}
+    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 5000, "device_return_confirmation": {"evidence": "battery-report", "settle_ms": 250, "reassert_at_fallback": true}}
   },
   "qualification_migrations": [
+    {"from_runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6", "preserve_stage_roles": ["lighting", "map"]}
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 130960a..5002559 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -143,10 +143,11 @@
     "device-return-confirmation": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["evidence", "settle_ms"],
+      "required": ["evidence", "settle_ms", "reassert_at_fallback"],
       "properties": {
         "evidence": {"enum": ["battery-report"]},
-        "settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000}
+        "settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000},
+        "reassert_at_fallback": {"type": "boolean"}
       }
     },
     "qualification-migration": {
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 0a0a662..9c1e02b 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6
+// Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f
 
 #pragma once
 
@@ -66,7 +66,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6";
+inline constexpr std::string_view profile_source_sha256 = "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f";
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -161,7 +161,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", 2, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
-    {"child.razer.deathstalker-v2-pro-tkl.0296", "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb", 4, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
+    {"child.razer.deathstalker-v2-pro-tkl.0296", "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a", 5, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
     {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
 }};
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 52aba6b..5df0d0c 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6'
+PROFILE_SOURCE_SHA256: Final = 'cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -635,7 +635,9 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
-               'qualification_migrations': [{'from_runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
+               'qualification_migrations': [{'from_runtime_sha256': '31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
+                                            {'from_runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
                                             {'from_runtime_sha256': '8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
@@ -646,11 +648,12 @@
                                 'External power does not establish a direct USB data route or charging state.',
                                 'Receiver route value 0x0101 is indeterminate and cannot override observed keyboard '
                                 'activity.'],
-               'revision': 4,
-               'runtime_sha256': '31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb',
+               'revision': 5,
+               'runtime_sha256': '133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-deathstalker-v2-pro-tkl-0296.json',
                'transport': {'lifecycle': {'device_return_confirmation': {'evidence': 'battery-report',
+                                                                          'reassert_at_fallback': True,
                                                                           'settle_ms': 250},
                                            'device_return_settle_ms': 5000,
                                            'power_off_departure_evidence': 'receiver-state'},
@@ -842,7 +845,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6'}
+ 'source_sha256': 'cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 9f3c7a1..2836387 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "bbfc43aa4c8fa261f38e4ada94c074451194b17a97ad5bc39822b2507f8512e6"
+  "source_sha256": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
 }
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index a35b6e1..f2a1e4f 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -213,6 +213,23 @@ def test_lifecycle_policy_is_bounded_profile_local_and_digest_bound(self) -> Non
         _validate_profiles(profiles, capabilities, claims)
         self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
 
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        before = _runtime_profile_digest(keyboard, capabilities)
+        keyboard["transport"]["lifecycle"]["device_return_confirmation"][
+            "reassert_at_fallback"
+        ] = False
+        _validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
+
+        profiles, capabilities, claims = self.validation_copies()
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        keyboard["transport"]["lifecycle"]["device_return_confirmation"][
+            "reassert_at_fallback"
+        ] = 1
+        with self.assertRaisesRegex(ModelError, "fallback reassertion must be boolean"):
+            _validate_profiles(profiles, capabilities, claims)
+
         profiles, capabilities, claims = self.validation_copies()
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
         keyboard["transport"]["lifecycle"]["device_return_confirmation"]["evidence"] = "activity"
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index 17bd6b9..c5f5d16 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -230,6 +230,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "pub struct DeviceReturnConfirmationRecord {",
         "    pub evidence: DeviceReturnConfirmationEvidence,",
         "    pub settle_ms: u64,",
+        "    pub reassert_at_fallback: bool,",
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
@@ -383,6 +384,8 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                     "                evidence: DeviceReturnConfirmationEvidence::"
                     f"{confirmation_evidence},",
                     f"                settle_ms: {confirmation['settle_ms']},",
+                    "                reassert_at_fallback: "
+                    f"{str(confirmation['reassert_at_fallback']).lower()},",
                     "            }),",
                 ]
             else:
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 34695fe..9783b3d 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -84,7 +84,7 @@
     "device_return_settle_ms",
 }
 POWER_OFF_DEPARTURE_EVIDENCE = {"receiver-state", "watched-retained-route"}
-DEVICE_RETURN_CONFIRMATION_KEYS = {"evidence", "settle_ms"}
+DEVICE_RETURN_CONFIRMATION_KEYS = {"evidence", "settle_ms", "reassert_at_fallback"}
 DEVICE_RETURN_CONFIRMATION_EVIDENCE = {"battery-report"}
 MAX_DEVICE_RETURN_SETTLE_MS = 30_000
 QUALIFICATION_MIGRATION_KEYS = {"from_runtime_sha256", "preserve_stage_roles"}
@@ -653,6 +653,10 @@ def _validate_lifecycle_policy(
         raise ModelError(
             f"{profile['profile_id']}: confirmation must precede a positive return fallback"
         )
+    if not isinstance(confirmation["reassert_at_fallback"], bool):
+        raise ModelError(
+            f"{profile['profile_id']}: return fallback reassertion must be boolean"
+        )
     if evidence == "battery-report" and not isinstance(passive, dict):
         raise ModelError(
             f"{profile['profile_id']}: battery confirmation requires a passive decoder"

From e05226346dc3da60cfa294230719a1ad22d7018d Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:35:26 +0400
Subject: [PATCH 28/67] fix: migrate compatible stable lighting state

---
 crates/hfx-bridge/src/backend.rs              |   3 +-
 crates/hfx-bridge/src/profile_authority.rs    |  32 ++
 crates/hfx-bridge/src/restoration_runtime.rs  |   8 +-
 crates/hfx-bridge/tests/file_persistence.rs   | 156 +++++-
 crates/hfx-bridge/tests/profile_authority.rs  |  22 +
 crates/hfx-core/src/ports.rs                  |  16 +
 crates/hfx-core/src/restoration/engine.rs     | 124 ++++-
 crates/hfx-core/tests/restoration.rs          | 454 +++++++++++++++++-
 .../hfx-daemon/src/production_restoration.rs  |   7 +-
 crates/hfx-sim/src/restoration.rs             |   2 +-
 10 files changed, 784 insertions(+), 40 deletions(-)

diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index fbb308a..26a0387 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -371,7 +371,8 @@ where
         &mut self,
         trigger: &RestoreTrigger,
     ) -> Result<RestorePlanResult, RestorationError> {
-        self.restoration.plan_restore(trigger)
+        let profiles = self.profiles.view(&self.receivers);
+        self.restoration.plan_restore(trigger, &profiles)
     }
 
     /// Advances one restoration claim through the same session, ownership,
diff --git a/crates/hfx-bridge/src/profile_authority.rs b/crates/hfx-bridge/src/profile_authority.rs
index a2c045b..878c53d 100644
--- a/crates/hfx-bridge/src/profile_authority.rs
+++ b/crates/hfx-bridge/src/profile_authority.rs
@@ -323,6 +323,38 @@ impl ProfileRegistry for RuntimeProfileView<'_> {
             application_slot_count: lighting.application_slot_count,
         })
     }
+
+    fn permits_stable_lighting_migration(
+        &self,
+        resource: &ResourceKey,
+        from_profile_digest: &hfx_domain::ProfileDigest,
+    ) -> bool {
+        if resource.kind != ResourceKind::Lighting {
+            return false;
+        }
+        let Some((_, generation, _)) =
+            (*self).active_generation(&resource.receiver_id, resource.generation_id)
+        else {
+            return false;
+        };
+        let Some(device) = generation.device(&resource.device_id) else {
+            return false;
+        };
+        let Some(profile) = RuntimeProfileView::profile_for_device(
+            *self,
+            &resource.receiver_id,
+            resource.generation_id,
+            device,
+        ) else {
+            return false;
+        };
+
+        profile.qualification_migrations.iter().any(|migration| {
+            migration.from_runtime_digest == *from_profile_digest
+                && migration.preserve_stage_roles.contains(&"lighting")
+                && migration.preserve_stage_roles.contains(&"map")
+        })
+    }
 }
 
 impl DeviceStateAuthority for RuntimeProfileView<'_> {
diff --git a/crates/hfx-bridge/src/restoration_runtime.rs b/crates/hfx-bridge/src/restoration_runtime.rs
index cd986f4..29127ac 100644
--- a/crates/hfx-bridge/src/restoration_runtime.rs
+++ b/crates/hfx-bridge/src/restoration_runtime.rs
@@ -56,9 +56,10 @@ pub trait RestorationRuntime: RestorationSnapshotSource {
     /// # Errors
     ///
     /// Returns a trigger, persistence, capacity, or prior-attempt barrier.
-    fn plan_restore(
+    fn plan_restore<P: ProfileRegistry>(
         &mut self,
         _trigger: &RestoreTrigger,
+        _profiles: &P,
     ) -> Result<RestorePlanResult, RestorationError> {
         Ok(RestorePlanResult::Disabled)
     }
@@ -316,11 +317,12 @@ impl<S: PersistenceStore> RestorationRuntime for DurableRestorationRuntime<S> {
         RestorationCoordinator.pending_restore_records(receiver_id, &self.store)
     }
 
-    fn plan_restore(
+    fn plan_restore<P: ProfileRegistry>(
         &mut self,
         trigger: &RestoreTrigger,
+        profiles: &P,
     ) -> Result<RestorePlanResult, RestorationError> {
-        RestorationCoordinator.plan_restore(trigger, &mut self.store)
+        RestorationCoordinator.plan_restore(trigger, profiles, &mut self.store)
     }
 
     fn advance_claim<A, D, P, T, E>(
diff --git a/crates/hfx-bridge/tests/file_persistence.rs b/crates/hfx-bridge/tests/file_persistence.rs
index 4f30f73..0a2e7b7 100644
--- a/crates/hfx-bridge/tests/file_persistence.rs
+++ b/crates/hfx-bridge/tests/file_persistence.rs
@@ -8,19 +8,20 @@ use hfx_bridge::{
 use hfx_core::{
     CURRENT_PERSISTENCE_SCHEMA_VERSION, CompletedTransaction, MAX_RESTORE_RECORDS_PER_RECEIVER,
     PersistedRestorePolicy, PersistedStableEntry, PersistenceCasOutcome, PersistenceStore,
-    RestoreCompletion, RestoreInvalidation, RestoreRecord, RestoreRecordChange,
-    RestoreRecordStatus, StableCommitOutcome, StableIntentChange, StableIntentTombstone,
-    StableLighting, canonical_request_digest,
+    ProfileRegistry, QualifiedDeviceProfile, QualifiedReceiverProfile, RestoreCompletion,
+    RestoreInvalidation, RestorePlanResult, RestoreRecord, RestoreRecordChange,
+    RestoreRecordStatus, RestoreTrigger, StableCommitOutcome, StableIntentChange,
+    StableIntentTombstone, StableLighting, canonical_request_digest,
 };
 use hfx_domain::{
     ColorChannel, DeliveredFrameCount, DeviceApplicationState, FrameCount, FrameIndex,
-    GenerationId, IntentDigest, IntentRevision, LogicalDeviceId, PersistenceRevision,
-    PersistenceSchemaVersion, ProtocolErrorKind, ReceiverId, RequestDigest, RestoreAttemptNumber,
-    RestoreClaimId, RestoreInvalidationReason, RestoreState, RestoreTriggerId, RestoreTriggerKind,
-    SequenceNumber, SideEffectCertainty, StableLightingMode, TransactionId, TransactionState,
-    WallClockUnixMs,
+    GenerationId, IntentDigest, IntentRevision, LedCount, LogicalDeviceId, PersistenceRevision,
+    PersistenceSchemaVersion, ProfileDigest, ProtocolErrorKind, ReceiverId, RequestDigest,
+    ResourceKind, RestoreAttemptNumber, RestoreClaimId, RestoreInvalidationReason, RestoreState,
+    RestoreTriggerId, RestoreTriggerKind, SequenceNumber, SideEffectCertainty, StableLightingMode,
+    TransactionId, TransactionState, WallClockUnixMs,
 };
-use hfx_protocol::{StableLightingIntent, TransactionRequest, TransactionTerminal};
+use hfx_protocol::{ResourceKey, StableLightingIntent, TransactionRequest, TransactionTerminal};
 use std::fs::{self, OpenOptions};
 use std::io::Write as _;
 use std::os::unix::fs::{DirBuilderExt, OpenOptionsExt, PermissionsExt, symlink};
@@ -227,6 +228,49 @@ fn completed_stable_transaction() -> CompletedTransaction {
     CompletedTransaction { request, terminal }
 }
 
+#[derive(Clone, Debug)]
+struct CompatibleMigrationProfiles {
+    current_digest: ProfileDigest,
+}
+
+impl ProfileRegistry for CompatibleMigrationProfiles {
+    fn supports(&self, resource: &ResourceKey) -> bool {
+        resource.receiver_id.as_str() == "receiver-1"
+            && resource.generation_id.get() == 1
+            && resource.kind == ResourceKind::Lighting
+            && matches!(resource.device_id.as_str(), "mouse-1" | "mouse-2")
+    }
+
+    fn receiver_profile(
+        &self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> Option<QualifiedReceiverProfile> {
+        (receiver_id.as_str() == "receiver-1" && generation_id.get() == 1).then(|| {
+            QualifiedReceiverProfile {
+                profile_id: id("profile.receiver"),
+                profile_digest: id(&"a".repeat(64)),
+            }
+        })
+    }
+
+    fn device_profile(&self, resource: &ResourceKey) -> Option<QualifiedDeviceProfile> {
+        self.supports(resource).then(|| QualifiedDeviceProfile {
+            profile_id: id(&format!("profile.{}", resource.device_id.as_str())),
+            profile_digest: self.current_digest.clone(),
+            application_slot_count: LedCount::try_from(1_u16).expect("test LED count"),
+        })
+    }
+
+    fn permits_stable_lighting_migration(
+        &self,
+        resource: &ResourceKey,
+        from_profile_digest: &ProfileDigest,
+    ) -> bool {
+        self.supports(resource) && from_profile_digest.as_str() == "b".repeat(64)
+    }
+}
+
 #[test]
 fn policy_commit_is_private_durable_and_exclusively_locked() {
     let directory = TestDirectory::new();
@@ -675,6 +719,100 @@ fn durable_runtime_captures_static_and_off_once_across_process_reopen() {
     );
 }
 
+#[test]
+fn compatible_profile_upgrade_rebinds_stable_state_durably_across_process_reopen() {
+    let directory = TestDirectory::new();
+    let config = FilePersistenceConfig::new(directory.state_path());
+    let completed = completed_stable_transaction();
+    let receiver_id = completed.request.receiver_id.clone();
+    let profiles = CompatibleMigrationProfiles {
+        current_digest: id(&"c".repeat(64)),
+    };
+
+    let store = FilePersistenceStore::open(config.clone()).expect("store opens");
+    let mut runtime = DurableRestorationRuntime::new(store);
+    let StableCommitOutcome::Captured(original) = runtime
+        .capture_completed(
+            &completed,
+            WallClockUnixMs::try_from(10_u64).expect("capture time"),
+        )
+        .expect("stable state is captured")
+    else {
+        panic!("stable state must be captured")
+    };
+    runtime
+        .set_enabled(&receiver_id, true)
+        .expect("stable restoration is enabled");
+    drop(runtime);
+
+    let reopened = FilePersistenceStore::open(config.clone()).expect("state reopens");
+    let mut restarted_runtime = DurableRestorationRuntime::new(reopened);
+    let trigger = RestoreTrigger {
+        trigger_id: id("compatible-profile-upgrade"),
+        kind: RestoreTriggerKind::ServiceStart,
+        receiver_id: receiver_id.clone(),
+        generation_id: GenerationId::try_from(1_u64).expect("generation"),
+        target_device_id: None,
+    };
+    let RestorePlanResult::Planned(records) = restarted_runtime
+        .plan_restore(&trigger, &profiles)
+        .expect("compatible stable state migrates and plans")
+    else {
+        panic!("migrated stable state must create restore claims")
+    };
+    assert_eq!(records.len(), 2);
+
+    let migrated = restarted_runtime
+        .store()
+        .stable_entries(&receiver_id)
+        .expect("migrated stable state loads");
+    assert_eq!(migrated.len(), original.len());
+    for previous in &original {
+        let current = migrated
+            .iter()
+            .find_map(|entry| match entry {
+                PersistedStableEntry::Present(intent) if intent.device_id == previous.device_id => {
+                    Some(intent)
+                }
+                PersistedStableEntry::Present(_) | PersistedStableEntry::Deleted(_) => None,
+            })
+            .expect("migrated device state exists");
+        assert_eq!(current.profile_id, previous.profile_id);
+        assert_eq!(current.profile_digest, profiles.current_digest);
+        assert_eq!(
+            current.application_slot_count,
+            previous.application_slot_count
+        );
+        assert_eq!(current.lighting, previous.lighting);
+        assert_eq!(
+            current.source_transaction_id,
+            previous.source_transaction_id
+        );
+        assert_eq!(
+            current.source_request_digest,
+            previous.source_request_digest
+        );
+        assert_eq!(current.captured_at, previous.captured_at);
+        assert_eq!(current.revision.get(), previous.revision.get() + 1);
+        assert_ne!(current.content_digest, previous.content_digest);
+        let claim = records
+            .iter()
+            .find(|record| record.device_id == current.device_id)
+            .expect("migrated claim exists");
+        assert_eq!(claim.intent_revision, current.revision);
+        assert_eq!(claim.intent_digest, current.content_digest);
+    }
+    drop(restarted_runtime);
+
+    let final_store = FilePersistenceStore::open(config).expect("migrated state reopens");
+    assert_eq!(
+        final_store
+            .stable_entries(&receiver_id)
+            .expect("migrated state remains durable"),
+        migrated
+    );
+}
+
 #[test]
 fn malformed_oversized_and_permissive_state_fail_closed() {
     let malformed_directory = TestDirectory::new();
diff --git a/crates/hfx-bridge/tests/profile_authority.rs b/crates/hfx-bridge/tests/profile_authority.rs
index 4c5f912..c9dc294 100644
--- a/crates/hfx-bridge/tests/profile_authority.rs
+++ b/crates/hfx-bridge/tests/profile_authority.rs
@@ -166,6 +166,28 @@ fn exact_generation_composes_mouse_and_keyboard_independently() {
     assert_eq!(keyboard.application_slot_count.get(), 102);
 }
 
+#[test]
+fn stable_lighting_migration_requires_explicit_map_and_lighting_equivalence() {
+    let receivers = lifecycle(RouteKind::HyperfluxWireless);
+    let mut authority = RuntimeProfileAuthority::load(4).expect("authority loads");
+    bind(&mut authority, "receiver-a", 1);
+    let view = authority.view(&receivers);
+    let keyboard = resource("keyboard", ResourceKind::Lighting, 1);
+
+    assert!(view.permits_stable_lighting_migration(
+        &keyboard,
+        &text("fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6")
+    ));
+    assert!(!view.permits_stable_lighting_migration(
+        &keyboard,
+        &text("ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff")
+    ));
+    assert!(!view.permits_stable_lighting_migration(
+        &resource("keyboard", ResourceKind::Settings, 1),
+        &text("fcdd53fe104e649cc7d2c38c939bbd41095dc3eb53488ebb30a8615a76bbfba6")
+    ));
+}
+
 #[test]
 fn write_readiness_comes_from_exact_current_lifecycle_state() {
     let mut receivers = lifecycle(RouteKind::HyperfluxWireless);
diff --git a/crates/hfx-core/src/ports.rs b/crates/hfx-core/src/ports.rs
index f0f8d2b..cbe325e 100644
--- a/crates/hfx-core/src/ports.rs
+++ b/crates/hfx-core/src/ports.rs
@@ -163,6 +163,22 @@ pub trait ProfileRegistry {
     ) -> Option<QualifiedReceiverProfile>;
 
     fn device_profile(&self, resource: &ResourceKey) -> Option<QualifiedDeviceProfile>;
+
+    /// Returns whether the current device profile explicitly permits a saved
+    /// stable-lighting intent from `from_profile_digest` to be rebound to the
+    /// current profile digest.
+    ///
+    /// The caller still verifies an unchanged profile id, receiver profile,
+    /// and application slot count. Registries must return `true` only when
+    /// both lighting behavior and the application-to-physical map are known
+    /// to be equivalent. The default remains fail-closed.
+    fn permits_stable_lighting_migration(
+        &self,
+        _resource: &ResourceKey,
+        _from_profile_digest: &ProfileDigest,
+    ) -> bool {
+        false
+    }
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
diff --git a/crates/hfx-core/src/restoration/engine.rs b/crates/hfx-core/src/restoration/engine.rs
index fe9bf10..aa3879b 100644
--- a/crates/hfx-core/src/restoration/engine.rs
+++ b/crates/hfx-core/src/restoration/engine.rs
@@ -1,18 +1,18 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use super::intent::load_entries;
+use super::intent::{intent_digest, load_entries};
 use super::{
     MAX_RESTORE_RECORDS_PER_RECEIVER, PersistenceOperation, RestorationAuthority,
     RestorationCoordinator, RestorationError, RestoreAdvanceResult, RestoreGenerationRetirement,
-    RestorePlanResult, current_schema_version, next_persistence_revision, sha256_hex,
-    transition_record, validate_schema,
+    RestorePlanResult, current_schema_version, next_intent_revision, next_persistence_revision,
+    sha256_hex, transition_record, validate_schema,
 };
 use crate::{
     BoundedEventLog, DeviceStateAuthority, DispatchResult, EventDraft, EventSink, LeaseManager,
     LeaseManagerError, OutcomeLookup, PersistedStableEntry, PersistedStableIntent,
     PersistenceCasOutcome, PersistenceStore, ProfileRegistry, ReceiverTransport, RestoreAttempt,
     RestoreCompletion, RestoreDeferred, RestoreInvalidation, RestoreRecord, RestoreRecordChange,
-    RestoreRecordStatus, RestoreTrigger, SessionAuthority, SubmissionBinding,
+    RestoreRecordStatus, RestoreTrigger, SessionAuthority, StableIntentChange, SubmissionBinding,
     TransactionCoordinator, TransactionCoordinatorError, TransportDispatch, TransportFailureFacts,
     TransportReceipt, TransportReconciliation, TransportTerminal, canonical_request_digest,
 };
@@ -41,9 +41,10 @@ impl RestorationCoordinator {
     ///
     /// Returns an error for invalid persisted records, capacity violations,
     /// storage failures, or compare-and-set conflicts.
-    pub fn plan_restore<S: PersistenceStore>(
+    pub fn plan_restore<P: ProfileRegistry, S: PersistenceStore>(
         &self,
         trigger: &RestoreTrigger,
+        profiles: &P,
         store: &mut S,
     ) -> Result<RestorePlanResult, RestorationError> {
         validate_trigger(trigger)?;
@@ -60,6 +61,9 @@ impl RestorationCoordinator {
         if !policy.enabled {
             return Ok(RestorePlanResult::Disabled);
         }
+        let mut records = load_records(&trigger.receiver_id, store)?;
+        validate_trigger_history(trigger, &records)?;
+        migrate_compatible_stable_intents(trigger, profiles, &records, store)?;
         let entries = load_entries(&trigger.receiver_id, store)?;
         let intents = entries
             .into_iter()
@@ -77,8 +81,6 @@ impl RestorationCoordinator {
         if intents.is_empty() {
             return Ok(RestorePlanResult::NoStableIntents);
         }
-        let mut records = load_records(&trigger.receiver_id, store)?;
-        validate_trigger_history(trigger, &records)?;
         let mut planned = Vec::with_capacity(intents.len());
         for intent in intents {
             let candidate = new_restore_record(trigger, &intent)?;
@@ -581,6 +583,90 @@ impl RestorationCoordinator {
     }
 }
 
+fn migrate_compatible_stable_intents<P: ProfileRegistry, S: PersistenceStore>(
+    trigger: &RestoreTrigger,
+    profiles: &P,
+    records: &[RestoreRecord],
+    store: &mut S,
+) -> Result<(), RestorationError> {
+    let Some(receiver_profile) =
+        profiles.receiver_profile(&trigger.receiver_id, trigger.generation_id)
+    else {
+        return Ok(());
+    };
+    let entries = load_entries(&trigger.receiver_id, store)?;
+    let mut changes = Vec::new();
+
+    for entry in entries {
+        let PersistedStableEntry::Present(intent) = entry else {
+            continue;
+        };
+        if trigger
+            .target_device_id
+            .as_ref()
+            .is_some_and(|target| target != &intent.device_id)
+            || intent.receiver_profile_id != receiver_profile.profile_id
+            || intent.receiver_profile_digest != receiver_profile.profile_digest
+        {
+            continue;
+        }
+
+        let resource = lighting_resource(
+            &trigger.receiver_id,
+            trigger.generation_id,
+            &intent.device_id,
+        );
+        let Some(current) = profiles.device_profile(&resource) else {
+            continue;
+        };
+        if intent.profile_digest == current.profile_digest
+            || intent.profile_id != current.profile_id
+            || intent.application_slot_count != current.application_slot_count
+            || !profiles.permits_stable_lighting_migration(&resource, &intent.profile_digest)
+        {
+            continue;
+        }
+        enforce_prior_outcomes(records.iter().filter(|record| {
+            record.receiver_id == intent.receiver_id
+                && record.device_id == intent.device_id
+                && record.intent_revision == intent.revision
+                && record.intent_digest == intent.content_digest
+        }))?;
+
+        let expected_revision = intent.revision;
+        let mut migrated = intent;
+        migrated.profile_digest = current.profile_digest;
+        migrated.revision = next_intent_revision(Some(expected_revision))?;
+        migrated.content_digest = intent_digest(
+            &migrated.receiver_id,
+            &migrated.device_id,
+            &migrated.receiver_profile_id,
+            &migrated.receiver_profile_digest,
+            &migrated.profile_id,
+            &migrated.profile_digest,
+            migrated.application_slot_count.get(),
+            &migrated.lighting,
+        )?;
+        changes.push(StableIntentChange {
+            expected_revision: Some(expected_revision),
+            entry: PersistedStableEntry::Present(migrated),
+        });
+    }
+
+    if changes.is_empty() {
+        return Ok(());
+    }
+    match store
+        .compare_and_set_stable_entries(&changes)
+        .map_err(|_| RestorationError::Persistence(PersistenceOperation::SaveIntent))?
+    {
+        PersistenceCasOutcome::Applied => Ok(()),
+        PersistenceCasOutcome::Conflict => Err(RestorationError::PersistenceConflict(
+            PersistenceOperation::SaveIntent,
+        )),
+    }
+}
+
 fn retire_record<T: ReceiverTransport>(
     record: RestoreRecord,
     now: MonotonicMs,
@@ -1564,19 +1650,23 @@ fn enforce_prior_outcome_barrier<S: PersistenceStore>(
     candidate: &RestoreRecord,
     store: &S,
 ) -> Result<(), RestorationError> {
-    for prior in load_records(&candidate.receiver_id, store)?
-        .into_iter()
-        .filter(|prior| {
-            prior.claim_id != candidate.claim_id
-                && prior.device_id == candidate.device_id
-                && prior.intent_revision == candidate.intent_revision
-                && prior.intent_digest == candidate.intent_digest
-        })
-    {
+    let records = load_records(&candidate.receiver_id, store)?;
+    enforce_prior_outcomes(records.iter().filter(|prior| {
+        prior.claim_id != candidate.claim_id
+            && prior.device_id == candidate.device_id
+            && prior.intent_revision == candidate.intent_revision
+            && prior.intent_digest == candidate.intent_digest
+    }))
+}
+
+fn enforce_prior_outcomes<'a>(
+    records: impl IntoIterator<Item = &'a RestoreRecord>,
+) -> Result<(), RestorationError> {
+    for prior in records {
         if active_attempt(&prior.status).is_some() {
             return Err(RestorationError::PriorClaimUnresolved);
         }
-        if let RestoreRecordStatus::Failed(completion) = prior.status
+        if let RestoreRecordStatus::Failed(completion) = &prior.status
             && (completion.live_write_executed
                 || completion.delivered_frames.get() > 0
                 || completion.side_effect_certainty != SideEffectCertainty::None)
diff --git a/crates/hfx-core/tests/restoration.rs b/crates/hfx-core/tests/restoration.rs
index d59872e..4550c13 100644
--- a/crates/hfx-core/tests/restoration.rs
+++ b/crates/hfx-core/tests/restoration.rs
@@ -389,6 +389,7 @@ impl DeviceStateAuthority for FakeDevices {
 #[derive(Clone, Copy, Debug)]
 struct FakeProfiles {
     valid: bool,
+    permits_stable_migration: bool,
 }
 
 impl ProfileRegistry for FakeProfiles {
@@ -419,6 +420,79 @@ impl ProfileRegistry for FakeProfiles {
             application_slot_count: LedCount::try_from(1_u16).expect("test LED count is valid"),
         })
     }
+
+    fn permits_stable_lighting_migration(
+        &self,
+        resource: &ResourceKey,
+        from_profile_digest: &hfx_domain::ProfileDigest,
+    ) -> bool {
+        self.supports(resource)
+            && self.permits_stable_migration
+            && from_profile_digest.as_str()
+                == "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+    }
+}
+
+#[derive(Clone, Debug)]
+struct DigestProfiles {
+    current_digest: hfx_domain::ProfileDigest,
+    migration_from: Option<hfx_domain::ProfileDigest>,
+}
+
+impl DigestProfiles {
+    fn exact(current_digest: hfx_domain::ProfileDigest) -> Self {
+        Self {
+            current_digest,
+            migration_from: None,
+        }
+    }
+
+    fn migrating(
+        current_digest: hfx_domain::ProfileDigest,
+        migration_from: hfx_domain::ProfileDigest,
+    ) -> Self {
+        Self {
+            current_digest,
+            migration_from: Some(migration_from),
+        }
+    }
+}
+
+impl ProfileRegistry for DigestProfiles {
+    fn supports(&self, resource: &ResourceKey) -> bool {
+        resource.receiver_id.as_str() == "receiver-1"
+            && resource.generation_id == generation(1)
+            && resource.kind == ResourceKind::Lighting
+    }
+
+    fn receiver_profile(
+        &self,
+        receiver_id: &ReceiverId,
+        generation_id: hfx_domain::GenerationId,
+    ) -> Option<QualifiedReceiverProfile> {
+        (receiver_id.as_str() == "receiver-1" && generation_id == generation(1)).then(|| {
+            QualifiedReceiverProfile {
+                profile_id: common::receiver_profile_id(),
+                profile_digest: common::receiver_profile_digest(),
+            }
+        })
+    }
+
+    fn device_profile(&self, resource: &ResourceKey) -> Option<QualifiedDeviceProfile> {
+        self.supports(resource).then(|| QualifiedDeviceProfile {
+            profile_id: common::device_profile_id(resource.device_id.as_str()),
+            profile_digest: self.current_digest.clone(),
+            application_slot_count: LedCount::try_from(1_u16).expect("test LED count is valid"),
+        })
+    }
+
+    fn permits_stable_lighting_migration(
+        &self,
+        resource: &ResourceKey,
+        from_profile_digest: &hfx_domain::ProfileDigest,
+    ) -> bool {
+        self.supports(resource) && self.migration_from.as_ref() == Some(from_profile_digest)
+    }
 }
 
 #[derive(Debug, Default)]
@@ -519,7 +593,14 @@ fn plan_claims(
         target_device_id: target_device_id.map(text),
     };
     let RestorePlanResult::Planned(records) = coordinator
-        .plan_restore(&trigger, store)
+        .plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            store,
+        )
         .expect("restore trigger is planned")
     else {
         panic!("stable intents produce restore claims")
@@ -565,7 +646,10 @@ impl RestoreRuntime {
             store,
             sessions: sessions(),
             devices,
-            profiles: FakeProfiles { valid: true },
+            profiles: FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
             transport: fake_transport(),
             leases: LeaseManager::new(16, 32).expect("test lease bounds are valid"),
             transactions: TransactionCoordinator::new(16)
@@ -656,7 +740,14 @@ fn missing_policy_defaults_disabled_and_enable_disable_is_cas_versioned() {
     let mut store = MemoryPersistenceStore::default();
 
     assert_eq!(
-        coordinator.plan_restore(&trigger, &mut store),
+        coordinator.plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            &mut store,
+        ),
         Ok(RestorePlanResult::Disabled)
     );
 
@@ -667,7 +758,14 @@ fn missing_policy_defaults_disabled_and_enable_disable_is_cas_versioned() {
     assert_eq!(enabled.revision.get(), 1);
     assert_eq!(store.policy_cas_calls[0].expected_revision, None);
     assert_eq!(
-        coordinator.plan_restore(&trigger, &mut store),
+        coordinator.plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            &mut store,
+        ),
         Ok(RestorePlanResult::NoStableIntents)
     );
 
@@ -681,7 +779,14 @@ fn missing_policy_defaults_disabled_and_enable_disable_is_cas_versioned() {
         Some(enabled.revision)
     );
     assert_eq!(
-        coordinator.plan_restore(&trigger, &mut store),
+        coordinator.plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            &mut store,
+        ),
         Ok(RestorePlanResult::Disabled)
     );
 
@@ -704,6 +809,336 @@ fn missing_policy_defaults_disabled_and_enable_disable_is_cas_versioned() {
     );
 }
 
+#[test]
+fn explicit_map_and_lighting_compatibility_rebinds_stable_intent_before_claim() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let mut request = stable_request("profile-migration", &["keyboard-1"]);
+    request.device_profiles[0].profile_digest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+
+    let before = match store
+        .persisted_entry(&request.receiver_id, &text("keyboard-1"))
+        .expect("stable intent exists")
+    {
+        PersistedStableEntry::Present(intent) => intent.clone(),
+        PersistedStableEntry::Deleted(_) => panic!("stable intent is present"),
+    };
+    let trigger = RestoreTrigger {
+        trigger_id: text("profile-migration-trigger"),
+        kind: RestoreTriggerKind::DeviceReturn,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: Some(text("keyboard-1")),
+    };
+    let profiles = FakeProfiles {
+        valid: true,
+        permits_stable_migration: true,
+    };
+
+    let RestorePlanResult::Planned(records) = coordinator
+        .plan_restore(&trigger, &profiles, &mut store)
+        .expect("compatible stable intent migrates before planning")
+    else {
+        panic!("migrated stable intent produces one claim")
+    };
+    assert_eq!(records.len(), 1);
+
+    let migrated = match store
+        .persisted_entry(&request.receiver_id, &text("keyboard-1"))
+        .expect("migrated stable intent exists")
+    {
+        PersistedStableEntry::Present(intent) => intent,
+        PersistedStableEntry::Deleted(_) => panic!("migrated stable intent is present"),
+    };
+    assert_eq!(migrated.profile_id, before.profile_id);
+    assert_eq!(migrated.profile_digest, common::device_profile_digest());
+    assert_eq!(
+        migrated.application_slot_count,
+        before.application_slot_count
+    );
+    assert_eq!(migrated.lighting, before.lighting);
+    assert_eq!(migrated.source_transaction_id, before.source_transaction_id);
+    assert_eq!(migrated.source_request_digest, before.source_request_digest);
+    assert_eq!(migrated.captured_at, before.captured_at);
+    assert_eq!(migrated.revision.get(), before.revision.get() + 1);
+    assert_ne!(migrated.content_digest, before.content_digest);
+    assert_eq!(records[0].intent_revision, migrated.revision);
+    assert_eq!(records[0].intent_digest, migrated.content_digest);
+    assert_eq!(store.stable_cas_calls.len(), 2);
+    assert_eq!(
+        store.stable_cas_calls[1][0].expected_revision,
+        Some(before.revision)
+    );
+}
+
+#[test]
+fn undeclared_profile_change_keeps_stable_intent_bound_to_original_digest() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let mut request = stable_request("profile-change", &["keyboard-1"]);
+    request.device_profiles[0].profile_digest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+
+    let trigger = RestoreTrigger {
+        trigger_id: text("profile-change-trigger"),
+        kind: RestoreTriggerKind::DeviceReturn,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: Some(text("keyboard-1")),
+    };
+    let RestorePlanResult::Planned(records) = coordinator
+        .plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            &mut store,
+        )
+        .expect("undeclared profile change remains a planned fail-closed claim")
+    else {
+        panic!("stable intent produces one claim")
+    };
+    assert_eq!(records.len(), 1);
+    let original_digest = match store
+        .persisted_entry(&request.receiver_id, &text("keyboard-1"))
+        .expect("stable intent remains present")
+    {
+        PersistedStableEntry::Present(intent) => intent.content_digest.clone(),
+        PersistedStableEntry::Deleted(_) => panic!("stable intent remains present"),
+    };
+    assert_eq!(records[0].intent_digest, original_digest);
+    assert_eq!(store.stable_cas_calls.len(), 1);
+
+    let mut runtime = RestoreRuntime::new(
+        store,
+        FakeDevices {
+            readiness: BTreeMap::from([(text("keyboard-1"), DeviceWriteReadiness::Ready)]),
+        },
+    );
+    let outcome = runtime
+        .advance(&records[0].claim_id)
+        .expect("profile mismatch is terminally fail-closed");
+    assert!(matches!(
+        outcome,
+        RestoreAdvanceResult::Terminal(RestoreRecord {
+            status: RestoreRecordStatus::Invalidated(ref detail),
+            ..
+        }) if detail.reason == RestoreInvalidationReason::ProfileChanged
+    ));
+    assert_eq!(runtime.transport.physical_writes, 0);
+}
+
+#[test]
+fn stable_intent_migration_conflict_is_atomic_and_creates_no_claim() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let mut request = stable_request("profile-migration-conflict", &["keyboard-1"]);
+    request.device_profiles[0].profile_digest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+    let before = store.durable_snapshot();
+    store.conflict_next_stable_cas = true;
+    let trigger = RestoreTrigger {
+        trigger_id: text("profile-migration-conflict-trigger"),
+        kind: RestoreTriggerKind::DeviceReturn,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: Some(text("keyboard-1")),
+    };
+
+    assert_eq!(
+        coordinator.plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: true,
+            },
+            &mut store,
+        ),
+        Err(RestorationError::PersistenceConflict(
+            PersistenceOperation::SaveIntent
+        ))
+    );
+    assert_eq!(store.durable_snapshot(), before);
+    assert!(store.durable.restore_records.is_empty());
+}
+
+#[test]
+fn uncertain_prior_outcome_blocks_compatible_intent_migration() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let mut request = stable_request("profile-migration-uncertain", &["keyboard-1"]);
+    let old_digest: hfx_domain::ProfileDigest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    request.device_profiles[0].profile_digest = old_digest.clone();
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+
+    let old_profiles = DigestProfiles::exact(old_digest.clone());
+    let trigger = RestoreTrigger {
+        trigger_id: text("profile-migration-uncertain-old"),
+        kind: RestoreTriggerKind::ServiceStart,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: None,
+    };
+    let RestorePlanResult::Planned(records) = coordinator
+        .plan_restore(&trigger, &old_profiles, &mut store)
+        .expect("old profile restore is planned")
+    else {
+        panic!("old stable intent must create a claim")
+    };
+    let claim_id = records[0].claim_id.clone();
+
+    let sessions = sessions();
+    let devices = devices(&[("keyboard-1", DeviceWriteReadiness::Ready)]);
+    let mut transport = fake_transport();
+    let mut leases = LeaseManager::new(16, 32).expect("test lease bounds are valid");
+    let mut transactions =
+        TransactionCoordinator::new(16).expect("test transaction bounds are valid");
+    let mut events = event_log();
+    let mut sink = FakeSink::default();
+    assert!(matches!(
+        coordinator.advance_claim(
+            &claim_id,
+            &authority(10),
+            monotonic(10),
+            &sessions,
+            &devices,
+            &old_profiles,
+            &transport,
+            &mut store,
+            &mut leases,
+            &mut transactions,
+            &mut events,
+            &mut sink,
+        ),
+        Ok(RestoreAdvanceResult::Queued(_))
+    ));
+
+    leases = LeaseManager::new(16, 32).expect("restart lease bounds are valid");
+    transactions = TransactionCoordinator::new(16).expect("restart transaction bounds are valid");
+    events = event_log();
+    sink = FakeSink::default();
+    transport.forced_reconciliation = Some(TransportReconciliation::Unavailable);
+    assert!(matches!(
+        coordinator.advance_claim(
+            &claim_id,
+            &authority(10),
+            monotonic(10),
+            &sessions,
+            &devices,
+            &old_profiles,
+            &transport,
+            &mut store,
+            &mut leases,
+            &mut transactions,
+            &mut events,
+            &mut sink,
+        ),
+        Ok(RestoreAdvanceResult::Terminal(RestoreRecord {
+            status: RestoreRecordStatus::Failed(_),
+            ..
+        }))
+    ));
+
+    let stable_before = store
+        .persisted_entry(&request.receiver_id, &text("keyboard-1"))
+        .expect("old stable intent remains")
+        .clone();
+    let current_profiles = DigestProfiles::migrating(common::device_profile_digest(), old_digest);
+    let current_trigger = RestoreTrigger {
+        trigger_id: text("profile-migration-uncertain-current"),
+        kind: RestoreTriggerKind::SystemResume,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: None,
+    };
+    assert_eq!(
+        coordinator.plan_restore(&current_trigger, &current_profiles, &mut store),
+        Err(RestorationError::PriorOutcomeUncertain)
+    );
+    assert_eq!(
+        store
+            .persisted_entry(&request.receiver_id, &text("keyboard-1"))
+            .expect("stable intent remains after barrier"),
+        &stable_before
+    );
+}
+
+#[test]
+fn compatible_digest_does_not_override_application_slot_change() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let mut request = stable_request("profile-slot-change", &["keyboard-1"]);
+    request.device_profiles[0].profile_digest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    request.device_profiles[0].application_slot_count =
+        LedCount::try_from(2_u16).expect("test slot count is valid");
+    request.frames[0].colors = vec![zero_color(), zero_color()];
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+    let trigger = RestoreTrigger {
+        trigger_id: text("profile-slot-change-trigger"),
+        kind: RestoreTriggerKind::DeviceReturn,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: Some(text("keyboard-1")),
+    };
+
+    let RestorePlanResult::Planned(records) = coordinator
+        .plan_restore(
+            &trigger,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: true,
+            },
+            &mut store,
+        )
+        .expect("slot-changing profile remains fail-closed")
+    else {
+        panic!("old stable intent produces a fail-closed claim")
+    };
+    assert_eq!(records.len(), 1);
+    assert_eq!(records[0].intent_revision.get(), 1);
+    assert_eq!(store.stable_cas_calls.len(), 1);
+
+    let mut runtime = RestoreRuntime::new(
+        store,
+        FakeDevices {
+            readiness: BTreeMap::from([(text("keyboard-1"), DeviceWriteReadiness::Ready)]),
+        },
+    );
+    let outcome = runtime
+        .advance(&records[0].claim_id)
+        .expect("slot mismatch invalidates before transport");
+    assert!(matches!(
+        outcome,
+        RestoreAdvanceResult::Terminal(RestoreRecord {
+            status: RestoreRecordStatus::Invalidated(ref detail),
+            ..
+        }) if detail.reason == RestoreInvalidationReason::ProfileChanged
+    ));
+    assert_eq!(runtime.transport.physical_writes, 0);
+}
+
 #[test]
 fn definitive_success_captures_static_and_off_in_one_batch() {
     let coordinator = RestorationCoordinator;
@@ -1696,7 +2131,14 @@ fn trigger_replay_is_idempotent_and_device_return_is_scoped() {
         target_device_id: None,
     };
     assert_eq!(
-        coordinator.plan_restore(&invalid, &mut store),
+        coordinator.plan_restore(
+            &invalid,
+            &FakeProfiles {
+                valid: true,
+                permits_stable_migration: false,
+            },
+            &mut store,
+        ),
         Err(RestorationError::InvalidTrigger)
     );
 }
diff --git a/crates/hfx-daemon/src/production_restoration.rs b/crates/hfx-daemon/src/production_restoration.rs
index ba271d3..36385b7 100644
--- a/crates/hfx-daemon/src/production_restoration.rs
+++ b/crates/hfx-daemon/src/production_restoration.rs
@@ -90,13 +90,14 @@ impl RestorationRuntime for ProductionRestoration {
         }
     }
 
-    fn plan_restore(
+    fn plan_restore<P: ProfileRegistry>(
         &mut self,
         trigger: &RestoreTrigger,
+        profiles: &P,
     ) -> Result<RestorePlanResult, RestorationError> {
         match self {
-            Self::Disabled(runtime) => runtime.plan_restore(trigger),
-            Self::Durable(runtime) => runtime.plan_restore(trigger),
+            Self::Disabled(runtime) => runtime.plan_restore(trigger, profiles),
+            Self::Durable(runtime) => runtime.plan_restore(trigger, profiles),
         }
     }
 
diff --git a/crates/hfx-sim/src/restoration.rs b/crates/hfx-sim/src/restoration.rs
index 897d0a4..42863ac 100644
--- a/crates/hfx-sim/src/restoration.rs
+++ b/crates/hfx-sim/src/restoration.rs
@@ -532,7 +532,7 @@ impl SimRestorationHarness {
         trigger: &RestoreTrigger,
     ) -> Result<CrashExecution<RestorePlanResult>, SimRestorationError> {
         let result = catch_unwind(AssertUnwindSafe(|| {
-            RestorationCoordinator.plan_restore(trigger, &mut self.store)
+            RestorationCoordinator.plan_restore(trigger, &self.profiles, &mut self.store)
         }));
         self.finish_crashable(result)
     }

From 48adf49903069698b9cdb900486427fad28e21f8 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:05:13 +0400
Subject: [PATCH 29/67] fix: replan migrated restoration claims

---
 crates/hfx-bridge/src/backend.rs              |  15 ++
 crates/hfx-bridge/src/restoration_runtime.rs  |  22 +++
 crates/hfx-bridge/tests/file_persistence.rs   |   8 +-
 crates/hfx-core/src/restoration/engine.rs     |  44 ++++-
 crates/hfx-core/tests/restoration.rs          |  88 +++++++++
 .../hfx-daemon/src/production_restoration.rs  |  11 ++
 crates/hfx-daemon/src/restoration.rs          | 171 +++++++++++++++++-
 7 files changed, 351 insertions(+), 8 deletions(-)

diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index 26a0387..d8adcad 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -362,6 +362,21 @@ where
         self.restoration.pending_records(receiver_id)
     }
 
+    /// Rebinds stable intents whose current profile explicitly preserves both
+    /// lighting semantics and the application map.
+    ///
+    /// # Errors
+    ///
+    /// Returns a persistence, compatibility, or prior-outcome barrier.
+    pub fn rebind_compatible_stable_intents(
+        &mut self,
+        trigger: &RestoreTrigger,
+    ) -> Result<usize, RestorationError> {
+        let profiles = self.profiles.view(&self.receivers);
+        self.restoration
+            .rebind_compatible_stable_intents(trigger, &profiles)
+    }
+
     /// Plans one exact lifecycle restoration trigger.
     ///
     /// # Errors
diff --git a/crates/hfx-bridge/src/restoration_runtime.rs b/crates/hfx-bridge/src/restoration_runtime.rs
index 29127ac..b527b03 100644
--- a/crates/hfx-bridge/src/restoration_runtime.rs
+++ b/crates/hfx-bridge/src/restoration_runtime.rs
@@ -51,6 +51,20 @@ pub trait RestorationRuntime: RestorationSnapshotSource {
         Ok(Vec::new())
     }
 
+    /// Rebinds stable intents across an explicitly compatible profile
+    /// upgrade before older deferred claims are recovered.
+    ///
+    /// # Errors
+    ///
+    /// Returns a profile, persistence, or unresolved-prior-outcome failure.
+    fn rebind_compatible_stable_intents<P: ProfileRegistry>(
+        &mut self,
+        _trigger: &RestoreTrigger,
+        _profiles: &P,
+    ) -> Result<usize, RestorationError> {
+        Ok(0)
+    }
+
     /// Plans claims for one exact lifecycle trigger.
     ///
     /// # Errors
@@ -317,6 +331,14 @@ impl<S: PersistenceStore> RestorationRuntime for DurableRestorationRuntime<S> {
         RestorationCoordinator.pending_restore_records(receiver_id, &self.store)
     }
 
+    fn rebind_compatible_stable_intents<P: ProfileRegistry>(
+        &mut self,
+        trigger: &RestoreTrigger,
+        profiles: &P,
+    ) -> Result<usize, RestorationError> {
+        RestorationCoordinator.rebind_compatible_stable_intents(trigger, profiles, &mut self.store)
+    }
+
     fn plan_restore<P: ProfileRegistry>(
         &mut self,
         trigger: &RestoreTrigger,
diff --git a/crates/hfx-bridge/tests/file_persistence.rs b/crates/hfx-bridge/tests/file_persistence.rs
index 0a2e7b7..5e28e66 100644
--- a/crates/hfx-bridge/tests/file_persistence.rs
+++ b/crates/hfx-bridge/tests/file_persistence.rs
@@ -754,9 +754,15 @@ fn compatible_profile_upgrade_rebinds_stable_state_durably_across_process_reopen
         generation_id: GenerationId::try_from(1_u64).expect("generation"),
         target_device_id: None,
     };
+    assert_eq!(
+        restarted_runtime
+            .rebind_compatible_stable_intents(&trigger, &profiles)
+            .expect("compatible stable state rebinds after reopen"),
+        2
+    );
     let RestorePlanResult::Planned(records) = restarted_runtime
         .plan_restore(&trigger, &profiles)
-        .expect("compatible stable state migrates and plans")
+        .expect("rebound stable state plans")
     else {
         panic!("migrated stable state must create restore claims")
     };
diff --git a/crates/hfx-core/src/restoration/engine.rs b/crates/hfx-core/src/restoration/engine.rs
index aa3879b..b2bec62 100644
--- a/crates/hfx-core/src/restoration/engine.rs
+++ b/crates/hfx-core/src/restoration/engine.rs
@@ -31,6 +31,41 @@ use serde::Serialize;
 use std::collections::BTreeSet;
 
 impl RestorationCoordinator {
+    /// Rebinds saved stable-lighting intents across an explicitly compatible
+    /// profile upgrade without creating restore claims.
+    ///
+    /// This is separated from claim planning so a process restart can update
+    /// durable intent authority before recovering older deferred claims.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for invalid triggers, persistence failures, uncertain
+    /// prior outcomes, or compare-and-set conflicts.
+    pub fn rebind_compatible_stable_intents<P: ProfileRegistry, S: PersistenceStore>(
+        &self,
+        trigger: &RestoreTrigger,
+        profiles: &P,
+        store: &mut S,
+    ) -> Result<usize, RestorationError> {
+        validate_trigger(trigger)?;
+        let policy = store
+            .restore_policy(&trigger.receiver_id)
+            .map_err(|_| RestorationError::Persistence(PersistenceOperation::LoadPolicy))?;
+        let Some(policy) = policy else {
+            return Ok(0);
+        };
+        validate_schema(policy.schema_version)?;
+        if policy.receiver_id != trigger.receiver_id {
+            return Err(RestorationError::ReceiverMismatch);
+        }
+        if !policy.enabled {
+            return Ok(0);
+        }
+        let records = load_records(&trigger.receiver_id, store)?;
+        validate_trigger_history(trigger, &records)?;
+        migrate_compatible_stable_intents(trigger, profiles, &records, store)
+    }
+
     /// Creates one durable claim per active stable intent for a lifecycle trigger.
     ///
     /// Repeating the same trigger returns the same records. A newer trigger
@@ -588,11 +623,11 @@ fn migrate_compatible_stable_intents<P: ProfileRegistry, S: PersistenceStore>(
     profiles: &P,
     records: &[RestoreRecord],
     store: &mut S,
-) -> Result<(), RestorationError> {
+) -> Result<usize, RestorationError> {
     let Some(receiver_profile) =
         profiles.receiver_profile(&trigger.receiver_id, trigger.generation_id)
     else {
-        return Ok(());
+        return Ok(0);
     };
     let entries = load_entries(&trigger.receiver_id, store)?;
     let mut changes = Vec::new();
@@ -654,13 +689,14 @@ fn migrate_compatible_stable_intents<P: ProfileRegistry, S: PersistenceStore>(
     }
 
     if changes.is_empty() {
-        return Ok(());
+        return Ok(0);
     }
+    let migrated_count = changes.len();
     match store
         .compare_and_set_stable_entries(&changes)
         .map_err(|_| RestorationError::Persistence(PersistenceOperation::SaveIntent))?
     {
-        PersistenceCasOutcome::Applied => Ok(()),
+        PersistenceCasOutcome::Applied => Ok(migrated_count),
         PersistenceCasOutcome::Conflict => Err(RestorationError::PersistenceConflict(
             PersistenceOperation::SaveIntent,
         )),
diff --git a/crates/hfx-core/tests/restoration.rs b/crates/hfx-core/tests/restoration.rs
index 4550c13..dab1cba 100644
--- a/crates/hfx-core/tests/restoration.rs
+++ b/crates/hfx-core/tests/restoration.rs
@@ -876,6 +876,94 @@ fn explicit_map_and_lighting_compatibility_rebinds_stable_intent_before_claim()
     );
 }
 
+#[test]
+fn restart_rebind_supersedes_a_stale_deferred_claim_before_new_planning() {
+    let coordinator = RestorationCoordinator;
+    let mut store = MemoryPersistenceStore::default();
+    let old_digest: hfx_domain::ProfileDigest =
+        text("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    let mut request = stable_request("profile-restart-migration", &["keyboard-1"]);
+    request.device_profiles[0].profile_digest = old_digest.clone();
+    commit_static(coordinator, &request, 1, &mut store);
+    coordinator
+        .set_restore_enabled(&request.receiver_id, true, &mut store)
+        .expect("restore policy is enabled");
+
+    let prior_trigger = RestoreTrigger {
+        trigger_id: text("profile-restart-prior-trigger"),
+        kind: RestoreTriggerKind::ServiceStart,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: None,
+    };
+    let RestorePlanResult::Planned(prior_records) = coordinator
+        .plan_restore(
+            &prior_trigger,
+            &DigestProfiles::exact(old_digest.clone()),
+            &mut store,
+        )
+        .expect("old profile claim is persisted")
+    else {
+        panic!("old stable intent must create a claim")
+    };
+    let prior = prior_records[0].clone();
+    let deferred = RestoreRecord {
+        status: RestoreRecordStatus::Deferred(hfx_core::RestoreDeferred {
+            reason: RestoreDeferReason::DeviceSleeping,
+            prior_outcome: None,
+        }),
+        revision: PersistenceRevision::try_from(prior.revision.get() + 1)
+            .expect("deferred revision"),
+        ..prior.clone()
+    };
+    assert_eq!(
+        store
+            .compare_and_set_restore_record(Some(prior.revision), &deferred)
+            .expect("deferred claim persists"),
+        PersistenceCasOutcome::Applied
+    );
+
+    let current_profiles = DigestProfiles::migrating(common::device_profile_digest(), old_digest);
+    let current_trigger = RestoreTrigger {
+        trigger_id: text("profile-restart-current-trigger"),
+        kind: RestoreTriggerKind::ServiceStart,
+        receiver_id: request.receiver_id.clone(),
+        generation_id: generation(1),
+        target_device_id: None,
+    };
+    assert_eq!(
+        coordinator
+            .rebind_compatible_stable_intents(&current_trigger, &current_profiles, &mut store,)
+            .expect("compatible stable intent rebinds"),
+        1
+    );
+
+    let RestorePlanResult::Planned(current_records) = coordinator
+        .plan_restore(&current_trigger, &current_profiles, &mut store)
+        .expect("current profile claim is planned")
+    else {
+        panic!("migrated stable intent must create a current claim")
+    };
+    assert_eq!(current_records.len(), 1);
+    assert_ne!(current_records[0].claim_id, prior.claim_id);
+    assert!(matches!(
+        store
+            .durable
+            .restore_records
+            .get(&prior.claim_id)
+            .expect("prior claim remains auditable")
+            .status,
+        RestoreRecordStatus::Invalidated(ref detail)
+            if detail.reason == RestoreInvalidationReason::SupersededTrigger
+    ));
+    assert_eq!(
+        coordinator
+            .pending_restore_records(&request.receiver_id, &store)
+            .expect("only current claims remain pending"),
+        current_records
+    );
+}
+
 #[test]
 fn undeclared_profile_change_keeps_stable_intent_bound_to_original_digest() {
     let coordinator = RestorationCoordinator;
diff --git a/crates/hfx-daemon/src/production_restoration.rs b/crates/hfx-daemon/src/production_restoration.rs
index 36385b7..bec7647 100644
--- a/crates/hfx-daemon/src/production_restoration.rs
+++ b/crates/hfx-daemon/src/production_restoration.rs
@@ -90,6 +90,17 @@ impl RestorationRuntime for ProductionRestoration {
         }
     }
 
+    fn rebind_compatible_stable_intents<P: ProfileRegistry>(
+        &mut self,
+        trigger: &RestoreTrigger,
+        profiles: &P,
+    ) -> Result<usize, RestorationError> {
+        match self {
+            Self::Disabled(runtime) => runtime.rebind_compatible_stable_intents(trigger, profiles),
+            Self::Durable(runtime) => runtime.rebind_compatible_stable_intents(trigger, profiles),
+        }
+    }
+
     fn plan_restore<P: ProfileRegistry>(
         &mut self,
         trigger: &RestoreTrigger,
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index a91dddd..2293e65 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -104,6 +104,12 @@ trait RestorationController {
         &self,
         receiver_id: &ReceiverId,
     ) -> Result<Vec<RestoreRecord>, RestorationError>;
+    fn rebind_compatible_stable_intents(
+        &mut self,
+        _trigger: &RestoreTrigger,
+    ) -> Result<usize, RestorationError> {
+        Ok(0)
+    }
     fn plan_restore(
         &mut self,
         trigger: &RestoreTrigger,
@@ -150,6 +156,13 @@ where
         self.pending_restoration_records(receiver_id)
     }
 
+    fn rebind_compatible_stable_intents(
+        &mut self,
+        trigger: &RestoreTrigger,
+    ) -> Result<usize, RestorationError> {
+        CoreBridgeBackend::rebind_compatible_stable_intents(self, trigger)
+    }
+
     fn plan_restore(
         &mut self,
         trigger: &RestoreTrigger,
@@ -676,6 +689,7 @@ impl RestorationScheduler {
                 .triggers
                 .remove(&trigger_id)
                 .ok_or(RestorationScheduleError::Identifier)?;
+            let receiver_id = scheduled.trigger.receiver_id.clone();
             if let Some(device_id) = scheduled.trigger.target_device_id.as_ref() {
                 let readiness = (
                     scheduled.trigger.receiver_id.clone(),
@@ -695,14 +709,17 @@ impl RestorationScheduler {
                 .contains(&scheduled.trigger.receiver_id);
             if newly_configured {
                 controller.set_enabled(&scheduled.trigger.receiver_id, true)?;
-                self.configured_receivers
-                    .insert(scheduled.trigger.receiver_id.clone());
             }
+            let migrated = if newly_configured {
+                controller.rebind_compatible_stable_intents(&scheduled.trigger)?
+            } else {
+                0
+            };
             let pending = newly_configured
                 .then(|| controller.pending_records(&scheduled.trigger.receiver_id))
                 .transpose()?
                 .unwrap_or_default();
-            if pending.is_empty() {
+            if pending.is_empty() || migrated > 0 {
                 match controller.plan_restore(&scheduled.trigger) {
                     Ok(RestorePlanResult::Planned(records)) => {
                         for record in records {
@@ -739,6 +756,9 @@ impl RestorationScheduler {
                     self.schedule_trigger_record(record, scheduled.trigger.kind, now)?;
                 }
             }
+            if newly_configured {
+                self.configured_receivers.insert(receiver_id);
+            }
         }
         Ok(())
     }
@@ -1367,6 +1387,77 @@ mod tests {
         }
     }
 
+    struct MigratingController {
+        inner: FakeController,
+        migrated_intents: usize,
+        migration_fails: bool,
+    }
+
+    impl RestorationController for MigratingController {
+        fn now(&self) -> MonotonicMs {
+            self.inner.now()
+        }
+
+        fn set_enabled(
+            &mut self,
+            receiver_id: &ReceiverId,
+            enabled: bool,
+        ) -> Result<(), RestorationError> {
+            self.inner.set_enabled(receiver_id, enabled)
+        }
+
+        fn pending_records(
+            &self,
+            receiver_id: &ReceiverId,
+        ) -> Result<Vec<RestoreRecord>, RestorationError> {
+            self.inner.pending_records(receiver_id)
+        }
+
+        fn rebind_compatible_stable_intents(
+            &mut self,
+            _trigger: &RestoreTrigger,
+        ) -> Result<usize, RestorationError> {
+            if self.migration_fails {
+                return Err(RestorationError::Persistence(
+                    hfx_core::PersistenceOperation::SaveIntent,
+                ));
+            }
+            Ok(self.migrated_intents)
+        }
+
+        fn plan_restore(
+            &mut self,
+            trigger: &RestoreTrigger,
+        ) -> Result<RestorePlanResult, RestorationError> {
+            self.inner.plan_restore(trigger)
+        }
+
+        fn advance_claim(
+            &mut self,
+            claim_id: &RestoreClaimId,
+            session: &AuthorizedSession,
+            sessions: &SessionRegistry,
+            lease_duration_ms: LeaseDurationMs,
+            authority_window_ms: u64,
+        ) -> Result<RestoreAdvanceResult, RestorationError> {
+            self.inner.advance_claim(
+                claim_id,
+                session,
+                sessions,
+                lease_duration_ms,
+                authority_window_ms,
+            )
+        }
+
+        fn dispatch_claim(
+            &mut self,
+            claim_id: &RestoreClaimId,
+            sessions: &SessionRegistry,
+        ) -> Result<RestoreRecord, RestorationError> {
+            self.inner.dispatch_claim(claim_id, sessions)
+        }
+    }
+
     fn id<T>(value: &str) -> T
     where
         T: TryFrom<String>,
@@ -1920,6 +2011,80 @@ mod tests {
         assert_eq!(controller.plans.len(), 1);
     }
 
+    #[test]
+    fn compatible_rebind_replans_instead_of_recovering_a_stale_deferred_claim() {
+        let prior = record(
+            "claim-prior",
+            RestoreRecordStatus::Deferred(RestoreDeferred {
+                reason: RestoreDeferReason::DeviceSleeping,
+                prior_outcome: None,
+            }),
+        );
+        let current = record("claim-current", RestoreRecordStatus::Planned);
+        let mut controller = MigratingController {
+            inner: FakeController {
+                now: time(10),
+                plans: vec![Ok(RestorePlanResult::Planned(vec![current.clone()]))],
+                pending: vec![prior.clone()],
+                advances: Vec::new(),
+                dispatches: Vec::new(),
+                policy_calls: 0,
+                advance_calls: 0,
+                dispatch_calls: 0,
+            },
+            migrated_intents: 1,
+            migration_fails: false,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_service_start(id("receiver-1"), generation(1))
+            .expect("service trigger schedules");
+        let mut report = RestorationTickReport::default();
+
+        scheduler
+            .process_due_trigger(&mut controller, time(10), &mut report)
+            .expect("compatible stable state replans");
+
+        assert_eq!(report.triggers_planned, 1);
+        assert_eq!(report.claims_recovered, 0);
+        assert!(controller.inner.plans.is_empty());
+        assert!(scheduler.claims.contains_key(&current.claim_id));
+        assert!(!scheduler.claims.contains_key(&prior.claim_id));
+    }
+
+    #[test]
+    fn failed_compatible_rebind_leaves_receiver_unconfigured_for_retry() {
+        let mut controller = MigratingController {
+            inner: FakeController {
+                now: time(10),
+                plans: Vec::new(),
+                pending: Vec::new(),
+                advances: Vec::new(),
+                dispatches: Vec::new(),
+                policy_calls: 0,
+                advance_calls: 0,
+                dispatch_calls: 0,
+            },
+            migrated_intents: 0,
+            migration_fails: true,
+        };
+        let receiver_id: ReceiverId = id("receiver-1");
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_service_start(receiver_id.clone(), generation(1))
+            .expect("service trigger schedules");
+        let mut report = RestorationTickReport::default();
+
+        assert!(matches!(
+            scheduler.process_due_trigger(&mut controller, time(10), &mut report),
+            Err(RestorationScheduleError::Restoration(
+                RestorationError::Persistence(hfx_core::PersistenceOperation::SaveIntent)
+            ))
+        ));
+        assert!(!scheduler.configured_receivers.contains(&receiver_id));
+        assert_eq!(controller.inner.policy_calls, 1);
+    }
+
     #[test]
     fn service_restart_preserves_a_pending_generation_claims_readiness_gate() {
         let mut prior = record("claim-prior", RestoreRecordStatus::Planned);

From 57c3d747bed388dd6aecb72a517542c56891213f Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:46:00 +0400
Subject: [PATCH 30/67] fix: retry restoration after child identity

---
 crates/hfx-daemon/src/restoration.rs | 85 +++++++++++++++++++++-------
 1 file changed, 66 insertions(+), 19 deletions(-)

diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 2293e65..0160253 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -710,11 +710,7 @@ impl RestorationScheduler {
             if newly_configured {
                 controller.set_enabled(&scheduled.trigger.receiver_id, true)?;
             }
-            let migrated = if newly_configured {
-                controller.rebind_compatible_stable_intents(&scheduled.trigger)?
-            } else {
-                0
-            };
+            let migrated = controller.rebind_compatible_stable_intents(&scheduled.trigger)?;
             let pending = newly_configured
                 .then(|| controller.pending_records(&scheduled.trigger.receiver_id))
                 .transpose()?
@@ -915,8 +911,8 @@ impl RestorationScheduler {
         } else if kind == RestoreTriggerKind::DeviceReturn
             && purpose == ScheduledTriggerPurpose::Primary
         {
-            let woke = self.wake(&receiver_id, generation_id, target_device_id.as_ref(), due);
-            if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
+            self.wake(&receiver_id, generation_id, target_device_id.as_ref(), due);
+            if self.has_pending_broad_trigger(&receiver_id, generation_id) {
                 return Ok(());
             }
             let same_scope = self.triggers.iter().find_map(|(trigger_id, scheduled)| {
@@ -1389,8 +1385,7 @@ mod tests {
 
     struct MigratingController {
         inner: FakeController,
-        migrated_intents: usize,
-        migration_fails: bool,
+        migrations: Vec<Result<usize, RestorationError>>,
     }
 
     impl RestorationController for MigratingController {
@@ -1417,12 +1412,7 @@ mod tests {
             &mut self,
             _trigger: &RestoreTrigger,
         ) -> Result<usize, RestorationError> {
-            if self.migration_fails {
-                return Err(RestorationError::Persistence(
-                    hfx_core::PersistenceOperation::SaveIntent,
-                ));
-            }
-            Ok(self.migrated_intents)
+            self.migrations.remove(0)
         }
 
         fn plan_restore(
@@ -2032,8 +2022,7 @@ mod tests {
                 advance_calls: 0,
                 dispatch_calls: 0,
             },
-            migrated_intents: 1,
-            migration_fails: false,
+            migrations: vec![Ok(1)],
         };
         let mut scheduler = scheduler();
         scheduler
@@ -2052,6 +2041,63 @@ mod tests {
         assert!(!scheduler.claims.contains_key(&prior.claim_id));
     }
 
+    #[test]
+    fn child_identity_arriving_after_service_start_retries_compatible_rebind() {
+        let prior = record(
+            "claim-prior",
+            RestoreRecordStatus::Deferred(RestoreDeferred {
+                reason: RestoreDeferReason::DeviceUnknown,
+                prior_outcome: None,
+            }),
+        );
+        let current = record("claim-current", RestoreRecordStatus::Planned);
+        let mut controller = MigratingController {
+            inner: FakeController {
+                now: time(10),
+                plans: vec![Ok(RestorePlanResult::Planned(vec![current.clone()]))],
+                pending: vec![prior.clone()],
+                advances: Vec::new(),
+                dispatches: Vec::new(),
+                policy_calls: 0,
+                advance_calls: 0,
+                dispatch_calls: 0,
+            },
+            migrations: vec![Ok(0), Ok(1)],
+        };
+        let receiver_id: ReceiverId = id("receiver-1");
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_service_start(receiver_id.clone(), generation(1))
+            .expect("receiver-only service trigger schedules");
+        let mut startup_report = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, time(10), &mut startup_report)
+            .expect("receiver-only startup safely recovers pending state");
+        assert_eq!(startup_report.claims_recovered, 1);
+        assert!(scheduler.configured_receivers.contains(&receiver_id));
+
+        scheduler
+            .schedule_device_return_at(
+                receiver_id,
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(2_u64).expect("sequence"),
+                time(10),
+                0,
+            )
+            .expect("child identity trigger schedules");
+        let mut return_report = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, time(10), &mut return_report)
+            .expect("late child identity retries compatible migration");
+
+        assert_eq!(return_report.triggers_planned, 1);
+        assert_eq!(return_report.claims_recovered, 0);
+        assert!(controller.migrations.is_empty());
+        assert!(controller.inner.plans.is_empty());
+        assert!(scheduler.claims.contains_key(&current.claim_id));
+    }
+
     #[test]
     fn failed_compatible_rebind_leaves_receiver_unconfigured_for_retry() {
         let mut controller = MigratingController {
@@ -2065,8 +2111,9 @@ mod tests {
                 advance_calls: 0,
                 dispatch_calls: 0,
             },
-            migrated_intents: 0,
-            migration_fails: true,
+            migrations: vec![Err(RestorationError::Persistence(
+                hfx_core::PersistenceOperation::SaveIntent,
+            ))],
         };
         let receiver_id: ReceiverId = id("receiver-1");
         let mut scheduler = scheduler();

From 0f5b13e8a22cc19f0bdd5d70b4f97cc679b1728a Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 12:16:07 +0400
Subject: [PATCH 31/67] fix: recover stale lifecycle checkpoints

---
 .../src/qualification_event_evidence.rs       | 10 ++++
 crates/hfx-ops/src/qualification_lifecycle.rs | 54 ++++++++++++++++++-
 crates/hfx-ops/src/qualification_server.rs    | 23 +++++++-
 3 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/crates/hfx-ops/src/qualification_event_evidence.rs b/crates/hfx-ops/src/qualification_event_evidence.rs
index ef7db81..574dade 100644
--- a/crates/hfx-ops/src/qualification_event_evidence.rs
+++ b/crates/hfx-ops/src/qualification_event_evidence.rs
@@ -41,6 +41,16 @@ pub(crate) fn cursor_evidence(cursor: &EventCursor) -> String {
     format!("{CURSOR_EVIDENCE_PREFIX}{}", digest_hex(&encoded))
 }
 
+pub(crate) fn cursor_anchor_unavailable(batch: &EventBatch, evidence_refs: &[String]) -> bool {
+    evidence_refs
+        .iter()
+        .any(|value| value.starts_with(CURSOR_EVIDENCE_PREFIX))
+        && matches!(
+            latest_anchor_sequence(batch, evidence_refs),
+            Err(EventEvidenceError::AnchorUnavailable)
+        )
+}
+
 pub(crate) fn device_return_restore(
     batch: &EventBatch,
     evidence_refs: &[String],
diff --git a/crates/hfx-ops/src/qualification_lifecycle.rs b/crates/hfx-ops/src/qualification_lifecycle.rs
index d68a8a5..9cbad76 100644
--- a/crates/hfx-ops/src/qualification_lifecycle.rs
+++ b/crates/hfx-ops/src/qualification_lifecycle.rs
@@ -2,8 +2,8 @@
 
 use crate::qualification::{SYSTEM_RESUME_RETRY_EVIDENCE, StageCheckpoint, StageProgress};
 use crate::qualification_event_evidence::{
-    DeviceReturnEvidenceMode, cursor_evidence, device_return_restore, renewed_generation_restores,
-    resumed_generation_restores,
+    DeviceReturnEvidenceMode, cursor_anchor_unavailable, cursor_evidence, device_return_restore,
+    renewed_generation_restores, resumed_generation_restores,
 };
 use crate::qualification_runner::{ObservationVerdict, RunnerTransition};
 use crate::{
@@ -300,6 +300,20 @@ pub(crate) fn observe_lifecycle(
     }
 }
 
+pub(crate) fn reset_unavailable_event_anchor(
+    run: &mut LifecycleRunState,
+    events: Option<&EventBatch>,
+) -> Option<String> {
+    let active = run.active.as_ref()?;
+    let events = events?;
+    if !cursor_anchor_unavailable(events, &active.evidence_refs) {
+        return None;
+    }
+    let stage_id = active.stage_id.clone();
+    run.active = None;
+    Some(stage_id)
+}
+
 pub(crate) fn start_lifecycle_stage(
     mut run: LifecycleRunState,
     stage: &QualificationStage,
@@ -1784,6 +1798,42 @@ mod tests {
         )
     }
 
+    #[test]
+    fn unavailable_event_anchor_restarts_only_the_active_lifecycle_stage() {
+        let (run, _, _) = start_stage("keyboard-test");
+        let device_id = run
+            .active
+            .as_ref()
+            .expect("stage is active")
+            .device_id
+            .clone();
+        let events = test_events(&run, &device_id, run.receiver.generation_id);
+
+        let mut current = run.clone();
+        assert_eq!(
+            reset_unavailable_event_anchor(&mut current, Some(&events)),
+            None
+        );
+        assert!(current.active.is_some());
+
+        let mut replaced_stream = events;
+        replaced_stream.next_cursor.stream_id =
+            StreamId::try_from("replacement-lifecycle-stream").expect("stream id");
+        let stage_id = run
+            .active
+            .as_ref()
+            .expect("stage is active")
+            .stage_id
+            .clone();
+        let mut stale = run;
+        assert_eq!(
+            reset_unavailable_event_anchor(&mut stale, Some(&replaced_stream)),
+            Some(stage_id)
+        );
+        assert!(stale.active.is_none());
+        stale.validate().expect("remaining campaign stays valid");
+    }
+
     #[test]
     fn campaign_requires_every_non_lifecycle_prerequisite() {
         let view = fixture_view("rust-qualified-pair.json", false);
diff --git a/crates/hfx-ops/src/qualification_server.rs b/crates/hfx-ops/src/qualification_server.rs
index 63ac994..6b0fdaa 100644
--- a/crates/hfx-ops/src/qualification_server.rs
+++ b/crates/hfx-ops/src/qualification_server.rs
@@ -5,7 +5,7 @@ use crate::qualification_lifecycle::{
     PreparedLifecycleAction, capture_lifecycle_run, current_suspend_stamp,
     identity_transition_matches, observe_lifecycle, overlay_lifecycle_run,
     prepare_lifecycle_checkpoint, reconcile_system_resume, recover_retryable_resume_failure,
-    start_lifecycle_stage,
+    reset_unavailable_event_anchor, start_lifecycle_stage,
 };
 use crate::qualification_migration::{
     migrate_profile_catalog_state, qualification_stage_authorities,
@@ -298,6 +298,9 @@ fn live_view(
     if reconcile_lifecycle_resume_state(integration.as_ref(), state) {
         changed = true;
     }
+    if reconcile_lifecycle_event_anchor(integration.as_ref(), state) {
+        changed = true;
+    }
     if let Some(run) = &state.lifecycle_run {
         overlay_lifecycle_run(&mut view, run);
     }
@@ -398,6 +401,24 @@ fn reconcile_lifecycle_resume_state(
     true
 }
 
+fn reconcile_lifecycle_event_anchor(
+    integration: Option<&crate::BridgeIntegration>,
+    session: &mut ServerState,
+) -> bool {
+    let Some(mut run) = session.lifecycle_run.clone() else {
+        return false;
+    };
+    let Some(stage_id) =
+        reset_unavailable_event_anchor(&mut run, integration.map(|value| &value.events))
+    else {
+        return false;
+    };
+    session.lifecycle_run = Some(run);
+    session.results.remove(&stage_id);
+    session.revision = session.revision.saturating_add(1);
+    true
+}
+
 fn reconcile_pending(
     probe: &RealSystemProbe,
     view: &QualificationView,

From ff1f71d8e41f7c340f1f6890878e796ec9985562 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:38:10 +0400
Subject: [PATCH 32/67] test: freeze proven behavior before wake restoration

---
 architecture/repository-atlas.json     |   2 +-
 assurance/README.md                    |   1 +
 assurance/protected-behavior.json      |  63 ++++++++++
 docs/generated/installation.md         |   4 +-
 docs/generated/repository-atlas.md     |   2 +-
 packaging/generated/install-plan.json  |   7 ++
 schemas/protected-behavior.schema.json | 106 ++++++++++++++++
 tests/test_assurance.py                |  28 +++++
 tools/hfxdev/protected_behavior.py     | 160 +++++++++++++++++++++++++
 tools/hfxdev/verification_run.py       |   1 +
 tools/hfxdev/verify.py                 |   2 +
 verification/tests.json                |   1 +
 12 files changed, 373 insertions(+), 4 deletions(-)
 create mode 100644 assurance/protected-behavior.json
 create mode 100644 schemas/protected-behavior.schema.json
 create mode 100644 tools/hfxdev/protected_behavior.py

diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index 8b16157..03c4831 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -43,7 +43,7 @@
       "inputs": ["Architecture invariants", "Verification evidence", "Dependency metadata"],
       "outputs": ["Release readiness assessment", "SBOM", "Coverage and model reports"],
       "public_contracts": ["No test result grants publication", "Missing evidence remains a blocker", "All models are explicitly bounded"],
-      "canonical_files": ["assurance/design-coverage.json", "assurance/dependencies.json", "assurance/formal-model.json", "assurance/performance-budgets.json", "assurance/release-gates.json"],
+      "canonical_files": ["assurance/design-coverage.json", "assurance/dependencies.json", "assurance/formal-model.json", "assurance/performance-budgets.json", "assurance/protected-behavior.json", "assurance/release-gates.json"],
       "generated_files": ["assurance/README.md", "assurance/generated/hyperflux-next.spdx.json", "docs/generated/release-gates.md"],
       "verification": ["assurance-contracts", "formal-model-contracts"],
       "limitations": ["Software evidence cannot replace pending physical qualification"],
diff --git a/assurance/README.md b/assurance/README.md
index 90ef17b..c9884fa 100644
--- a/assurance/README.md
+++ b/assurance/README.md
@@ -29,6 +29,7 @@ Owns explicit design coverage, bounded formal models, performance budgets, depen
 - [`assurance/dependencies.json`](dependencies.json)
 - [`assurance/formal-model.json`](formal-model.json)
 - [`assurance/performance-budgets.json`](performance-budgets.json)
+- [`assurance/protected-behavior.json`](protected-behavior.json)
 - [`assurance/release-gates.json`](release-gates.json)
 
 ## Verification
diff --git a/assurance/protected-behavior.json b/assurance/protected-behavior.json
new file mode 100644
index 0000000..4ae727d
--- /dev/null
+++ b/assurance/protected-behavior.json
@@ -0,0 +1,63 @@
+{
+  "$schema": "../schemas/protected-behavior.schema.json",
+  "schema": "hyperflux-protected-behavior-v1",
+  "source_revision": "0f5b13e8a22cc19f0bdd5d70b4f97cc679b1728a",
+  "software_baseline": {
+    "lane": "fast",
+    "status": "passed",
+    "required_nodes": [
+      "foundation-contracts",
+      "profile-contracts",
+      "protocol-contracts",
+      "rust-unit",
+      "simulator-contracts",
+      "kernel-profile-contracts",
+      "integration-contracts"
+    ]
+  },
+  "protected_surfaces": [
+    {
+      "id": "paired-identity-and-telemetry",
+      "summary": "Exact paired identities and passive telemetry remain generation-bound, profile-local, and fail closed.",
+      "authority_paths": ["profiles/children/", "profiles/receivers/", "driver/kernel/hyperflux-next-observation.c"],
+      "claim_ids": ["claim.child.00cd.passive-identity-telemetry", "claim.child.0296.passive-identity-telemetry", "claim.receiver.1532-00cf.generation-session"],
+      "verification_nodes": ["profile-contracts", "kernel-profile-contracts", "rust-unit"]
+    },
+    {
+      "id": "qualified-lighting-topology",
+      "summary": "The qualified mouse and keyboard LED maps, Static, Off, brightness, complete black, and software-effect frame transport remain unchanged.",
+      "authority_paths": ["profiles/children/", "crates/hfx-kernel-transport/", "protocol/"],
+      "claim_ids": ["claim.child.00cd.complete-led-map", "claim.child.0296.complete-keyboard-map", "claim.children.complete-static-black", "claim.children.static-off-brightness", "claim.children.software-effect-frame-continuity"],
+      "verification_nodes": ["profile-contracts", "protocol-contracts", "rust-unit", "integration-contracts"]
+    },
+    {
+      "id": "input-and-transport-safety",
+      "summary": "Ordinary HID input, sibling isolation, generation replacement, session ownership, and conservative transport outcomes remain protected.",
+      "authority_paths": ["driver/kernel/", "crates/hfx-core/", "crates/hfx-bridge/", "crates/hfx-kernel-transport/"],
+      "claim_ids": ["claim.receiver.1532-00cf.generation-session"],
+      "verification_nodes": ["formal-model-contracts", "kernel-profile-contracts", "rust-unit", "simulator-contracts"]
+    },
+    {
+      "id": "stable-lifecycle-restoration",
+      "summary": "Service start, receiver renewal, and system-resume restoration remain qualified while natural child wake remains explicitly outside this claim.",
+      "authority_paths": ["crates/hfx-core/src/restoration.rs", "crates/hfx-daemon/src/restoration.rs", "profiles/evidence/claims.json"],
+      "claim_ids": ["claim.receiver.stable-state-lifecycle-restore"],
+      "verification_nodes": ["rust-unit", "simulator-contracts"]
+    }
+  ],
+  "known_gaps": [
+    {
+      "id": "natural-device-wake-restoration",
+      "summary": "A terminal receiver transaction does not prove that a naturally waking child displayed the selected frame; the existing quiet-gap heuristic can finish too early.",
+      "forbidden_claim": "Natural device wake is not qualified until repeated watched cycles show no visible firmware Spectrum interval.",
+      "required_evidence": ["profile-bound return epochs", "bounded coalesced retries", "no-visible-Spectrum watched qualification", "controls preserved throughout every cycle"]
+    }
+  ],
+  "change_policy": {
+    "integration_only_prefixes": ["integrations/", "tests/cpp/", "tests/openrazer_compat_contracts.py", "tests/polychromatic_contracts.py"],
+    "protected_prefixes": ["driver/kernel/", "crates/hfx-core/", "crates/hfx-bridge/", "crates/hfx-daemon/", "crates/hfx-kernel-transport/", "profiles/", "protocol/", "runtime/"],
+    "advanced_capability_prefixes": ["knowledge/", "integrations/", "profiles/capabilities.json"],
+    "approval_required_when": ["advanced-change-touches-protected-prefix", "qualified-profile-runtime-digest-changes", "public-protocol-semantics-change"],
+    "required_reverification": ["profile-contracts", "protocol-contracts", "kernel-profile-contracts", "rust-unit", "simulator-contracts", "integration-contracts"]
+  }
+}
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 09689b9..d2fcaba 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,7 +33,7 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `151` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `152` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,7 +47,7 @@ The expanded source payload contains `151` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 49 | `-` |
+| `schemas` | 50 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index df74d4c..c844124 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -258,7 +258,7 @@ Owns explicit design coverage, bounded formal models, performance budgets, depen
 
 **Used by:** [GitHub governance authority](#governance), [Verification graph](#verification)
 
-**Canonical sources:** `assurance/design-coverage.json`, `assurance/dependencies.json`, `assurance/formal-model.json`, `assurance/performance-budgets.json`, `assurance/release-gates.json`.
+**Canonical sources:** `assurance/design-coverage.json`, `assurance/dependencies.json`, `assurance/formal-model.json`, `assurance/performance-budgets.json`, `assurance/protected-behavior.json`, `assurance/release-gates.json`.
 
 **Generated projections:** `assurance/README.md`, `assurance/generated/hyperflux-next.spdx.json`, `docs/generated/release-gates.md`.
 
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 93c59eb..ed56df4 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -466,6 +466,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/protected-behavior.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/protected-behavior.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/protocol-catalog.schema.json",
diff --git a/schemas/protected-behavior.schema.json b/schemas/protected-behavior.schema.json
new file mode 100644
index 0000000..8abcb57
--- /dev/null
+++ b/schemas/protected-behavior.schema.json
@@ -0,0 +1,106 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/protected-behavior-v1.json",
+  "title": "Protected HyperFlux behavior baseline",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "source_revision", "software_baseline", "protected_surfaces", "known_gaps", "change_policy"],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-protected-behavior-v1"},
+    "source_revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "software_baseline": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["lane", "status", "required_nodes"],
+      "properties": {
+        "lane": {"const": "fast"},
+        "status": {"const": "passed"},
+        "required_nodes": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[a-z0-9-]+$"}
+        }
+      }
+    },
+    "protected_surfaces": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/protected-surface"}
+    },
+    "known_gaps": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/known-gap"}
+    },
+    "change_policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["integration_only_prefixes", "protected_prefixes", "advanced_capability_prefixes", "approval_required_when", "required_reverification"],
+      "properties": {
+        "integration_only_prefixes": {"$ref": "#/$defs/paths"},
+        "protected_prefixes": {"$ref": "#/$defs/paths"},
+        "advanced_capability_prefixes": {"$ref": "#/$defs/paths"},
+        "approval_required_when": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["advanced-change-touches-protected-prefix", "qualified-profile-runtime-digest-changes", "public-protocol-semantics-change"]}
+        },
+        "required_reverification": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[a-z0-9-]+$"}
+        }
+      }
+    }
+  },
+  "$defs": {
+    "paths": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"type": "string", "pattern": "^[A-Za-z0-9_.+/-]+$"}
+    },
+    "protected-surface": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "summary", "authority_paths", "claim_ids", "verification_nodes"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z0-9.-]+$"},
+        "summary": {"type": "string", "minLength": 1},
+        "authority_paths": {"$ref": "#/$defs/paths"},
+        "claim_ids": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^claim\\.[a-z0-9.-]+$"}
+        },
+        "verification_nodes": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[a-z0-9-]+$"}
+        }
+      }
+    },
+    "known-gap": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "summary", "forbidden_claim", "required_evidence"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z0-9.-]+$"},
+        "summary": {"type": "string", "minLength": 1},
+        "forbidden_claim": {"type": "string", "minLength": 1},
+        "required_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "minLength": 1}
+        }
+      }
+    }
+  }
+}
diff --git a/tests/test_assurance.py b/tests/test_assurance.py
index 41c563c..ee99f29 100644
--- a/tests/test_assurance.py
+++ b/tests/test_assurance.py
@@ -20,6 +20,7 @@
     verify_package_performance_budgets,
     verify_static_performance_budgets,
 )
+from hfxdev.protected_behavior import load_protected_behavior
 from hfxdev.release import load_release_gates
 from hfxdev.supply_chain import load_dependency_inventory
 
@@ -59,6 +60,33 @@ def test_release_gates_match_constitution_and_keep_publication_locked(self) -> N
         self.assertEqual(gates[-1].status, "publication-locked")
         self.assertTrue(gates[-1].publication_authorization_required)
 
+    def test_protected_behavior_freezes_claims_and_the_natural_wake_gap(self) -> None:
+        baseline = load_protected_behavior(ROOT)
+        self.assertEqual(
+            baseline.source_revision,
+            "0f5b13e8a22cc19f0bdd5d70b4f97cc679b1728a",
+        )
+        self.assertIn("claim.child.00cd.complete-led-map", baseline.claim_ids)
+        self.assertIn("claim.child.0296.complete-keyboard-map", baseline.claim_ids)
+        self.assertEqual(
+            baseline.known_gap_ids,
+            ("natural-device-wake-restoration",),
+        )
+
+    def test_protected_behavior_separates_integrations_from_core_changes(self) -> None:
+        baseline = load_protected_behavior(ROOT)
+        integration_change = ("integrations/openrgb/src/controller.cpp",)
+        self.assertTrue(baseline.integration_only(integration_change))
+        self.assertEqual(baseline.protected_changes(integration_change), ())
+        mixed_advanced_change = (
+            "knowledge/reviewed-facts.json",
+            "crates/hfx-core/src/restoration.rs",
+        )
+        self.assertFalse(baseline.integration_only(mixed_advanced_change))
+        self.assertTrue(
+            baseline.advanced_change_requires_approval(mixed_advanced_change)
+        )
+
     def test_static_and_package_performance_budgets_fail_closed(self) -> None:
         static = verify_static_performance_budgets(ROOT, self.metrics)
         self.assertEqual(static["bridge-command-queue-capacity"], 128.0)
diff --git a/tools/hfxdev/protected_behavior.py b/tools/hfxdev/protected_behavior.py
new file mode 100644
index 0000000..39fb4fd
--- /dev/null
+++ b/tools/hfxdev/protected_behavior.py
@@ -0,0 +1,160 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import re
+from typing import Any, Iterable
+
+from .model import ModelError, load_json, require_unique
+
+
+ROOT_KEYS = {
+    "$schema",
+    "schema",
+    "source_revision",
+    "software_baseline",
+    "protected_surfaces",
+    "known_gaps",
+    "change_policy",
+}
+SURFACE_KEYS = {"id", "summary", "authority_paths", "claim_ids", "verification_nodes"}
+GAP_KEYS = {"id", "summary", "forbidden_claim", "required_evidence"}
+POLICY_KEYS = {
+    "integration_only_prefixes",
+    "protected_prefixes",
+    "advanced_capability_prefixes",
+    "approval_required_when",
+    "required_reverification",
+}
+REVISION = re.compile(r"^[0-9a-f]{40}$")
+
+
+@dataclass(frozen=True)
+class ProtectedBehavior:
+    source_revision: str
+    required_nodes: tuple[str, ...]
+    protected_prefixes: tuple[str, ...]
+    integration_only_prefixes: tuple[str, ...]
+    advanced_capability_prefixes: tuple[str, ...]
+    claim_ids: tuple[str, ...]
+    known_gap_ids: tuple[str, ...]
+
+    def protected_changes(self, paths: Iterable[str]) -> tuple[str, ...]:
+        return tuple(
+            sorted(
+                path
+                for path in paths
+                if any(path.startswith(prefix) for prefix in self.protected_prefixes)
+            )
+        )
+
+    def integration_only(self, paths: Iterable[str]) -> bool:
+        values = tuple(paths)
+        return bool(values) and all(
+            any(path.startswith(prefix) for prefix in self.integration_only_prefixes)
+            for path in values
+        )
+
+    def advanced_change_requires_approval(self, paths: Iterable[str]) -> bool:
+        values = tuple(paths)
+        is_advanced = any(
+            any(path.startswith(prefix) for prefix in self.advanced_capability_prefixes)
+            for path in values
+        )
+        return is_advanced and bool(self.protected_changes(values))
+
+
+def _exact(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - value.keys())
+    extra = sorted(value.keys() - expected)
+    if missing:
+        raise ModelError(f"{label}: missing fields {', '.join(missing)}")
+    if extra:
+        raise ModelError(f"{label}: unknown fields {', '.join(extra)}")
+
+
+def _strings(value: object, label: str) -> tuple[str, ...]:
+    if not isinstance(value, list) or not value or not all(isinstance(item, str) and item for item in value):
+        raise ModelError(f"{label}: expected a non-empty string list")
+    require_unique(value, label)
+    return tuple(value)
+
+
+def load_protected_behavior(root: Path) -> ProtectedBehavior:
+    value = load_json(root / "assurance" / "protected-behavior.json")
+    _exact(value, ROOT_KEYS, "protected behavior")
+    if value["schema"] != "hyperflux-protected-behavior-v1":
+        raise ModelError("protected behavior: unsupported schema")
+    revision = value["source_revision"]
+    if not isinstance(revision, str) or REVISION.fullmatch(revision) is None:
+        raise ModelError("protected behavior: invalid source revision")
+
+    baseline = value["software_baseline"]
+    if not isinstance(baseline, dict):
+        raise ModelError("protected behavior: software baseline must be an object")
+    _exact(baseline, {"lane", "status", "required_nodes"}, "software baseline")
+    if baseline["lane"] != "fast" or baseline["status"] != "passed":
+        raise ModelError("protected behavior: baseline must record a passing fast lane")
+    required_nodes = _strings(baseline["required_nodes"], "protected baseline nodes")
+
+    evidence = load_json(root / "profiles" / "evidence" / "claims.json")
+    available_claims = {claim["id"] for claim in evidence["claims"]}
+    surfaces = value["protected_surfaces"]
+    if not isinstance(surfaces, list) or not surfaces:
+        raise ModelError("protected behavior: protected surfaces must be non-empty")
+    surface_ids: list[str] = []
+    claim_ids: list[str] = []
+    for index, surface in enumerate(surfaces):
+        if not isinstance(surface, dict):
+            raise ModelError(f"protected surface {index}: expected an object")
+        _exact(surface, SURFACE_KEYS, f"protected surface {index}")
+        surface_ids.append(surface["id"])
+        _strings(surface["authority_paths"], f"protected surface {surface['id']} paths")
+        claims = _strings(surface["claim_ids"], f"protected surface {surface['id']} claims")
+        missing_claims = sorted(set(claims) - available_claims)
+        if missing_claims:
+            raise ModelError(
+                f"protected surface {surface['id']}: unknown claims {', '.join(missing_claims)}"
+            )
+        _strings(surface["verification_nodes"], f"protected surface {surface['id']} nodes")
+        claim_ids.extend(claims)
+    require_unique(surface_ids, "protected surface id")
+
+    gaps = value["known_gaps"]
+    if not isinstance(gaps, list) or not gaps:
+        raise ModelError("protected behavior: known gaps must be non-empty")
+    gap_ids: list[str] = []
+    for index, gap in enumerate(gaps):
+        if not isinstance(gap, dict):
+            raise ModelError(f"known gap {index}: expected an object")
+        _exact(gap, GAP_KEYS, f"known gap {index}")
+        gap_ids.append(gap["id"])
+        _strings(gap["required_evidence"], f"known gap {gap['id']} evidence")
+    require_unique(gap_ids, "known gap id")
+
+    policy = value["change_policy"]
+    if not isinstance(policy, dict):
+        raise ModelError("protected behavior: change policy must be an object")
+    _exact(policy, POLICY_KEYS, "protected change policy")
+    integration = _strings(policy["integration_only_prefixes"], "integration prefixes")
+    protected = _strings(policy["protected_prefixes"], "protected prefixes")
+    advanced = _strings(policy["advanced_capability_prefixes"], "advanced prefixes")
+    _strings(policy["approval_required_when"], "approval requirements")
+    reverification = _strings(policy["required_reverification"], "required reverification")
+    unknown_nodes = sorted(set(reverification) - set(required_nodes))
+    if unknown_nodes:
+        raise ModelError(
+            "protected behavior: reverification nodes are absent from the baseline: "
+            + ", ".join(unknown_nodes)
+        )
+    return ProtectedBehavior(
+        source_revision=revision,
+        required_nodes=required_nodes,
+        protected_prefixes=protected,
+        integration_only_prefixes=integration,
+        advanced_capability_prefixes=advanced,
+        claim_ids=tuple(sorted(set(claim_ids))),
+        known_gap_ids=tuple(gap_ids),
+    )
diff --git a/tools/hfxdev/verification_run.py b/tools/hfxdev/verification_run.py
index f3829c3..39b0b04 100644
--- a/tools/hfxdev/verification_run.py
+++ b/tools/hfxdev/verification_run.py
@@ -44,6 +44,7 @@
     ("generated-profiles", "generated/profiles/catalog.json", "file"),
     ("integration-catalog", "integrations/catalog.json", "file"),
     ("performance-budgets", "assurance/performance-budgets.json", "file"),
+    ("protected-behavior", "assurance/protected-behavior.json", "file"),
     ("protocol-catalog", "protocol/v5/catalog.json", "file"),
     ("release-gates", "assurance/release-gates.json", "file"),
     ("replay-fixtures", "tests/fixtures/replay", "tree"),
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 0acde55..a1f279e 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -38,6 +38,7 @@
     verify_package_performance_budgets,
     verify_static_performance_budgets,
 )
+from .protected_behavior import load_protected_behavior
 from .render import rendered_binary_files, rendered_files
 from .profiles import load_profile_inputs
 from .protocol import load_protocol_catalog
@@ -1030,6 +1031,7 @@ def _run_assurance_contracts(root: Path, _node: TestNode) -> None:
     load_dependency_inventory(root)
     verify_licensing_policy(root)
     load_release_gates(root)
+    load_protected_behavior(root)
     metrics = load_performance_budgets(root)
     verify_static_performance_budgets(root, metrics)
 
diff --git a/verification/tests.json b/verification/tests.json
index 0955074..e163ba7 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -99,6 +99,7 @@
         "LICENSES/*.txt",
         "tools/hfxdev/licensing.py",
         "tools/hfxdev/performance.py",
+        "tools/hfxdev/protected_behavior.py",
         "tools/hfxdev/release.py",
         "tools/hfxdev/supply_chain.py"
       ],

From 06444837f981ab960949385eac55eda984f67831 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 15:39:15 +0400
Subject: [PATCH 33/67] Implement profile-driven return restoration

---
 .../tests/fixtures/rust-qualified-mouse.json  |    6 +-
 .../tests/fixtures/rust-qualified-pair.json   |   10 +-
 architecture/repository-atlas.json            |    4 +-
 crates/hfx-bridge/src/backend.rs              |  176 +-
 crates/hfx-bridge/src/lib.rs                  |    2 +-
 crates/hfx-bridge/src/runtime_identity.rs     |   22 +-
 crates/hfx-bridge/src/snapshot.rs             |    1 +
 crates/hfx-bridge/tests/core_backend.rs       |   98 +-
 crates/hfx-bridge/tests/rpc_framing.rs        |    2 +-
 crates/hfx-core/src/desired_effects.rs        |  355 ++++
 crates/hfx-core/src/lib.rs                    |   10 +-
 crates/hfx-core/src/lifecycle.rs              |  380 +++-
 crates/hfx-core/tests/desired_effects.rs      |  168 ++
 crates/hfx-core/tests/return_lifecycle.rs     |  273 +++
 crates/hfx-daemon/src/manager.rs              |   29 +-
 crates/hfx-daemon/src/observation.rs          |  593 ++++--
 crates/hfx-daemon/src/restoration.rs          | 1545 +++++++-------
 crates/hfx-domain/src/generated.rs            |  168 ++
 .../hfx-integration-model/tests/view_model.rs |    1 +
 crates/hfx-profiles/src/catalog.rs            |   18 +-
 crates/hfx-profiles/src/generated.rs          |  118 +-
 crates/hfx-profiles/tests/catalog.rs          |   57 +-
 crates/hfx-protocol/src/generated.rs          |   38 +-
 crates/hfx-protocol/src/generated_v6.rs       | 1103 ++++++++++
 crates/hfx-protocol/src/generated_versions.rs |   20 +-
 crates/hfx-protocol/src/lib.rs                |    5 +-
 crates/hfx-protocol/src/snapshot.rs           |   50 +-
 crates/hfx-protocol/src/wire.rs               |   67 +-
 crates/hfx-protocol/tests/protocol.rs         |    6 +-
 .../hfx-protocol/tests/wire_and_snapshot.rs   |   91 +-
 crates/hfx-runtime/src/generated.rs           |    3 +-
 crates/hfx-sim/src/lib.rs                     |    2 +
 crates/hfx-sim/src/return_lifecycle.rs        |  181 ++
 .../hfx-sim/tests/return_lifecycle_matrix.rs  |  244 +++
 docs/generated/bridge-protocol-v6.md          |  627 ++++++
 docs/generated/bridge-protocol.md             |   19 +-
 docs/generated/domain-types.md                |    3 +
 docs/generated/installation.md                |    8 +-
 docs/generated/linux-runtime.md               |    2 +-
 docs/generated/repository-atlas.md            |    4 +-
 docs/generated/supported-hardware.md          |    6 +-
 .../generated/hyperflux_receiver_profiles.inc |    2 +-
 generated/knowledge/catalog.json              |    2 +-
 generated/profiles/catalog.json               |  108 +-
 packaging/generated/install-plan.json         |   28 +
 profiles/README.md                            |    1 +
 .../razer-basilisk-v3-pro-35k-00cd.json       |   10 +-
 .../razer-deathstalker-v2-pro-tkl-0296.json   |   10 +-
 profiles/lifecycle-policies.json              |   36 +
 protocol/registry.json                        |    8 +-
 protocol/v6/catalog.json                      |  569 +++++
 .../transaction-request-canonical.json        |    1 +
 runtime/linux.json                            |    3 +-
 schemas/README.md                             |    1 +
 schemas/domain-catalog.json                   |    3 +
 schemas/hardware-profile.schema.json          |   30 +-
 schemas/lifecycle-policy-catalog.schema.json  |   81 +
 schemas/linux-runtime.schema.json             |    6 +-
 .../hyperflux/generated/domain_json.hpp       |  135 ++
 .../hyperflux/generated/domain_types.hpp      |   78 +
 .../hyperflux/generated/profile_catalog.hpp   |  100 +-
 .../hyperflux/generated/protocol_json.hpp     |   41 +-
 .../hyperflux/generated/protocol_types.hpp    |   19 +-
 .../hyperflux/generated/protocol_v6_json.hpp  | 1878 +++++++++++++++++
 .../hyperflux/generated/protocol_v6_types.hpp |  790 +++++++
 .../hyperflux_sdk/generated/domain_types.py   |   33 +
 .../hyperflux_sdk/generated/linux_runtime.py  |    3 +-
 .../generated/profile_catalog.py              |   69 +-
 .../hyperflux_sdk/generated/protocol_types.py |   23 +-
 .../generated/protocol_v6_types.py            |  930 ++++++++
 tests/cpp/domain_types_smoke.cpp              |    7 +-
 .../generated/profile-compositions.json       |    2 +-
 tests/test_profiles.py                        |  207 +-
 tests/test_protocol.py                        |   13 +-
 tools/hfxdev/generators/linux_runtime.py      |    3 -
 tools/hfxdev/generators/profiles.py           |  269 ++-
 tools/hfxdev/linux_runtime.py                 |    8 -
 tools/hfxdev/profiles.py                      |  289 ++-
 tools/hfxdev/verification_run.py              |    2 +-
 79 files changed, 10954 insertions(+), 1359 deletions(-)
 create mode 100644 crates/hfx-core/src/desired_effects.rs
 create mode 100644 crates/hfx-core/tests/desired_effects.rs
 create mode 100644 crates/hfx-core/tests/return_lifecycle.rs
 create mode 100644 crates/hfx-protocol/src/generated_v6.rs
 create mode 100644 crates/hfx-sim/src/return_lifecycle.rs
 create mode 100644 crates/hfx-sim/tests/return_lifecycle_matrix.rs
 create mode 100644 docs/generated/bridge-protocol-v6.md
 create mode 100644 profiles/lifecycle-policies.json
 create mode 100644 protocol/v6/catalog.json
 create mode 100644 protocol/v6/fixtures/transaction-request-canonical.json
 create mode 100644 schemas/lifecycle-policy-catalog.schema.json
 create mode 100644 sdk/cpp/include/hyperflux/generated/protocol_v6_json.hpp
 create mode 100644 sdk/cpp/include/hyperflux/generated/protocol_v6_types.hpp
 create mode 100644 sdk/python/hyperflux_sdk/generated/protocol_v6_types.py

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index e7836fa..f6c6e90 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
+    "profile_catalog_digest": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
   },
   "receivers": [
     {
@@ -38,7 +38,7 @@
           "product_id": 205,
           "profile": {
             "id": "child.razer.basilisk-v3-pro-35k.00cd",
-            "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
+            "digest": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -130,7 +130,7 @@
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
-        "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
+        "digest": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 7d5779f..3fec05c 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
+    "profile_catalog_digest": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
   },
   "receivers": [
     {
@@ -38,7 +38,7 @@
           "product_id": 205,
           "profile": {
             "id": "child.razer.basilisk-v3-pro-35k.00cd",
-            "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
+            "digest": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -127,7 +127,7 @@
           "product_id": 662,
           "profile": {
             "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-            "digest": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a"
+            "digest": "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63"
           },
           "presence": "active",
           "support": "production-qualified",
@@ -214,7 +214,7 @@
       "device_id": "mouse-test",
       "profile_binding": {
         "id": "child.razer.basilisk-v3-pro-35k.00cd",
-        "digest": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc"
+        "digest": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
@@ -444,7 +444,7 @@
       "device_id": "keyboard-test",
       "profile_binding": {
         "id": "child.razer.deathstalker-v2-pro-tkl.0296",
-        "digest": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a"
+        "digest": "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63"
       },
       "verdict": "not-run",
       "summary": "5 evidence checks for this exact profile and receiver generation.",
diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index 03c4831..5bb5313 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -27,7 +27,7 @@
       "inputs": ["Architecture invariants", "Canonical subsystem requirements"],
       "outputs": ["Validated canonical data", "Generator input contracts"],
       "public_contracts": ["Additional properties rejected", "Stable schema identifiers", "Safe repository-relative paths"],
-      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json"],
+      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json", "schemas/lifecycle-policy-catalog.schema.json"],
       "generated_files": ["schemas/README.md", "docs/generated/domain-types.md"],
       "verification": ["schema-contracts", "repository-atlas-contracts"],
       "limitations": ["Schemas validate structure and bounded values, not real hardware behavior"],
@@ -75,7 +75,7 @@
       "inputs": ["Reviewed evidence claims", "Canonical capability vocabulary", "Integration metadata references"],
       "outputs": ["Compiled profile catalog", "Kernel-safe receiver table", "SDK profile bindings"],
       "public_contracts": ["Exact identity plus public evidence gates writes", "Children compose independently", "Candidates inherit no authority"],
-      "canonical_files": ["profiles/capabilities.json", "profiles/evidence/claims.json", "profiles/receivers/razer-hyperflux-v2-1532-00cf.json", "profiles/surfaces/razer-hyperflux-v2-hard-edition.json", "profiles/children/razer-basilisk-v3-pro-35k-00cd.json", "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json", "profiles/candidates/razer-hyperflux-v2-2026-07-13.json", "profiles/candidates/razer-hyperflux-v2-2026-07-21.json"],
+      "canonical_files": ["profiles/capabilities.json", "profiles/lifecycle-policies.json", "profiles/evidence/claims.json", "profiles/receivers/razer-hyperflux-v2-1532-00cf.json", "profiles/surfaces/razer-hyperflux-v2-hard-edition.json", "profiles/children/razer-basilisk-v3-pro-35k-00cd.json", "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json", "profiles/candidates/razer-hyperflux-v2-2026-07-13.json", "profiles/candidates/razer-hyperflux-v2-2026-07-21.json"],
       "generated_files": ["profiles/README.md", "generated/profiles/catalog.json", "docs/generated/supported-hardware.md"],
       "verification": ["profile-contracts"],
       "limitations": ["Only two child profiles currently carry physical qualification"],
diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index d8adcad..df0bec6 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -10,13 +10,13 @@ use crate::{
     SnapshotProjectionError, SnapshotProjector, SubscriptionRegistry, SubscriptionRegistryError,
 };
 use hfx_core::{
-    BoundedEventLog, Clock, DiagnosticRegistry, DiagnosticRegistryError, DispatchResult,
-    EventDraft, EventLogError, EventSink, LeaseManager, LeaseManagerError, LifecycleLimits,
-    OutcomeJournalError, OutcomeLookup, PersistedStableIntent, ProfileRegistry,
+    BoundedEventLog, Clock, DesiredEffectError, DiagnosticRegistry, DiagnosticRegistryError,
+    DispatchResult, EventDraft, EventLogError, EventSink, LeaseManager, LeaseManagerError,
+    LifecycleLimits, OutcomeJournalError, OutcomeLookup, PersistedStableIntent, ProfileRegistry,
     ReceiverLifecycleRegistry, ReceiverTransport, RestorationAuthority, RestorationError,
     RestoreAdvanceResult, RestorePlanResult, RestoreRecord, RestoreTrigger, SessionAuthority,
     StableCommitOutcome, SubmissionResult, TransactionCoordinator, TransactionCoordinatorError,
-    TransactionQueueError, WallClock,
+    TransactionQueueError, VolatileEffectRegistry, WallClock,
 };
 use hfx_domain::{
     EventKind, FindingId, LeaseDurationMs, MonotonicMs, ProjectionRevision, ProtocolErrorKind,
@@ -59,6 +59,14 @@ pub struct BridgeDispatchResult {
     pub stable_capture: StableCaptureStatus,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DesiredEffectReplayStatus {
+    NotAvailable,
+    Queued,
+    Deferred,
+    Invalidated,
+}
+
 impl Deref for BridgeDispatchResult {
     type Target = DispatchResult;
 
@@ -105,6 +113,7 @@ pub struct CoreBridgeBackend<C, W, T, R, S> {
     profiles: RuntimeProfileAuthority,
     leases: LeaseManager,
     transactions: TransactionCoordinator,
+    desired_effects: VolatileEffectRegistry,
     events: BoundedEventLog,
     diagnostics: DiagnosticRegistry,
     subscriptions: SubscriptionRegistry,
@@ -147,6 +156,12 @@ where
         let transactions =
             TransactionCoordinator::new(usize::from(config.transaction_capacity.get()))
                 .map_err(CoreBridgeBackendError::Transaction)?;
+        let desired_effects = VolatileEffectRegistry::new(usize::from(
+            config.transaction_capacity.get(),
+        ))
+        .map_err(|_| {
+            CoreBridgeBackendError::Transaction(TransactionCoordinatorError::InvalidCapacity)
+        })?;
         let events = BoundedEventLog::new(
             config.stream_id.clone(),
             config.stream_epoch,
@@ -170,6 +185,7 @@ where
             profiles,
             leases,
             transactions,
+            desired_effects,
             events,
             diagnostics,
             subscriptions,
@@ -237,6 +253,10 @@ where
                         Err(error) => StableCaptureStatus::Failed(error),
                     }
                 });
+        if let Some(completed) = dispatch.completed.as_ref() {
+            self.desired_effects
+                .observe_completed(&completed.request, &completed.terminal);
+        }
         Ok(BridgeDispatchResult {
             dispatch,
             stable_capture,
@@ -263,7 +283,7 @@ where
         &mut self,
         observation: ReceiverGenerationObservation,
     ) -> Result<GenerationActivationOutcome, GenerationOrchestrationError> {
-        GenerationOrchestrator::activate(
+        let outcome = GenerationOrchestrator::activate(
             observation,
             self.config.lifecycle_limits,
             &self.transport,
@@ -274,7 +294,14 @@ where
             &mut self.transactions,
             &mut self.events,
             &mut self.event_sink,
-        )
+        )?;
+        if let GenerationActivationOutcome::Applied(activation) = &outcome
+            && let Some(previous_generation) = activation.previous_generation
+        {
+            self.desired_effects
+                .remove_generation(&activation.receiver_id, previous_generation);
+        }
+        Ok(outcome)
     }
 
     /// Begins a transport-confirmed receiver disconnect and revokes all live
@@ -287,7 +314,7 @@ where
         &mut self,
         observation: ReceiverDisconnectObservation,
     ) -> Result<ReceiverDisconnectOutcome, GenerationOrchestrationError> {
-        GenerationOrchestrator::begin_disconnect(
+        let outcome = GenerationOrchestrator::begin_disconnect(
             observation,
             &self.transport,
             &mut self.restoration,
@@ -296,7 +323,12 @@ where
             &mut self.transactions,
             &mut self.events,
             &mut self.event_sink,
-        )
+        )?;
+        if let ReceiverDisconnectOutcome::Applied(disconnect) = &outcome {
+            self.desired_effects
+                .remove_generation(&disconnect.receiver_id, disconnect.generation_id);
+        }
+        Ok(outcome)
     }
 
     /// Completes a previously begun receiver disconnect and retires its
@@ -465,6 +497,88 @@ where
         )
     }
 
+    /// Queues the latest owner-bound software-effect frame for one returning
+    /// endpoint through the ordinary transaction authority.
+    ///
+    /// Expected stale ownership and temporary readiness outcomes are returned
+    /// as lifecycle statuses. Structural, identity, event, and outcome failures
+    /// remain typed RPC failures.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed RPC failure when fresh replay identity cannot be issued,
+    /// retained effect state is invalid, or ordinary transaction admission
+    /// encounters a non-recoverable internal failure.
+    #[allow(clippy::too_many_arguments)]
+    pub fn queue_desired_effect_replay(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: hfx_domain::GenerationId,
+        device_id: &hfx_domain::LogicalDeviceId,
+        sessions: &SessionRegistry,
+        authority_window_ms: u64,
+    ) -> Result<DesiredEffectReplayStatus, RpcFailure> {
+        let deadline = self
+            .clock
+            .now()
+            .get()
+            .checked_add(authority_window_ms)
+            .and_then(|value| hfx_domain::MonotonicMs::try_from(value).ok())
+            .ok_or_else(RpcFailure::internal)?;
+        let request_id = self.identities.request_id().map_err(identity_failure)?;
+        let transaction_id = self.identities.transaction_id().map_err(identity_failure)?;
+        let dispatch_nonce = self.identities.dispatch_nonce().map_err(identity_failure)?;
+        let Some(replay) = self
+            .desired_effects
+            .plan_replay(
+                receiver_id,
+                generation_id,
+                device_id,
+                request_id,
+                transaction_id,
+                dispatch_nonce,
+                deadline,
+            )
+            .map_err(desired_effect_failure)?
+        else {
+            return Ok(DesiredEffectReplayStatus::NotAvailable);
+        };
+        let profiles = self.profiles.view(&self.receivers);
+        match self.transactions.submit(
+            replay.request,
+            replay.submission,
+            self.clock.now(),
+            sessions,
+            &self.leases,
+            &profiles,
+            &profiles,
+            &self.transport,
+            &mut self.events,
+            &mut self.event_sink,
+        ) {
+            Ok(SubmissionResult::Queued(_)) => Ok(DesiredEffectReplayStatus::Queued),
+            Ok(SubmissionResult::Replay(_)) => Err(RpcFailure::internal()),
+            Err(
+                TransactionCoordinatorError::DeviceNotReady(_)
+                | TransactionCoordinatorError::Queue(
+                    TransactionQueueError::Full | TransactionQueueError::DeadlineElapsed,
+                ),
+            ) => Ok(DesiredEffectReplayStatus::Deferred),
+            Err(
+                TransactionCoordinatorError::SessionRevoked
+                | TransactionCoordinatorError::OwnershipDenied
+                | TransactionCoordinatorError::StaleGeneration
+                | TransactionCoordinatorError::UnsupportedResource
+                | TransactionCoordinatorError::ProfileBindingChanged,
+            ) => {
+                self.desired_effects
+                    .remove_target(receiver_id, generation_id, device_id);
+                Ok(DesiredEffectReplayStatus::Invalidated)
+            }
+            Err(error) => Err(transaction_failure(error)),
+        }
+    }
+
     #[must_use]
     pub fn now(&self) -> MonotonicMs {
         self.clock.now()
@@ -511,6 +625,11 @@ where
         self.transactions.queued_len()
     }
 
+    #[must_use]
+    pub fn desired_effect_frames(&self) -> usize {
+        self.desired_effects.len()
+    }
+
     #[must_use]
     pub fn active_subscriptions(&self) -> usize {
         self.subscriptions.len()
@@ -588,7 +707,7 @@ where
 
         let mut next_events = self.events.clone();
         let mut emitted = Vec::with_capacity(expired.len());
-        for grant in expired {
+        for grant in &expired {
             emitted.push(
                 next_events
                     .append(EventDraft {
@@ -596,7 +715,7 @@ where
                         receiver_id: None,
                         generation_id: None,
                         device_id: None,
-                        lease_id: Some(grant.lease_id),
+                        lease_id: Some(grant.lease_id.clone()),
                         transaction_id: None,
                         finding_id: None,
                     })
@@ -606,6 +725,9 @@ where
 
         self.leases = next_leases;
         self.events = next_events;
+        for grant in expired {
+            self.desired_effects.remove_lease(&grant.lease_id);
+        }
         for event in emitted {
             let _ = self.event_sink.try_emit(&event);
         }
@@ -698,6 +820,7 @@ where
     ) -> Result<LeaseResult, RpcFailure> {
         Self::authorize_client(context, &request.client_id)?;
         self.tick()?;
+        let released_lease_id = request.lease_id.clone();
         let decision = self
             .leases
             .release_request_decision(request, self.clock.now())
@@ -707,6 +830,9 @@ where
         {
             self.record_ownership_change(grant.lease_id.clone())?;
         }
+        if decision.changed {
+            self.desired_effects.remove_lease(&released_lease_id);
+        }
         Ok(decision.result)
     }
 
@@ -717,12 +843,18 @@ where
     ) -> Result<TransactionResult, RpcFailure> {
         Self::authorize_client(context, &request.client_id)?;
         self.tick()?;
+        self.desired_effects
+            .validate_admission(&request)
+            .map_err(desired_effect_failure)?;
         let nonce = self.identities.dispatch_nonce().map_err(identity_failure)?;
+        let submission = context.session().submission_binding(nonce);
+        let desired_request = request.clone();
         let profiles = self.profiles.view(&self.receivers);
-        self.transactions
+        let result = self
+            .transactions
             .submit(
                 request,
-                context.session().submission_binding(nonce),
+                submission.clone(),
                 self.clock.now(),
                 context.sessions(),
                 &self.leases,
@@ -732,11 +864,16 @@ where
                 &mut self.events,
                 &mut self.event_sink,
             )
-            .map(|result| match result {
-                SubmissionResult::Queued(progress) => TransactionResult::Progress(progress),
-                SubmissionResult::Replay(result) => result,
-            })
-            .map_err(transaction_failure)
+            .map_err(transaction_failure)?;
+        if matches!(result, SubmissionResult::Queued(_)) {
+            self.desired_effects
+                .capture_admitted(&desired_request, &submission)
+                .map_err(desired_effect_failure)?;
+        }
+        Ok(match result {
+            SubmissionResult::Queued(progress) => TransactionResult::Progress(progress),
+            SubmissionResult::Replay(result) => result,
+        })
     }
 
     fn transaction_outcome(
@@ -798,6 +935,7 @@ where
 
     fn disconnect(&mut self, session: &AuthorizedSession) -> Result<(), RpcFailure> {
         self.tick()?;
+        self.desired_effects.remove_session(&session.session_id);
         let _ = self.subscriptions.revoke_session(session);
         let released = self.leases.release_client(&session.client_id);
         let mut first_failure = None;
@@ -822,6 +960,10 @@ fn finding(code: ErrorCode) -> FindingId {
         .expect("generated error codes satisfy the finding identity bound")
 }
 
+fn desired_effect_failure(_error: DesiredEffectError) -> RpcFailure {
+    RpcFailure::internal()
+}
+
 const fn request_failure() -> RpcFailure {
     RpcFailure::new(ErrorCode::HfxRequest001, ProtocolErrorKind::InvalidRequest)
 }
diff --git a/crates/hfx-bridge/src/lib.rs b/crates/hfx-bridge/src/lib.rs
index 9978e8f..f043152 100644
--- a/crates/hfx-bridge/src/lib.rs
+++ b/crates/hfx-bridge/src/lib.rs
@@ -26,7 +26,7 @@ pub use actor::{
 };
 pub use backend::{
     BridgeDispatchResult, CoreBridgeBackend, CoreBridgeBackendError, CoreBridgeConfig,
-    StableCaptureStatus,
+    DesiredEffectReplayStatus, StableCaptureStatus,
 };
 pub use clock::{LinuxMonotonicClock, LinuxWallClock};
 pub use connection::{ConnectionServeError, ConnectionServeReport, serve_connection};
diff --git a/crates/hfx-bridge/src/runtime_identity.rs b/crates/hfx-bridge/src/runtime_identity.rs
index 9591589..e944d0c 100644
--- a/crates/hfx-bridge/src/runtime_identity.rs
+++ b/crates/hfx-bridge/src/runtime_identity.rs
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{SessionIdentityError, SessionIdentitySource};
-use hfx_domain::{DispatchNonce, LeaseId, SubscriptionId};
+use hfx_domain::{DispatchNonce, LeaseId, RequestId, SubscriptionId, TransactionId};
 use std::fmt;
 
 const PROCESS_PREFIX_BYTES: usize = 16;
@@ -79,6 +79,26 @@ impl RuntimeIdentityIssuer {
         self.string_identity("subscription", sequence)
     }
 
+    /// Issues one process-unique request identity for bridge-owned replay.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error only after the finite process sequence is exhausted.
+    pub fn request_id(&mut self) -> Result<RequestId, RuntimeIdentityError> {
+        let sequence = self.take_sequence()?;
+        self.string_identity("request", sequence)
+    }
+
+    /// Issues one process-unique transaction identity for bridge-owned replay.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error only after the finite process sequence is exhausted.
+    pub fn transaction_id(&mut self) -> Result<TransactionId, RuntimeIdentityError> {
+        let sequence = self.take_sequence()?;
+        self.string_identity("transaction", sequence)
+    }
+
     /// Issues one nonzero dispatch nonce that cannot repeat in this process.
     ///
     /// # Errors
diff --git a/crates/hfx-bridge/src/snapshot.rs b/crates/hfx-bridge/src/snapshot.rs
index 46237d0..2c4234d 100644
--- a/crates/hfx-bridge/src/snapshot.rs
+++ b/crates/hfx-bridge/src/snapshot.rs
@@ -202,6 +202,7 @@ fn project_endpoint(endpoint: &EndpointLifecycle) -> EndpointSnapshot {
         confidence: latest.confidence(),
         evidence_claim_id: Some(latest.evidence_claim_id().clone()),
         observed_at_ms: Some(latest.observed_at_ms()),
+        return_epoch: None,
     }
 }
 
diff --git a/crates/hfx-bridge/tests/core_backend.rs b/crates/hfx-bridge/tests/core_backend.rs
index 801b118..8021799 100644
--- a/crates/hfx-bridge/tests/core_backend.rs
+++ b/crates/hfx-bridge/tests/core_backend.rs
@@ -2,9 +2,10 @@
 
 use hfx_bridge::{
     BridgeSessionConfig, ConnectionDispatcher, CoreBridgeBackend, CoreBridgeConfig,
-    DisabledRestorationSource, ReceiverRestorationSnapshot, RestorationProjectionError,
-    RestorationRuntime, RestorationSnapshotSource, RuntimeProfileAuthority, SessionIdentityError,
-    SessionIdentitySource, SessionRegistry, StableCaptureStatus,
+    DesiredEffectReplayStatus, DisabledRestorationSource, ReceiverRestorationSnapshot,
+    RestorationProjectionError, RestorationRuntime, RestorationSnapshotSource,
+    RuntimeProfileAuthority, SessionIdentityError, SessionIdentitySource, SessionRegistry,
+    StableCaptureStatus,
 };
 use hfx_core::{
     ChildIdentity, Clock, CompletedTransaction, EndpointIdentity, EventDelivery, EventSink,
@@ -506,6 +507,97 @@ fn assert_error(response: RpcResponse, finding: &str, kind: ProtocolErrorKind) {
     assert_eq!(envelope.error.kind, kind);
 }
 
+#[test]
+fn effect_return_replay_reuses_live_owner_authority_and_disconnect_invalidates_it() {
+    let mut backend = backend();
+    let mut sessions = SessionRegistry::new(
+        QueueCapacity::try_from(4_u16).expect("session capacity is canonical"),
+    );
+    let mut dispatcher = new_dispatcher();
+    let mut session_identities = DeterministicIdentities(48);
+    let hello = negotiate(
+        &mut dispatcher,
+        &mut session_identities,
+        &mut sessions,
+        &mut backend,
+    );
+    let acquired = dispatcher.dispatch(
+        RpcRequest::AcquireLease(SessionRequestEnvelope {
+            request_id: text("request-effect-acquire"),
+            protocol_session_id: hello.protocol_session_id.clone(),
+            negotiation_token: hello.negotiation_token.clone(),
+            params: lease_request("request-effect-acquire", resource("mouse", 1)),
+        }),
+        &mut session_identities,
+        &mut sessions,
+        &mut backend,
+    );
+    let RpcResponse::AcquireLeaseSuccess(acquired) = acquired else {
+        panic!("lease must be granted: {acquired:?}");
+    };
+    let LeaseResult::Granted(grant) = acquired.result else {
+        panic!("lease result must be granted");
+    };
+
+    let mut effect = static_transaction(&backend, grant.lease_id);
+    effect.transaction_class = TransactionClass::EffectFrame;
+    effect.stable_intents.clear();
+    let queued = dispatcher.dispatch(
+        RpcRequest::SubmitTransaction(SessionRequestEnvelope {
+            request_id: effect.request_id.clone(),
+            protocol_session_id: hello.protocol_session_id,
+            negotiation_token: hello.negotiation_token,
+            params: effect,
+        }),
+        &mut session_identities,
+        &mut sessions,
+        &mut backend,
+    );
+    assert!(matches!(
+        queued,
+        RpcResponse::SubmitTransactionSuccess(ref envelope)
+            if matches!(envelope.result, TransactionResult::Progress(_))
+    ));
+    assert_eq!(backend.desired_effect_frames(), 1);
+    backend
+        .dispatch_next(&sessions)
+        .expect("original effect frame dispatches");
+
+    assert_eq!(
+        backend
+            .queue_desired_effect_replay(
+                &text("receiver-1"),
+                generation(1),
+                &text("mouse"),
+                &sessions,
+                1_000,
+            )
+            .expect("return replay is coordinated"),
+        DesiredEffectReplayStatus::Queued
+    );
+    backend
+        .dispatch_next(&sessions)
+        .expect("return effect frame dispatches through normal authority");
+    assert_eq!(backend.transport().dispatches.len(), 2);
+
+    dispatcher
+        .disconnect(&mut sessions, &mut backend)
+        .expect("disconnect cleanup succeeds");
+    assert_eq!(backend.desired_effect_frames(), 0);
+    assert_eq!(
+        backend
+            .queue_desired_effect_replay(
+                &text("receiver-1"),
+                generation(1),
+                &text("mouse"),
+                &sessions,
+                1_000,
+            )
+            .expect("missing effect is a typed outcome"),
+        DesiredEffectReplayStatus::NotAvailable
+    );
+}
+
 #[test]
 #[allow(clippy::too_many_lines)]
 fn production_backend_composes_authority_replay_dispatch_events_and_cleanup() {
diff --git a/crates/hfx-bridge/tests/rpc_framing.rs b/crates/hfx-bridge/tests/rpc_framing.rs
index 33f8d91..69a7f94 100644
--- a/crates/hfx-bridge/tests/rpc_framing.rs
+++ b/crates/hfx-bridge/tests/rpc_framing.rs
@@ -313,7 +313,7 @@ fn unsupported_response_version_emits_no_partial_frame() {
         write_rpc_response_for_version(
             &mut output,
             &negotiation_response(),
-            ProtocolVersion::try_from(6_u16).expect("version number is canonical"),
+            ProtocolVersion::try_from(7_u16).expect("version number is canonical"),
         ),
         Err(FrameError::InvalidResponse(
             hfx_protocol::ProtocolWireError::UnsupportedProtocolVersion
diff --git a/crates/hfx-core/src/desired_effects.rs b/crates/hfx-core/src/desired_effects.rs
new file mode 100644
index 0000000..0a75354
--- /dev/null
+++ b/crates/hfx-core/src/desired_effects.rs
@@ -0,0 +1,355 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::SubmissionBinding;
+use hfx_domain::{
+    AuthorizationEpoch, DispatchNonce, FrameIndex, GenerationId, LeaseId, LogicalDeviceId,
+    MonotonicMs, ReceiverId, RequestId, SessionId, SideEffectCertainty, TransactionClass,
+    TransactionId, TransactionState,
+};
+use hfx_protocol::{
+    DeviceProfileBinding, LightingFrame, ProtocolValidationError, ResourceKey, TransactionRequest,
+    TransactionTerminal, validate_transaction,
+};
+use std::collections::BTreeMap;
+use std::fmt;
+
+/// Exact lifecycle scope of one volatile software-effect frame.
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+pub struct EffectFrameKey {
+    pub receiver_id: ReceiverId,
+    pub generation_id: GenerationId,
+    pub device_id: LogicalDeviceId,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct EffectFrameOwner {
+    session_id: SessionId,
+    authorization_epoch: AuthorizationEpoch,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct DesiredEffectFrame {
+    client_id: hfx_domain::ClientId,
+    lease_id: LeaseId,
+    receiver_profile_id: hfx_domain::ProfileId,
+    receiver_profile_digest: hfx_domain::ProfileDigest,
+    device_profile: DeviceProfileBinding,
+    resource: ResourceKey,
+    frame: LightingFrame,
+    owner: EffectFrameOwner,
+    revision: u64,
+}
+
+/// Fresh transaction material for one owner-bound effect replay.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EffectReplay {
+    pub request: TransactionRequest,
+    pub submission: SubmissionBinding,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EffectCapture {
+    pub captured: usize,
+    pub evicted: Vec<EffectFrameKey>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum DesiredEffectError {
+    InvalidCapacity,
+    InvalidTransaction(ProtocolValidationError),
+    RevisionExhausted,
+}
+
+impl fmt::Display for DesiredEffectError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidCapacity => "desired effect frame capacity is invalid",
+            Self::InvalidTransaction(_) => "desired effect transaction is invalid",
+            Self::RevisionExhausted => "desired effect frame revision is exhausted",
+        })
+    }
+}
+
+impl std::error::Error for DesiredEffectError {}
+
+/// Bounded process-local desired state for software-generated RGB frames.
+///
+/// This registry never grants authority and never writes hardware. A replay
+/// must pass through the ordinary session, lease, generation, profile, device,
+/// transaction, and transport checks again. Process exit deliberately drops
+/// every entry because software effects belong to a live application owner.
+#[derive(Clone, Debug)]
+pub struct VolatileEffectRegistry {
+    capacity: usize,
+    next_revision: u64,
+    entries: BTreeMap<EffectFrameKey, DesiredEffectFrame>,
+}
+
+impl VolatileEffectRegistry {
+    /// Creates one bounded registry.
+    ///
+    /// # Errors
+    ///
+    /// Rejects capacities outside the shared transaction bound.
+    pub fn new(capacity: usize) -> Result<Self, DesiredEffectError> {
+        if !(1..=4096).contains(&capacity) {
+            return Err(DesiredEffectError::InvalidCapacity);
+        }
+        Ok(Self {
+            capacity,
+            next_revision: 1,
+            entries: BTreeMap::new(),
+        })
+    }
+
+    /// Records the latest admitted effect frame for each target.
+    ///
+    /// Non-effect requests are ignored. Capacity pressure evicts the oldest
+    /// desired target deterministically; it never changes transaction outcome.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the request is malformed or the finite process
+    /// revision is exhausted. The registry remains unchanged on error.
+    pub fn capture_admitted(
+        &mut self,
+        request: &TransactionRequest,
+        submission: &SubmissionBinding,
+    ) -> Result<EffectCapture, DesiredEffectError> {
+        if request.transaction_class != TransactionClass::EffectFrame {
+            return Ok(EffectCapture {
+                captured: 0,
+                evicted: Vec::new(),
+            });
+        }
+        self.validate_admission(request)?;
+        let revision = self
+            .next_revision
+            .checked_add(1)
+            .ok_or(DesiredEffectError::RevisionExhausted)?;
+        let mut staged = Vec::with_capacity(request.frames.len());
+        for frame in &request.frames {
+            let device_profile = request
+                .device_profiles
+                .iter()
+                .find(|profile| profile.device_id == frame.device_id)
+                .ok_or(DesiredEffectError::InvalidTransaction(
+                    ProtocolValidationError::FrameWithoutProfileBinding,
+                ))?
+                .clone();
+            let resource = request
+                .resources
+                .iter()
+                .find(|resource| resource.device_id == frame.device_id)
+                .ok_or(DesiredEffectError::InvalidTransaction(
+                    ProtocolValidationError::FrameWithoutLightingLease,
+                ))?
+                .clone();
+            let key = EffectFrameKey {
+                receiver_id: request.receiver_id.clone(),
+                generation_id: request.generation_id,
+                device_id: frame.device_id.clone(),
+            };
+            let desired = DesiredEffectFrame {
+                client_id: request.client_id.clone(),
+                lease_id: request.lease_id.clone(),
+                receiver_profile_id: request.receiver_profile_id.clone(),
+                receiver_profile_digest: request.receiver_profile_digest.clone(),
+                device_profile,
+                resource,
+                frame: frame.clone(),
+                owner: EffectFrameOwner {
+                    session_id: submission.session_id.clone(),
+                    authorization_epoch: submission.authorization_epoch,
+                },
+                revision: self.next_revision,
+            };
+            staged.push((key, desired));
+        }
+
+        self.next_revision = revision;
+        let captured = staged.len();
+        for (key, desired) in staged {
+            self.entries.insert(key, desired);
+        }
+        let mut evicted = Vec::new();
+        while self.entries.len() > self.capacity {
+            let Some(oldest) = self
+                .entries
+                .iter()
+                .min_by_key(|(key, desired)| (desired.revision, *key))
+                .map(|(key, _)| key.clone())
+            else {
+                break;
+            };
+            self.entries.remove(&oldest);
+            evicted.push(oldest);
+        }
+        Ok(EffectCapture { captured, evicted })
+    }
+
+    /// Preflights effect capture without changing registry state.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the effect request is malformed or no further
+    /// process-local revision can be represented.
+    pub fn validate_admission(
+        &self,
+        request: &TransactionRequest,
+    ) -> Result<(), DesiredEffectError> {
+        if request.transaction_class != TransactionClass::EffectFrame {
+            return Ok(());
+        }
+        validate_transaction(request).map_err(DesiredEffectError::InvalidTransaction)?;
+        self.next_revision
+            .checked_add(1)
+            .ok_or(DesiredEffectError::RevisionExhausted)?;
+        Ok(())
+    }
+
+    /// Builds a fresh, single-target replay without changing registry state.
+    /// The caller must submit it through the ordinary transaction authority.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error only if internally retained validated state can no
+    /// longer form a valid request.
+    #[allow(clippy::too_many_arguments)]
+    pub fn plan_replay(
+        &self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: &LogicalDeviceId,
+        request_id: RequestId,
+        transaction_id: TransactionId,
+        dispatch_nonce: DispatchNonce,
+        deadline_ms: MonotonicMs,
+    ) -> Result<Option<EffectReplay>, DesiredEffectError> {
+        let key = EffectFrameKey {
+            receiver_id: receiver_id.clone(),
+            generation_id,
+            device_id: device_id.clone(),
+        };
+        let Some(desired) = self.entries.get(&key) else {
+            return Ok(None);
+        };
+        let mut frame = desired.frame.clone();
+        frame.frame_index = FrameIndex::try_from(FrameIndex::MIN).map_err(|_| {
+            DesiredEffectError::InvalidTransaction(ProtocolValidationError::NonCanonicalFrameOrder)
+        })?;
+        let request = TransactionRequest {
+            request_id,
+            transaction_id,
+            client_id: desired.client_id.clone(),
+            lease_id: desired.lease_id.clone(),
+            receiver_id: receiver_id.clone(),
+            generation_id,
+            receiver_profile_id: desired.receiver_profile_id.clone(),
+            receiver_profile_digest: desired.receiver_profile_digest.clone(),
+            device_profiles: vec![desired.device_profile.clone()],
+            transaction_class: TransactionClass::EffectFrame,
+            stable_intents: Vec::new(),
+            deadline_ms,
+            resources: vec![desired.resource.clone()],
+            frames: vec![frame],
+        };
+        validate_transaction(&request).map_err(DesiredEffectError::InvalidTransaction)?;
+        Ok(Some(EffectReplay {
+            request,
+            submission: SubmissionBinding {
+                session_id: desired.owner.session_id.clone(),
+                authorization_epoch: desired.owner.authorization_epoch,
+                dispatch_nonce,
+            },
+        }))
+    }
+
+    /// Drops volatile effect intent after a definitive user-authored stable
+    /// transaction replaces it.
+    pub fn observe_completed(
+        &mut self,
+        request: &TransactionRequest,
+        terminal: &TransactionTerminal,
+    ) {
+        if request.transaction_class != TransactionClass::StaticLighting
+            || !is_definitive_success(request, terminal)
+        {
+            return;
+        }
+        for frame in &request.frames {
+            self.remove_target(
+                &request.receiver_id,
+                request.generation_id,
+                &frame.device_id,
+            );
+        }
+    }
+
+    pub fn remove_target(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: &LogicalDeviceId,
+    ) -> bool {
+        self.entries
+            .remove(&EffectFrameKey {
+                receiver_id: receiver_id.clone(),
+                generation_id,
+                device_id: device_id.clone(),
+            })
+            .is_some()
+    }
+
+    pub fn remove_session(&mut self, session_id: &SessionId) -> usize {
+        let before = self.entries.len();
+        self.entries
+            .retain(|_, desired| desired.owner.session_id != *session_id);
+        before - self.entries.len()
+    }
+
+    pub fn remove_lease(&mut self, lease_id: &LeaseId) -> usize {
+        let before = self.entries.len();
+        self.entries
+            .retain(|_, desired| desired.lease_id != *lease_id);
+        before - self.entries.len()
+    }
+
+    pub fn remove_generation(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> usize {
+        let before = self.entries.len();
+        self.entries
+            .retain(|key, _| key.receiver_id != *receiver_id || key.generation_id != generation_id);
+        before - self.entries.len()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+}
+
+fn is_definitive_success(request: &TransactionRequest, terminal: &TransactionTerminal) -> bool {
+    let Ok(frame_count) = u16::try_from(request.frames.len()) else {
+        return false;
+    };
+    terminal.request_id == request.request_id
+        && terminal.transaction_id == request.transaction_id
+        && terminal.receiver_id == request.receiver_id
+        && terminal.generation_id == request.generation_id
+        && terminal.state == TransactionState::Succeeded
+        && terminal.declared_frames.get() == frame_count
+        && terminal.delivered_frames.get() == frame_count
+        && terminal.side_effect_certainty == SideEffectCertainty::Committed
+        && terminal.live_write_executed
+        && terminal.device_application != hfx_domain::DeviceApplicationState::Rejected
+        && terminal.error_kind.is_none()
+}
diff --git a/crates/hfx-core/src/lib.rs b/crates/hfx-core/src/lib.rs
index f92abf9..9a78138 100644
--- a/crates/hfx-core/src/lib.rs
+++ b/crates/hfx-core/src/lib.rs
@@ -3,6 +3,7 @@
 #![forbid(unsafe_code)]
 
 mod coordinator;
+mod desired_effects;
 mod diagnostics;
 mod events;
 mod leases;
@@ -16,14 +17,19 @@ pub use coordinator::{
     CompletedTransaction, DispatchResult, SubmissionResult, TransactionCoordinator,
     TransactionCoordinatorError,
 };
+pub use desired_effects::{
+    DesiredEffectError, EffectCapture, EffectFrameKey, EffectReplay, VolatileEffectRegistry,
+};
 pub use diagnostics::{BoundedDiagnosticSink, DiagnosticRegistry, DiagnosticRegistryError};
 pub use events::{BoundedEventLog, EventDraft, EventLogError};
+pub use hfx_domain::{RestoreDeliveryState, ReturnEvidence, ReturnPhase};
 pub use leases::{LeaseDecision, LeaseManager, LeaseManagerError};
 pub use lifecycle::{
     BatteryLifecycle, BatteryValue, ChildIdentity, DEFAULT_MAX_DEVICE_ENDPOINTS,
     DEFAULT_MAX_LIFECYCLE_DEVICES, DeviceLifecycle, EndpointIdentity, EndpointLifecycle,
-    LifecycleError, LifecycleFact, LifecycleLimits, ObservationStamp, ReceiverGenerationLifecycle,
-    ReceiverLifecycleMachine,
+    EndpointReturnLifecycle, EndpointReturnPolicy, LifecycleError, LifecycleFact, LifecycleLimits,
+    MAX_RETURN_RETRY_ATTEMPTS, MAX_RETURN_RETRY_WINDOW_MS, ObservationStamp,
+    ReceiverGenerationLifecycle, ReceiverLifecycleMachine, ReturnEpoch, ReturnTransition,
 };
 pub use ports::{
     Clock, DeviceStateAuthority, EventDelivery, EventSink, PersistedRestorePolicy,
diff --git a/crates/hfx-core/src/lifecycle.rs b/crates/hfx-core/src/lifecycle.rs
index f75daa5..e07ff94 100644
--- a/crates/hfx-core/src/lifecycle.rs
+++ b/crates/hfx-core/src/lifecycle.rs
@@ -9,13 +9,16 @@ use hfx_domain::{
     ActivityState, ApplyOutcome, BatteryPercent, ConnectionMode, ContactState, DeviceKind,
     EndpointId, EvidenceClaimId, EvidenceConfidence, FreshnessState, GenerationId, LogicalDeviceId,
     MonotonicMs, PairingState, PowerState, PresenceState, ProductId, ReceiverId,
-    ReceiverLifecycleState, RouteKind, RouteState, SequenceNumber, SleepState,
+    ReceiverLifecycleState, RestoreDeliveryState, ReturnEvidence, ReturnPhase, RouteKind,
+    RouteState, SequenceNumber, SleepState,
 };
 use std::collections::{BTreeMap, VecDeque};
 use std::fmt;
 
 pub const DEFAULT_MAX_LIFECYCLE_DEVICES: usize = 32;
 pub const DEFAULT_MAX_DEVICE_ENDPOINTS: usize = 8;
+pub const MAX_RETURN_RETRY_ATTEMPTS: usize = 32;
+pub const MAX_RETURN_RETRY_WINDOW_MS: u64 = 30_000;
 const MAX_RETIRED_GENERATIONS: usize = 256;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -81,6 +84,7 @@ pub enum LifecycleError {
         route_kind: RouteKind,
         connection_mode: ConnectionMode,
     },
+    InvalidReturnPolicy,
 }
 
 impl fmt::Display for LifecycleError {
@@ -113,6 +117,7 @@ impl fmt::Display for LifecycleError {
                 formatter,
                 "route {route_kind} cannot use connection mode {connection_mode}"
             ),
+            Self::InvalidReturnPolicy => formatter.write_str("endpoint return policy is invalid"),
         }
     }
 }
@@ -1308,3 +1313,376 @@ const fn valid_receiver_transition(
     !matches!(from, ReceiverLifecycleState::Disconnecting)
         || matches!(to, ReceiverLifecycleState::Disconnecting)
 }
+
+/// One immutable opening boundary plus its truthful, evolving delivery state.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ReturnEpoch {
+    sequence: SequenceNumber,
+    opened_at_ms: MonotonicMs,
+    opening_evidence: ReturnEvidence,
+    phase: ReturnPhase,
+    delivery: RestoreDeliveryState,
+}
+
+impl ReturnEpoch {
+    #[must_use]
+    pub const fn sequence(self) -> SequenceNumber {
+        self.sequence
+    }
+
+    #[must_use]
+    pub const fn opened_at_ms(self) -> MonotonicMs {
+        self.opened_at_ms
+    }
+
+    #[must_use]
+    pub const fn opening_evidence(self) -> ReturnEvidence {
+        self.opening_evidence
+    }
+
+    #[must_use]
+    pub const fn phase(self) -> ReturnPhase {
+        self.phase
+    }
+
+    #[must_use]
+    pub const fn delivery(self) -> RestoreDeliveryState {
+        self.delivery
+    }
+}
+
+/// A pure transition emitted by [`EndpointReturnLifecycle`].
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ReturnTransition {
+    None,
+    QuiescenceCandidate,
+    BecameUnavailable,
+    EpochOpened(ReturnEpoch),
+    EpochAccelerated(ReturnEpoch),
+    Synchronized(ReturnEpoch),
+    WindowCompleted(ReturnEpoch),
+}
+
+/// Validated universal policy for one qualified endpoint profile.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EndpointReturnPolicy {
+    quiescence_candidate_ms: u64,
+    observation_jitter_ms: u64,
+    retry_offsets_ms: Vec<u64>,
+    open_evidence: Vec<ReturnEvidence>,
+    accelerator_evidence: Vec<ReturnEvidence>,
+}
+
+impl EndpointReturnPolicy {
+    /// Builds a bounded policy from generated profile data.
+    ///
+    /// # Errors
+    ///
+    /// Rejects empty evidence, unordered or unbounded retries, zero
+    /// quiescence, duplicate evidence, or opening evidence that cannot also
+    /// accelerate its own active epoch.
+    pub fn new(
+        quiescence_candidate_ms: u64,
+        observation_jitter_ms: u64,
+        retry_offsets_ms: &[u64],
+        open_evidence: &[ReturnEvidence],
+        accelerator_evidence: &[ReturnEvidence],
+    ) -> Result<Self, LifecycleError> {
+        let retry_offsets_are_valid = (2..=MAX_RETURN_RETRY_ATTEMPTS)
+            .contains(&retry_offsets_ms.len())
+            && retry_offsets_ms.first() == Some(&0)
+            && retry_offsets_ms.windows(2).all(|pair| pair[0] < pair[1])
+            && retry_offsets_ms
+                .last()
+                .is_some_and(|offset| *offset <= MAX_RETURN_RETRY_WINDOW_MS);
+        let open_evidence_is_valid = !open_evidence.is_empty()
+            && evidence_is_unique(open_evidence)
+            && open_evidence
+                .iter()
+                .all(|evidence| accelerator_evidence.contains(evidence));
+        if quiescence_candidate_ms == 0
+            || observation_jitter_ms >= quiescence_candidate_ms
+            || !retry_offsets_are_valid
+            || !open_evidence_is_valid
+            || accelerator_evidence.is_empty()
+            || !evidence_is_unique(accelerator_evidence)
+        {
+            return Err(LifecycleError::InvalidReturnPolicy);
+        }
+        Ok(Self {
+            quiescence_candidate_ms,
+            observation_jitter_ms,
+            retry_offsets_ms: retry_offsets_ms.to_vec(),
+            open_evidence: open_evidence.to_vec(),
+            accelerator_evidence: accelerator_evidence.to_vec(),
+        })
+    }
+
+    #[must_use]
+    pub const fn quiescence_candidate_ms(&self) -> u64 {
+        self.quiescence_candidate_ms
+    }
+
+    #[must_use]
+    pub const fn observation_jitter_ms(&self) -> u64 {
+        self.observation_jitter_ms
+    }
+
+    #[must_use]
+    pub const fn effective_quiescence_ms(&self) -> u64 {
+        self.quiescence_candidate_ms - self.observation_jitter_ms
+    }
+
+    #[must_use]
+    pub fn retry_offsets_ms(&self) -> &[u64] {
+        &self.retry_offsets_ms
+    }
+
+    #[must_use]
+    pub fn open_evidence(&self) -> &[ReturnEvidence] {
+        &self.open_evidence
+    }
+
+    #[must_use]
+    pub fn accelerator_evidence(&self) -> &[ReturnEvidence] {
+        &self.accelerator_evidence
+    }
+}
+
+fn evidence_is_unique(evidence: &[ReturnEvidence]) -> bool {
+    evidence
+        .iter()
+        .enumerate()
+        .all(|(index, item)| !evidence[index + 1..].contains(item))
+}
+
+/// Pure, endpoint-local detector for return epochs and bounded replay windows.
+///
+/// It never infers an exact sleep timer. Endpoint activity opens an epoch only
+/// after the policy's conservative quiescence candidate; explicit route return
+/// can open immediately. Other profile-selected facts accelerate an existing
+/// epoch without extending its deadline.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct EndpointReturnLifecycle {
+    policy: EndpointReturnPolicy,
+    phase: ReturnPhase,
+    last_sequence: Option<SequenceNumber>,
+    last_observed_at_ms: Option<MonotonicMs>,
+    last_activity_ms: Option<MonotonicMs>,
+    epoch: Option<ReturnEpoch>,
+    seen_accelerators: u16,
+}
+
+impl EndpointReturnLifecycle {
+    #[must_use]
+    pub const fn new(policy: EndpointReturnPolicy) -> Self {
+        Self {
+            policy,
+            phase: ReturnPhase::Stable,
+            last_sequence: None,
+            last_observed_at_ms: None,
+            last_activity_ms: None,
+            epoch: None,
+            seen_accelerators: 0,
+        }
+    }
+
+    #[must_use]
+    pub const fn policy(&self) -> &EndpointReturnPolicy {
+        &self.policy
+    }
+
+    #[must_use]
+    pub const fn epoch(&self) -> Option<ReturnEpoch> {
+        self.epoch
+    }
+
+    #[must_use]
+    pub const fn phase(&self) -> ReturnPhase {
+        self.phase
+    }
+
+    /// Clears volatile activity/epoch anchors at a receiver suspend boundary.
+    pub fn reset_observation_anchor(&mut self) {
+        self.last_sequence = None;
+        self.last_observed_at_ms = None;
+        self.last_activity_ms = None;
+        self.epoch = None;
+        self.seen_accelerators = 0;
+        self.phase = ReturnPhase::Stable;
+    }
+
+    /// Applies one ordered passive fact and returns only a typed lifecycle edge.
+    pub fn observe(
+        &mut self,
+        evidence: ReturnEvidence,
+        sequence: SequenceNumber,
+        observed_at_ms: MonotonicMs,
+    ) -> ReturnTransition {
+        if self
+            .last_sequence
+            .is_some_and(|current| sequence <= current)
+            || self
+                .last_observed_at_ms
+                .is_some_and(|current| observed_at_ms < current)
+        {
+            return ReturnTransition::None;
+        }
+
+        let completed = self.complete_if_expired(observed_at_ms);
+        if evidence == ReturnEvidence::RouteDeparture {
+            self.last_sequence = Some(sequence);
+            self.last_observed_at_ms = Some(observed_at_ms);
+            self.epoch = None;
+            self.seen_accelerators = 0;
+            self.phase = ReturnPhase::Unavailable;
+            return ReturnTransition::BecameUnavailable;
+        }
+        if evidence == ReturnEvidence::ApplicationOwnershipLoss {
+            self.last_sequence = Some(sequence);
+            self.last_observed_at_ms = Some(observed_at_ms);
+            self.epoch = None;
+            self.seen_accelerators = 0;
+            self.phase = ReturnPhase::Stable;
+            return completed.map_or(ReturnTransition::None, ReturnTransition::WindowCompleted);
+        }
+        let activity_opens = if evidence == ReturnEvidence::EndpointActivity {
+            self.phase == ReturnPhase::Unavailable
+                || self.last_activity_ms.is_none_or(|prior| {
+                    observed_at_ms.get().saturating_sub(prior.get())
+                        >= self.policy.effective_quiescence_ms()
+                })
+        } else {
+            true
+        };
+        if evidence == ReturnEvidence::EndpointActivity {
+            self.last_activity_ms = Some(observed_at_ms);
+        }
+        self.last_sequence = Some(sequence);
+        self.last_observed_at_ms = Some(observed_at_ms);
+
+        if activity_opens && self.policy.open_evidence.contains(&evidence) {
+            let epoch = ReturnEpoch {
+                sequence,
+                opened_at_ms: observed_at_ms,
+                opening_evidence: evidence,
+                phase: ReturnPhase::Returning,
+                delivery: RestoreDeliveryState::NotAttempted,
+            };
+            self.epoch = Some(epoch);
+            self.seen_accelerators = if evidence == ReturnEvidence::EndpointActivity {
+                0
+            } else {
+                evidence_bit(evidence)
+            };
+            self.phase = ReturnPhase::Returning;
+            return ReturnTransition::EpochOpened(epoch);
+        }
+
+        if let Some(epoch) = self.epoch
+            && epoch.phase == ReturnPhase::Returning
+            && self.policy.accelerator_evidence.contains(&evidence)
+            && (evidence == ReturnEvidence::EndpointActivity
+                || self.seen_accelerators & evidence_bit(evidence) == 0)
+        {
+            if evidence != ReturnEvidence::EndpointActivity {
+                self.seen_accelerators |= evidence_bit(evidence);
+            }
+            return ReturnTransition::EpochAccelerated(epoch);
+        }
+        completed.map_or(ReturnTransition::None, ReturnTransition::WindowCompleted)
+    }
+
+    /// Records receiver-level delivery for the matching epoch only.
+    ///
+    /// A receiver-delivered result intentionally leaves the phase in
+    /// `Returning`: the
+    /// receiver acknowledgement is not proof that the child applied lighting.
+    pub fn note_delivery(
+        &mut self,
+        epoch_sequence: SequenceNumber,
+        delivery: RestoreDeliveryState,
+    ) -> ReturnTransition {
+        let Some(epoch) = self.epoch.as_mut() else {
+            return ReturnTransition::None;
+        };
+        if epoch.sequence != epoch_sequence || epoch.phase != ReturnPhase::Returning {
+            return ReturnTransition::None;
+        }
+        epoch.delivery = merge_delivery(epoch.delivery, delivery);
+        if epoch.delivery == RestoreDeliveryState::ChildConfirmed {
+            epoch.phase = ReturnPhase::Synchronized;
+            self.phase = ReturnPhase::Synchronized;
+            return ReturnTransition::Synchronized(*epoch);
+        }
+        ReturnTransition::None
+    }
+
+    /// Closes an elapsed retry window without making a physical-state claim.
+    pub fn advance(&mut self, now: MonotonicMs) -> ReturnTransition {
+        if let Some(epoch) = self.complete_if_expired(now) {
+            return ReturnTransition::WindowCompleted(epoch);
+        }
+        if matches!(self.phase, ReturnPhase::Stable | ReturnPhase::Synchronized)
+            && self.last_activity_ms.is_some_and(|activity| {
+                now.get().saturating_sub(activity.get()) >= self.policy.quiescence_candidate_ms
+            })
+        {
+            self.phase = ReturnPhase::QuiescentCandidate;
+            return ReturnTransition::QuiescenceCandidate;
+        }
+        ReturnTransition::None
+    }
+
+    fn complete_if_expired(&mut self, now: MonotonicMs) -> Option<ReturnEpoch> {
+        let epoch = self.epoch.as_mut()?;
+        if epoch.phase != ReturnPhase::Returning {
+            return None;
+        }
+        let final_offset = *self
+            .policy
+            .retry_offsets_ms
+            .last()
+            .expect("validated return policy has retries");
+        let deadline = epoch.opened_at_ms.get().saturating_add(final_offset);
+        if now.get() <= deadline {
+            return None;
+        }
+        epoch.phase = ReturnPhase::Stable;
+        self.phase = ReturnPhase::Stable;
+        Some(*epoch)
+    }
+}
+
+const fn evidence_bit(evidence: ReturnEvidence) -> u16 {
+    match evidence {
+        ReturnEvidence::ApplicationOwnershipLoss => 1 << 0,
+        ReturnEvidence::BatteryReport => 1 << 1,
+        ReturnEvidence::ContactReport => 1 << 2,
+        ReturnEvidence::EndpointActivity => 1 << 3,
+        ReturnEvidence::EndpointIdentity => 1 << 4,
+        ReturnEvidence::EndpointStatus => 1 << 5,
+        ReturnEvidence::ReceiverGeneration => 1 << 6,
+        ReturnEvidence::RouteDeparture => 1 << 7,
+        ReturnEvidence::RouteReturn => 1 << 8,
+        ReturnEvidence::SystemResume => 1 << 9,
+    }
+}
+
+const fn merge_delivery(
+    current: RestoreDeliveryState,
+    candidate: RestoreDeliveryState,
+) -> RestoreDeliveryState {
+    use RestoreDeliveryState::{
+        ChildConfirmed, ChildRejected, NotAttempted, OutcomeUncertain, ReceiverDelivered,
+        ReceiverRejected,
+    };
+    match (current, candidate) {
+        (ChildConfirmed, _) | (_, ChildConfirmed) => ChildConfirmed,
+        (ChildRejected, _) | (_, ChildRejected) => ChildRejected,
+        (ReceiverDelivered, _) | (_, ReceiverDelivered) => ReceiverDelivered,
+        (OutcomeUncertain, _) | (_, OutcomeUncertain) => OutcomeUncertain,
+        (ReceiverRejected, _) | (_, ReceiverRejected) => ReceiverRejected,
+        (NotAttempted, NotAttempted) => NotAttempted,
+    }
+}
diff --git a/crates/hfx-core/tests/desired_effects.rs b/crates/hfx-core/tests/desired_effects.rs
new file mode 100644
index 0000000..e81fd79
--- /dev/null
+++ b/crates/hfx-core/tests/desired_effects.rs
@@ -0,0 +1,168 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+mod common;
+
+use common::{generation, text, time, transaction_request};
+use hfx_core::{SubmissionBinding, VolatileEffectRegistry, canonical_request_digest};
+use hfx_domain::{
+    AuthorizationEpoch, DeliveredFrameCount, DeviceApplicationState, DispatchNonce, FrameCount,
+    SequenceNumber, SideEffectCertainty, TransactionClass, TransactionState,
+};
+use hfx_protocol::{TransactionRequest, TransactionTerminal, validate_transaction};
+
+fn binding(session: &str, nonce: u64) -> SubmissionBinding {
+    SubmissionBinding {
+        session_id: text(session),
+        authorization_epoch: AuthorizationEpoch::try_from(1_u64).expect("authorization epoch"),
+        dispatch_nonce: DispatchNonce::try_from(nonce).expect("dispatch nonce"),
+    }
+}
+
+fn successful_terminal(request: &TransactionRequest) -> TransactionTerminal {
+    let frames = u16::try_from(request.frames.len()).expect("frame count fits");
+    TransactionTerminal {
+        request_id: request.request_id.clone(),
+        request_digest: canonical_request_digest(request).expect("request is canonical"),
+        transaction_id: request.transaction_id.clone(),
+        receiver_id: request.receiver_id.clone(),
+        generation_id: request.generation_id,
+        state: TransactionState::Succeeded,
+        declared_frames: FrameCount::try_from(frames).expect("declared frame count"),
+        delivered_frames: DeliveredFrameCount::try_from(frames).expect("delivered frame count"),
+        side_effect_certainty: SideEffectCertainty::Committed,
+        live_write_executed: true,
+        automatic_retry: false,
+        device_application: DeviceApplicationState::Confirmed,
+        terminal_sequence: SequenceNumber::try_from(1_u64).expect("terminal sequence"),
+        error_kind: None,
+        superseded_by: None,
+    }
+}
+
+#[test]
+fn admitted_effect_is_split_into_exact_owner_bound_replays() {
+    let mut registry = VolatileEffectRegistry::new(8).expect("registry");
+    let request = transaction_request(
+        "effect",
+        TransactionClass::EffectFrame,
+        10_000,
+        &["keyboard-1", "mouse-1"],
+    );
+    let owner = binding("session-app", 7);
+    let capture = registry
+        .capture_admitted(&request, &owner)
+        .expect("effect capture succeeds");
+    assert_eq!(capture.captured, 2);
+    assert!(capture.evicted.is_empty());
+
+    let replay = registry
+        .plan_replay(
+            &text("receiver-1"),
+            generation(1),
+            &text("mouse-1"),
+            text("request-replay"),
+            text("transaction-replay"),
+            DispatchNonce::try_from(8_u64).expect("dispatch nonce"),
+            time(20_000),
+        )
+        .expect("replay planning succeeds")
+        .expect("mouse desired frame exists");
+    validate_transaction(&replay.request).expect("replay remains canonical");
+    assert_eq!(replay.request.frames.len(), 1);
+    assert_eq!(replay.request.frames[0].device_id, text("mouse-1"));
+    assert_eq!(replay.request.frames[0].frame_index.get(), 0);
+    assert_eq!(replay.submission.session_id, owner.session_id);
+    assert_eq!(
+        replay.submission.authorization_epoch,
+        owner.authorization_epoch
+    );
+    assert_ne!(replay.submission.dispatch_nonce, owner.dispatch_nonce);
+}
+
+#[test]
+fn bounded_registry_evicts_oldest_target_without_cross_device_mutation() {
+    let mut registry = VolatileEffectRegistry::new(1).expect("registry");
+    let first = transaction_request(
+        "first",
+        TransactionClass::EffectFrame,
+        10_000,
+        &["keyboard-1"],
+    );
+    let second = transaction_request(
+        "second",
+        TransactionClass::EffectFrame,
+        10_000,
+        &["mouse-1"],
+    );
+    registry
+        .capture_admitted(&first, &binding("session-app", 1))
+        .expect("first capture");
+    let capture = registry
+        .capture_admitted(&second, &binding("session-app", 2))
+        .expect("second capture");
+    assert_eq!(registry.len(), 1);
+    assert_eq!(capture.evicted.len(), 1);
+    assert_eq!(capture.evicted[0].device_id, text("keyboard-1"));
+}
+
+#[test]
+fn stable_success_replaces_effect_but_failed_stable_does_not() {
+    let mut registry = VolatileEffectRegistry::new(8).expect("registry");
+    let effect = transaction_request(
+        "effect",
+        TransactionClass::EffectFrame,
+        10_000,
+        &["mouse-1"],
+    );
+    registry
+        .capture_admitted(&effect, &binding("session-app", 1))
+        .expect("effect capture");
+
+    let stable = transaction_request(
+        "stable",
+        TransactionClass::StaticLighting,
+        10_000,
+        &["mouse-1"],
+    );
+    let mut failed = successful_terminal(&stable);
+    failed.state = TransactionState::Failed;
+    registry.observe_completed(&stable, &failed);
+    assert_eq!(registry.len(), 1);
+
+    registry.observe_completed(&stable, &successful_terminal(&stable));
+    assert!(registry.is_empty());
+}
+
+#[test]
+fn owner_lease_session_and_generation_cleanup_are_exact() {
+    let mut registry = VolatileEffectRegistry::new(8).expect("registry");
+    let keyboard = transaction_request(
+        "keyboard",
+        TransactionClass::EffectFrame,
+        10_000,
+        &["keyboard-1"],
+    );
+    let mut mouse =
+        transaction_request("mouse", TransactionClass::EffectFrame, 10_000, &["mouse-1"]);
+    mouse.lease_id = text("lease-2");
+    registry
+        .capture_admitted(&keyboard, &binding("session-1", 1))
+        .expect("keyboard capture");
+    registry
+        .capture_admitted(&mouse, &binding("session-2", 2))
+        .expect("mouse capture");
+
+    assert_eq!(registry.remove_lease(&text("lease-2")), 1);
+    assert_eq!(registry.len(), 1);
+    assert_eq!(registry.remove_session(&text("session-1")), 1);
+    assert!(registry.is_empty());
+
+    registry
+        .capture_admitted(&keyboard, &binding("session-1", 3))
+        .expect("keyboard recapture");
+    assert_eq!(
+        registry.remove_generation(&text("receiver-1"), generation(1)),
+        1
+    );
+    assert!(registry.is_empty());
+}
diff --git a/crates/hfx-core/tests/return_lifecycle.rs b/crates/hfx-core/tests/return_lifecycle.rs
new file mode 100644
index 0000000..0504970
--- /dev/null
+++ b/crates/hfx-core/tests/return_lifecycle.rs
@@ -0,0 +1,273 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_core::{
+    EndpointReturnLifecycle, EndpointReturnPolicy, LifecycleError, RestoreDeliveryState,
+    ReturnEvidence, ReturnPhase, ReturnTransition,
+};
+use hfx_domain::{MonotonicMs, SequenceNumber};
+
+const RETRIES: &[u64] = &[
+    0, 100, 200, 300, 500, 750, 1_000, 1_500, 2_250, 3_250, 4_500, 6_000,
+];
+const OPEN: &[ReturnEvidence] = &[
+    ReturnEvidence::EndpointActivity,
+    ReturnEvidence::RouteReturn,
+];
+const ACCELERATORS: &[ReturnEvidence] = &[
+    ReturnEvidence::BatteryReport,
+    ReturnEvidence::ContactReport,
+    ReturnEvidence::EndpointActivity,
+    ReturnEvidence::RouteReturn,
+];
+
+fn sequence(value: u64) -> SequenceNumber {
+    SequenceNumber::try_from(value).expect("sequence")
+}
+
+fn time(value: u64) -> MonotonicMs {
+    MonotonicMs::try_from(value).expect("monotonic time")
+}
+
+fn lifecycle() -> EndpointReturnLifecycle {
+    EndpointReturnLifecycle::new(
+        EndpointReturnPolicy::new(60_000, 500, RETRIES, OPEN, ACCELERATORS)
+            .expect("return policy is valid"),
+    )
+}
+
+#[test]
+fn first_activity_and_post_quiescence_activity_open_distinct_epochs() {
+    let mut lifecycle = lifecycle();
+    let first = lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(100));
+    let ReturnTransition::EpochOpened(first) = first else {
+        panic!("first activity must open a startup return epoch");
+    };
+    assert_eq!(first.phase(), ReturnPhase::Returning);
+    assert_eq!(first.opening_evidence(), ReturnEvidence::EndpointActivity);
+
+    assert!(matches!(
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(2), time(500)),
+        ReturnTransition::EpochAccelerated(_)
+    ));
+    let resumed = lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(3), time(60_501));
+    let ReturnTransition::EpochOpened(resumed) = resumed else {
+        panic!("activity after the conservative quiet candidate must open an epoch");
+    };
+    assert_eq!(resumed.sequence(), sequence(3));
+    assert_eq!(resumed.opened_at_ms(), time(60_501));
+}
+
+#[test]
+fn accelerator_evidence_never_extends_or_replaces_the_active_epoch() {
+    let mut lifecycle = lifecycle();
+    let ReturnTransition::EpochOpened(opened) =
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(10_000))
+    else {
+        panic!("epoch opens");
+    };
+    let accelerated = lifecycle.observe(ReturnEvidence::BatteryReport, sequence(2), time(12_000));
+    let ReturnTransition::EpochAccelerated(accelerated) = accelerated else {
+        panic!("profile-selected battery evidence accelerates the active epoch");
+    };
+    assert_eq!(accelerated.sequence(), opened.sequence());
+    assert_eq!(accelerated.opened_at_ms(), opened.opened_at_ms());
+
+    assert_eq!(
+        lifecycle.advance(time(16_000)),
+        ReturnTransition::None,
+        "the final retry remains eligible at its exact deadline"
+    );
+    let ReturnTransition::WindowCompleted(completed) = lifecycle.advance(time(16_001)) else {
+        panic!("the retry window closes after its final deadline");
+    };
+    assert_eq!(completed.phase(), ReturnPhase::Stable);
+    assert_eq!(completed.opened_at_ms(), time(10_000));
+    assert_eq!(lifecycle.phase(), ReturnPhase::Stable);
+}
+
+#[test]
+fn route_return_opens_immediately_and_supersedes_an_older_epoch() {
+    let mut lifecycle = lifecycle();
+    lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(1_000));
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::RouteDeparture, sequence(2), time(1_005)),
+        ReturnTransition::BecameUnavailable
+    );
+    assert_eq!(lifecycle.phase(), ReturnPhase::Unavailable);
+    let transition = lifecycle.observe(ReturnEvidence::RouteReturn, sequence(3), time(1_010));
+    let ReturnTransition::EpochOpened(epoch) = transition else {
+        panic!("an explicit route-return edge opens immediately");
+    };
+    assert_eq!(epoch.sequence(), sequence(3));
+    assert_eq!(epoch.opening_evidence(), ReturnEvidence::RouteReturn);
+}
+
+#[test]
+fn activity_after_explicit_departure_opens_without_a_sleep_timer() {
+    let mut lifecycle = lifecycle();
+    let first = lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(100));
+    let ReturnTransition::EpochOpened(first) = first else {
+        panic!("initial activity opens bootstrap epoch");
+    };
+    lifecycle.note_delivery(first.sequence(), RestoreDeliveryState::ChildConfirmed);
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::RouteDeparture, sequence(2), time(200)),
+        ReturnTransition::BecameUnavailable
+    );
+    assert!(matches!(
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(3), time(300)),
+        ReturnTransition::EpochOpened(_)
+    ));
+}
+
+#[test]
+fn receiver_delivery_is_recorded_without_claiming_child_application() {
+    let mut lifecycle = lifecycle();
+    let ReturnTransition::EpochOpened(epoch) =
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(1_000))
+    else {
+        panic!("epoch opens");
+    };
+    assert_eq!(
+        lifecycle.note_delivery(epoch.sequence(), RestoreDeliveryState::ReceiverDelivered),
+        ReturnTransition::None
+    );
+    let recorded = lifecycle.epoch().expect("epoch remains inspectable");
+    assert_eq!(recorded.delivery(), RestoreDeliveryState::ReceiverDelivered);
+    assert_eq!(recorded.phase(), ReturnPhase::Returning);
+    assert_eq!(
+        lifecycle.note_delivery(sequence(2), RestoreDeliveryState::ReceiverRejected),
+        ReturnTransition::None
+    );
+}
+
+#[test]
+fn only_child_confirmation_marks_an_epoch_synchronized() {
+    let mut lifecycle = lifecycle();
+    let ReturnTransition::EpochOpened(epoch) =
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(1_000))
+    else {
+        panic!("epoch opens");
+    };
+    let ReturnTransition::Synchronized(confirmed) =
+        lifecycle.note_delivery(epoch.sequence(), RestoreDeliveryState::ChildConfirmed)
+    else {
+        panic!("child confirmation synchronizes the matching epoch");
+    };
+    assert_eq!(confirmed.sequence(), epoch.sequence());
+    assert_eq!(lifecycle.phase(), ReturnPhase::Synchronized);
+    assert_eq!(
+        lifecycle
+            .epoch()
+            .expect("confirmed epoch remains inspectable")
+            .delivery(),
+        RestoreDeliveryState::ChildConfirmed
+    );
+}
+
+#[test]
+fn quiescence_is_a_candidate_not_a_sleep_claim() {
+    let mut lifecycle = lifecycle();
+    lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(100));
+    assert!(matches!(
+        lifecycle.advance(time(6_101)),
+        ReturnTransition::WindowCompleted(_)
+    ));
+    assert_eq!(
+        lifecycle.advance(time(60_100)),
+        ReturnTransition::QuiescenceCandidate
+    );
+    assert_eq!(lifecycle.phase(), ReturnPhase::QuiescentCandidate);
+    assert!(matches!(
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(2), time(60_101)),
+        ReturnTransition::EpochOpened(_)
+    ));
+}
+
+#[test]
+fn stale_evidence_and_receiver_suspend_reset_are_bounded() {
+    let mut lifecycle = lifecycle();
+    lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(2), time(2_000));
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::RouteDeparture, sequence(1), time(2_100)),
+        ReturnTransition::None
+    );
+    lifecycle.reset_observation_anchor();
+    assert!(matches!(
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(2_200)),
+        ReturnTransition::EpochOpened(_)
+    ));
+}
+
+#[test]
+fn malformed_or_unbounded_policies_fail_closed() {
+    for result in [
+        EndpointReturnPolicy::new(0, 0, RETRIES, OPEN, ACCELERATORS),
+        EndpointReturnPolicy::new(60_000, 60_000, RETRIES, OPEN, ACCELERATORS),
+        EndpointReturnPolicy::new(60_000, 500, &[0], OPEN, ACCELERATORS),
+        EndpointReturnPolicy::new(60_000, 500, &[0, 100, 100], OPEN, ACCELERATORS),
+        EndpointReturnPolicy::new(60_000, 500, &[0, 30_001], OPEN, ACCELERATORS),
+        EndpointReturnPolicy::new(60_000, 500, RETRIES, &[], ACCELERATORS),
+        EndpointReturnPolicy::new(
+            60_000,
+            500,
+            RETRIES,
+            &[ReturnEvidence::RouteReturn],
+            &[ReturnEvidence::EndpointActivity],
+        ),
+    ] {
+        assert_eq!(result, Err(LifecycleError::InvalidReturnPolicy));
+    }
+}
+
+#[test]
+fn observation_jitter_prevents_an_exact_minimum_idle_boundary() {
+    let mut before = lifecycle();
+    let first = before.observe(ReturnEvidence::EndpointActivity, sequence(1), time(1_000));
+    let ReturnTransition::EpochOpened(first) = first else {
+        panic!("initial activity opens bootstrap epoch");
+    };
+    before.note_delivery(first.sequence(), RestoreDeliveryState::ChildConfirmed);
+    assert_eq!(
+        before.observe(ReturnEvidence::EndpointActivity, sequence(2), time(60_499),),
+        ReturnTransition::None
+    );
+
+    let mut at_boundary = lifecycle();
+    let first = at_boundary.observe(ReturnEvidence::EndpointActivity, sequence(1), time(1_000));
+    let ReturnTransition::EpochOpened(first) = first else {
+        panic!("initial activity opens bootstrap epoch");
+    };
+    at_boundary.note_delivery(first.sequence(), RestoreDeliveryState::ChildConfirmed);
+    assert!(matches!(
+        at_boundary.observe(ReturnEvidence::EndpointActivity, sequence(2), time(60_500),),
+        ReturnTransition::EpochOpened(_)
+    ));
+}
+
+#[test]
+fn deterministic_event_fuzz_keeps_one_bounded_epoch_and_never_panics() {
+    let mut lifecycle = lifecycle();
+    let mut seed = 0x5eed_cafe_d00d_f00d_u64;
+    let mut now = 0_u64;
+    let mut openings = 0_usize;
+    for index in 1..=10_000_u64 {
+        seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
+        now = now.saturating_add((seed >> 32) % 70_001);
+        let evidence = match seed & 3 {
+            0 => ReturnEvidence::BatteryReport,
+            1 => ReturnEvidence::ContactReport,
+            2 => ReturnEvidence::EndpointActivity,
+            _ => ReturnEvidence::RouteReturn,
+        };
+        if matches!(
+            lifecycle.observe(evidence, sequence(index), time(now)),
+            ReturnTransition::EpochOpened(_)
+        ) {
+            openings += 1;
+        }
+        assert_eq!(lifecycle.policy().retry_offsets_ms().len(), RETRIES.len());
+    }
+    assert!(openings > 0);
+    assert!(openings <= 10_000);
+}
diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index 5a051d5..ad17eaf 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -395,7 +395,6 @@ impl LinuxRuntimeManager {
                         self.apply_lifecycle_translation(
                             &endpoint.receiver_id,
                             info.generation_id,
-                            sequence,
                             translation,
                             backend,
                         )?;
@@ -427,7 +426,6 @@ impl LinuxRuntimeManager {
         &mut self,
         receiver_id: &ReceiverId,
         generation_id: hfx_domain::GenerationId,
-        raw_sequence: u64,
         translation: PassiveTranslation,
         backend: &mut ProductionBackend,
     ) -> Result<(), RuntimeTickError> {
@@ -462,29 +460,24 @@ impl LinuxRuntimeManager {
             }
         }
         if let Some(readiness) = translation.restore_ready {
-            let sequence =
-                SequenceNumber::try_from(raw_sequence).map_err(RuntimeTickError::Domain)?;
             match readiness.phase {
-                DeviceRestoreReadinessPhase::Timed => {
-                    self.restoration.schedule_device_return_with_policy_at(
+                DeviceRestoreReadinessPhase::EpochOpened => {
+                    self.restoration.schedule_device_return_epoch_at(
                         receiver_id.clone(),
                         generation_id,
                         readiness.device_id,
-                        sequence,
-                        backend.now(),
-                        readiness.settle_ms,
-                        readiness.reassert_at_fallback,
+                        readiness.epoch_sequence,
+                        readiness.opened_at_ms,
+                        &readiness.retry_offsets_ms,
                     )
                 }
-                DeviceRestoreReadinessPhase::Confirmed => {
-                    self.restoration.confirm_device_return_with_policy_at(
-                        receiver_id.clone(),
+                DeviceRestoreReadinessPhase::EpochAccelerated => {
+                    self.restoration.accelerate_device_return_epoch_at(
+                        receiver_id,
                         generation_id,
-                        readiness.device_id,
-                        sequence,
-                        backend.now(),
-                        readiness.settle_ms,
-                        readiness.reassert_at_fallback,
+                        &readiness.device_id,
+                        readiness.epoch_sequence,
+                        readiness.evidence_at_ms,
                     )
                 }
             }
diff --git a/crates/hfx-daemon/src/observation.rs b/crates/hfx-daemon/src/observation.rs
index c6abf70..52d85b3 100644
--- a/crates/hfx-daemon/src/observation.rs
+++ b/crates/hfx-daemon/src/observation.rs
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use hfx_bridge::{LifecycleObservation, LifecycleObservationKind};
-use hfx_core::{ChildIdentity, EndpointIdentity, LifecycleError, ObservationStamp};
+use hfx_core::{
+    ChildIdentity, EndpointIdentity, EndpointReturnLifecycle, EndpointReturnPolicy, LifecycleError,
+    ObservationStamp, ReturnEvidence, ReturnTransition,
+};
 use hfx_domain::{
     ActivityState, BatteryPercent, ConnectionMode, ContactState, DeviceKind, DomainValueError,
     EndpointId, EvidenceClaimId, EvidenceConfidence, FreshnessState, GenerationId, LogicalDeviceId,
@@ -20,10 +23,9 @@ use hfx_kernel_transport::{
     HFX_UAPI_OBSERVATION_SOURCE_POWER_MANAGEMENT, RawKernelObservation,
 };
 use hfx_profiles::{
-    DeviceReturnConfirmationEvidence, LifecyclePolicyRecord, PassiveBatteryEncoding,
-    PassiveEndpointLane, PassiveTelemetryRecord, RuntimeProfileCatalog,
+    LifecyclePolicyRecord, PassiveBatteryEncoding, PassiveEndpointLane, PassiveTelemetryRecord,
+    ReturnEvidenceSource, RuntimeProfileCatalog, return_policy_by_id,
 };
-use hfx_runtime::ACTIVITY_RESUMPTION_QUIET_MS;
 use std::collections::BTreeMap;
 use std::fmt;
 
@@ -40,15 +42,17 @@ pub enum PassiveDisposition {
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct DeviceRestoreReadiness {
     pub device_id: LogicalDeviceId,
-    pub settle_ms: u64,
+    pub epoch_sequence: SequenceNumber,
+    pub opened_at_ms: MonotonicMs,
+    pub evidence_at_ms: MonotonicMs,
+    pub retry_offsets_ms: Vec<u64>,
     pub phase: DeviceRestoreReadinessPhase,
-    pub reassert_at_fallback: bool,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum DeviceRestoreReadinessPhase {
-    Timed,
-    Confirmed,
+    EpochOpened,
+    EpochAccelerated,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -73,18 +77,22 @@ impl PassiveTranslation {
     fn restore_ready(
         observations: Vec<LifecycleObservation>,
         device_id: LogicalDeviceId,
-        settle_ms: u64,
+        epoch_sequence: SequenceNumber,
+        opened_at_ms: MonotonicMs,
+        evidence_at_ms: MonotonicMs,
+        retry_offsets_ms: Vec<u64>,
         phase: DeviceRestoreReadinessPhase,
-        reassert_at_fallback: bool,
     ) -> Self {
         Self {
             disposition: PassiveDisposition::Applied,
             observations,
             restore_ready: Some(DeviceRestoreReadiness {
                 device_id,
-                settle_ms,
+                epoch_sequence,
+                opened_at_ms,
+                evidence_at_ms,
+                retry_offsets_ms,
                 phase,
-                reassert_at_fallback,
             }),
         }
     }
@@ -105,6 +113,7 @@ pub enum PassiveTranslationError {
     UnsupportedEndpointSlot(u32),
     InvalidObservationValue,
     ProfileLaneMismatch(ProductId),
+    MissingReturnPolicy(ProductId),
     Domain(DomainValueError),
     Lifecycle(LifecycleError),
 }
@@ -119,6 +128,9 @@ impl fmt::Display for PassiveTranslationError {
             Self::ProfileLaneMismatch(_) => {
                 "passive observation contradicts the child profile lane"
             }
+            Self::MissingReturnPolicy(_) => {
+                "qualified child profile references an unavailable return policy"
+            }
             Self::Domain(_) => "passive observation contains an invalid typed value",
             Self::Lifecycle(_) => "passive observation contains an invalid lifecycle identity",
         })
@@ -145,9 +157,8 @@ struct LaneBinding {
     device_id: LogicalDeviceId,
     endpoint_id: EndpointId,
     passive: Option<PassiveTelemetryRecord>,
-    lifecycle: Option<LifecyclePolicyRecord>,
-    last_activity_ms: Option<MonotonicMs>,
-    return_confirmation_deadline_ms: Option<MonotonicMs>,
+    return_lifecycle: Option<EndpointReturnLifecycle>,
+    last_route_state: Option<RouteState>,
 }
 
 pub struct PassiveObservationTranslator {
@@ -281,8 +292,10 @@ impl PassiveObservationTranslator {
         if state == ReceiverLifecycleState::Suspended {
             if !self.receiver_was_suspended {
                 for binding in self.lanes.values_mut() {
-                    binding.last_activity_ms = None;
-                    binding.return_confirmation_deadline_ms = None;
+                    if let Some(lifecycle) = binding.return_lifecycle.as_mut() {
+                        lifecycle.reset_observation_anchor();
+                    }
+                    binding.last_route_state = None;
                 }
             }
             self.receiver_was_suspended = true;
@@ -325,18 +338,23 @@ impl PassiveObservationTranslator {
             device_kind.as_str()
         ))?;
         let endpoint_id = EndpointId::try_from(format!("hyperflux-{}", lane_name(lane)))?;
+        let lifecycle = profile.and_then(|profile| profile.lifecycle);
         let prior = self.lanes.get(&slot);
-        let last_activity_ms = prior.and_then(|binding| binding.last_activity_ms);
-        let return_confirmation_deadline_ms =
-            prior.and_then(|binding| binding.return_confirmation_deadline_ms);
+        let return_lifecycle = if let Some(prior) = prior {
+            prior.return_lifecycle.clone()
+        } else {
+            lifecycle
+                .map(|lifecycle| return_lifecycle(product_id, lifecycle))
+                .transpose()?
+        };
+        let last_route_state = prior.and_then(|binding| binding.last_route_state);
         let binding = LaneBinding {
             product_id,
             device_id: device_id.clone(),
             endpoint_id: endpoint_id.clone(),
             passive: profile.and_then(|profile| profile.passive),
-            lifecycle: profile.and_then(|profile| profile.lifecycle),
-            last_activity_ms,
-            return_confirmation_deadline_ms,
+            return_lifecycle,
+            last_route_state,
         };
         let child = ChildIdentity::new(device_id.clone(), device_kind, product_id)?;
         let endpoint = EndpointIdentity::new(
@@ -383,35 +401,15 @@ impl PassiveObservationTranslator {
             ));
         };
         let observed_at_ms = stamp.observed_at_ms();
-        let restore_ready = binding.last_activity_ms.is_none_or(|prior| {
-            observed_at_ms.get().saturating_sub(prior.get()) >= ACTIVITY_RESUMPTION_QUIET_MS
-        });
-        if binding
-            .last_activity_ms
-            .is_none_or(|prior| observed_at_ms > prior)
-        {
-            binding.last_activity_ms = Some(observed_at_ms);
-        }
-        let readiness = restore_ready.then(|| {
-            let (settle_ms, confirmation) = binding.lifecycle.map_or((0, None), |policy| {
-                (
-                    policy.device_return_settle_ms,
-                    policy.device_return_confirmation,
-                )
+        let evidence = route_evidence(binding, RouteState::Available)
+            .unwrap_or(ReturnEvidence::EndpointActivity);
+        let return_transition = binding
+            .return_lifecycle
+            .as_mut()
+            .map_or(ReturnTransition::None, |lifecycle| {
+                lifecycle.observe(evidence, stamp.sequence(), observed_at_ms)
             });
-            if confirmation.is_some() {
-                let deadline = observed_at_ms.get().saturating_add(settle_ms);
-                binding.return_confirmation_deadline_ms = MonotonicMs::try_from(deadline).ok();
-            } else {
-                binding.return_confirmation_deadline_ms = None;
-            }
-            (
-                binding.device_id.clone(),
-                settle_ms,
-                DeviceRestoreReadinessPhase::Timed,
-                confirmation.is_some_and(|policy| policy.reassert_at_fallback),
-            )
-        });
+        let readiness = restore_readiness(binding, return_transition, observed_at_ms);
         let binding = binding.clone();
         let observations = vec![
             self.endpoint_observation(
@@ -436,19 +434,19 @@ impl PassiveObservationTranslator {
                 EndpointFact::Freshness(FreshnessState::Fresh),
             ),
         ];
-        Ok(
-            if let Some((device_id, settle_ms, phase, reassert_at_fallback)) = readiness {
-                PassiveTranslation::restore_ready(
-                    observations,
-                    device_id,
-                    settle_ms,
-                    phase,
-                    reassert_at_fallback,
-                )
-            } else {
-                PassiveTranslation::applied(observations)
-            },
-        )
+        Ok(if let Some(readiness) = readiness {
+            PassiveTranslation::restore_ready(
+                observations,
+                readiness.device_id,
+                readiness.epoch_sequence,
+                readiness.opened_at_ms,
+                readiness.evidence_at_ms,
+                readiness.retry_offsets_ms,
+                readiness.phase,
+            )
+        } else {
+            PassiveTranslation::applied(observations)
+        })
     }
 
     fn battery(
@@ -475,19 +473,19 @@ impl PassiveObservationTranslator {
                     .map_err(|_| PassiveTranslationError::InvalidObservationValue)?
             }
         };
-        let confirmation = binding
-            .lifecycle
-            .and_then(|policy| policy.device_return_confirmation)
-            .filter(|confirmation| {
-                confirmation.evidence == DeviceReturnConfirmationEvidence::BatteryReport
-            })
-            .and_then(|confirmation| {
-                binding
-                    .return_confirmation_deadline_ms
-                    .filter(|deadline| stamp.observed_at_ms() <= *deadline)
-                    .map(|_| (confirmation.settle_ms, confirmation.reassert_at_fallback))
+        let observed_at_ms = stamp.observed_at_ms();
+        let evidence = if passive.report_implies_route_available {
+            route_evidence(binding, RouteState::Available).unwrap_or(ReturnEvidence::BatteryReport)
+        } else {
+            ReturnEvidence::BatteryReport
+        };
+        let return_transition = binding
+            .return_lifecycle
+            .as_mut()
+            .map_or(ReturnTransition::None, |lifecycle| {
+                lifecycle.observe(evidence, stamp.sequence(), observed_at_ms)
             });
-        binding.return_confirmation_deadline_ms = None;
+        let readiness = restore_readiness(binding, return_transition, observed_at_ms);
         let binding = binding.clone();
         let mut observations = vec![self.observation(
             stamp.clone(),
@@ -499,23 +497,23 @@ impl PassiveObservationTranslator {
         if passive.report_implies_route_available {
             observations.extend(self.route_observations(&binding, stamp, RouteState::Available));
         }
-        Ok(
-            if let Some((settle_ms, reassert_at_fallback)) = confirmation {
-                PassiveTranslation::restore_ready(
-                    observations,
-                    binding.device_id,
-                    settle_ms,
-                    DeviceRestoreReadinessPhase::Confirmed,
-                    reassert_at_fallback,
-                )
-            } else {
-                PassiveTranslation::applied(observations)
-            },
-        )
+        Ok(if let Some(readiness) = readiness {
+            PassiveTranslation::restore_ready(
+                observations,
+                readiness.device_id,
+                readiness.epoch_sequence,
+                readiness.opened_at_ms,
+                readiness.evidence_at_ms,
+                readiness.retry_offsets_ms,
+                readiness.phase,
+            )
+        } else {
+            PassiveTranslation::applied(observations)
+        })
     }
 
-    fn contact(&self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
-        let Some(binding) = self.lanes.get(&slot) else {
+    fn contact(&mut self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
+        let Some(binding) = self.lanes.get_mut(&slot) else {
             return PassiveTranslation::disposition(PassiveDisposition::IgnoredUnknownLane);
         };
         let Some(passive) = binding.passive else {
@@ -531,16 +529,45 @@ impl PassiveObservationTranslator {
         } else {
             ContactState::Unknown
         };
+        let observed_at_ms = stamp.observed_at_ms();
+        let evidence = if passive.report_implies_route_available {
+            route_evidence(binding, RouteState::Available).unwrap_or(ReturnEvidence::ContactReport)
+        } else {
+            ReturnEvidence::ContactReport
+        };
+        let return_transition = if state == ContactState::OnMat {
+            binding
+                .return_lifecycle
+                .as_mut()
+                .map_or(ReturnTransition::None, |lifecycle| {
+                    lifecycle.observe(evidence, stamp.sequence(), observed_at_ms)
+                })
+        } else {
+            ReturnTransition::None
+        };
+        let readiness = restore_readiness(binding, return_transition, observed_at_ms);
+        let binding = binding.clone();
         let mut observations =
-            vec![self.endpoint_observation(binding, stamp.clone(), EndpointFact::Contact(state))];
+            vec![self.endpoint_observation(&binding, stamp.clone(), EndpointFact::Contact(state))];
         if passive.report_implies_route_available {
-            observations.extend(self.route_observations(binding, stamp, RouteState::Available));
+            observations.extend(self.route_observations(&binding, stamp, RouteState::Available));
+        }
+        match readiness {
+            Some(readiness) => PassiveTranslation::restore_ready(
+                observations,
+                readiness.device_id,
+                readiness.epoch_sequence,
+                readiness.opened_at_ms,
+                readiness.evidence_at_ms,
+                readiness.retry_offsets_ms,
+                readiness.phase,
+            ),
+            None => PassiveTranslation::applied(observations),
         }
-        PassiveTranslation::applied(observations)
     }
 
-    fn route(&self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
-        let Some(binding) = self.lanes.get(&slot) else {
+    fn route(&mut self, slot: u32, value: u32, stamp: ObservationStamp) -> PassiveTranslation {
+        let Some(binding) = self.lanes.get_mut(&slot) else {
             return PassiveTranslation::disposition(PassiveDisposition::IgnoredUnknownLane);
         };
         let Some(passive) = binding.passive else {
@@ -557,7 +584,31 @@ impl PassiveObservationTranslator {
         } else {
             return PassiveTranslation::disposition(PassiveDisposition::IgnoredUnqualifiedSemantic);
         };
-        PassiveTranslation::applied(self.route_observations(binding, stamp, state))
+        let observed_at_ms = stamp.observed_at_ms();
+        let route_return = route_evidence(binding, state);
+        let return_transition = route_return.map_or(ReturnTransition::None, |evidence| {
+            binding
+                .return_lifecycle
+                .as_mut()
+                .map_or(ReturnTransition::None, |lifecycle| {
+                    lifecycle.observe(evidence, stamp.sequence(), observed_at_ms)
+                })
+        });
+        let readiness = restore_readiness(binding, return_transition, observed_at_ms);
+        let binding = binding.clone();
+        let observations = self.route_observations(&binding, stamp, state);
+        match readiness {
+            Some(readiness) => PassiveTranslation::restore_ready(
+                observations,
+                readiness.device_id,
+                readiness.epoch_sequence,
+                readiness.opened_at_ms,
+                readiness.evidence_at_ms,
+                readiness.retry_offsets_ms,
+                readiness.phase,
+            ),
+            None => PassiveTranslation::applied(observations),
+        }
     }
 
     fn route_observations(
@@ -650,6 +701,98 @@ fn lane(slot: u32) -> Result<PassiveEndpointLane, PassiveTranslationError> {
     }
 }
 
+fn return_lifecycle(
+    product_id: ProductId,
+    lifecycle: LifecyclePolicyRecord,
+) -> Result<EndpointReturnLifecycle, PassiveTranslationError> {
+    let policy = return_policy_by_id(lifecycle.return_policy_id)
+        .ok_or(PassiveTranslationError::MissingReturnPolicy(product_id))?;
+    if !lifecycle
+        .open_evidence
+        .iter()
+        .all(|evidence| policy.allowed_open_evidence.contains(evidence))
+        || !lifecycle
+            .accelerator_evidence
+            .iter()
+            .all(|evidence| policy.allowed_accelerator_evidence.contains(evidence))
+    {
+        return Err(PassiveTranslationError::Lifecycle(
+            LifecycleError::InvalidReturnPolicy,
+        ));
+    }
+    let open_evidence = lifecycle
+        .open_evidence
+        .iter()
+        .copied()
+        .map(ReturnEvidenceSource::domain)
+        .collect::<Vec<_>>();
+    let accelerator_evidence = lifecycle
+        .accelerator_evidence
+        .iter()
+        .copied()
+        .map(ReturnEvidenceSource::domain)
+        .collect::<Vec<_>>();
+    let policy = EndpointReturnPolicy::new(
+        policy.quiescence_candidate_ms,
+        policy.observation_jitter_ms,
+        policy.retry_offsets_ms,
+        &open_evidence,
+        &accelerator_evidence,
+    )?;
+    Ok(EndpointReturnLifecycle::new(policy))
+}
+
+fn route_evidence(binding: &mut LaneBinding, state: RouteState) -> Option<ReturnEvidence> {
+    let departed = binding.last_route_state != Some(RouteState::Unavailable)
+        && state == RouteState::Unavailable;
+    let returned = binding.last_route_state == Some(RouteState::Unavailable)
+        && state == RouteState::Available
+        && binding.return_lifecycle.as_ref().is_some_and(|lifecycle| {
+            lifecycle
+                .policy()
+                .accelerator_evidence()
+                .contains(&ReturnEvidence::RouteReturn)
+        });
+    binding.last_route_state = Some(state);
+    if departed {
+        Some(ReturnEvidence::RouteDeparture)
+    } else {
+        returned.then_some(ReturnEvidence::RouteReturn)
+    }
+}
+
+fn restore_readiness(
+    binding: &LaneBinding,
+    transition: ReturnTransition,
+    evidence_at_ms: MonotonicMs,
+) -> Option<DeviceRestoreReadiness> {
+    let (epoch, phase) = match transition {
+        ReturnTransition::EpochOpened(epoch) => (epoch, DeviceRestoreReadinessPhase::EpochOpened),
+        ReturnTransition::EpochAccelerated(epoch) => {
+            (epoch, DeviceRestoreReadinessPhase::EpochAccelerated)
+        }
+        ReturnTransition::None
+        | ReturnTransition::QuiescenceCandidate
+        | ReturnTransition::BecameUnavailable
+        | ReturnTransition::Synchronized(_)
+        | ReturnTransition::WindowCompleted(_) => return None,
+    };
+    let retry_offsets_ms = binding
+        .return_lifecycle
+        .as_ref()?
+        .policy()
+        .retry_offsets_ms()
+        .to_vec();
+    Some(DeviceRestoreReadiness {
+        device_id: binding.device_id.clone(),
+        epoch_sequence: epoch.sequence(),
+        opened_at_ms: epoch.opened_at_ms(),
+        evidence_at_ms,
+        retry_offsets_ms,
+        phase,
+    })
+}
+
 const fn lane_name(lane: PassiveEndpointLane) -> &'static str {
     match lane {
         PassiveEndpointLane::Pointer => "pointer",
@@ -662,6 +805,11 @@ mod tests {
     use super::*;
     use hfx_kernel_transport::HFX_UAPI_ENDPOINT_SLOT_RECEIVER;
 
+    const RETURN_RETRIES: &[u64] = &[
+        0, 100, 200, 300, 500, 750, 1_000, 1_500, 2_250, 3_250, 4_500, 6_000,
+    ];
+    const QUIESCENCE_CANDIDATE_MS: u64 = 60_000;
+
     fn translator() -> PassiveObservationTranslator {
         PassiveObservationTranslator::new(
             ReceiverId::try_from("receiver-test").expect("receiver id is valid"),
@@ -848,6 +996,135 @@ mod tests {
         }
     }
 
+    #[test]
+    fn exact_unavailable_to_available_route_edge_opens_a_keyboard_return_epoch() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        let unavailable = translator
+            .translate(raw_at(
+                2,
+                1_000,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ROUTE_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+                2,
+            ))
+            .expect("route departure translates");
+        assert_eq!(unavailable.restore_ready, None);
+
+        let returned = translator
+            .translate(raw_at(
+                3,
+                1_010,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_ROUTE_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+                3,
+            ))
+            .expect("route return translates");
+        let readiness = returned.restore_ready.expect("route edge opens an epoch");
+        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::EpochOpened);
+        assert_eq!(
+            readiness.epoch_sequence,
+            SequenceNumber::try_from(3).unwrap()
+        );
+        assert_eq!(
+            readiness.opened_at_ms,
+            MonotonicMs::try_from(1_010).unwrap()
+        );
+        assert_eq!(readiness.retry_offsets_ms, RETURN_RETRIES);
+    }
+
+    #[test]
+    fn mouse_contact_accelerates_once_and_does_not_open_without_activity() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        let first_contact = translator
+            .translate(raw_at(
+                2,
+                900,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_CONTACT_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                1,
+            ))
+            .expect("contact telemetry translates");
+        assert_eq!(first_contact.restore_ready, None);
+        translator
+            .translate(activity(3, 1_000, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
+            .expect("activity opens an epoch");
+        let accelerated = translator
+            .translate(raw_at(
+                4,
+                1_050,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_CONTACT_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                1,
+            ))
+            .expect("contact accelerates the active epoch");
+        assert_eq!(
+            accelerated.restore_ready.as_ref().map(|value| value.phase),
+            Some(DeviceRestoreReadinessPhase::EpochAccelerated)
+        );
+        let repeated = translator
+            .translate(raw_at(
+                5,
+                1_100,
+                HFX_UAPI_OBSERVATION_KIND_ENDPOINT_CONTACT_RAW,
+                HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                1,
+            ))
+            .expect("repeated contact remains telemetry");
+        assert_eq!(repeated.restore_ready, None);
+    }
+
+    #[test]
+    fn profiles_share_one_engine_policy_and_select_evidence_without_pid_branches() {
+        let mut translator = translator();
+        identify(
+            &mut translator,
+            1,
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            0x00cd,
+        );
+        identify(
+            &mut translator,
+            2,
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+            0x0296,
+        );
+        let mouse = translator
+            .lanes
+            .get(&HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE)
+            .and_then(|binding| binding.return_lifecycle.as_ref())
+            .expect("qualified mouse has a generated policy");
+        let keyboard = translator
+            .lanes
+            .get(&HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE)
+            .and_then(|binding| binding.return_lifecycle.as_ref())
+            .expect("qualified keyboard has a generated policy");
+        assert_eq!(mouse.policy().retry_offsets_ms(), RETURN_RETRIES);
+        assert_eq!(keyboard.policy().retry_offsets_ms(), RETURN_RETRIES);
+        assert_eq!(
+            mouse.policy().open_evidence(),
+            &[ReturnEvidence::EndpointActivity]
+        );
+        assert_eq!(
+            keyboard.policy().open_evidence(),
+            &[
+                ReturnEvidence::EndpointActivity,
+                ReturnEvidence::RouteReturn
+            ]
+        );
+    }
+
     #[test]
     fn externally_powered_keyboard_route_cannot_override_observed_activity() {
         let mut translator = translator();
@@ -925,6 +1202,7 @@ mod tests {
             .translate(activity)
             .expect("activity translates without a model decoder");
         assert_eq!(activity.observations.len(), 5);
+        assert_eq!(activity.restore_ready, None);
     }
 
     #[test]
@@ -947,32 +1225,28 @@ mod tests {
                 .map(|readiness| readiness.device_id.as_str()),
             Some("paired-mouse-00cd")
         );
+        let first_readiness = first.restore_ready.as_ref().expect("startup epoch opens");
         assert_eq!(
-            first
-                .restore_ready
-                .as_ref()
-                .map(|readiness| readiness.settle_ms),
-            Some(1_000)
+            first_readiness.opened_at_ms,
+            MonotonicMs::try_from(1_000).unwrap()
         );
         assert_eq!(
-            first
-                .restore_ready
-                .as_ref()
-                .map(|readiness| readiness.phase),
-            Some(DeviceRestoreReadinessPhase::Timed)
+            first_readiness.evidence_at_ms,
+            MonotonicMs::try_from(1_000).unwrap()
         );
+        assert_eq!(first_readiness.retry_offsets_ms, RETURN_RETRIES);
         assert_eq!(
             first
                 .restore_ready
                 .as_ref()
-                .map(|readiness| readiness.reassert_at_fallback),
-            Some(false)
+                .map(|readiness| readiness.phase),
+            Some(DeviceRestoreReadinessPhase::EpochOpened)
         );
 
         let resumed = translator
             .translate(activity(
                 3,
-                1_000 + ACTIVITY_RESUMPTION_QUIET_MS,
+                1_000 + QUIESCENCE_CANDIDATE_MS,
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("post-quiet activity translates");
@@ -987,15 +1261,25 @@ mod tests {
         let continuous = translator
             .translate(activity(
                 4,
-                1_001 + ACTIVITY_RESUMPTION_QUIET_MS,
+                1_001 + QUIESCENCE_CANDIDATE_MS,
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("continuous activity translates");
-        assert_eq!(continuous.restore_ready, None);
+        let continuous = continuous
+            .restore_ready
+            .expect("fresh activity accelerates the existing bounded epoch");
+        assert_eq!(
+            continuous.phase,
+            DeviceRestoreReadinessPhase::EpochAccelerated
+        );
+        assert_eq!(
+            continuous.epoch_sequence,
+            SequenceNumber::try_from(3).unwrap()
+        );
     }
 
     #[test]
-    fn keyboard_battery_confirms_one_pending_return_before_the_fallback() {
+    fn keyboard_battery_accelerates_one_active_epoch_without_extending_it() {
         let mut translator = translator();
         identify(
             &mut translator,
@@ -1010,9 +1294,12 @@ mod tests {
         let readiness = candidate
             .restore_ready
             .expect("keyboard activity schedules a fallback");
-        assert_eq!(readiness.settle_ms, 5_000);
-        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Timed);
-        assert!(readiness.reassert_at_fallback);
+        assert_eq!(readiness.retry_offsets_ms, RETURN_RETRIES);
+        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::EpochOpened);
+        assert_eq!(
+            readiness.opened_at_ms,
+            MonotonicMs::try_from(1_000).unwrap()
+        );
 
         let confirmed = translator
             .translate(raw_at(
@@ -1026,9 +1313,23 @@ mod tests {
         let readiness = confirmed
             .restore_ready
             .expect("the first fresh battery report confirms the child route");
-        assert_eq!(readiness.settle_ms, 250);
-        assert_eq!(readiness.phase, DeviceRestoreReadinessPhase::Confirmed);
-        assert!(readiness.reassert_at_fallback);
+        assert_eq!(
+            readiness.phase,
+            DeviceRestoreReadinessPhase::EpochAccelerated
+        );
+        assert_eq!(
+            readiness.epoch_sequence,
+            SequenceNumber::try_from(2).unwrap()
+        );
+        assert_eq!(
+            readiness.opened_at_ms,
+            MonotonicMs::try_from(1_000).unwrap()
+        );
+        assert_eq!(
+            readiness.evidence_at_ms,
+            MonotonicMs::try_from(2_900).unwrap()
+        );
+        assert_eq!(readiness.retry_offsets_ms, RETURN_RETRIES);
 
         let repeated = translator
             .translate(raw_at(
@@ -1058,7 +1359,7 @@ mod tests {
         let late = translator
             .translate(raw_at(
                 3,
-                6_001,
+                7_001,
                 HFX_UAPI_OBSERVATION_KIND_ENDPOINT_BATTERY_RAW,
                 HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
                 128,
@@ -1098,7 +1399,7 @@ mod tests {
         let mouse = translator
             .translate(activity(
                 6,
-                1_000 + ACTIVITY_RESUMPTION_QUIET_MS,
+                1_000 + QUIESCENCE_CANDIDATE_MS,
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("mouse resumes after identity replay");
@@ -1113,14 +1414,24 @@ mod tests {
             mouse
                 .restore_ready
                 .as_ref()
-                .map(|readiness| readiness.settle_ms),
-            Some(1_000)
+                .map(|readiness| readiness.retry_offsets_ms.as_slice()),
+            Some(RETURN_RETRIES)
         );
 
         let keyboard = translator
             .translate(activity(7, 1_001, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
             .expect("keyboard remains continuous");
-        assert_eq!(keyboard.restore_ready, None);
+        let keyboard = keyboard
+            .restore_ready
+            .expect("fresh sibling activity accelerates only its own epoch");
+        assert_eq!(
+            keyboard.phase,
+            DeviceRestoreReadinessPhase::EpochAccelerated
+        );
+        assert_eq!(
+            keyboard.epoch_sequence,
+            SequenceNumber::try_from(4).unwrap()
+        );
     }
 
     #[test]
@@ -1139,7 +1450,7 @@ mod tests {
         let first = next_generation
             .translate(activity(
                 2,
-                ACTIVITY_RESUMPTION_QUIET_MS * 10,
+                QUIESCENCE_CANDIDATE_MS * 10,
                 HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
             ))
             .expect("first generation-bound activity translates");
@@ -1257,8 +1568,8 @@ mod tests {
             mouse
                 .restore_ready
                 .as_ref()
-                .map(|readiness| readiness.settle_ms),
-            Some(1_000)
+                .map(|readiness| readiness.phase),
+            Some(DeviceRestoreReadinessPhase::EpochOpened)
         );
         let keyboard = translator
             .translate(activity(8, 1_005, HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE))
@@ -1274,13 +1585,23 @@ mod tests {
             keyboard
                 .restore_ready
                 .as_ref()
-                .map(|readiness| readiness.settle_ms),
-            Some(5_000)
+                .map(|readiness| readiness.phase),
+            Some(DeviceRestoreReadinessPhase::EpochOpened)
         );
         let continuous = translator
             .translate(activity(9, 1_006, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("continuous mouse activity translates");
-        assert_eq!(continuous.restore_ready, None);
+        let continuous = continuous
+            .restore_ready
+            .expect("fresh activity accelerates without opening another epoch");
+        assert_eq!(
+            continuous.phase,
+            DeviceRestoreReadinessPhase::EpochAccelerated
+        );
+        assert_eq!(
+            continuous.epoch_sequence,
+            SequenceNumber::try_from(7).unwrap()
+        );
     }
 
     #[test]
@@ -1327,6 +1648,16 @@ mod tests {
         let continuous = translator
             .translate(activity(6, 1_004, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE))
             .expect("post-active input remains continuous");
-        assert_eq!(continuous.restore_ready, None);
+        let continuous = continuous
+            .restore_ready
+            .expect("post-active input accelerates the already-open epoch");
+        assert_eq!(
+            continuous.phase,
+            DeviceRestoreReadinessPhase::EpochAccelerated
+        );
+        assert_eq!(
+            continuous.epoch_sequence,
+            SequenceNumber::try_from(4).unwrap()
+        );
     }
 }
diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 0160253..6ff22d2 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -3,7 +3,10 @@
 //! Bounded, event-driven production restoration scheduling.
 
 use crate::ProductionBackend;
-use hfx_bridge::{AuthorizedSession, CoreBridgeBackend, RestorationRuntime, SessionRegistry};
+use hfx_bridge::{
+    AuthorizedSession, CoreBridgeBackend, DesiredEffectReplayStatus, RestorationRuntime,
+    SessionRegistry,
+};
 use hfx_core::{
     Clock, EventSink, ReceiverTransport, RestorationError, RestoreAdvanceResult, RestorePlanResult,
     RestoreRecord, RestoreTrigger, WallClock,
@@ -24,6 +27,8 @@ use std::fmt;
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 pub struct RestorationTickReport {
     pub triggers_planned: usize,
+    pub effect_replays_queued: usize,
+    pub effect_replays_deferred: usize,
     pub claims_recovered: usize,
     pub claims_advanced: usize,
     pub claims_dispatched: usize,
@@ -38,6 +43,7 @@ pub enum RestorationScheduleError {
     ClaimCapacity,
     TimeOverflow,
     Identifier,
+    EffectReplay,
     Restoration(RestorationError),
 }
 
@@ -49,6 +55,7 @@ impl fmt::Display for RestorationScheduleError {
             Self::ClaimCapacity => "restoration claim capacity is exhausted",
             Self::TimeOverflow => "restoration scheduler time cannot advance",
             Self::Identifier => "restoration lifecycle identity is invalid",
+            Self::EffectReplay => "owner-bound effect replay coordination failed",
             Self::Restoration(_) => "durable restoration coordination failed",
         })
     }
@@ -73,14 +80,7 @@ struct ScheduledTrigger {
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 enum ScheduledTriggerPurpose {
     Primary,
-    Reassertion,
-}
-
-#[derive(Clone, Copy, Debug)]
-struct DeviceReturnWindow {
-    fallback_due: MonotonicMs,
-    sequence: SequenceNumber,
-    confirmed: bool,
+    ReturnAttempt(u8),
 }
 
 #[derive(Clone, Debug)]
@@ -114,6 +114,16 @@ trait RestorationController {
         &mut self,
         trigger: &RestoreTrigger,
     ) -> Result<RestorePlanResult, RestorationError>;
+    fn queue_desired_effect_replay(
+        &mut self,
+        _receiver_id: &ReceiverId,
+        _generation_id: GenerationId,
+        _device_id: &LogicalDeviceId,
+        _sessions: &SessionRegistry,
+        _authority_window_ms: u64,
+    ) -> Result<DesiredEffectReplayStatus, RestorationScheduleError> {
+        Ok(DesiredEffectReplayStatus::NotAvailable)
+    }
     fn advance_claim(
         &mut self,
         claim_id: &RestoreClaimId,
@@ -170,6 +180,25 @@ where
         self.plan_restoration(trigger)
     }
 
+    fn queue_desired_effect_replay(
+        &mut self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+        device_id: &LogicalDeviceId,
+        sessions: &SessionRegistry,
+        authority_window_ms: u64,
+    ) -> Result<DesiredEffectReplayStatus, RestorationScheduleError> {
+        CoreBridgeBackend::queue_desired_effect_replay(
+            self,
+            receiver_id,
+            generation_id,
+            device_id,
+            sessions,
+            authority_window_ms,
+        )
+        .map_err(|_| RestorationScheduleError::EffectReplay)
+    }
+
     fn advance_claim(
         &mut self,
         claim_id: &RestoreClaimId,
@@ -211,7 +240,7 @@ pub struct RestorationScheduler {
     max_claims: usize,
     configured_receivers: BTreeSet<ReceiverId>,
     ready_devices: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), MonotonicMs>,
-    return_windows: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), DeviceReturnWindow>,
+    return_epochs: BTreeMap<(ReceiverId, GenerationId, LogicalDeviceId), SequenceNumber>,
     triggers: BTreeMap<RestoreTriggerId, ScheduledTrigger>,
     claims: BTreeMap<RestoreClaimId, ScheduledClaim>,
 }
@@ -276,7 +305,7 @@ impl RestorationScheduler {
             max_claims,
             configured_receivers: BTreeSet::new(),
             ready_devices: BTreeMap::new(),
-            return_windows: BTreeMap::new(),
+            return_epochs: BTreeMap::new(),
             triggers: BTreeMap::new(),
             claims: BTreeMap::new(),
         })
@@ -364,265 +393,161 @@ impl RestorationScheduler {
         )
     }
 
-    /// Wakes one device's claims and enqueues its exact return trigger.
-    ///
-    /// # Errors
-    ///
-    /// Returns a trigger-capacity or generated-identity failure.
-    pub fn schedule_device_return(
-        &mut self,
-        receiver_id: ReceiverId,
-        generation_id: GenerationId,
-        device_id: LogicalDeviceId,
-        sequence: SequenceNumber,
-    ) -> Result<(), RestorationScheduleError> {
-        self.schedule_device_return_at(
-            receiver_id,
-            generation_id,
-            device_id,
-            sequence,
-            immediate_due()?,
-            0,
-        )
-    }
-
-    /// Enqueues one exact return after a profile-owned wake-settle interval.
-    /// The schedule timestamp comes from the same monotonic clock used by the
-    /// actor tick, keeping the deadline valid across suspend boundaries.
-    ///
-    /// # Errors
-    ///
-    /// Returns a time, trigger-capacity, or generated-identity failure.
-    pub fn schedule_device_return_at(
-        &mut self,
-        receiver_id: ReceiverId,
-        generation_id: GenerationId,
-        device_id: LogicalDeviceId,
-        sequence: SequenceNumber,
-        scheduled_at: MonotonicMs,
-        settle_ms: u64,
-    ) -> Result<(), RestorationScheduleError> {
-        self.schedule_device_return_with_policy_at(
-            receiver_id,
-            generation_id,
-            device_id,
-            sequence,
-            scheduled_at,
-            settle_ms,
-            false,
-        )
-    }
-
-    /// Enqueues one exact return and records whether stronger child evidence
-    /// should preserve one bounded late reassertion at the original fallback.
-    /// The policy is generated from the matching child profile.
+    /// Atomically installs the complete bounded retry envelope for one exact
+    /// endpoint return epoch. A newer epoch supersedes only the same endpoint;
+    /// equal or stale epochs are idempotent.
     ///
     /// # Errors
     ///
-    /// Returns a time, trigger-capacity, or generated-identity failure.
+    /// Returns before changing scheduler state when the retry envelope is
+    /// malformed, overflows monotonic time, or cannot fit within capacity.
     #[allow(clippy::too_many_arguments)]
-    pub fn schedule_device_return_with_policy_at(
+    pub fn schedule_device_return_epoch_at(
         &mut self,
         receiver_id: ReceiverId,
         generation_id: GenerationId,
         device_id: LogicalDeviceId,
-        sequence: SequenceNumber,
-        scheduled_at: MonotonicMs,
-        settle_ms: u64,
-        reassert_at_fallback: bool,
+        epoch_sequence: SequenceNumber,
+        opened_at: MonotonicMs,
+        retry_offsets_ms: &[u64],
     ) -> Result<(), RestorationScheduleError> {
         if !self.enabled {
             return Ok(());
         }
-        let due = due_after(scheduled_at, settle_ms)?;
-        let readiness = (receiver_id.clone(), generation_id, device_id.clone());
-        self.ready_devices
-            .entry(readiness.clone())
-            .and_modify(|existing| *existing = (*existing).max(due))
-            .or_insert(due);
-        if reassert_at_fallback {
-            let replace_window = self
-                .return_windows
-                .get(&readiness)
-                .is_none_or(|window| sequence > window.sequence);
-            if replace_window {
-                self.remove_device_return_triggers(
-                    &receiver_id,
+        if retry_offsets_ms.len() < 2
+            || retry_offsets_ms.len() > 32
+            || retry_offsets_ms.first() != Some(&0)
+            || !retry_offsets_ms.windows(2).all(|pair| pair[0] < pair[1])
+            || retry_offsets_ms
+                .last()
+                .is_none_or(|offset| *offset > 30_000)
+        {
+            return Err(RestorationScheduleError::InvalidConfiguration);
+        }
+        let readiness = (receiver_id, generation_id, device_id);
+        if self
+            .return_epochs
+            .get(&readiness)
+            .is_some_and(|current| epoch_sequence <= *current)
+        {
+            return Ok(());
+        }
+
+        let due = retry_offsets_ms
+            .iter()
+            .map(|offset| due_after(opened_at, *offset))
+            .collect::<Result<Vec<_>, _>>()?;
+        let replaced = self
+            .triggers
+            .values()
+            .filter(|scheduled| {
+                scheduled.trigger.receiver_id == readiness.0
+                    && scheduled.trigger.generation_id == generation_id
+                    && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
+                    && scheduled.trigger.target_device_id.as_ref() == Some(&readiness.2)
+            })
+            .count();
+        let remaining = self.triggers.len().saturating_sub(replaced);
+        if remaining
+            .checked_add(due.len())
+            .is_none_or(|total| total > self.max_triggers)
+        {
+            return Err(RestorationScheduleError::TriggerCapacity);
+        }
+
+        let staged = due
+            .iter()
+            .enumerate()
+            .map(|(attempt, due)| {
+                let attempt = u8::try_from(attempt)
+                    .map_err(|_| RestorationScheduleError::InvalidConfiguration)?;
+                let purpose = ScheduledTriggerPurpose::ReturnAttempt(attempt);
+                let trigger_id = trigger_id(
+                    RestoreTriggerKind::DeviceReturn,
+                    &readiness.0,
                     generation_id,
-                    &device_id,
-                    Some(ScheduledTriggerPurpose::Reassertion),
-                );
-                self.return_windows.insert(
-                    readiness,
-                    DeviceReturnWindow {
-                        fallback_due: due,
-                        sequence,
-                        confirmed: false,
+                    Some(&readiness.2),
+                    Some(epoch_sequence),
+                    None,
+                    purpose,
+                )?;
+                Ok((
+                    trigger_id.clone(),
+                    ScheduledTrigger {
+                        trigger: RestoreTrigger {
+                            trigger_id,
+                            kind: RestoreTriggerKind::DeviceReturn,
+                            receiver_id: readiness.0.clone(),
+                            generation_id,
+                            target_device_id: Some(readiness.2.clone()),
+                        },
+                        due: *due,
+                        sequence: Some(epoch_sequence),
+                        purpose,
                     },
-                );
-            }
-        } else {
-            self.return_windows.remove(&readiness);
-            self.remove_device_return_triggers(
-                &receiver_id,
-                generation_id,
-                &device_id,
-                Some(ScheduledTriggerPurpose::Reassertion),
-            );
-        }
-        self.schedule_at(
-            RestoreTriggerKind::DeviceReturn,
-            receiver_id,
-            generation_id,
-            Some(device_id),
-            Some(sequence),
-            due,
-        )
-    }
+                ))
+            })
+            .collect::<Result<Vec<_>, RestorationScheduleError>>()?;
 
-    /// Advances one pending device-return fallback after stronger profile-owned
-    /// child evidence arrives. Confirmation can only move the exact device
-    /// earlier; repeated evidence cannot postpone it or affect a sibling.
-    ///
-    /// # Errors
-    ///
-    /// Returns a time, trigger-capacity, or generated-identity failure.
-    pub fn confirm_device_return_at(
-        &mut self,
-        receiver_id: ReceiverId,
-        generation_id: GenerationId,
-        device_id: LogicalDeviceId,
-        sequence: SequenceNumber,
-        confirmed_at: MonotonicMs,
-        settle_ms: u64,
-    ) -> Result<(), RestorationScheduleError> {
-        self.confirm_device_return_with_policy_at(
-            receiver_id,
-            generation_id,
-            device_id,
-            sequence,
-            confirmed_at,
-            settle_ms,
-            false,
-        )
+        self.remove_device_return_triggers(&readiness.0, generation_id, &readiness.2, None);
+        for (trigger_id, trigger) in staged {
+            self.triggers.insert(trigger_id, trigger);
+        }
+        let first_due = due[0];
+        self.ready_devices.insert(readiness.clone(), first_due);
+        self.return_epochs.insert(readiness.clone(), epoch_sequence);
+        self.wake(&readiness.0, generation_id, Some(&readiness.2), first_due);
+        Ok(())
     }
 
-    /// Advances one exact pending fallback and, when the generated child
-    /// policy requests it, preserves one late reassertion at the original
-    /// deadline. Repeated confirmations are idempotent.
+    /// Pulls the earliest still-pending attempt for one active return epoch to
+    /// the new evidence timestamp. It never postpones an attempt, creates a new
+    /// attempt, or changes another endpoint.
     ///
     /// # Errors
     ///
-    /// Returns a time, trigger-capacity, or generated-identity failure.
-    #[allow(clippy::too_many_arguments)]
-    pub fn confirm_device_return_with_policy_at(
+    /// Returns an identifier error only if the selected pending trigger
+    /// disappears from the scheduler before its due time can be updated.
+    pub fn accelerate_device_return_epoch_at(
         &mut self,
-        receiver_id: ReceiverId,
+        receiver_id: &ReceiverId,
         generation_id: GenerationId,
-        device_id: LogicalDeviceId,
-        sequence: SequenceNumber,
-        confirmed_at: MonotonicMs,
-        settle_ms: u64,
-        reassert_at_fallback: bool,
+        device_id: &LogicalDeviceId,
+        epoch_sequence: SequenceNumber,
+        evidence_at: MonotonicMs,
     ) -> Result<(), RestorationScheduleError> {
         if !self.enabled {
             return Ok(());
         }
-        let confirmed_due = due_after(confirmed_at, settle_ms)?;
         let readiness = (receiver_id.clone(), generation_id, device_id.clone());
-        let fallback_due = if reassert_at_fallback {
-            let Some(window) = self.return_windows.get(&readiness) else {
-                return Ok(());
-            };
-            if sequence < window.sequence || window.confirmed {
-                return Ok(());
-            }
-            Some(window.fallback_due)
-        } else {
-            None
-        };
-        let due = self
-            .ready_devices
-            .get(&readiness)
-            .map_or(confirmed_due, |existing| (*existing).min(confirmed_due));
-        let has_matching_claim = self.claims.values().any(|claim| {
-            claim.receiver_id == receiver_id
-                && claim.generation_id == generation_id
-                && claim.device_id == device_id
-        });
-        let has_broad_trigger = self.has_pending_broad_trigger(&receiver_id, generation_id);
-        let matching_triggers = self
+        if self.return_epochs.get(&readiness) != Some(&epoch_sequence) {
+            return Ok(());
+        }
+        let candidate = self
             .triggers
             .iter()
-            .filter_map(|(trigger_id, scheduled)| {
-                (scheduled.trigger.receiver_id == receiver_id
+            .filter(|(_, scheduled)| {
+                scheduled.trigger.receiver_id == *receiver_id
                     && scheduled.trigger.generation_id == generation_id
                     && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
-                    && scheduled.trigger.target_device_id.as_ref() == Some(&device_id)
-                    && scheduled.purpose == ScheduledTriggerPurpose::Primary)
-                    .then_some(trigger_id.clone())
+                    && scheduled.trigger.target_device_id.as_ref() == Some(device_id)
+                    && scheduled.sequence == Some(epoch_sequence)
+                    && matches!(scheduled.purpose, ScheduledTriggerPurpose::ReturnAttempt(_))
+                    && scheduled.due > evidence_at
             })
-            .collect::<Vec<_>>();
-        let has_reassertion = self.triggers.values().any(|scheduled| {
-            scheduled.trigger.receiver_id == receiver_id
-                && scheduled.trigger.generation_id == generation_id
-                && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
-                && scheduled.trigger.target_device_id.as_ref() == Some(&device_id)
-                && scheduled.purpose == ScheduledTriggerPurpose::Reassertion
-        });
-        let needs_primary = !has_matching_claim && !has_broad_trigger;
-        let needs_reassertion = fallback_due.is_some_and(|fallback| fallback > due);
-        let remaining = self.triggers.len().saturating_sub(matching_triggers.len());
-        let additions =
-            usize::from(needs_primary) + usize::from(needs_reassertion && !has_reassertion);
-        if remaining
-            .checked_add(additions)
-            .is_none_or(|total| total > self.max_triggers)
-        {
-            return Err(RestorationScheduleError::TriggerCapacity);
-        }
-
-        if reassert_at_fallback {
-            self.return_windows
-                .get_mut(&readiness)
+            .min_by_key(|(trigger_id, scheduled)| (scheduled.due, *trigger_id))
+            .map(|(trigger_id, _)| trigger_id.clone());
+        if let Some(trigger_id) = candidate {
+            self.triggers
+                .get_mut(&trigger_id)
                 .ok_or(RestorationScheduleError::Identifier)?
-                .confirmed = true;
-        }
-        self.ready_devices.insert(readiness.clone(), due);
-        let woke = self.wake_earlier(&receiver_id, generation_id, &device_id, due);
-        debug_assert_eq!(woke > 0, has_matching_claim);
-        for trigger_id in matching_triggers {
-            self.triggers.remove(&trigger_id);
-        }
-        if needs_primary {
-            self.schedule_at(
-                RestoreTriggerKind::DeviceReturn,
-                receiver_id.clone(),
-                generation_id,
-                Some(device_id.clone()),
-                Some(sequence),
-                due,
-            )?;
-        }
-        if let Some(fallback_due) = fallback_due.filter(|fallback| *fallback > due) {
-            self.schedule_at_with_purpose(
-                RestoreTriggerKind::DeviceReturn,
-                receiver_id,
-                generation_id,
-                Some(device_id),
-                Some(sequence),
-                fallback_due,
-                ScheduledTriggerPurpose::Reassertion,
-            )?;
-        } else if reassert_at_fallback {
-            self.return_windows.remove(&readiness);
-            self.remove_device_return_triggers(
-                &receiver_id,
-                generation_id,
-                &device_id,
-                Some(ScheduledTriggerPurpose::Reassertion),
-            );
+                .due = evidence_at;
         }
+        self.ready_devices
+            .entry(readiness)
+            .and_modify(|due| *due = (*due).min(evidence_at))
+            .or_insert(evidence_at);
+        self.wake_earlier(receiver_id, generation_id, device_id, evidence_at);
         Ok(())
     }
 
@@ -637,7 +562,7 @@ impl RestorationScheduler {
         self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
-        self.return_windows.retain(|(candidate, generation, _), _| {
+        self.return_epochs.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
     }
@@ -668,7 +593,7 @@ impl RestorationScheduler {
     ) -> Result<RestorationTickReport, RestorationScheduleError> {
         let now = controller.now();
         let mut report = RestorationTickReport::default();
-        self.process_due_trigger(controller, now, &mut report)?;
+        self.process_due_trigger(controller, sessions, now, &mut report)?;
 
         for _ in 0..self.claims_per_tick {
             if !self.process_due_claim(controller, sessions, now, &mut report)? {
@@ -681,6 +606,7 @@ impl RestorationScheduler {
     fn process_due_trigger<C: RestorationController>(
         &mut self,
         controller: &mut C,
+        sessions: &SessionRegistry,
         now: MonotonicMs,
         report: &mut RestorationTickReport,
     ) -> Result<(), RestorationScheduleError> {
@@ -690,26 +616,40 @@ impl RestorationScheduler {
                 .remove(&trigger_id)
                 .ok_or(RestorationScheduleError::Identifier)?;
             let receiver_id = scheduled.trigger.receiver_id.clone();
-            if let Some(device_id) = scheduled.trigger.target_device_id.as_ref() {
-                let readiness = (
-                    scheduled.trigger.receiver_id.clone(),
-                    scheduled.trigger.generation_id,
-                    device_id.clone(),
-                );
-                if scheduled.purpose == ScheduledTriggerPurpose::Reassertion
-                    || self.return_windows.get(&readiness).is_some_and(|window| {
-                        !window.confirmed && window.fallback_due <= scheduled.due
-                    })
-                {
-                    self.return_windows.remove(&readiness);
-                }
-            }
             let newly_configured = !self
                 .configured_receivers
                 .contains(&scheduled.trigger.receiver_id);
             if newly_configured {
                 controller.set_enabled(&scheduled.trigger.receiver_id, true)?;
             }
+            if matches!(scheduled.purpose, ScheduledTriggerPurpose::ReturnAttempt(_))
+                && let Some(device_id) = scheduled.trigger.target_device_id.as_ref()
+            {
+                match controller.queue_desired_effect_replay(
+                    &scheduled.trigger.receiver_id,
+                    scheduled.trigger.generation_id,
+                    device_id,
+                    sessions,
+                    self.authority_window_ms,
+                )? {
+                    DesiredEffectReplayStatus::Queued => {
+                        report.effect_replays_queued += 1;
+                        if newly_configured {
+                            self.configured_receivers.insert(receiver_id);
+                        }
+                        return Ok(());
+                    }
+                    DesiredEffectReplayStatus::Deferred => {
+                        report.effect_replays_deferred += 1;
+                        if newly_configured {
+                            self.configured_receivers.insert(receiver_id);
+                        }
+                        return Ok(());
+                    }
+                    DesiredEffectReplayStatus::NotAvailable
+                    | DesiredEffectReplayStatus::Invalidated => {}
+                }
+            }
             let migrated = controller.rebind_compatible_stable_intents(&scheduled.trigger)?;
             let pending = newly_configured
                 .then(|| controller.pending_records(&scheduled.trigger.receiver_id))
@@ -888,7 +828,7 @@ impl RestorationScheduler {
         if !self.enabled {
             return Ok(());
         }
-        if purpose == ScheduledTriggerPurpose::Reassertion
+        if matches!(purpose, ScheduledTriggerPurpose::ReturnAttempt(_))
             && kind != RestoreTriggerKind::DeviceReturn
         {
             return Err(RestorationScheduleError::InvalidConfiguration);
@@ -904,6 +844,7 @@ impl RestorationScheduler {
                 scheduled.trigger.receiver_id != receiver_id
                     || scheduled.trigger.generation_id != generation_id
                     || scheduled.trigger.kind != RestoreTriggerKind::DeviceReturn
+                    || matches!(scheduled.purpose, ScheduledTriggerPurpose::ReturnAttempt(_))
             });
             if woke > 0 || self.has_pending_broad_trigger(&receiver_id, generation_id) {
                 return Ok(());
@@ -929,21 +870,6 @@ impl RestorationScheduler {
                 }
                 self.triggers.remove(&existing_id);
             }
-        } else if kind == RestoreTriggerKind::DeviceReturn {
-            let same_scope = self.triggers.iter().find_map(|(trigger_id, scheduled)| {
-                (scheduled.trigger.receiver_id == receiver_id
-                    && scheduled.trigger.generation_id == generation_id
-                    && scheduled.trigger.kind == RestoreTriggerKind::DeviceReturn
-                    && scheduled.trigger.target_device_id == target_device_id
-                    && scheduled.purpose == ScheduledTriggerPurpose::Reassertion)
-                    .then(|| (trigger_id.clone(), scheduled.due))
-            });
-            if let Some((existing_id, existing_due)) = same_scope {
-                if existing_due <= due {
-                    return Ok(());
-                }
-                self.triggers.remove(&existing_id);
-            }
         }
         let trigger_id = trigger_id(
             kind,
@@ -1128,7 +1054,7 @@ impl RestorationScheduler {
         self.ready_devices.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
-        self.return_windows.retain(|(candidate, generation, _), _| {
+        self.return_epochs.retain(|(candidate, generation, _), _| {
             candidate != receiver_id || *generation != generation_id
         });
         self.triggers.retain(|_, scheduled| {
@@ -1265,8 +1191,12 @@ fn trigger_id(
     if let Some(nonce) = process_nonce {
         digest.update(nonce);
     }
-    if purpose == ScheduledTriggerPurpose::Reassertion {
-        digest_field(&mut digest, b"device-return-reassertion")?;
+    match purpose {
+        ScheduledTriggerPurpose::Primary => {}
+        ScheduledTriggerPurpose::ReturnAttempt(attempt) => {
+            digest_field(&mut digest, b"device-return-attempt")?;
+            digest.update([attempt]);
+        }
     }
     let encoded = digest
         .finalize()
@@ -1299,9 +1229,10 @@ mod tests {
     use hfx_core::{
         ChildIdentity, CompletedTransaction, EndpointIdentity, EventDelivery, LifecycleLimits,
         ObservationStamp, PersistenceStore, ProfileRegistry, ReceiverLifecycleMachine,
-        ReceiverLifecycleRegistry, RestorationCoordinator, RestoreDeferred, RestoreRecordStatus,
-        StableCommitOutcome, TransportDispatch, TransportFailure, TransportFailureFacts,
-        TransportReceipt, TransportReconciliation, TransportTerminal, canonical_request_digest,
+        ReceiverLifecycleRegistry, RestorationCoordinator, RestoreCompletion, RestoreDeferred,
+        RestoreRecordStatus, StableCommitOutcome, TransportDispatch, TransportFailure,
+        TransportFailureFacts, TransportReceipt, TransportReconciliation, TransportTerminal,
+        canonical_request_digest,
     };
     use hfx_domain::{
         ActivityState, ApplyOutcome, AuthorizationEpoch, ColorChannel, ConnectionMode,
@@ -1309,9 +1240,9 @@ mod tests {
         EvidenceConfidence, FrameCount, FrameIndex, FreshnessState, IntentRevision,
         LogicalDeviceId, PairingState, PersistenceRevision, PersistenceSchemaVersion, PowerState,
         ProductId, ProjectionRevision, ProtocolVersion, QueueCapacity, ResourceKind,
-        RestoreDeferReason, RouteKind, RouteState, SessionId, SideEffectCertainty, SleepState,
-        StableLightingMode, StreamEpoch, StreamId, TransactionClass, TransactionState, VendorId,
-        WallClockUnixMs,
+        RestoreAttemptNumber, RestoreDeferReason, RouteKind, RouteState, SessionId,
+        SideEffectCertainty, SleepState, StableLightingMode, StreamEpoch, StreamId,
+        TransactionClass, TransactionState, VendorId, WallClockUnixMs,
     };
     use hfx_protocol::{
         DeviceProfileBinding, LightingFrame, ResourceKey, RgbColor, StableLightingIntent,
@@ -1388,6 +1319,75 @@ mod tests {
         migrations: Vec<Result<usize, RestorationError>>,
     }
 
+    struct EffectController {
+        inner: FakeController,
+        replays: Vec<DesiredEffectReplayStatus>,
+    }
+
+    impl RestorationController for EffectController {
+        fn now(&self) -> MonotonicMs {
+            self.inner.now()
+        }
+
+        fn set_enabled(
+            &mut self,
+            receiver_id: &ReceiverId,
+            enabled: bool,
+        ) -> Result<(), RestorationError> {
+            self.inner.set_enabled(receiver_id, enabled)
+        }
+
+        fn pending_records(
+            &self,
+            receiver_id: &ReceiverId,
+        ) -> Result<Vec<RestoreRecord>, RestorationError> {
+            self.inner.pending_records(receiver_id)
+        }
+
+        fn plan_restore(
+            &mut self,
+            trigger: &RestoreTrigger,
+        ) -> Result<RestorePlanResult, RestorationError> {
+            self.inner.plan_restore(trigger)
+        }
+
+        fn queue_desired_effect_replay(
+            &mut self,
+            _receiver_id: &ReceiverId,
+            _generation_id: GenerationId,
+            _device_id: &LogicalDeviceId,
+            _sessions: &SessionRegistry,
+            _authority_window_ms: u64,
+        ) -> Result<DesiredEffectReplayStatus, RestorationScheduleError> {
+            Ok(self.replays.remove(0))
+        }
+
+        fn advance_claim(
+            &mut self,
+            claim_id: &RestoreClaimId,
+            session: &AuthorizedSession,
+            sessions: &SessionRegistry,
+            lease_duration_ms: LeaseDurationMs,
+            authority_window_ms: u64,
+        ) -> Result<RestoreAdvanceResult, RestorationError> {
+            self.inner.advance_claim(
+                claim_id,
+                session,
+                sessions,
+                lease_duration_ms,
+                authority_window_ms,
+            )
+        }
+
+        fn dispatch_claim(
+            &mut self,
+            claim_id: &RestoreClaimId,
+            sessions: &SessionRegistry,
+        ) -> Result<RestoreRecord, RestorationError> {
+            self.inner.dispatch_claim(claim_id, sessions)
+        }
+    }
+
     impl RestorationController for MigratingController {
         fn now(&self) -> MonotonicMs {
             self.inner.now()
@@ -1500,6 +1500,25 @@ mod tests {
         }
     }
 
+    fn delivered_record(claim: &str, device_id: &str) -> RestoreRecord {
+        record_for_device(
+            claim,
+            device_id,
+            RestoreRecordStatus::Succeeded(RestoreCompletion {
+                attempt_number: RestoreAttemptNumber::try_from(1_u32).expect("attempt"),
+                transaction_id: id(&format!("transaction-{claim}")),
+                request_digest: id(&"22".repeat(32)),
+                state: TransactionState::Succeeded,
+                delivered_frames: DeliveredFrameCount::try_from(1_u16).expect("frame count"),
+                side_effect_certainty: SideEffectCertainty::Committed,
+                live_write_executed: true,
+                automatic_retry: false,
+                device_application: DeviceApplicationState::Unverified,
+                error_kind: None,
+            }),
+        )
+    }
+
     fn session() -> AuthorizedSession {
         AuthorizedSession {
             client_id: id("bridge-restoration"),
@@ -1524,6 +1543,25 @@ mod tests {
         .expect("scheduler")
     }
 
+    fn epoch_scheduler(max_triggers: usize) -> RestorationScheduler {
+        RestorationScheduler::new(
+            true,
+            Some(session()),
+            [0x55; 32],
+            LeaseDurationMs::try_from(10_000_u32).expect("lease"),
+            30_000,
+            1_000,
+            4,
+            max_triggers,
+            max_triggers.max(32),
+        )
+        .expect("epoch scheduler")
+    }
+
+    const RETURN_RETRIES: &[u64] = &[
+        0, 100, 200, 300, 500, 750, 1_000, 1_500, 2_250, 3_250, 4_500, 6_000,
+    ];
+
     fn sessions() -> SessionRegistry {
         let mut sessions =
             SessionRegistry::new(hfx_domain::QueueCapacity::try_from(2_u16).expect("capacity"));
@@ -2031,7 +2069,7 @@ mod tests {
         let mut report = RestorationTickReport::default();
 
         scheduler
-            .process_due_trigger(&mut controller, time(10), &mut report)
+            .process_due_trigger(&mut controller, &sessions(), time(10), &mut report)
             .expect("compatible stable state replans");
 
         assert_eq!(report.triggers_planned, 1);
@@ -2071,24 +2109,24 @@ mod tests {
             .expect("receiver-only service trigger schedules");
         let mut startup_report = RestorationTickReport::default();
         scheduler
-            .process_due_trigger(&mut controller, time(10), &mut startup_report)
+            .process_due_trigger(&mut controller, &sessions(), time(10), &mut startup_report)
             .expect("receiver-only startup safely recovers pending state");
         assert_eq!(startup_report.claims_recovered, 1);
         assert!(scheduler.configured_receivers.contains(&receiver_id));
 
         scheduler
-            .schedule_device_return_at(
+            .schedule_device_return_epoch_at(
                 receiver_id,
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(2_u64).expect("sequence"),
                 time(10),
-                0,
+                &[0, 1],
             )
             .expect("child identity trigger schedules");
         let mut return_report = RestorationTickReport::default();
         scheduler
-            .process_due_trigger(&mut controller, time(10), &mut return_report)
+            .process_due_trigger(&mut controller, &sessions(), time(10), &mut return_report)
             .expect("late child identity retries compatible migration");
 
         assert_eq!(return_report.triggers_planned, 1);
@@ -2099,8 +2137,64 @@ mod tests {
     }
 
     #[test]
-    fn failed_compatible_rebind_leaves_receiver_unconfigured_for_retry() {
-        let mut controller = MigratingController {
+    fn return_envelope_prefers_live_effect_and_falls_back_only_after_invalidation() {
+        let mut controller = EffectController {
+            inner: FakeController {
+                now: time(10),
+                plans: vec![Ok(RestorePlanResult::NoStableIntents)],
+                pending: Vec::new(),
+                advances: Vec::new(),
+                dispatches: Vec::new(),
+                policy_calls: 0,
+                advance_calls: 0,
+                dispatch_calls: 0,
+            },
+            replays: vec![
+                DesiredEffectReplayStatus::Queued,
+                DesiredEffectReplayStatus::Deferred,
+                DesiredEffectReplayStatus::Invalidated,
+            ],
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(9_u64).expect("sequence"),
+                time(10),
+                &[0, 1, 2],
+            )
+            .expect("return envelope schedules");
+
+        let mut first = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, &sessions(), time(10), &mut first)
+            .expect("live effect replay queues");
+        assert_eq!(first.effect_replays_queued, 1);
+        assert_eq!(first.triggers_planned, 0);
+        assert_eq!(controller.inner.plans.len(), 1);
+
+        let mut second = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, &sessions(), time(11), &mut second)
+            .expect("temporary readiness consumes only this attempt");
+        assert_eq!(second.effect_replays_deferred, 1);
+        assert_eq!(second.triggers_planned, 0);
+        assert_eq!(controller.inner.plans.len(), 1);
+
+        let mut third = RestorationTickReport::default();
+        scheduler
+            .process_due_trigger(&mut controller, &sessions(), time(12), &mut third)
+            .expect("stale owner falls back to stable authority");
+        assert_eq!(third.triggers_planned, 1);
+        assert!(controller.inner.plans.is_empty());
+        assert!(controller.replays.is_empty());
+    }
+
+    #[test]
+    fn failed_compatible_rebind_leaves_receiver_unconfigured_for_retry() {
+        let mut controller = MigratingController {
             inner: FakeController {
                 now: time(10),
                 plans: Vec::new(),
@@ -2123,7 +2217,7 @@ mod tests {
         let mut report = RestorationTickReport::default();
 
         assert!(matches!(
-            scheduler.process_due_trigger(&mut controller, time(10), &mut report),
+            scheduler.process_due_trigger(&mut controller, &sessions(), time(10), &mut report),
             Err(RestorationScheduleError::Restoration(
                 RestorationError::Persistence(hfx_core::PersistenceOperation::SaveIntent)
             ))
@@ -2199,14 +2293,16 @@ mod tests {
     }
 
     #[test]
-    fn overlapping_resume_and_device_return_leave_one_broad_trigger() {
+    fn overlapping_resume_and_device_return_preserve_the_latest_exact_envelope() {
         let mut scheduler = scheduler();
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(1_u64).expect("sequence"),
+                time(0),
+                &[0, 100],
             )
             .expect("device return schedules");
         scheduler
@@ -2217,25 +2313,37 @@ mod tests {
             )
             .expect("resume schedules");
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(3_u64).expect("sequence"),
+                time(0),
+                &[0, 100],
             )
             .expect("later device return coalesces");
 
-        assert_eq!(scheduler.triggers.len(), 1);
-        assert!(matches!(
+        assert_eq!(scheduler.triggers.len(), 3);
+        assert_eq!(
             scheduler
                 .triggers
                 .values()
-                .next()
-                .expect("one trigger")
-                .trigger
-                .kind,
-            RestoreTriggerKind::SystemResume
-        ));
+                .filter(|scheduled| scheduled.trigger.kind == RestoreTriggerKind::SystemResume)
+                .count(),
+            1
+        );
+        assert_eq!(
+            scheduler
+                .triggers
+                .values()
+                .filter(|scheduled| matches!(
+                    scheduled.purpose,
+                    ScheduledTriggerPurpose::ReturnAttempt(_)
+                ) && scheduled.sequence
+                    == Some(SequenceNumber::try_from(3_u64).unwrap()))
+                .count(),
+            2
+        );
         assert!(scheduler.ready_devices.contains_key(&(
             id("receiver-1"),
             generation(1),
@@ -2243,6 +2351,290 @@ mod tests {
         )));
     }
 
+    #[test]
+    fn return_epoch_queues_the_complete_bounded_profile_envelope() {
+        let mut scheduler = epoch_scheduler(32);
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                RETURN_RETRIES,
+            )
+            .expect("bounded return epoch schedules");
+
+        let mut attempts = scheduler
+            .triggers
+            .values()
+            .map(|scheduled| (scheduled.due.get(), scheduled.purpose))
+            .collect::<Vec<_>>();
+        attempts.sort_by_key(|(due, _)| *due);
+        assert_eq!(attempts.len(), RETURN_RETRIES.len());
+        for (index, ((due, purpose), offset)) in attempts.iter().zip(RETURN_RETRIES).enumerate() {
+            assert_eq!(*due, 1_000 + offset);
+            assert_eq!(
+                *purpose,
+                ScheduledTriggerPurpose::ReturnAttempt(u8::try_from(index).unwrap())
+            );
+        }
+    }
+
+    #[test]
+    fn terminal_receiver_delivery_does_not_cancel_the_remaining_bounded_attempts() {
+        let planned = [
+            record_for_device("claim-return-1", "mouse-1", RestoreRecordStatus::Planned),
+            record_for_device("claim-return-2", "mouse-1", RestoreRecordStatus::Planned),
+            record_for_device("claim-return-3", "mouse-1", RestoreRecordStatus::Planned),
+        ];
+        let mut controller = FakeController {
+            now: time(1_000),
+            plans: planned
+                .iter()
+                .cloned()
+                .map(|record| Ok(RestorePlanResult::Planned(vec![record])))
+                .collect(),
+            pending: Vec::new(),
+            advances: planned
+                .iter()
+                .cloned()
+                .map(|record| Ok(RestoreAdvanceResult::Queued(record)))
+                .collect(),
+            dispatches: [
+                delivered_record("claim-return-1", "mouse-1"),
+                delivered_record("claim-return-2", "mouse-1"),
+                delivered_record("claim-return-3", "mouse-1"),
+            ]
+            .into_iter()
+            .map(Ok)
+            .collect(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = epoch_scheduler(8);
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                &[0, 100, 200],
+            )
+            .expect("return envelope schedules");
+
+        for (index, now) in [1_000_u64, 1_100, 1_200].into_iter().enumerate() {
+            controller.now = time(now);
+            let report = scheduler
+                .tick_with(&mut controller, &sessions())
+                .expect("bounded attempt completes");
+            assert_eq!(report.triggers_planned, 1);
+            assert_eq!(report.claims_dispatched, 1);
+            assert_eq!(report.claims_terminal, 1);
+            assert_eq!(scheduler.triggers.len(), 2 - index);
+        }
+        assert_eq!(controller.dispatch_calls, 3);
+    }
+
+    #[test]
+    fn unresolved_attempt_does_not_extend_or_destroy_the_remaining_envelope() {
+        let mut controller = FakeController {
+            now: time(1_000),
+            plans: vec![
+                Err(RestorationError::PriorClaimUnresolved),
+                Ok(RestorePlanResult::NoStableIntents),
+            ],
+            pending: Vec::new(),
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = epoch_scheduler(8);
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).expect("sequence"),
+                time(1_000),
+                &[0, 100],
+            )
+            .expect("return envelope schedules");
+
+        let first = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("unresolved attempt remains bounded");
+        assert_eq!(first.claims_recovered, 0);
+        assert_eq!(scheduler.triggers.len(), 1);
+
+        controller.now = time(1_100);
+        let second = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("next bounded attempt remains available");
+        assert_eq!(second.triggers_planned, 1);
+        assert!(scheduler.triggers.is_empty());
+    }
+
+    #[test]
+    fn newer_return_epoch_replaces_only_the_same_endpoint_and_stale_epochs_are_ignored() {
+        let mut scheduler = epoch_scheduler(40);
+        for (device, sequence) in [("mouse-1", 10_u64), ("keyboard-1", 11_u64)] {
+            scheduler
+                .schedule_device_return_epoch_at(
+                    id("receiver-1"),
+                    generation(1),
+                    id(device),
+                    SequenceNumber::try_from(sequence).unwrap(),
+                    time(1_000),
+                    &[0, 100],
+                )
+                .expect("endpoint epoch schedules");
+        }
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(12_u64).unwrap(),
+                time(2_000),
+                &[0, 200, 400],
+            )
+            .expect("newer mouse epoch replaces its predecessor");
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(9_u64).unwrap(),
+                time(3_000),
+                &[0, 100],
+            )
+            .expect("stale epoch is an idempotent no-op");
+
+        let mouse = scheduler
+            .triggers
+            .values()
+            .filter(|scheduled| scheduled.trigger.target_device_id.as_ref() == Some(&id("mouse-1")))
+            .collect::<Vec<_>>();
+        let keyboard = scheduler
+            .triggers
+            .values()
+            .filter(|scheduled| {
+                scheduled.trigger.target_device_id.as_ref() == Some(&id("keyboard-1"))
+            })
+            .collect::<Vec<_>>();
+        assert_eq!(mouse.len(), 3);
+        assert!(mouse.iter().all(|scheduled| {
+            scheduled.sequence == Some(SequenceNumber::try_from(12_u64).unwrap())
+        }));
+        assert_eq!(keyboard.len(), 2);
+        assert!(keyboard.iter().all(|scheduled| {
+            scheduled.sequence == Some(SequenceNumber::try_from(11_u64).unwrap())
+        }));
+    }
+
+    #[test]
+    fn return_epoch_capacity_failure_is_atomic() {
+        let mut scheduler = epoch_scheduler(11);
+        assert_eq!(
+            scheduler.schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).unwrap(),
+                time(1_000),
+                RETURN_RETRIES,
+            ),
+            Err(RestorationScheduleError::TriggerCapacity)
+        );
+        assert!(scheduler.triggers.is_empty());
+        assert!(scheduler.ready_devices.is_empty());
+        assert!(scheduler.return_epochs.is_empty());
+    }
+
+    #[test]
+    fn accelerator_moves_one_pending_attempt_earlier_without_touching_a_sibling() {
+        let mut scheduler = epoch_scheduler(40);
+        for (device, sequence) in [("mouse-1", 10_u64), ("keyboard-1", 11_u64)] {
+            scheduler
+                .schedule_device_return_epoch_at(
+                    id("receiver-1"),
+                    generation(1),
+                    id(device),
+                    SequenceNumber::try_from(sequence).unwrap(),
+                    time(1_000),
+                    &[0, 1_000, 2_000],
+                )
+                .expect("endpoint epoch schedules");
+        }
+        scheduler
+            .accelerate_device_return_epoch_at(
+                &id("receiver-1"),
+                generation(1),
+                &id("mouse-1"),
+                SequenceNumber::try_from(10_u64).unwrap(),
+                time(1_500),
+            )
+            .expect("mouse evidence accelerates one attempt");
+
+        let mut mouse_due = scheduler
+            .triggers
+            .values()
+            .filter(|scheduled| scheduled.trigger.target_device_id.as_ref() == Some(&id("mouse-1")))
+            .map(|scheduled| scheduled.due.get())
+            .collect::<Vec<_>>();
+        let mut keyboard_due = scheduler
+            .triggers
+            .values()
+            .filter(|scheduled| {
+                scheduled.trigger.target_device_id.as_ref() == Some(&id("keyboard-1"))
+            })
+            .map(|scheduled| scheduled.due.get())
+            .collect::<Vec<_>>();
+        mouse_due.sort_unstable();
+        keyboard_due.sort_unstable();
+        assert_eq!(mouse_due, vec![1_000, 1_500, 3_000]);
+        assert_eq!(keyboard_due, vec![1_000, 2_000, 3_000]);
+    }
+
+    #[test]
+    fn broad_resume_does_not_erase_an_endpoint_retry_envelope() {
+        let mut scheduler = epoch_scheduler(32);
+        scheduler
+            .schedule_device_return_epoch_at(
+                id("receiver-1"),
+                generation(1),
+                id("mouse-1"),
+                SequenceNumber::try_from(10_u64).unwrap(),
+                time(1_000),
+                &[0, 100, 200],
+            )
+            .expect("endpoint epoch schedules");
+        scheduler
+            .schedule_system_resume(
+                id("receiver-1"),
+                generation(1),
+                SequenceNumber::try_from(11_u64).unwrap(),
+            )
+            .expect("resume coexists with the endpoint envelope");
+
+        assert_eq!(
+            scheduler
+                .triggers
+                .values()
+                .filter(|scheduled| matches!(
+                    scheduled.purpose,
+                    ScheduledTriggerPurpose::ReturnAttempt(_)
+                ))
+                .count(),
+            3
+        );
+    }
+
     #[test]
     fn receiver_generation_parks_each_sibling_until_its_exact_activity() {
         let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
@@ -2268,6 +2660,7 @@ mod tests {
         scheduler
             .process_due_trigger(
                 &mut controller,
+                &sessions(),
                 time(10),
                 &mut RestorationTickReport::default(),
             )
@@ -2293,11 +2686,13 @@ mod tests {
         );
 
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(4_u64).expect("sequence"),
+                time(0),
+                &[0, 1],
             )
             .expect("mouse readiness wakes its claim");
         assert_eq!(
@@ -2343,16 +2738,19 @@ mod tests {
             .schedule_receiver_generation(id("receiver-1"), generation(1))
             .expect("generation trigger schedules");
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(4_u64).expect("sequence"),
+                time(10),
+                &[0, 1],
             )
             .expect("early mouse readiness is retained");
         scheduler
             .process_due_trigger(
                 &mut controller,
+                &sessions(),
                 time(10),
                 &mut RestorationTickReport::default(),
             )
@@ -2403,11 +2801,13 @@ mod tests {
             u64::MAX
         );
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(6_u64).expect("sequence"),
+                time(0),
+                &[0, 1],
             )
             .expect("fresh activity wakes the claim");
         scheduler
@@ -2434,551 +2834,26 @@ mod tests {
     }
 
     #[test]
-    fn repeated_device_returns_coalesce_without_trigger_overflow() {
+    fn repeated_device_return_epochs_replace_without_trigger_overflow() {
         let mut scheduler = scheduler();
         for sequence in 1_u64..=65 {
             scheduler
-                .schedule_device_return(
+                .schedule_device_return_epoch_at(
                     id("receiver-1"),
                     generation(1),
                     id("mouse-1"),
                     SequenceNumber::try_from(sequence).expect("sequence"),
+                    time(0),
+                    &[0, 1],
                 )
                 .expect("same-scope return coalesces");
         }
 
-        assert_eq!(scheduler.triggers.len(), 1);
-        assert_eq!(
-            scheduler
-                .triggers
-                .values()
-                .next()
-                .expect("one trigger")
-                .sequence,
-            Some(SequenceNumber::try_from(65_u64).expect("sequence"))
-        );
-    }
-
-    #[test]
-    fn profile_owned_return_settle_delays_only_the_exact_device() {
-        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
-        let keyboard =
-            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_record(mouse.clone(), parked_due().expect("parked due"))
-            .expect("mouse claim schedules");
-        scheduler
-            .schedule_record(keyboard.clone(), parked_due().expect("parked due"))
-            .expect("keyboard claim schedules");
-
-        scheduler
-            .schedule_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                1_000,
-            )
-            .expect("settled mouse return schedules");
-        scheduler
-            .schedule_device_return(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-            )
-            .expect("default keyboard return schedules");
-
-        assert_eq!(
-            scheduler
-                .claims
-                .get(&mouse.claim_id)
-                .expect("mouse claim")
-                .due,
-            time(2_000)
-        );
-        assert_eq!(
-            scheduler
-                .claims
-                .get(&keyboard.claim_id)
-                .expect("keyboard claim")
-                .due,
-            time(0)
-        );
+        assert_eq!(scheduler.triggers.len(), 2);
+        assert!(scheduler.triggers.values().all(|scheduled| {
+            scheduled.sequence == Some(SequenceNumber::try_from(65_u64).expect("sequence"))
+        }));
     }
-
-    #[test]
-    fn profile_owned_return_confirmation_advances_only_the_exact_device() {
-        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
-        let keyboard =
-            record_for_device("claim-keyboard", "keyboard-1", RestoreRecordStatus::Planned);
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_record(mouse.clone(), parked_due().expect("parked due"))
-            .expect("mouse claim schedules");
-        scheduler
-            .schedule_record(keyboard.clone(), parked_due().expect("parked due"))
-            .expect("keyboard claim schedules");
-
-        scheduler
-            .schedule_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-            )
-            .expect("mouse fallback schedules");
-        scheduler
-            .confirm_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-            )
-            .expect("mouse confirmation advances the fallback");
-        scheduler
-            .confirm_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(12_u64).expect("sequence"),
-                time(3_000),
-                250,
-            )
-            .expect("repeated confirmation cannot postpone the claim");
-
-        assert_eq!(
-            scheduler
-                .claims
-                .get(&mouse.claim_id)
-                .expect("mouse claim")
-                .due,
-            time(3_150)
-        );
-        assert_eq!(
-            scheduler
-                .claims
-                .get(&keyboard.claim_id)
-                .expect("keyboard claim")
-                .due,
-            parked_due().expect("parked due")
-        );
-    }
-
-    #[test]
-    fn repeated_return_confirmation_coalesces_without_postponing_a_trigger() {
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-            )
-            .expect("fallback trigger schedules");
-        scheduler
-            .confirm_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-            )
-            .expect("confirmation advances the trigger");
-        scheduler
-            .confirm_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(12_u64).expect("sequence"),
-                time(3_000),
-                250,
-            )
-            .expect("repeated confirmation coalesces");
-
-        assert_eq!(scheduler.triggers.len(), 1);
-        let trigger = scheduler.triggers.values().next().expect("one trigger");
-        assert_eq!(trigger.due, time(3_150));
-        assert_eq!(
-            trigger.sequence,
-            Some(SequenceNumber::try_from(12_u64).expect("sequence"))
-        );
-    }
-
-    #[test]
-    fn confirmed_return_preserves_one_late_reassertion_without_touching_a_sibling() {
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("keyboard fallback schedules");
-        scheduler
-            .schedule_device_return_at(
-                id("receiver-1"),
-                generation(1),
-                id("mouse-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(1_000),
-                4_000,
-            )
-            .expect("mouse return schedules independently");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(12_u64).expect("sequence"),
-                time(2_900),
-                250,
-                true,
-            )
-            .expect("keyboard confirmation advances one attempt");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(13_u64).expect("sequence"),
-                time(3_000),
-                250,
-                true,
-            )
-            .expect("repeated keyboard confirmation is idempotent");
-
-        let mut keyboard = scheduler
-            .triggers
-            .values()
-            .filter(|scheduled| {
-                scheduled.trigger.target_device_id.as_ref() == Some(&id("keyboard-1"))
-            })
-            .collect::<Vec<_>>();
-        keyboard.sort_by_key(|scheduled| scheduled.due);
-        assert_eq!(keyboard.len(), 2);
-        assert_eq!(keyboard[0].due, time(3_150));
-        assert_eq!(keyboard[0].purpose, ScheduledTriggerPurpose::Primary);
-        assert_eq!(keyboard[1].due, time(6_000));
-        assert_eq!(keyboard[1].purpose, ScheduledTriggerPurpose::Reassertion);
-
-        let mouse = scheduler
-            .triggers
-            .values()
-            .find(|scheduled| scheduled.trigger.target_device_id.as_ref() == Some(&id("mouse-1")))
-            .expect("mouse trigger remains present");
-        assert_eq!(mouse.due, time(5_000));
-        assert_eq!(mouse.purpose, ScheduledTriggerPurpose::Primary);
-        assert_eq!(scheduler.triggers.len(), 3);
-    }
-
-    #[test]
-    fn two_stage_confirmation_fails_atomically_when_trigger_capacity_is_exhausted() {
-        let mut scheduler = RestorationScheduler::new(
-            true,
-            Some(session()),
-            [0x55; 32],
-            LeaseDurationMs::try_from(10_000_u32).expect("lease"),
-            30_000,
-            1_000,
-            4,
-            1,
-            2,
-        )
-        .expect("bounded scheduler");
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("one fallback fits");
-
-        assert_eq!(
-            scheduler.confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-                true,
-            ),
-            Err(RestorationScheduleError::TriggerCapacity)
-        );
-
-        assert_eq!(scheduler.triggers.len(), 1);
-        let trigger = scheduler
-            .triggers
-            .values()
-            .next()
-            .expect("fallback remains");
-        assert_eq!(trigger.due, time(6_000));
-        assert_eq!(trigger.purpose, ScheduledTriggerPurpose::Primary);
-        let readiness = (id("receiver-1"), generation(1), id("keyboard-1"));
-        assert_eq!(scheduler.ready_devices.get(&readiness), Some(&time(6_000)));
-        assert!(
-            !scheduler
-                .return_windows
-                .get(&readiness)
-                .expect("window remains")
-                .confirmed
-        );
-    }
-
-    #[test]
-    fn unconfirmed_return_keeps_only_its_original_fallback() {
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("keyboard fallback schedules");
-
-        assert_eq!(scheduler.triggers.len(), 1);
-        let trigger = scheduler.triggers.values().next().expect("one fallback");
-        assert_eq!(trigger.due, time(6_000));
-        assert_eq!(trigger.purpose, ScheduledTriggerPurpose::Primary);
-
-        let mut controller = FakeController {
-            now: time(6_000),
-            plans: vec![Ok(RestorePlanResult::NoStableIntents)],
-            pending: Vec::new(),
-            advances: Vec::new(),
-            dispatches: Vec::new(),
-            policy_calls: 0,
-            advance_calls: 0,
-            dispatch_calls: 0,
-        };
-        scheduler
-            .process_due_trigger(
-                &mut controller,
-                time(6_000),
-                &mut RestorationTickReport::default(),
-            )
-            .expect("the original fallback is consumed once");
-        assert!(scheduler.triggers.is_empty());
-        assert!(scheduler.return_windows.is_empty());
-    }
-
-    #[test]
-    fn suspend_and_generation_retirement_clear_both_return_stages() {
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("keyboard fallback schedules");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-                true,
-            )
-            .expect("keyboard confirmation schedules both stages");
-        scheduler
-            .schedule_system_suspend(&id("receiver-1"), generation(1))
-            .expect("suspend invalidates the return window");
-        assert!(scheduler.triggers.is_empty());
-        assert!(scheduler.ready_devices.is_empty());
-        assert!(scheduler.return_windows.is_empty());
-
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(2),
-                id("keyboard-1"),
-                SequenceNumber::try_from(12_u64).expect("sequence"),
-                time(7_000),
-                5_000,
-                true,
-            )
-            .expect("new-generation fallback schedules");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(2),
-                id("keyboard-1"),
-                SequenceNumber::try_from(13_u64).expect("sequence"),
-                time(8_000),
-                250,
-                true,
-            )
-            .expect("new-generation confirmation schedules");
-        scheduler.retire_generation(&id("receiver-1"), generation(2));
-        assert!(scheduler.triggers.is_empty());
-        assert!(scheduler.ready_devices.is_empty());
-        assert!(scheduler.return_windows.is_empty());
-    }
-
-    #[test]
-    fn terminal_early_restore_allows_exactly_one_late_reassertion() {
-        let early = record_for_device("claim-early", "keyboard-1", RestoreRecordStatus::Planned);
-        let late = record_for_device("claim-late", "keyboard-1", RestoreRecordStatus::Planned);
-        let early_terminal = record_for_device(
-            "claim-early",
-            "keyboard-1",
-            RestoreRecordStatus::Invalidated(hfx_core::RestoreInvalidation {
-                reason: hfx_domain::RestoreInvalidationReason::IntentChanged,
-            }),
-        );
-        let late_terminal = record_for_device(
-            "claim-late",
-            "keyboard-1",
-            RestoreRecordStatus::Invalidated(hfx_core::RestoreInvalidation {
-                reason: hfx_domain::RestoreInvalidationReason::IntentChanged,
-            }),
-        );
-        let mut controller = FakeController {
-            now: time(3_150),
-            plans: vec![
-                Ok(RestorePlanResult::Planned(vec![early.clone()])),
-                Ok(RestorePlanResult::Planned(vec![late.clone()])),
-            ],
-            pending: Vec::new(),
-            advances: vec![
-                Ok(RestoreAdvanceResult::Queued(early)),
-                Ok(RestoreAdvanceResult::Queued(late)),
-            ],
-            dispatches: vec![Ok(early_terminal), Ok(late_terminal)],
-            policy_calls: 0,
-            advance_calls: 0,
-            dispatch_calls: 0,
-        };
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("fallback schedules");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-                true,
-            )
-            .expect("confirmation schedules both stages");
-
-        let early_report = scheduler
-            .tick_with(&mut controller, &sessions())
-            .expect("early restore completes");
-        assert_eq!(early_report.triggers_planned, 1);
-        assert_eq!(early_report.claims_terminal, 1);
-        assert_eq!(scheduler.triggers.len(), 1);
-
-        controller.now = time(6_000);
-        let late_report = scheduler
-            .tick_with(&mut controller, &sessions())
-            .expect("late reassertion completes");
-        assert_eq!(late_report.triggers_planned, 1);
-        assert_eq!(late_report.claims_terminal, 1);
-        assert!(scheduler.triggers.is_empty());
-        assert!(scheduler.return_windows.is_empty());
-        assert_eq!(controller.dispatch_calls, 2);
-    }
-
-    #[test]
-    fn late_reassertion_recovers_an_unfinished_early_claim_without_a_third_trigger() {
-        let early = record_for_device("claim-early", "keyboard-1", RestoreRecordStatus::Planned);
-        let mut controller = FakeController {
-            now: time(3_150),
-            plans: vec![
-                Ok(RestorePlanResult::Planned(vec![early.clone()])),
-                Err(RestorationError::PriorClaimUnresolved),
-            ],
-            pending: Vec::new(),
-            advances: Vec::new(),
-            dispatches: Vec::new(),
-            policy_calls: 0,
-            advance_calls: 0,
-            dispatch_calls: 0,
-        };
-        let mut scheduler = scheduler();
-        scheduler
-            .schedule_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(10_u64).expect("sequence"),
-                time(1_000),
-                5_000,
-                true,
-            )
-            .expect("fallback schedules");
-        scheduler
-            .confirm_device_return_with_policy_at(
-                id("receiver-1"),
-                generation(1),
-                id("keyboard-1"),
-                SequenceNumber::try_from(11_u64).expect("sequence"),
-                time(2_900),
-                250,
-                true,
-            )
-            .expect("confirmation schedules both stages");
-
-        scheduler
-            .process_due_trigger(
-                &mut controller,
-                time(3_150),
-                &mut RestorationTickReport::default(),
-            )
-            .expect("early claim plans but remains unfinished");
-        controller.pending = vec![early];
-        let mut report = RestorationTickReport::default();
-        scheduler
-            .process_due_trigger(&mut controller, time(6_000), &mut report)
-            .expect("late reassertion recovers the early claim");
-
-        assert_eq!(report.claims_recovered, 1);
-        assert_eq!(scheduler.claims.len(), 1);
-        assert!(scheduler.triggers.is_empty());
-        assert!(scheduler.return_windows.is_empty());
-    }
-
     #[test]
     fn deferred_claim_waits_for_backoff_but_device_return_wakes_it() {
         let deferred = record(
@@ -3016,11 +2891,13 @@ mod tests {
             u64::MAX
         );
         scheduler
-            .schedule_device_return(
+            .schedule_device_return_epoch_at(
                 id("receiver-1"),
                 generation(1),
                 id("mouse-1"),
                 SequenceNumber::try_from(9_u64).expect("sequence"),
+                time(0),
+                &[0, 1],
             )
             .expect("return schedules");
         assert_eq!(
@@ -3079,6 +2956,7 @@ mod tests {
     }
 
     #[test]
+    #[allow(clippy::too_many_lines)]
     fn durable_service_start_restore_uses_the_normal_backend_and_survives_reopen() {
         let root = temporary_directory();
         fs::create_dir(&root).expect("state directory creates");
@@ -3143,6 +3021,7 @@ mod tests {
                 claims_dispatched: 1,
                 claims_deferred: 0,
                 claims_terminal: 1,
+                ..RestorationTickReport::default()
             }
         );
         assert_eq!(backend.transport().dispatches.len(), 1);
diff --git a/crates/hfx-domain/src/generated.rs b/crates/hfx-domain/src/generated.rs
index a74a6af..57fa22b 100644
--- a/crates/hfx-domain/src/generated.rs
+++ b/crates/hfx-domain/src/generated.rs
@@ -4485,6 +4485,174 @@ impl fmt::Display for RestoreTriggerKind {
     }
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum ReturnEvidence {
+    #[serde(rename = "application-ownership-loss")]
+    ApplicationOwnershipLoss,
+    #[serde(rename = "battery-report")]
+    BatteryReport,
+    #[serde(rename = "contact-report")]
+    ContactReport,
+    #[serde(rename = "endpoint-activity")]
+    EndpointActivity,
+    #[serde(rename = "endpoint-identity")]
+    EndpointIdentity,
+    #[serde(rename = "endpoint-status")]
+    EndpointStatus,
+    #[serde(rename = "receiver-generation")]
+    ReceiverGeneration,
+    #[serde(rename = "route-departure")]
+    RouteDeparture,
+    #[serde(rename = "route-return")]
+    RouteReturn,
+    #[serde(rename = "system-resume")]
+    SystemResume,
+}
+
+impl ReturnEvidence {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::ApplicationOwnershipLoss => "application-ownership-loss",
+            Self::BatteryReport => "battery-report",
+            Self::ContactReport => "contact-report",
+            Self::EndpointActivity => "endpoint-activity",
+            Self::EndpointIdentity => "endpoint-identity",
+            Self::EndpointStatus => "endpoint-status",
+            Self::ReceiverGeneration => "receiver-generation",
+            Self::RouteDeparture => "route-departure",
+            Self::RouteReturn => "route-return",
+            Self::SystemResume => "system-resume",
+        }
+    }
+}
+
+impl FromStr for ReturnEvidence {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "application-ownership-loss" => Ok(Self::ApplicationOwnershipLoss),
+            "battery-report" => Ok(Self::BatteryReport),
+            "contact-report" => Ok(Self::ContactReport),
+            "endpoint-activity" => Ok(Self::EndpointActivity),
+            "endpoint-identity" => Ok(Self::EndpointIdentity),
+            "endpoint-status" => Ok(Self::EndpointStatus),
+            "receiver-generation" => Ok(Self::ReceiverGeneration),
+            "route-departure" => Ok(Self::RouteDeparture),
+            "route-return" => Ok(Self::RouteReturn),
+            "system-resume" => Ok(Self::SystemResume),
+            _ => Err(DomainValueError::unknown_wire("ReturnEvidence")),
+        }
+    }
+}
+
+impl fmt::Display for ReturnEvidence {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum ReturnPhase {
+    #[serde(rename = "stable")]
+    Stable,
+    #[serde(rename = "quiescent-candidate")]
+    QuiescentCandidate,
+    #[serde(rename = "returning")]
+    Returning,
+    #[serde(rename = "synchronized")]
+    Synchronized,
+    #[serde(rename = "unavailable")]
+    Unavailable,
+}
+
+impl ReturnPhase {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Stable => "stable",
+            Self::QuiescentCandidate => "quiescent-candidate",
+            Self::Returning => "returning",
+            Self::Synchronized => "synchronized",
+            Self::Unavailable => "unavailable",
+        }
+    }
+}
+
+impl FromStr for ReturnPhase {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "stable" => Ok(Self::Stable),
+            "quiescent-candidate" => Ok(Self::QuiescentCandidate),
+            "returning" => Ok(Self::Returning),
+            "synchronized" => Ok(Self::Synchronized),
+            "unavailable" => Ok(Self::Unavailable),
+            _ => Err(DomainValueError::unknown_wire("ReturnPhase")),
+        }
+    }
+}
+
+impl fmt::Display for ReturnPhase {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum RestoreDeliveryState {
+    #[serde(rename = "not-attempted")]
+    NotAttempted,
+    #[serde(rename = "receiver-rejected")]
+    ReceiverRejected,
+    #[serde(rename = "outcome-uncertain")]
+    OutcomeUncertain,
+    #[serde(rename = "receiver-delivered")]
+    ReceiverDelivered,
+    #[serde(rename = "child-rejected")]
+    ChildRejected,
+    #[serde(rename = "child-confirmed")]
+    ChildConfirmed,
+}
+
+impl RestoreDeliveryState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::NotAttempted => "not-attempted",
+            Self::ReceiverRejected => "receiver-rejected",
+            Self::OutcomeUncertain => "outcome-uncertain",
+            Self::ReceiverDelivered => "receiver-delivered",
+            Self::ChildRejected => "child-rejected",
+            Self::ChildConfirmed => "child-confirmed",
+        }
+    }
+}
+
+impl FromStr for RestoreDeliveryState {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "not-attempted" => Ok(Self::NotAttempted),
+            "receiver-rejected" => Ok(Self::ReceiverRejected),
+            "outcome-uncertain" => Ok(Self::OutcomeUncertain),
+            "receiver-delivered" => Ok(Self::ReceiverDelivered),
+            "child-rejected" => Ok(Self::ChildRejected),
+            "child-confirmed" => Ok(Self::ChildConfirmed),
+            _ => Err(DomainValueError::unknown_wire("RestoreDeliveryState")),
+        }
+    }
+}
+
+impl fmt::Display for RestoreDeliveryState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum RestoreRecordState {
     #[serde(rename = "planned")]
diff --git a/crates/hfx-integration-model/tests/view_model.rs b/crates/hfx-integration-model/tests/view_model.rs
index db6034a..0c23649 100644
--- a/crates/hfx-integration-model/tests/view_model.rs
+++ b/crates/hfx-integration-model/tests/view_model.rs
@@ -63,6 +63,7 @@ fn endpoint(
         confidence: EvidenceConfidence::Observed,
         evidence_claim_id: Some(text(&format!("claim-{endpoint_id}"))),
         observed_at_ms: Some(time(10)),
+        return_epoch: None,
     }
 }
 
diff --git a/crates/hfx-profiles/src/catalog.rs b/crates/hfx-profiles/src/catalog.rs
index 0a1b63e..51b831b 100644
--- a/crates/hfx-profiles/src/catalog.rs
+++ b/crates/hfx-profiles/src/catalog.rs
@@ -2,11 +2,11 @@
 
 use crate::{
     LifecyclePolicyRecord, LightingTopology, PROFILES, PassiveTelemetryRecord, PresentationRecord,
-    ProfileRecord, QualificationMigrationRecord,
+    ProfileRecord, QualificationMigrationRecord, ReturnEvidenceSource,
 };
 use hfx_domain::{
     CapabilityId, CarrierIndex, DeviceKind, DomainValueError, LedCount, ProductId, ProfileDigest,
-    ProfileId, ProfileKind, ProfileRevision, RouteKind, SupportLevel, VendorId,
+    ProfileId, ProfileKind, ProfileRevision, ReturnEvidence, RouteKind, SupportLevel, VendorId,
 };
 use std::collections::BTreeMap;
 use std::fmt;
@@ -144,6 +144,20 @@ impl RuntimeProfile {
     }
 }
 
+impl ReturnEvidenceSource {
+    /// Projects generated profile evidence into the application-neutral core
+    /// lifecycle vocabulary.
+    #[must_use]
+    pub const fn domain(self) -> ReturnEvidence {
+        match self {
+            Self::BatteryReport => ReturnEvidence::BatteryReport,
+            Self::ContactReport => ReturnEvidence::ContactReport,
+            Self::EndpointActivity => ReturnEvidence::EndpointActivity,
+            Self::RouteReturn => ReturnEvidence::RouteReturn,
+        }
+    }
+}
+
 /// Validated typed view over the generated, immutable profile catalog.
 #[derive(Clone, Debug)]
 pub struct RuntimeProfileCatalog {
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 2ee326c..fc9f282 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f
+// Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -51,22 +51,48 @@ pub enum PowerOffDepartureEvidence {
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub enum DeviceReturnConfirmationEvidence {
+pub enum ReturnEvidenceSource {
     BatteryReport,
+    ContactReport,
+    EndpointActivity,
+    RouteReturn,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub struct DeviceReturnConfirmationRecord {
-    pub evidence: DeviceReturnConfirmationEvidence,
-    pub settle_ms: u64,
-    pub reassert_at_fallback: bool,
+pub enum ReturnPolicyStrategy {
+    ActivityAssistedReturnEpoch,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ReturnPolicyQualification {
+    PrequalificationCandidate,
+    Qualified,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ReturnDeliverySemantics {
+    ReceiverDeliveredNotChildApplied,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct ReturnPolicyRecord {
+    pub id: &'static str,
+    pub strategy: ReturnPolicyStrategy,
+    pub qualification: ReturnPolicyQualification,
+    pub quiescence_candidate_ms: u64,
+    pub observation_jitter_ms: u64,
+    pub retry_offsets_ms: &'static [u64],
+    pub allowed_open_evidence: &'static [ReturnEvidenceSource],
+    pub allowed_accelerator_evidence: &'static [ReturnEvidenceSource],
+    pub delivery_semantics: ReturnDeliverySemantics,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct LifecyclePolicyRecord {
     pub power_off_departure_evidence: PowerOffDepartureEvidence,
-    pub device_return_settle_ms: u64,
-    pub device_return_confirmation: Option<DeviceReturnConfirmationRecord>,
+    pub return_policy_id: &'static str,
+    pub open_evidence: &'static [ReturnEvidenceSource],
+    pub accelerator_evidence: &'static [ReturnEvidenceSource],
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -112,7 +138,29 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f";
+    "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac";
+
+pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
+    id: "receiver-child.activity-assisted.v1",
+    strategy: ReturnPolicyStrategy::ActivityAssistedReturnEpoch,
+    qualification: ReturnPolicyQualification::PrequalificationCandidate,
+    quiescence_candidate_ms: 60000,
+    observation_jitter_ms: 500,
+    retry_offsets_ms: &[
+        0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000,
+    ],
+    allowed_open_evidence: &[
+        ReturnEvidenceSource::EndpointActivity,
+        ReturnEvidenceSource::RouteReturn,
+    ],
+    allowed_accelerator_evidence: &[
+        ReturnEvidenceSource::BatteryReport,
+        ReturnEvidenceSource::ContactReport,
+        ReturnEvidenceSource::EndpointActivity,
+        ReturnEvidenceSource::RouteReturn,
+    ],
+    delivery_semantics: ReturnDeliverySemantics::ReceiverDeliveredNotChildApplied,
+}];
 
 const CAPABILITIES_0: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -195,11 +243,16 @@ const PASSIVE_ROUTE_AVAILABLE_0: &[u32] = &[];
 const PASSIVE_ROUTE_UNAVAILABLE_0: &[u32] = &[];
 const PASSIVE_ROUTE_INDETERMINATE_0: &[u32] = &[];
 
-const QUALIFICATION_MIGRATIONS_0: &[QualificationMigrationRecord] =
-    &[QualificationMigrationRecord {
+const QUALIFICATION_MIGRATIONS_0: &[QualificationMigrationRecord] = &[
+    QualificationMigrationRecord {
+        from_runtime_sha256: "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    },
+    QualificationMigrationRecord {
         from_runtime_sha256: "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
         preserve_stage_roles: &["lighting", "map", "telemetry"],
-    }];
+    },
+];
 
 const CAPABILITIES_1: &[CapabilityRecord] = &[
     CapabilityRecord {
@@ -284,6 +337,10 @@ const PASSIVE_ROUTE_UNAVAILABLE_1: &[u32] = &[2];
 const PASSIVE_ROUTE_INDETERMINATE_1: &[u32] = &[257];
 
 const QUALIFICATION_MIGRATIONS_1: &[QualificationMigrationRecord] = &[
+    QualificationMigrationRecord {
+        from_runtime_sha256: "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
+        preserve_stage_roles: &["lighting", "map", "telemetry"],
+    },
     QualificationMigrationRecord {
         from_runtime_sha256: "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
         preserve_stage_roles: &["lighting", "map", "telemetry"],
@@ -355,8 +412,8 @@ const QUALIFICATION_MIGRATIONS_3: &[QualificationMigrationRecord] = &[];
 pub const PROFILES: &[ProfileRecord] = &[
     ProfileRecord {
         id: "child.razer.basilisk-v3-pro-35k.00cd",
-        runtime_sha256: "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
-        revision: 2,
+        runtime_sha256: "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf",
+        revision: 3,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Mouse,
         vendor_id: Some(5426),
@@ -390,8 +447,12 @@ pub const PROFILES: &[ProfileRecord] = &[
         }),
         lifecycle: Some(LifecyclePolicyRecord {
             power_off_departure_evidence: PowerOffDepartureEvidence::WatchedRetainedRoute,
-            device_return_settle_ms: 1000,
-            device_return_confirmation: None,
+            return_policy_id: "receiver-child.activity-assisted.v1",
+            open_evidence: &[ReturnEvidenceSource::EndpointActivity],
+            accelerator_evidence: &[
+                ReturnEvidenceSource::ContactReport,
+                ReturnEvidenceSource::EndpointActivity,
+            ],
         }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_0,
         presentation: Some(PresentationRecord {
@@ -406,8 +467,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "child.razer.deathstalker-v2-pro-tkl.0296",
-        runtime_sha256: "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
-        revision: 5,
+        runtime_sha256: "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63",
+        revision: 6,
         profile_kind: ProfileKind::Child,
         device_kind: DeviceKind::Keyboard,
         vendor_id: Some(5426),
@@ -441,12 +502,16 @@ pub const PROFILES: &[ProfileRecord] = &[
         }),
         lifecycle: Some(LifecyclePolicyRecord {
             power_off_departure_evidence: PowerOffDepartureEvidence::ReceiverState,
-            device_return_settle_ms: 5000,
-            device_return_confirmation: Some(DeviceReturnConfirmationRecord {
-                evidence: DeviceReturnConfirmationEvidence::BatteryReport,
-                settle_ms: 250,
-                reassert_at_fallback: true,
-            }),
+            return_policy_id: "receiver-child.activity-assisted.v1",
+            open_evidence: &[
+                ReturnEvidenceSource::EndpointActivity,
+                ReturnEvidenceSource::RouteReturn,
+            ],
+            accelerator_evidence: &[
+                ReturnEvidenceSource::BatteryReport,
+                ReturnEvidenceSource::EndpointActivity,
+                ReturnEvidenceSource::RouteReturn,
+            ],
         }),
         qualification_migrations: QUALIFICATION_MIGRATIONS_1,
         presentation: Some(PresentationRecord {
@@ -530,3 +595,8 @@ pub fn child_profile_by_product_id(product_id: u16) -> Option<&'static ProfileRe
         profile.profile_kind == ProfileKind::Child && profile.product_id == Some(product_id)
     })
 }
+
+#[must_use]
+pub fn return_policy_by_id(id: &str) -> Option<&'static ReturnPolicyRecord> {
+    RETURN_POLICIES.iter().find(|policy| policy.id == id)
+}
diff --git a/crates/hfx-profiles/tests/catalog.rs b/crates/hfx-profiles/tests/catalog.rs
index 839ed0b..efbcfd3 100644
--- a/crates/hfx-profiles/tests/catalog.rs
+++ b/crates/hfx-profiles/tests/catalog.rs
@@ -2,8 +2,9 @@
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind};
 use hfx_profiles::{
-    DeviceReturnConfirmationEvidence, PROFILES, PowerOffDepartureEvidence, RuntimeProfileCatalog,
-    child_profile_by_product_id, profile_by_id, receiver_profile_by_usb_id,
+    PROFILES, PowerOffDepartureEvidence, ReturnDeliverySemantics, ReturnEvidenceSource,
+    ReturnPolicyQualification, RuntimeProfileCatalog, child_profile_by_product_id, profile_by_id,
+    receiver_profile_by_usb_id, return_policy_by_id,
 };
 
 #[test]
@@ -32,13 +33,22 @@ fn receiver_and_children_resolve_independently() {
         lifecycle.power_off_departure_evidence,
         PowerOffDepartureEvidence::WatchedRetainedRoute
     );
-    assert_eq!(lifecycle.device_return_settle_ms, 1_000);
-    assert_eq!(lifecycle.device_return_confirmation, None);
-    assert_eq!(mouse.qualification_migrations.len(), 1);
     assert_eq!(
-        mouse.qualification_migrations[0].preserve_stage_roles,
-        &["lighting", "map", "telemetry"]
+        lifecycle.return_policy_id,
+        "receiver-child.activity-assisted.v1"
+    );
+    assert_eq!(
+        lifecycle.open_evidence,
+        &[ReturnEvidenceSource::EndpointActivity]
     );
+    assert_eq!(
+        lifecycle.accelerator_evidence,
+        &[
+            ReturnEvidenceSource::ContactReport,
+            ReturnEvidenceSource::EndpointActivity,
+        ]
+    );
+    assert_eq!(mouse.qualification_migrations.len(), 2);
     assert_eq!(keyboard.device_kind, DeviceKind::Keyboard);
     let lifecycle = keyboard
         .lifecycle
@@ -47,17 +57,14 @@ fn receiver_and_children_resolve_independently() {
         lifecycle.power_off_departure_evidence,
         PowerOffDepartureEvidence::ReceiverState
     );
-    assert_eq!(lifecycle.device_return_settle_ms, 5_000);
-    let confirmation = lifecycle
-        .device_return_confirmation
-        .expect("keyboard return uses child confirmation evidence");
     assert_eq!(
-        confirmation.evidence,
-        DeviceReturnConfirmationEvidence::BatteryReport
+        lifecycle.open_evidence,
+        &[
+            ReturnEvidenceSource::EndpointActivity,
+            ReturnEvidenceSource::RouteReturn,
+        ]
     );
-    assert_eq!(confirmation.settle_ms, 250);
-    assert!(confirmation.reassert_at_fallback);
-    assert_eq!(keyboard.qualification_migrations.len(), 4);
+    assert_eq!(keyboard.qualification_migrations.len(), 5);
     let current_migration = keyboard
         .qualification_migrations
         .iter()
@@ -82,6 +89,24 @@ fn receiver_and_children_resolve_independently() {
     assert_ne!(mouse.id, keyboard.id);
 }
 
+#[test]
+fn shared_return_policy_is_bounded_and_truthful() {
+    let policy = return_policy_by_id("receiver-child.activity-assisted.v1")
+        .expect("profile-selected return policy exists");
+    assert_eq!(
+        policy.qualification,
+        ReturnPolicyQualification::PrequalificationCandidate
+    );
+    assert_eq!(policy.quiescence_candidate_ms, 60_000);
+    assert_eq!(policy.retry_offsets_ms.first(), Some(&0));
+    assert_eq!(policy.retry_offsets_ms.last(), Some(&6_000));
+    assert_eq!(policy.retry_offsets_ms.len(), 12);
+    assert_eq!(
+        policy.delivery_semantics,
+        ReturnDeliverySemantics::ReceiverDeliveredNotChildApplied
+    );
+}
+
 #[test]
 fn unknown_child_has_no_implicit_profile() {
     assert!(child_profile_by_product_id(0xffff).is_none());
diff --git a/crates/hfx-protocol/src/generated.rs b/crates/hfx-protocol/src/generated.rs
index 0e6b15d..d347176 100644
--- a/crates/hfx-protocol/src/generated.rs
+++ b/crates/hfx-protocol/src/generated.rs
@@ -11,15 +11,16 @@ use hfx_domain::{
     NegotiationToken, PairingState, PowerState, PresenceState, PresentationKey, PrivacyClass,
     ProductId, ProfileDigest, ProfileId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId,
     ProtocolSessionId, ProtocolVersion, QueueAdmission, QueueCapacity, ReceiverId,
-    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreState, RouteKind,
-    RouteState, SequenceNumber, ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision,
-    StableLightingMode, StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability,
-    TransactionClass, TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
+    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreDeliveryState,
+    RestoreState, ReturnEvidence, ReturnPhase, RouteKind, RouteState, SequenceNumber,
+    ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision, StableLightingMode,
+    StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability, TransactionClass,
+    TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
 };
 use serde::{Deserialize, Serialize};
 
-pub const MINIMUM_PROTOCOL_VERSION: u16 = 5;
-pub const MAXIMUM_PROTOCOL_VERSION: u16 = 5;
+pub const MINIMUM_PROTOCOL_VERSION: u16 = 6;
+pub const MAXIMUM_PROTOCOL_VERSION: u16 = 6;
 pub const MAX_WIRE_MESSAGE_BYTES: usize = 1_048_576;
 pub const MAX_JSON_DEPTH: usize = 128;
 pub const SUPPORTED_FEATURES: &[&str] = &[
@@ -31,6 +32,7 @@ pub const SUPPORTED_FEATURES: &[&str] = &[
     "integration-view-projection",
     "event-subscriptions",
     "structured-diagnostics",
+    "return-lifecycle-projection",
 ];
 
 /// A method request with no method-specific fields.
@@ -192,6 +194,28 @@ pub struct EventCursor {
     pub sequence: SequenceNumber,
 }
 
+/// Generation-bound endpoint return state without claiming physical lighting application.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReturnEpoch {
+    /// Receiver generation that owns the epoch.
+    pub generation_id: GenerationId,
+    /// Logical child whose endpoint is returning.
+    pub device_id: LogicalDeviceId,
+    /// Exact endpoint whose return is tracked.
+    pub endpoint_id: EndpointId,
+    /// Opening evidence sequence for stale-event rejection.
+    pub epoch_sequence: SequenceNumber,
+    /// Bridge-local monotonic epoch opening time.
+    pub opened_at_ms: MonotonicMs,
+    /// Typed passive evidence that opened the epoch.
+    pub opening_evidence: ReturnEvidence,
+    /// Current endpoint return phase.
+    pub phase: ReturnPhase,
+    /// Strongest known replay-delivery fact.
+    pub delivery_state: RestoreDeliveryState,
+}
+
 /// Independent route, power, sleep, activity, contact, and freshness facts.
 #[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -220,6 +244,8 @@ pub struct EndpointSnapshot {
     pub evidence_claim_id: Option<EvidenceClaimId>,
     /// Bridge-local observation instant.
     pub observed_at_ms: Option<MonotonicMs>,
+    /// Optional versioned return projection; receiver delivery alone never means child application.
+    pub return_epoch: Option<ReturnEpoch>,
 }
 
 /// Battery availability and value without collapsing unknown and unavailable.
diff --git a/crates/hfx-protocol/src/generated_v6.rs b/crates/hfx-protocol/src/generated_v6.rs
new file mode 100644
index 0000000..d347176
--- /dev/null
+++ b/crates/hfx-protocol/src/generated_v6.rs
@@ -0,0 +1,1103 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_domain::{
+    ActivityState, BatteryPercent, CapabilityId, ClientId, ClientName, ColorChannel,
+    ComponentVersion, ConnectionMode, ContactState, ControllerAvailability, DeliveredFrameCount,
+    DeviceApplicationState, DeviceKind, DocumentationPath, DroppedEventCount, EndpointId,
+    ErrorSeverity, EventBatchLimit, EventKind, EvidenceClaimId, EvidenceConfidence, FindingId,
+    FrameCount, FrameIndex, FreshnessState, GenerationId, HumanMessage, InventoryAvailability,
+    LeaseDurationMs, LeaseId, LeaseState, LedCount, LogicalDeviceId, ModelName, MonotonicMs,
+    NegotiationToken, PairingState, PowerState, PresenceState, PresentationKey, PrivacyClass,
+    ProductId, ProfileDigest, ProfileId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId,
+    ProtocolSessionId, ProtocolVersion, QueueAdmission, QueueCapacity, ReceiverId,
+    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreDeliveryState,
+    RestoreState, ReturnEvidence, ReturnPhase, RouteKind, RouteState, SequenceNumber,
+    ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision, StableLightingMode,
+    StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability, TransactionClass,
+    TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
+};
+use serde::{Deserialize, Serialize};
+
+pub const MINIMUM_PROTOCOL_VERSION: u16 = 6;
+pub const MAXIMUM_PROTOCOL_VERSION: u16 = 6;
+pub const MAX_WIRE_MESSAGE_BYTES: usize = 1_048_576;
+pub const MAX_JSON_DEPTH: usize = 128;
+pub const SUPPORTED_FEATURES: &[&str] = &[
+    "ownership-leases",
+    "atomic-transactions",
+    "profile-bound-transactions",
+    "semantic-stable-lighting",
+    "snapshot-profile-bindings",
+    "integration-view-projection",
+    "event-subscriptions",
+    "structured-diagnostics",
+    "return-lifecycle-projection",
+];
+
+/// A method request with no method-specific fields.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EmptyRequest {}
+
+/// One canonical eight-bit RGB color.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RgbColor {
+    /// Red channel.
+    pub red: ColorChannel,
+    /// Green channel.
+    pub green: ColorChannel,
+    /// Blue channel.
+    pub blue: ColorChannel,
+}
+
+/// Bounded client protocol and feature offer.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ClientHello {
+    /// Process-scoped client identity.
+    pub client_id: ClientId,
+    /// User-facing application name.
+    pub client_name: ClientName,
+    /// Oldest protocol accepted by the client.
+    pub minimum_version: ProtocolVersion,
+    /// Newest protocol accepted by the client.
+    pub maximum_version: ProtocolVersion,
+    /// Features without which this client cannot operate.
+    pub required_features: Vec<ProtocolFeatureId>,
+    /// Features the client can use when available.
+    pub optional_features: Vec<ProtocolFeatureId>,
+}
+
+/// Negotiated protocol version and bridge feature set.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ServerHello {
+    /// Mutually supported protocol version.
+    pub selected_version: ProtocolVersion,
+    /// Changes whenever the bridge process identity changes.
+    pub server_instance_id: ServerInstanceId,
+    /// Server-issued connection ownership identity.
+    pub protocol_session_id: ProtocolSessionId,
+    /// Binds subsequent requests to this negotiated selection.
+    pub negotiation_token: NegotiationToken,
+    /// Bridge component version.
+    pub bridge_version: ComponentVersion,
+    /// Protocol features enabled for this connection.
+    pub enabled_features: Vec<ProtocolFeatureId>,
+    /// Maximum retained event count.
+    pub event_buffer_capacity: QueueCapacity,
+}
+
+/// One device-scoped writable resource.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ResourceKey {
+    /// Receiver that owns the route.
+    pub receiver_id: ReceiverId,
+    /// Receiver generation to which ownership is bound.
+    pub generation_id: GenerationId,
+    /// Logical resource owner.
+    pub device_id: LogicalDeviceId,
+    /// Generic resource domain.
+    pub kind: ResourceKind,
+}
+
+/// Atomic request for one or more writable resources.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Requesting client.
+    pub client_id: ClientId,
+    /// Complete atomic resource set.
+    pub resources: Vec<ResourceKey>,
+    /// Renewable lease duration.
+    pub duration_ms: LeaseDurationMs,
+}
+
+/// Granted ownership lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseGrant {
+    /// Lease identity.
+    pub lease_id: LeaseId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Atomically owned resources.
+    pub resources: Vec<ResourceKey>,
+    /// Exclusive monotonic expiry.
+    pub expires_at_ms: MonotonicMs,
+    /// Current lease state.
+    pub state: LeaseState,
+}
+
+/// Deterministic first conflict from an otherwise atomic lease request.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseConflict {
+    /// Current owner.
+    pub conflicting_client: ClientId,
+    /// First conflict in canonical resource order.
+    pub conflicting_resource: ResourceKey,
+}
+
+/// Structured lease rejection unrelated to another owner.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseRejection {
+    /// Stable rejection category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central error catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Idempotent renewal of one existing lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RenewLeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Lease to renew.
+    pub lease_id: LeaseId,
+    /// New bounded duration.
+    pub duration_ms: LeaseDurationMs,
+}
+
+/// Idempotent release of one existing lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReleaseLeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Lease to release.
+    pub lease_id: LeaseId,
+}
+
+/// Complete resumable position in one event stream projection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EventCursor {
+    /// Bridge event-stream identity.
+    pub stream_id: StreamId,
+    /// Changes whenever the event stream restarts.
+    pub stream_epoch: StreamEpoch,
+    /// Snapshot and event projection contract revision.
+    pub projection_revision: ProjectionRevision,
+    /// Last event reflected by this cursor.
+    pub sequence: SequenceNumber,
+}
+
+/// Generation-bound endpoint return state without claiming physical lighting application.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReturnEpoch {
+    /// Receiver generation that owns the epoch.
+    pub generation_id: GenerationId,
+    /// Logical child whose endpoint is returning.
+    pub device_id: LogicalDeviceId,
+    /// Exact endpoint whose return is tracked.
+    pub endpoint_id: EndpointId,
+    /// Opening evidence sequence for stale-event rejection.
+    pub epoch_sequence: SequenceNumber,
+    /// Bridge-local monotonic epoch opening time.
+    pub opened_at_ms: MonotonicMs,
+    /// Typed passive evidence that opened the epoch.
+    pub opening_evidence: ReturnEvidence,
+    /// Current endpoint return phase.
+    pub phase: ReturnPhase,
+    /// Strongest known replay-delivery fact.
+    pub delivery_state: RestoreDeliveryState,
+}
+
+/// Independent route, power, sleep, activity, contact, and freshness facts.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EndpointSnapshot {
+    /// Stable logical route identity.
+    pub endpoint_id: EndpointId,
+    /// Transport route category.
+    pub route_kind: RouteKind,
+    /// Current route evidence.
+    pub route_state: RouteState,
+    /// User-facing connection mode.
+    pub connection_mode: ConnectionMode,
+    /// Explicit power evidence, independent of route.
+    pub power_state: PowerState,
+    /// Explicit sleep evidence.
+    pub sleep_state: SleepState,
+    /// Recent activity evidence.
+    pub activity_state: ActivityState,
+    /// Mat-contact evidence where applicable.
+    pub contact_state: ContactState,
+    /// Freshness of the route projection.
+    pub freshness: FreshnessState,
+    /// How directly the state was established.
+    pub confidence: EvidenceConfidence,
+    /// Privacy-safe evidence provenance when available.
+    pub evidence_claim_id: Option<EvidenceClaimId>,
+    /// Bridge-local observation instant.
+    pub observed_at_ms: Option<MonotonicMs>,
+    /// Optional versioned return projection; receiver delivery alone never means child application.
+    pub return_epoch: Option<ReturnEpoch>,
+}
+
+/// Battery availability and value without collapsing unknown and unavailable.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BatteryObservation {
+    /// Whether a current value exists.
+    pub availability: TelemetryAvailability,
+    /// Reported value only when availability is reported.
+    pub percentage: Option<BatteryPercent>,
+    /// Freshness of the battery observation.
+    pub freshness: FreshnessState,
+    /// How directly the value was established.
+    pub confidence: EvidenceConfidence,
+    /// Bridge-local observation instant.
+    pub observed_at_ms: Option<MonotonicMs>,
+}
+
+/// Current bounded application ownership for one generation-scoped resource.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ResourceOwnershipSnapshot {
+    /// Owned resource.
+    pub resource: ResourceKey,
+    /// Current owning client.
+    pub client_id: ClientId,
+    /// Authorizing lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Application-neutral logical controller state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LogicalDeviceSnapshot {
+    /// Logical identity.
+    pub device_id: LogicalDeviceId,
+    /// Device category.
+    pub device_kind: DeviceKind,
+    /// Observed product id.
+    pub product_id: ProductId,
+    /// Qualified profile when available.
+    pub profile_id: Option<ProfileId>,
+    /// Immutable qualified child profile digest when available.
+    pub profile_digest: Option<ProfileDigest>,
+    /// Receiver inventory state independent of route.
+    pub pairing: PairingState,
+    /// Derived controller presence.
+    pub presence: PresenceState,
+    /// Evidence-backed support level.
+    pub support_level: SupportLevel,
+    /// Independent known routes in canonical endpoint order.
+    pub endpoints: Vec<EndpointSnapshot>,
+    /// Current battery projection.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+}
+
+/// Generation-bound receiver and child inventory.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReceiverSnapshot {
+    /// Logical receiver identity.
+    pub receiver_id: ReceiverId,
+    /// Current receiver generation.
+    pub generation_id: GenerationId,
+    /// Exact qualified receiver profile when available.
+    pub profile_id: Option<ProfileId>,
+    /// Immutable qualified receiver profile digest when available.
+    pub profile_digest: Option<ProfileDigest>,
+    /// Receiver lifecycle state.
+    pub lifecycle: ReceiverLifecycleState,
+    /// Independent logical children.
+    pub devices: Vec<LogicalDeviceSnapshot>,
+    /// Current generation-scoped write ownership.
+    pub ownership: Vec<ResourceOwnershipSnapshot>,
+    /// Whether stable state restoration is enabled.
+    pub stable_restore_enabled: bool,
+    /// Current restoration state.
+    pub restore_state: RestoreState,
+}
+
+/// Sequence-bound complete bridge snapshot.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BridgeSnapshot {
+    /// Complete event position reflected by this snapshot.
+    pub cursor: EventCursor,
+    /// Exactly one current generation per receiver in canonical order.
+    pub receivers: Vec<ReceiverSnapshot>,
+}
+
+/// One logical-device direct-mode frame.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LightingFrame {
+    /// Frame target.
+    pub device_id: LogicalDeviceId,
+    /// Transaction-local frame order.
+    pub frame_index: FrameIndex,
+    /// Logical LED colors before carrier translation.
+    pub colors: Vec<RgbColor>,
+}
+
+/// Exact profile and lighting dimensions bound to one transaction target.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceProfileBinding {
+    /// Logical transaction target.
+    pub device_id: LogicalDeviceId,
+    /// Qualified child profile selected at admission.
+    pub profile_id: ProfileId,
+    /// Immutable profile-catalog digest selected at admission.
+    pub profile_digest: ProfileDigest,
+    /// Exact logical color count required by this profile.
+    pub application_slot_count: LedCount,
+}
+
+/// Explicit semantic stable-lighting intent for one frame target.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct StableLightingIntent {
+    /// Logical stable-lighting target.
+    pub device_id: LogicalDeviceId,
+    /// Stable Static or Off meaning independent of RGB payload values.
+    pub mode: StableLightingMode,
+}
+
+/// Atomic generation- and ownership-bound operation.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Submitting client.
+    pub client_id: ClientId,
+    /// Atomic ownership proof.
+    pub lease_id: LeaseId,
+    /// Receiver target.
+    pub receiver_id: ReceiverId,
+    /// Generation binding.
+    pub generation_id: GenerationId,
+    /// Exact qualified receiver profile selected at admission.
+    pub receiver_profile_id: ProfileId,
+    /// Immutable receiver profile-catalog digest selected at admission.
+    pub receiver_profile_digest: ProfileDigest,
+    /// Complete canonical profile binding for every frame target.
+    pub device_profiles: Vec<DeviceProfileBinding>,
+    /// Ordering and coalescing class.
+    pub transaction_class: TransactionClass,
+    /// Canonical per-target semantic intent for static-lighting; empty for every other transaction class.
+    pub stable_intents: Vec<StableLightingIntent>,
+    /// Absolute monotonic deadline.
+    pub deadline_ms: MonotonicMs,
+    /// Complete ownership set.
+    pub resources: Vec<ResourceKey>,
+    /// Complete atomic frame batch.
+    pub frames: Vec<LightingFrame>,
+}
+
+/// Nonterminal generation-bound transaction projection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionProgress {
+    /// Original idempotency identity.
+    pub request_id: RequestId,
+    /// Canonical request digest used for exact replay.
+    pub request_digest: RequestDigest,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Bound receiver.
+    pub receiver_id: ReceiverId,
+    /// Bound receiver generation.
+    pub generation_id: GenerationId,
+    /// Current nonterminal state.
+    pub state: TransactionState,
+    /// Bounded queue decision.
+    pub admission: QueueAdmission,
+    /// Frames promised by the transaction.
+    pub declared_frames: FrameCount,
+    /// Frames terminally accepted so far.
+    pub delivered_frames: DeliveredFrameCount,
+    /// Current transport side-effect knowledge.
+    pub side_effect_certainty: SideEffectCertainty,
+    /// Whether transport has begun a hardware write.
+    pub live_write_executed: bool,
+}
+
+/// Immutable terminal transaction outcome retained for bounded lookup.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionTerminal {
+    /// Original idempotency identity.
+    pub request_id: RequestId,
+    /// Canonical request digest used for exact replay.
+    pub request_digest: RequestDigest,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Bound receiver.
+    pub receiver_id: ReceiverId,
+    /// Bound receiver generation.
+    pub generation_id: GenerationId,
+    /// Terminal succeeded, failed, revoked, or superseded state.
+    pub state: TransactionState,
+    /// Frames promised by the transaction.
+    pub declared_frames: FrameCount,
+    /// Frames terminally accepted by transport.
+    pub delivered_frames: DeliveredFrameCount,
+    /// Terminal transport side-effect knowledge.
+    pub side_effect_certainty: SideEffectCertainty,
+    /// Whether transport began a hardware write.
+    pub live_write_executed: bool,
+    /// Whether exact automatic replay is safe; false after possible transport.
+    pub automatic_retry: bool,
+    /// Separate child-application evidence.
+    pub device_application: DeviceApplicationState,
+    /// Immutable completion event sequence.
+    pub terminal_sequence: SequenceNumber,
+    /// Structured failure category.
+    pub error_kind: Option<ProtocolErrorKind>,
+    /// Newer unsent effect transaction that replaced this one.
+    pub superseded_by: Option<TransactionId>,
+}
+
+/// Outcome lookup cannot return a retained transaction record.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionUnavailable {
+    /// Requested transaction identity.
+    pub transaction_id: TransactionId,
+    /// Unknown or evicted outcome category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central error catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Idempotent lookup of one previously submitted transaction.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionLookup {
+    /// Lookup request identity.
+    pub request_id: RequestId,
+    /// Original transaction owner.
+    pub client_id: ClientId,
+    /// Transaction to inspect.
+    pub transaction_id: TransactionId,
+}
+
+/// Bounded event subscription cursor.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SubscriptionRequest {
+    /// Subscribing client.
+    pub client_id: ClientId,
+    /// Server-issued subscription identity when continuing.
+    pub subscription_id: Option<SubscriptionId>,
+    /// Previously observed complete event cursor.
+    pub expected_cursor: Option<EventCursor>,
+    /// Maximum events requested in this batch.
+    pub max_events: EventBatchLimit,
+}
+
+/// Sequence-bound typed event with snapshot references.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BridgeEvent {
+    /// Strictly increasing sequence.
+    pub sequence: SequenceNumber,
+    /// Typed event category.
+    pub kind: EventKind,
+    /// Affected receiver when applicable.
+    pub receiver_id: Option<ReceiverId>,
+    /// Affected generation when applicable.
+    pub generation_id: Option<GenerationId>,
+    /// Affected logical device when applicable.
+    pub device_id: Option<LogicalDeviceId>,
+    /// Affected lease when applicable.
+    pub lease_id: Option<LeaseId>,
+    /// Affected transaction when applicable.
+    pub transaction_id: Option<TransactionId>,
+    /// Affected finding when applicable.
+    pub finding_id: Option<FindingId>,
+}
+
+/// Bounded event result with explicit cursor-gap state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EventBatch {
+    /// Subscription identity.
+    pub subscription_id: SubscriptionId,
+    /// Cursor to supply for the next batch.
+    pub next_cursor: EventCursor,
+    /// Events after the requested cursor.
+    pub events: Vec<BridgeEvent>,
+    /// Oldest retained sequence.
+    pub oldest_available: SequenceNumber,
+    /// Newest retained sequence.
+    pub latest_available: SequenceNumber,
+    /// Events evicted since this stream epoch began.
+    pub dropped_events: DroppedEventCount,
+    /// Whether the client must refresh its snapshot.
+    pub cursor_gap: bool,
+    /// Whether another retained event follows this batch.
+    pub has_more: bool,
+}
+
+/// One privacy-classified actionable finding.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DiagnosticFinding {
+    /// Stable finding code.
+    pub finding_id: FindingId,
+    /// User-facing severity.
+    pub severity: ErrorSeverity,
+    /// Bounded technical cause.
+    pub cause: HumanMessage,
+    /// Plain user explanation.
+    pub explanation: HumanMessage,
+    /// One safe remediation.
+    pub safe_action: HumanMessage,
+    /// Support-output privacy class.
+    pub privacy: PrivacyClass,
+    /// Stable documentation path.
+    pub documentation: DocumentationPath,
+}
+
+/// Bounded bridge findings and queue health.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DiagnosticSnapshot {
+    /// Latest reflected event sequence.
+    pub sequence: SequenceNumber,
+    /// Active actionable findings.
+    pub findings: Vec<DiagnosticFinding>,
+    /// Configured event bound.
+    pub event_buffer_capacity: QueueCapacity,
+    /// Configured transaction bound.
+    pub transaction_queue_capacity: QueueCapacity,
+}
+
+/// Exact immutable profile authority exposed to integrations.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ProfileBindingView {
+    /// Qualified profile identity.
+    pub profile_id: ProfileId,
+    /// Immutable runtime profile digest.
+    pub profile_digest: ProfileDigest,
+}
+
+/// Truthful paired-device inventory independent of application controller registration.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceInventoryView {
+    /// Logical device identity.
+    pub device_id: LogicalDeviceId,
+    /// Device category.
+    pub device_kind: DeviceKind,
+    /// Observed product id.
+    pub product_id: ProductId,
+    /// Exact qualified child profile when available.
+    pub profile: Option<ProfileBindingView>,
+    /// Qualified model name when available.
+    pub model_name: Option<ModelName>,
+    /// Receiver pairing truth.
+    pub pairing: PairingState,
+    /// Derived device presence.
+    pub presence: PresenceState,
+    /// Inventory-facing availability with receiver and pairing context.
+    pub availability: InventoryAvailability,
+    /// Evidence-backed support level.
+    pub support_level: SupportLevel,
+    /// Independent known routes.
+    pub endpoints: Vec<EndpointSnapshot>,
+    /// Battery truth without collapsing unavailable states.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+}
+
+/// Pinned upstream presentation authority without hardware transport policy.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct PresentationView {
+    /// Pinned upstream catalog identity.
+    pub upstream_id: UpstreamId,
+    /// Upstream project responsible for presentation.
+    pub owner: UpstreamOwner,
+    /// Pinned upstream project version.
+    pub project_version: ComponentVersion,
+    /// Pinned upstream source revision.
+    pub source_revision: SourceRevision,
+    /// Upstream model registry key.
+    pub model_key: PresentationKey,
+    /// Upstream layout registry key when applicable.
+    pub layout_key: Option<PresentationKey>,
+    /// Presentation variant for this route.
+    pub transport_variant: TransportVariant,
+}
+
+/// Application-facing lighting dimensions without receiver carrier mapping.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LightingTopologyView {
+    /// Physically illuminated LED count.
+    pub physical_led_count: LedCount,
+    /// Exact application color count.
+    pub application_slot_count: LedCount,
+    /// Application layout row count.
+    pub rows: LedCount,
+    /// Application layout column count.
+    pub columns: LedCount,
+}
+
+/// Writable controller currently has no application owner.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct UnownedController {}
+
+/// Writable controller is owned by the requesting client.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ViewerOwnedController {
+    /// Current ownership lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock lease expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Writable controller is owned by another application client.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OtherOwnedController {
+    /// Current owning client.
+    pub client_id: ClientId,
+    /// Current ownership lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock lease expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Viewer-specific actions derived from availability and ownership.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControllerActions {
+    /// Viewer may atomically acquire this resource.
+    pub can_acquire: bool,
+    /// Viewer may release its current lease.
+    pub can_release: bool,
+    /// Viewer owns a currently writable route.
+    pub can_submit_now: bool,
+}
+
+/// Exact qualified receiver-backed application controller.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControllerView {
+    /// Owning receiver.
+    pub receiver_id: ReceiverId,
+    /// Generation binding.
+    pub generation_id: GenerationId,
+    /// Logical controller identity.
+    pub device_id: LogicalDeviceId,
+    /// Exact usable receiver endpoint.
+    pub endpoint_id: EndpointId,
+    /// Controller category.
+    pub device_kind: DeviceKind,
+    /// Qualified product id.
+    pub product_id: ProductId,
+    /// Exact receiver profile authority.
+    pub receiver_profile: ProfileBindingView,
+    /// Exact child profile authority.
+    pub device_profile: ProfileBindingView,
+    /// Qualified model name.
+    pub model_name: ModelName,
+    /// Pinned application presentation authority.
+    pub presentation: PresentationView,
+    /// Ready or sleeping controller state.
+    pub availability: ControllerAvailability,
+    /// Current battery projection.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+    /// Application-facing lighting dimensions.
+    pub lighting: LightingTopologyView,
+    /// Generation-scoped lighting ownership resource.
+    pub resource: ResourceKey,
+    /// Viewer-specific ownership state.
+    pub ownership: ControllerOwnership,
+    /// Viewer-specific safe actions.
+    pub actions: ControllerActions,
+}
+
+/// One receiver generation with complete inventory and qualified controllers.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct IntegrationReceiverView {
+    /// Logical receiver identity.
+    pub receiver_id: ReceiverId,
+    /// Current receiver generation.
+    pub generation_id: GenerationId,
+    /// Exact receiver profile when qualified.
+    pub profile: Option<ProfileBindingView>,
+    /// Qualified receiver model name.
+    pub model_name: Option<ModelName>,
+    /// Current receiver lifecycle.
+    pub lifecycle: ReceiverLifecycleState,
+    /// Stable lighting restore policy.
+    pub stable_restore_enabled: bool,
+    /// Current restoration state.
+    pub restore_state: RestoreState,
+    /// Complete paired and observed inventory.
+    pub inventory: Vec<DeviceInventoryView>,
+    /// Exact qualified application controllers.
+    pub controllers: Vec<ControllerView>,
+}
+
+/// Client-specific application view projected once by bridge policy.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct IntegrationView {
+    /// Complete event position reflected by the projection.
+    pub cursor: EventCursor,
+    /// Current receiver integration projections.
+    pub receivers: Vec<IntegrationReceiverView>,
+}
+
+/// Stable structured request failure.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RpcError {
+    /// Related request when parsing reached it.
+    pub request_id: Option<RequestId>,
+    /// Machine-readable failure class.
+    pub kind: ProtocolErrorKind,
+    /// Bounded user-safe explanation.
+    pub message: HumanMessage,
+    /// Diagnostic catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Contradiction-free atomic lease outcome.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "outcome", content = "detail")]
+pub enum LeaseResult {
+    /// Every requested resource was granted.
+    #[serde(rename = "granted")]
+    Granted(LeaseGrant),
+    /// Another client owns at least one requested resource; none were granted.
+    #[serde(rename = "conflict")]
+    Conflict(LeaseConflict),
+    /// The request failed without granting any resource.
+    #[serde(rename = "rejected")]
+    Rejected(LeaseRejection),
+}
+
+/// Contradiction-free current, terminal, or unavailable transaction outcome.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "outcome", content = "detail")]
+pub enum TransactionResult {
+    /// The transaction has not reached a terminal state.
+    #[serde(rename = "progress")]
+    Progress(TransactionProgress),
+    /// The immutable terminal outcome is retained.
+    #[serde(rename = "terminal")]
+    Terminal(TransactionTerminal),
+    /// No retained outcome can answer this lookup.
+    #[serde(rename = "unavailable")]
+    Unavailable(TransactionUnavailable),
+}
+
+/// Contradiction-free viewer-specific controller ownership.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "state", content = "detail")]
+pub enum ControllerOwnership {
+    /// No application currently owns the controller.
+    #[serde(rename = "unowned")]
+    Unowned(UnownedController),
+    /// The requesting client owns the controller.
+    #[serde(rename = "owned-by-viewer")]
+    OwnedByViewer(ViewerOwnedController),
+    /// Another application client owns the controller.
+    #[serde(rename = "owned-by-other")]
+    OwnedByOther(OtherOwnedController),
+}
+
+/// Unnegotiated request envelope used only for the handshake.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NegotiationRequestEnvelope {
+    pub request_id: RequestId,
+    pub params: ClientHello,
+}
+
+/// Request envelope bound to one negotiated bridge connection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRequestEnvelope<T> {
+    pub request_id: RequestId,
+    pub protocol_session_id: ProtocolSessionId,
+    pub negotiation_token: NegotiationToken,
+    pub params: T,
+}
+
+/// Typed request envelope; arbitrary method strings or parameters are impossible.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "method", content = "request")]
+pub enum RpcRequest {
+    #[serde(rename = "negotiate")]
+    Negotiate(NegotiationRequestEnvelope),
+    #[serde(rename = "snapshot")]
+    Snapshot(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "integration-view")]
+    IntegrationView(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "acquire-lease")]
+    AcquireLease(SessionRequestEnvelope<LeaseRequest>),
+    #[serde(rename = "renew-lease")]
+    RenewLease(SessionRequestEnvelope<RenewLeaseRequest>),
+    #[serde(rename = "release-lease")]
+    ReleaseLease(SessionRequestEnvelope<ReleaseLeaseRequest>),
+    #[serde(rename = "submit-transaction")]
+    SubmitTransaction(SessionRequestEnvelope<TransactionRequest>),
+    #[serde(rename = "transaction-outcome")]
+    TransactionOutcome(SessionRequestEnvelope<TransactionLookup>),
+    #[serde(rename = "subscribe")]
+    Subscribe(SessionRequestEnvelope<SubscriptionRequest>),
+    #[serde(rename = "diagnostics")]
+    Diagnostics(SessionRequestEnvelope<EmptyRequest>),
+}
+
+/// Successful method response bound to the serving bridge instance.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SuccessEnvelope<T> {
+    pub request_id: RequestId,
+    pub server_instance_id: ServerInstanceId,
+    pub result: T,
+}
+
+/// Structured error response bound to the serving bridge instance.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ErrorEnvelope {
+    pub request_id: Option<RequestId>,
+    pub server_instance_id: ServerInstanceId,
+    pub error: RpcError,
+}
+
+/// Typed success-or-error response envelope.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "type", content = "response")]
+pub enum RpcResponse {
+    #[serde(rename = "negotiate-success")]
+    NegotiateSuccess(SuccessEnvelope<ServerHello>),
+    #[serde(rename = "snapshot-success")]
+    SnapshotSuccess(SuccessEnvelope<BridgeSnapshot>),
+    #[serde(rename = "integration-view-success")]
+    IntegrationViewSuccess(SuccessEnvelope<IntegrationView>),
+    #[serde(rename = "acquire-lease-success")]
+    AcquireLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "renew-lease-success")]
+    RenewLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "release-lease-success")]
+    ReleaseLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "submit-transaction-success")]
+    SubmitTransactionSuccess(SuccessEnvelope<TransactionResult>),
+    #[serde(rename = "transaction-outcome-success")]
+    TransactionOutcomeSuccess(SuccessEnvelope<TransactionResult>),
+    #[serde(rename = "subscribe-success")]
+    SubscribeSuccess(SuccessEnvelope<EventBatch>),
+    #[serde(rename = "diagnostics-success")]
+    DiagnosticsSuccess(SuccessEnvelope<DiagnosticSnapshot>),
+    #[serde(rename = "error")]
+    Error(ErrorEnvelope),
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct MethodDescriptor {
+    pub name: &'static str,
+    pub request: &'static str,
+    pub response: &'static str,
+    pub required_feature: Option<&'static str>,
+}
+
+pub const METHODS: &[MethodDescriptor] = &[
+    MethodDescriptor {
+        name: "negotiate",
+        request: "ClientHello",
+        response: "ServerHello",
+        required_feature: None,
+    },
+    MethodDescriptor {
+        name: "snapshot",
+        request: "EmptyRequest",
+        response: "BridgeSnapshot",
+        required_feature: None,
+    },
+    MethodDescriptor {
+        name: "integration-view",
+        request: "EmptyRequest",
+        response: "IntegrationView",
+        required_feature: Some("integration-view-projection"),
+    },
+    MethodDescriptor {
+        name: "acquire-lease",
+        request: "LeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "renew-lease",
+        request: "RenewLeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "release-lease",
+        request: "ReleaseLeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "submit-transaction",
+        request: "TransactionRequest",
+        response: "TransactionResult",
+        required_feature: Some("atomic-transactions"),
+    },
+    MethodDescriptor {
+        name: "transaction-outcome",
+        request: "TransactionLookup",
+        response: "TransactionResult",
+        required_feature: Some("atomic-transactions"),
+    },
+    MethodDescriptor {
+        name: "subscribe",
+        request: "SubscriptionRequest",
+        response: "EventBatch",
+        required_feature: Some("event-subscriptions"),
+    },
+    MethodDescriptor {
+        name: "diagnostics",
+        request: "EmptyRequest",
+        response: "DiagnosticSnapshot",
+        required_feature: Some("structured-diagnostics"),
+    },
+];
+
+impl RpcRequest {
+    /// Returns the request identity carried by every method envelope.
+    #[must_use]
+    pub fn request_id(&self) -> &RequestId {
+        match self {
+            Self::Negotiate(envelope) => &envelope.request_id,
+            Self::Snapshot(envelope)
+            | Self::IntegrationView(envelope)
+            | Self::Diagnostics(envelope) => &envelope.request_id,
+            Self::AcquireLease(envelope) => &envelope.request_id,
+            Self::RenewLease(envelope) => &envelope.request_id,
+            Self::ReleaseLease(envelope) => &envelope.request_id,
+            Self::SubmitTransaction(envelope) => &envelope.request_id,
+            Self::TransactionOutcome(envelope) => &envelope.request_id,
+            Self::Subscribe(envelope) => &envelope.request_id,
+        }
+    }
+
+    /// Returns the generated descriptor for this request variant.
+    #[must_use]
+    pub const fn method_descriptor(&self) -> &'static MethodDescriptor {
+        match self {
+            Self::Negotiate(_) => &METHODS[0],
+            Self::Snapshot(_) => &METHODS[1],
+            Self::IntegrationView(_) => &METHODS[2],
+            Self::AcquireLease(_) => &METHODS[3],
+            Self::RenewLease(_) => &METHODS[4],
+            Self::ReleaseLease(_) => &METHODS[5],
+            Self::SubmitTransaction(_) => &METHODS[6],
+            Self::TransactionOutcome(_) => &METHODS[7],
+            Self::Subscribe(_) => &METHODS[8],
+            Self::Diagnostics(_) => &METHODS[9],
+        }
+    }
+
+    /// Returns negotiated connection credentials for session-bound methods.
+    #[must_use]
+    pub fn session_credentials(&self) -> Option<(&ProtocolSessionId, &NegotiationToken)> {
+        match self {
+            Self::Negotiate(_) => None,
+            Self::Snapshot(envelope)
+            | Self::IntegrationView(envelope)
+            | Self::Diagnostics(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::AcquireLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::RenewLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::ReleaseLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::SubmitTransaction(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::TransactionOutcome(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::Subscribe(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+        }
+    }
+}
+
+impl RpcResponse {
+    /// Returns the request identity carried by the response envelope.
+    #[must_use]
+    pub fn request_id(&self) -> Option<&RequestId> {
+        match self {
+            Self::NegotiateSuccess(envelope) => Some(&envelope.request_id),
+            Self::SnapshotSuccess(envelope) => Some(&envelope.request_id),
+            Self::IntegrationViewSuccess(envelope) => Some(&envelope.request_id),
+            Self::AcquireLeaseSuccess(envelope)
+            | Self::RenewLeaseSuccess(envelope)
+            | Self::ReleaseLeaseSuccess(envelope) => Some(&envelope.request_id),
+            Self::SubmitTransactionSuccess(envelope)
+            | Self::TransactionOutcomeSuccess(envelope) => Some(&envelope.request_id),
+            Self::SubscribeSuccess(envelope) => Some(&envelope.request_id),
+            Self::DiagnosticsSuccess(envelope) => Some(&envelope.request_id),
+            Self::Error(envelope) => envelope.request_id.as_ref(),
+        }
+    }
+
+    /// Returns the bridge process identity carried by the response envelope.
+    #[must_use]
+    pub fn server_instance_id(&self) -> &ServerInstanceId {
+        match self {
+            Self::NegotiateSuccess(envelope) => &envelope.server_instance_id,
+            Self::SnapshotSuccess(envelope) => &envelope.server_instance_id,
+            Self::IntegrationViewSuccess(envelope) => &envelope.server_instance_id,
+            Self::AcquireLeaseSuccess(envelope)
+            | Self::RenewLeaseSuccess(envelope)
+            | Self::ReleaseLeaseSuccess(envelope) => &envelope.server_instance_id,
+            Self::SubmitTransactionSuccess(envelope)
+            | Self::TransactionOutcomeSuccess(envelope) => &envelope.server_instance_id,
+            Self::SubscribeSuccess(envelope) => &envelope.server_instance_id,
+            Self::DiagnosticsSuccess(envelope) => &envelope.server_instance_id,
+            Self::Error(envelope) => &envelope.server_instance_id,
+        }
+    }
+}
diff --git a/crates/hfx-protocol/src/generated_versions.rs b/crates/hfx-protocol/src/generated_versions.rs
index 7bb3f65..5c016b4 100644
--- a/crates/hfx-protocol/src/generated_versions.rs
+++ b/crates/hfx-protocol/src/generated_versions.rs
@@ -11,6 +11,8 @@ pub mod v3;
 pub mod v4;
 #[path = "generated_v5.rs"]
 pub mod v5;
+#[path = "generated_v6.rs"]
+pub mod v6;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct ProtocolVersionDescriptor {
@@ -20,7 +22,7 @@ pub struct ProtocolVersionDescriptor {
     pub served_features: &'static [&'static str],
 }
 
-pub const CURRENT_PROTOCOL_VERSION: u16 = 5;
+pub const CURRENT_PROTOCOL_VERSION: u16 = 6;
 pub const GENERATED_PROTOCOL_VERSIONS: &[ProtocolVersionDescriptor] = &[
     ProtocolVersionDescriptor {
         version: 1,
@@ -86,4 +88,20 @@ pub const GENERATED_PROTOCOL_VERSIONS: &[ProtocolVersionDescriptor] = &[
             "structured-diagnostics",
         ],
     },
+    ProtocolVersionDescriptor {
+        version: 6,
+        catalog_sha256: "6b7b16aeae887979de5f75fb82959450c55179dbed3142450939fd7ee8f8ce54",
+        catalog_features: v6::SUPPORTED_FEATURES,
+        served_features: &[
+            "atomic-transactions",
+            "event-subscriptions",
+            "integration-view-projection",
+            "ownership-leases",
+            "profile-bound-transactions",
+            "return-lifecycle-projection",
+            "semantic-stable-lighting",
+            "snapshot-profile-bindings",
+            "structured-diagnostics",
+        ],
+    },
 ];
diff --git a/crates/hfx-protocol/src/lib.rs b/crates/hfx-protocol/src/lib.rs
index 3894695..358b3bf 100644
--- a/crates/hfx-protocol/src/lib.rs
+++ b/crates/hfx-protocol/src/lib.rs
@@ -16,10 +16,7 @@ pub use framing::{
     write_rpc_request_for_version, write_rpc_response, write_rpc_response_for_version,
 };
 pub use generated::*;
-pub use generated_versions::{
-    CURRENT_PROTOCOL_VERSION, GENERATED_PROTOCOL_VERSIONS, ProtocolVersionDescriptor, v1, v2, v3,
-    v4, v5,
-};
+pub use generated_versions::*;
 pub use negotiation::{
     GENERATED_CONTRACT, NegotiationContext, NegotiationError, ProtocolContract, negotiate,
     negotiate_with_contract,
diff --git a/crates/hfx-protocol/src/snapshot.rs b/crates/hfx-protocol/src/snapshot.rs
index 7f0202f..794001d 100644
--- a/crates/hfx-protocol/src/snapshot.rs
+++ b/crates/hfx-protocol/src/snapshot.rs
@@ -1,7 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::{BatteryObservation, BridgeSnapshot, LogicalDeviceSnapshot, ReceiverSnapshot};
-use hfx_domain::{PresenceState, RouteState, SleepState, TelemetryAvailability};
+use crate::{
+    BatteryObservation, BridgeSnapshot, EndpointSnapshot, LogicalDeviceSnapshot, ReceiverSnapshot,
+};
+use hfx_domain::{
+    GenerationId, LogicalDeviceId, PresenceState, RestoreDeliveryState, ReturnPhase, RouteState,
+    SleepState, TelemetryAvailability,
+};
 use std::fmt;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -22,6 +27,7 @@ pub enum SnapshotValidationError {
     ReceiverProfileBindingContradiction,
     DeviceProfileBindingContradiction,
     PresenceContradiction,
+    ReturnEpochContradiction,
 }
 
 impl fmt::Display for SnapshotValidationError {
@@ -51,6 +57,9 @@ impl fmt::Display for SnapshotValidationError {
                 "device profile digest lacks a profile identity"
             }
             Self::PresenceContradiction => "device presence contradicts endpoint evidence",
+            Self::ReturnEpochContradiction => {
+                "return epoch contradicts its receiver, device, endpoint, phase, or delivery evidence"
+            }
         })
     }
 }
@@ -65,7 +74,37 @@ fn validate_battery(battery: &BatteryObservation) -> Result<(), SnapshotValidati
     Ok(())
 }
 
-fn validate_device(device: &LogicalDeviceSnapshot) -> Result<(), SnapshotValidationError> {
+fn validate_return_epoch(
+    receiver_generation: GenerationId,
+    device_id: &LogicalDeviceId,
+    endpoint: &EndpointSnapshot,
+) -> Result<(), SnapshotValidationError> {
+    let Some(epoch) = &endpoint.return_epoch else {
+        return Ok(());
+    };
+    let synchronized = epoch.phase == ReturnPhase::Synchronized;
+    let child_confirmed = epoch.delivery_state == RestoreDeliveryState::ChildConfirmed;
+    if epoch.generation_id != receiver_generation
+        || &epoch.device_id != device_id
+        || epoch.endpoint_id != endpoint.endpoint_id
+        || matches!(
+            epoch.phase,
+            ReturnPhase::QuiescentCandidate | ReturnPhase::Unavailable
+        )
+        || synchronized != child_confirmed
+        || endpoint
+            .observed_at_ms
+            .is_none_or(|observed| epoch.opened_at_ms > observed)
+    {
+        return Err(SnapshotValidationError::ReturnEpochContradiction);
+    }
+    Ok(())
+}
+
+fn validate_device(
+    receiver_generation: GenerationId,
+    device: &LogicalDeviceSnapshot,
+) -> Result<(), SnapshotValidationError> {
     if device.profile_digest.is_some() && device.profile_id.is_none() {
         return Err(SnapshotValidationError::DeviceProfileBindingContradiction);
     }
@@ -79,6 +118,9 @@ fn validate_device(device: &LogicalDeviceSnapshot) -> Result<(), SnapshotValidat
     {
         return Err(SnapshotValidationError::EndpointsNotCanonical);
     }
+    for endpoint in &device.endpoints {
+        validate_return_epoch(receiver_generation, &device.device_id, endpoint)?;
+    }
     if device.capabilities.len() > 128 {
         return Err(SnapshotValidationError::TooManyCapabilities);
     }
@@ -126,7 +168,7 @@ fn validate_receiver(receiver: &ReceiverSnapshot) -> Result<(), SnapshotValidati
         return Err(SnapshotValidationError::DevicesNotCanonical);
     }
     for device in &receiver.devices {
-        validate_device(device)?;
+        validate_device(receiver.generation_id, device)?;
     }
 
     if receiver.ownership.len() > 96 {
diff --git a/crates/hfx-protocol/src/wire.rs b/crates/hfx-protocol/src/wire.rs
index 7aede57..f3e1018 100644
--- a/crates/hfx-protocol/src/wire.rs
+++ b/crates/hfx-protocol/src/wire.rs
@@ -5,8 +5,8 @@ use crate::{
     DiagnosticSnapshot, EndpointSnapshot, EventBatch, IntegrationReceiverView, IntegrationView,
     LeaseResult, MAX_WIRE_MESSAGE_BYTES, ProtocolValidationError, RpcRequest, RpcResponse,
     SnapshotValidationError, StableLightingIntent, TransactionResult, TransactionTerminal,
-    TransactionUnavailable, v1, v2, v3, v4, v5, validate_bridge_snapshot, validate_lease_request,
-    validate_transaction,
+    TransactionUnavailable, v1, v2, v3, v4, v5, v6, validate_bridge_snapshot,
+    validate_lease_request, validate_transaction,
 };
 use hfx_domain::{
     ConnectionMode, ControllerAvailability, FreshnessState, InventoryAvailability, PairingState,
@@ -700,6 +700,7 @@ fn encode_rpc_request_version(
         3 => frozen_encoding::<v3::RpcRequest>(value),
         4 => frozen_encoding::<v4::RpcRequest>(value),
         5 => frozen_encoding::<v5::RpcRequest>(value),
+        6 => frozen_encoding::<v6::RpcRequest>(value),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
@@ -727,6 +728,7 @@ fn decode_rpc_request_version(bytes: &[u8], version: u16) -> Result<RpcRequest,
         3 => transcode_request(decode::<v3::RpcRequest>(bytes)?),
         4 => transcode_request(decode::<v4::RpcRequest>(bytes)?),
         5 => transcode_request(decode::<v5::RpcRequest>(bytes)?),
+        6 => transcode_request(decode::<v6::RpcRequest>(bytes)?),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
@@ -765,6 +767,7 @@ fn decode_rpc_response_version(
         3 => transcode_response(decode::<v3::RpcResponse>(bytes)?),
         4 => transcode_response(decode::<v4::RpcResponse>(bytes)?),
         5 => transcode_response(decode::<v5::RpcResponse>(bytes)?),
+        6 => transcode_response(decode::<v6::RpcResponse>(bytes)?),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
@@ -802,6 +805,9 @@ fn encode_rpc_response_version(
     }
     let mut value =
         serde_json::to_value(response).map_err(|_| ProtocolWireError::VersionTranslation)?;
+    if version < 6 {
+        remove_return_epochs(response, &mut value)?;
+    }
     match version {
         1 => {
             remove_snapshot_profile_bindings(response, &mut value)?;
@@ -817,10 +823,67 @@ fn encode_rpc_response_version(
         }
         4 => frozen_encoding::<v4::RpcResponse>(value),
         5 => frozen_encoding::<v5::RpcResponse>(value),
+        6 => frozen_encoding::<v6::RpcResponse>(value),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
 
+fn remove_return_epochs(
+    response: &RpcResponse,
+    value: &mut Value,
+) -> Result<(), ProtocolWireError> {
+    let receivers = value
+        .as_object_mut()
+        .and_then(|root| root.get_mut("response"))
+        .and_then(Value::as_object_mut)
+        .and_then(|response| response.get_mut("result"))
+        .and_then(Value::as_object_mut)
+        .and_then(|result| result.get_mut("receivers"))
+        .and_then(Value::as_array_mut);
+
+    let Some(receivers) = receivers else {
+        return if matches!(
+            response,
+            RpcResponse::SnapshotSuccess(_) | RpcResponse::IntegrationViewSuccess(_)
+        ) {
+            Err(ProtocolWireError::VersionTranslation)
+        } else {
+            Ok(())
+        };
+    };
+
+    for receiver in receivers {
+        let receiver = receiver
+            .as_object_mut()
+            .ok_or(ProtocolWireError::VersionTranslation)?;
+        let collections: &mut Vec<Value> = match response {
+            RpcResponse::SnapshotSuccess(_) => receiver
+                .get_mut("devices")
+                .and_then(Value::as_array_mut)
+                .ok_or(ProtocolWireError::VersionTranslation)?,
+            RpcResponse::IntegrationViewSuccess(_) => receiver
+                .get_mut("inventory")
+                .and_then(Value::as_array_mut)
+                .ok_or(ProtocolWireError::VersionTranslation)?,
+            _ => return Ok(()),
+        };
+        for item in collections {
+            let endpoints = item
+                .as_object_mut()
+                .and_then(|item| item.get_mut("endpoints"))
+                .and_then(Value::as_array_mut)
+                .ok_or(ProtocolWireError::VersionTranslation)?;
+            for endpoint in endpoints {
+                endpoint
+                    .as_object_mut()
+                    .ok_or(ProtocolWireError::VersionTranslation)?
+                    .remove("return_epoch");
+            }
+        }
+    }
+    Ok(())
+}
+
 fn remove_snapshot_profile_bindings(
     response: &RpcResponse,
     value: &mut Value,
diff --git a/crates/hfx-protocol/tests/protocol.rs b/crates/hfx-protocol/tests/protocol.rs
index 490329d..a3c7b5d 100644
--- a/crates/hfx-protocol/tests/protocol.rs
+++ b/crates/hfx-protocol/tests/protocol.rs
@@ -161,12 +161,12 @@ fn feature_negotiation_selects_intersection_and_rejects_incompatible_versions()
     );
 
     let incompatible = ClientHello {
-        minimum_version: number(6),
-        maximum_version: number(6),
+        minimum_version: number(7),
+        maximum_version: number(7),
         ..v5
     };
     assert_eq!(
-        negotiate(&incompatible, context("protocol-session-6")),
+        negotiate(&incompatible, context("protocol-session-7")),
         Err(NegotiationError::IncompatibleVersion)
     );
 }
diff --git a/crates/hfx-protocol/tests/wire_and_snapshot.rs b/crates/hfx-protocol/tests/wire_and_snapshot.rs
index 31b9240..14c602e 100644
--- a/crates/hfx-protocol/tests/wire_and_snapshot.rs
+++ b/crates/hfx-protocol/tests/wire_and_snapshot.rs
@@ -3,18 +3,18 @@
 use hfx_domain::{
     ActivityState, BatteryPercent, ClientId, ClientName, ColorChannel, ConnectionMode,
     ContactState, ControllerAvailability, DeviceKind, EvidenceConfidence, FreshnessState,
-    GenerationId, InventoryAvailability, LedCount, ModelName, PairingState, PowerState,
-    PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
-    ReceiverLifecycleState, ResourceKind, RestoreState, RouteKind, RouteState, SequenceNumber,
-    SleepState, StableLightingMode, StreamEpoch, SupportLevel, TelemetryAvailability,
-    TransactionClass,
+    GenerationId, InventoryAvailability, LedCount, ModelName, MonotonicMs, PairingState,
+    PowerState, PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
+    ReceiverLifecycleState, ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence,
+    ReturnPhase, RouteKind, RouteState, SequenceNumber, SleepState, StableLightingMode,
+    StreamEpoch, SupportLevel, TelemetryAvailability, TransactionClass,
 };
 use hfx_protocol::{
     BatteryObservation, BridgeSnapshot, ClientHello, ControllerActions, ControllerOwnership,
     ControllerView, DeviceInventoryView, EmptyRequest, EndpointSnapshot, EventCursor,
     IntegrationReceiverView, IntegrationView, LightingTopologyView, LogicalDeviceSnapshot,
     MAX_WIRE_MESSAGE_BYTES, NegotiationRequestEnvelope, PresentationView, ProfileBindingView,
-    ProtocolWireError, ReceiverSnapshot, ResourceKey, RpcRequest, RpcResponse,
+    ProtocolWireError, ReceiverSnapshot, ResourceKey, ReturnEpoch, RpcRequest, RpcResponse,
     SessionRequestEnvelope, SnapshotValidationError, SuccessEnvelope, UnownedController,
     decode_rpc_request, decode_rpc_request_for_version, decode_rpc_response,
     decode_rpc_response_for_version, encode_rpc_request_for_version,
@@ -60,6 +60,20 @@ fn endpoint() -> EndpointSnapshot {
         confidence: EvidenceConfidence::Observed,
         evidence_claim_id: Some(text("evidence-1")),
         observed_at_ms: Some(hfx_domain::MonotonicMs::try_from(10_u64).expect("time is valid")),
+        return_epoch: None,
+    }
+}
+
+fn return_epoch() -> ReturnEpoch {
+    ReturnEpoch {
+        generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
+        device_id: text("mouse-1"),
+        endpoint_id: text("endpoint-hyperflux"),
+        epoch_sequence: SequenceNumber::try_from(7_u64).expect("sequence is valid"),
+        opened_at_ms: MonotonicMs::try_from(5_u64).expect("time is valid"),
+        opening_evidence: ReturnEvidence::EndpointActivity,
+        phase: ReturnPhase::Returning,
+        delivery_state: RestoreDeliveryState::ReceiverDelivered,
     }
 }
 
@@ -440,10 +454,14 @@ fn versioned_decoders_reject_changed_or_unknown_wire_shapes_instead_of_guessing(
     );
     assert_eq!(
         decode_rpc_request_for_version(&v3, number(5)),
-        Ok(normalized)
+        Ok(normalized.clone())
     );
     assert_eq!(
         decode_rpc_request_for_version(&v3, number(6)),
+        Ok(normalized)
+    );
+    assert_eq!(
+        decode_rpc_request_for_version(&v3, number(7)),
         Err(ProtocolWireError::UnsupportedProtocolVersion)
     );
 }
@@ -529,8 +547,65 @@ fn responses_are_checked_against_the_exact_negotiated_schema() {
                 server_instance_id: text("bridge-instance-1"),
                 result: snapshot(battery(TelemetryAvailability::Reported, Some(73))),
             }),
-            number(6)
+            number(7)
         ),
         Err(ProtocolWireError::UnsupportedProtocolVersion)
     );
 }
+
+#[test]
+fn v6_projects_return_epochs_while_v5_omits_them_safely() {
+    let mut current = snapshot(battery(TelemetryAvailability::Reported, Some(73)));
+    current.receivers[0].devices[0].endpoints[0].return_epoch = Some(return_epoch());
+    let response = RpcResponse::SnapshotSuccess(SuccessEnvelope {
+        request_id: text("request-return-epoch"),
+        server_instance_id: text("bridge-instance-1"),
+        result: current,
+    });
+
+    let v6 = number(6);
+    let encoded = encode_rpc_response_for_version(&response, v6)
+        .expect("v6 preserves the return lifecycle projection");
+    assert_eq!(
+        decode_rpc_response_for_version(&encoded, v6),
+        Ok(response.clone())
+    );
+
+    let v5 = number(5);
+    let encoded = encode_rpc_response_for_version(&response, v5)
+        .expect("v5 safely omits the optional lifecycle projection");
+    let RpcResponse::SnapshotSuccess(legacy) =
+        decode_rpc_response_for_version(&encoded, v5).expect("v5 snapshot decodes")
+    else {
+        panic!("snapshot response expected")
+    };
+    assert!(
+        legacy.result.receivers[0].devices[0].endpoints[0]
+            .return_epoch
+            .is_none()
+    );
+}
+
+#[test]
+fn return_epoch_projection_rejects_cross_record_or_false_synchronization_claims() {
+    let mut wrong_device = snapshot(battery(TelemetryAvailability::Reported, Some(73)));
+    wrong_device.receivers[0].devices[0].endpoints[0].return_epoch = Some(ReturnEpoch {
+        device_id: text("keyboard-1"),
+        ..return_epoch()
+    });
+    assert_eq!(
+        validate_bridge_snapshot(&wrong_device),
+        Err(SnapshotValidationError::ReturnEpochContradiction)
+    );
+
+    let mut false_sync = snapshot(battery(TelemetryAvailability::Reported, Some(73)));
+    false_sync.receivers[0].devices[0].endpoints[0].return_epoch = Some(ReturnEpoch {
+        phase: ReturnPhase::Synchronized,
+        delivery_state: RestoreDeliveryState::ReceiverDelivered,
+        ..return_epoch()
+    });
+    assert_eq!(
+        validate_bridge_snapshot(&false_sync),
+        Err(SnapshotValidationError::ReturnEpochContradiction)
+    );
+}
diff --git a/crates/hfx-runtime/src/generated.rs b/crates/hfx-runtime/src/generated.rs
index 57724c1..a4a1b28 100644
--- a/crates/hfx-runtime/src/generated.rs
+++ b/crates/hfx-runtime/src/generated.rs
@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const LINUX_RUNTIME_SHA256: &str =
-    "aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8";
+    "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723";
 pub const PRODUCT_DISPLAY_NAME: &str = "HyperFlux Next";
 pub const PRODUCT_VERSION: &str = "0.0.0-dev.1";
 pub const PACKAGE_NAME: &str = "hyperflux-next-linux";
@@ -52,7 +52,6 @@ pub const DISCOVERY_INTERVAL_MS: u64 = 100;
 pub const ACCEPT_POLL_INTERVAL_MS: u64 = 25;
 pub const ACTOR_RESPONSE_TIMEOUT_MS: u64 = 30_000;
 pub const KERNEL_SESSION_DURATION_MS: u64 = 120_000;
-pub const ACTIVITY_RESUMPTION_QUIET_MS: u64 = 30_000;
 pub const RESTORATION_MAX_PENDING_TRIGGERS: usize = 64;
 pub const RESTORATION_MAX_PENDING_CLAIMS: usize = 4_096;
 pub const RESTORATION_CLAIMS_PER_TICK: usize = 1;
diff --git a/crates/hfx-sim/src/lib.rs b/crates/hfx-sim/src/lib.rs
index 4c8e4fe..c727857 100644
--- a/crates/hfx-sim/src/lib.rs
+++ b/crates/hfx-sim/src/lib.rs
@@ -8,6 +8,7 @@ mod event;
 mod persistence;
 mod replay;
 mod restoration;
+mod return_lifecycle;
 mod shadow;
 mod state;
 mod transport;
@@ -24,6 +25,7 @@ pub use restoration::{
     CrashCheckpoint, CrashExecution, SimDeviceProfile, SimRestorationConfig, SimRestorationError,
     SimRestorationHarness,
 };
+pub use return_lifecycle::{SimRetryEnvelope, SimReturnLifecycle, SimReturnLifecycleError};
 pub use shadow::{
     SHADOW_FIXTURE_SCHEMA, SHADOW_RESULT_SCHEMA, ShadowAuthority, ShadowCheckpointComparison,
     ShadowComparisonResult, ShadowDifference, ShadowDomain, ShadowDomainSummary, ShadowError,
diff --git a/crates/hfx-sim/src/return_lifecycle.rs b/crates/hfx-sim/src/return_lifecycle.rs
new file mode 100644
index 0000000..6144740
--- /dev/null
+++ b/crates/hfx-sim/src/return_lifecycle.rs
@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+//! Profile-driven harness around the production endpoint return machine.
+
+use hfx_core::{
+    EndpointReturnLifecycle, EndpointReturnPolicy, LifecycleError, RestoreDeliveryState,
+    ReturnEpoch, ReturnEvidence, ReturnPhase, ReturnTransition,
+};
+use hfx_domain::{MonotonicMs, ProfileId, SequenceNumber};
+use hfx_profiles::{RuntimeProfileCatalog, return_policy_by_id};
+use std::fmt;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SimRetryEnvelope {
+    pub epoch_sequence: SequenceNumber,
+    pub opened_at_ms: MonotonicMs,
+    pub due_at_ms: Vec<MonotonicMs>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum SimReturnLifecycleError {
+    MissingPolicy(String),
+    InvalidPolicy(LifecycleError),
+    TimeOverflow,
+}
+
+impl fmt::Display for SimReturnLifecycleError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::MissingPolicy(policy_id) => {
+                write!(
+                    formatter,
+                    "profile references missing return policy {policy_id}"
+                )
+            }
+            Self::InvalidPolicy(error) => error.fmt(formatter),
+            Self::TimeOverflow => formatter.write_str("simulated retry time overflowed"),
+        }
+    }
+}
+
+impl std::error::Error for SimReturnLifecycleError {}
+
+/// Deterministic simulator facade over the same generated policy and pure
+/// lifecycle machine used by production observation translation.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SimReturnLifecycle {
+    profile_id: ProfileId,
+    lifecycle: EndpointReturnLifecycle,
+}
+
+impl SimReturnLifecycle {
+    /// Resolves one qualified profile without product-specific simulator code.
+    /// Unknown profiles and profiles without writable lifecycle policy return
+    /// `None`, matching production's fail-closed behavior.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when generated profile and policy authorities disagree.
+    pub fn from_profile(
+        catalog: &RuntimeProfileCatalog,
+        profile_id: &ProfileId,
+    ) -> Result<Option<Self>, SimReturnLifecycleError> {
+        let Some(profile) = catalog.profile(profile_id) else {
+            return Ok(None);
+        };
+        let Some(binding) = profile.lifecycle else {
+            return Ok(None);
+        };
+        let policy = return_policy_by_id(binding.return_policy_id).ok_or_else(|| {
+            SimReturnLifecycleError::MissingPolicy(binding.return_policy_id.to_owned())
+        })?;
+        if !binding
+            .open_evidence
+            .iter()
+            .all(|evidence| policy.allowed_open_evidence.contains(evidence))
+            || !binding
+                .accelerator_evidence
+                .iter()
+                .all(|evidence| policy.allowed_accelerator_evidence.contains(evidence))
+        {
+            return Err(SimReturnLifecycleError::InvalidPolicy(
+                LifecycleError::InvalidReturnPolicy,
+            ));
+        }
+        let open_evidence = binding
+            .open_evidence
+            .iter()
+            .copied()
+            .map(hfx_profiles::ReturnEvidenceSource::domain)
+            .collect::<Vec<_>>();
+        let accelerator_evidence = binding
+            .accelerator_evidence
+            .iter()
+            .copied()
+            .map(hfx_profiles::ReturnEvidenceSource::domain)
+            .collect::<Vec<_>>();
+        let policy = EndpointReturnPolicy::new(
+            policy.quiescence_candidate_ms,
+            policy.observation_jitter_ms,
+            policy.retry_offsets_ms,
+            &open_evidence,
+            &accelerator_evidence,
+        )
+        .map_err(SimReturnLifecycleError::InvalidPolicy)?;
+        Ok(Some(Self {
+            profile_id: profile.profile_id.clone(),
+            lifecycle: EndpointReturnLifecycle::new(policy),
+        }))
+    }
+
+    #[must_use]
+    pub const fn profile_id(&self) -> &ProfileId {
+        &self.profile_id
+    }
+
+    #[must_use]
+    pub const fn phase(&self) -> ReturnPhase {
+        self.lifecycle.phase()
+    }
+
+    #[must_use]
+    pub const fn epoch(&self) -> Option<ReturnEpoch> {
+        self.lifecycle.epoch()
+    }
+
+    pub fn reset_observation_anchor(&mut self) {
+        self.lifecycle.reset_observation_anchor();
+    }
+
+    pub fn observe(
+        &mut self,
+        evidence: ReturnEvidence,
+        sequence: SequenceNumber,
+        observed_at_ms: MonotonicMs,
+    ) -> ReturnTransition {
+        self.lifecycle.observe(evidence, sequence, observed_at_ms)
+    }
+
+    pub fn note_delivery(
+        &mut self,
+        epoch_sequence: SequenceNumber,
+        delivery: RestoreDeliveryState,
+    ) -> ReturnTransition {
+        self.lifecycle.note_delivery(epoch_sequence, delivery)
+    }
+
+    pub fn advance(&mut self, now: MonotonicMs) -> ReturnTransition {
+        self.lifecycle.advance(now)
+    }
+
+    /// Projects the exact bounded retry envelope for the active epoch.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when simulated monotonic addition overflows.
+    pub fn retry_envelope(&self) -> Result<Option<SimRetryEnvelope>, SimReturnLifecycleError> {
+        let Some(epoch) = self.lifecycle.epoch() else {
+            return Ok(None);
+        };
+        let due_at_ms = self
+            .lifecycle
+            .policy()
+            .retry_offsets_ms()
+            .iter()
+            .map(|offset| {
+                epoch
+                    .opened_at_ms()
+                    .get()
+                    .checked_add(*offset)
+                    .and_then(|value| MonotonicMs::try_from(value).ok())
+                    .ok_or(SimReturnLifecycleError::TimeOverflow)
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        Ok(Some(SimRetryEnvelope {
+            epoch_sequence: epoch.sequence(),
+            opened_at_ms: epoch.opened_at_ms(),
+            due_at_ms,
+        }))
+    }
+}
diff --git a/crates/hfx-sim/tests/return_lifecycle_matrix.rs b/crates/hfx-sim/tests/return_lifecycle_matrix.rs
new file mode 100644
index 0000000..614b9e2
--- /dev/null
+++ b/crates/hfx-sim/tests/return_lifecycle_matrix.rs
@@ -0,0 +1,244 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_core::{
+    RestoreDeliveryState, ReturnEvidence, ReturnPhase, ReturnTransition, SubmissionBinding,
+    VolatileEffectRegistry,
+};
+use hfx_domain::{
+    AuthorizationEpoch, ClientId, ColorChannel, DispatchNonce, FrameIndex, GenerationId, LeaseId,
+    LedCount, LogicalDeviceId, MonotonicMs, ProfileDigest, ProfileId, ReceiverId, RequestId,
+    ResourceKind, SequenceNumber, TransactionClass, TransactionId,
+};
+use hfx_profiles::RuntimeProfileCatalog;
+use hfx_protocol::{
+    DeviceProfileBinding, LightingFrame, ResourceKey, RgbColor, TransactionRequest,
+};
+use hfx_sim::SimReturnLifecycle;
+
+const MOUSE_PROFILE: &str = "child.razer.basilisk-v3-pro-35k.00cd";
+const KEYBOARD_PROFILE: &str = "child.razer.deathstalker-v2-pro-tkl.0296";
+
+fn id<T>(value: &str) -> T
+where
+    T: TryFrom<String>,
+    T::Error: std::fmt::Debug,
+{
+    T::try_from(value.to_owned()).expect("test identity")
+}
+
+fn sequence(value: u64) -> SequenceNumber {
+    SequenceNumber::try_from(value).expect("sequence")
+}
+
+fn time(value: u64) -> MonotonicMs {
+    MonotonicMs::try_from(value).expect("time")
+}
+
+fn lifecycle(profile: &str) -> SimReturnLifecycle {
+    let catalog = RuntimeProfileCatalog::load().expect("profile catalog");
+    SimReturnLifecycle::from_profile(&catalog, &id(profile))
+        .expect("profile policy composes")
+        .expect("qualified profile has lifecycle policy")
+}
+
+fn bootstrap_synchronized(lifecycle: &mut SimReturnLifecycle, at_ms: u64) {
+    let transition = lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(at_ms));
+    let ReturnTransition::EpochOpened(epoch) = transition else {
+        panic!("bootstrap activity opens an epoch");
+    };
+    assert!(matches!(
+        lifecycle.note_delivery(epoch.sequence(), RestoreDeliveryState::ChildConfirmed),
+        ReturnTransition::Synchronized(_)
+    ));
+}
+
+#[test]
+fn randomized_legal_idle_durations_and_jitter_open_one_bounded_epoch() {
+    for profile in [MOUSE_PROFILE, KEYBOARD_PROFILE] {
+        let mut seed = 0x6a09_e667_f3bc_c909_u64;
+        for _ in 0..512 {
+            seed = seed.wrapping_mul(6_364_136_223_846_793_005).wrapping_add(1);
+            let idle_seconds = 60 + seed % 841;
+            let coalescing_jitter_ms = (seed >> 16) % 501;
+            let mut lifecycle = lifecycle(profile);
+            bootstrap_synchronized(&mut lifecycle, 1_000);
+            let wake_at = 1_000 + idle_seconds * 1_000 - coalescing_jitter_ms;
+            let transition =
+                lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(2), time(wake_at));
+            let ReturnTransition::EpochOpened(epoch) = transition else {
+                panic!("legal idle interval with bounded jitter must open an epoch");
+            };
+            let envelope = lifecycle
+                .retry_envelope()
+                .expect("retry envelope is representable")
+                .expect("return epoch owns one envelope");
+            assert_eq!(envelope.epoch_sequence, epoch.sequence());
+            assert_eq!(envelope.due_at_ms[0], time(wake_at));
+            assert!(envelope.due_at_ms[1].get() - wake_at <= 100);
+            assert_eq!(envelope.due_at_ms.len(), 12);
+
+            assert_eq!(
+                lifecycle.note_delivery(epoch.sequence(), RestoreDeliveryState::ReceiverDelivered,),
+                ReturnTransition::None
+            );
+            assert_eq!(lifecycle.phase(), ReturnPhase::Returning);
+            assert!(matches!(
+                lifecycle.advance(time(wake_at + 6_001)),
+                ReturnTransition::WindowCompleted(_)
+            ));
+            assert_eq!(lifecycle.phase(), ReturnPhase::Stable);
+        }
+    }
+}
+
+#[test]
+fn duplicate_reordered_and_accelerating_evidence_never_duplicates_an_epoch() {
+    let mut lifecycle = lifecycle(MOUSE_PROFILE);
+    bootstrap_synchronized(&mut lifecycle, 1_000);
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::RouteDeparture, sequence(2), time(2_000)),
+        ReturnTransition::BecameUnavailable
+    );
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::RouteDeparture, sequence(2), time(2_000)),
+        ReturnTransition::None
+    );
+    assert_eq!(
+        lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(1), time(2_100)),
+        ReturnTransition::None
+    );
+    let transition = lifecycle.observe(ReturnEvidence::EndpointActivity, sequence(3), time(2_100));
+    let ReturnTransition::EpochOpened(epoch) = transition else {
+        panic!("activity after explicit departure opens immediately");
+    };
+    let initial = lifecycle.retry_envelope().expect("envelope");
+    assert!(matches!(
+        lifecycle.observe(ReturnEvidence::ContactReport, sequence(4), time(2_110)),
+        ReturnTransition::EpochAccelerated(candidate) if candidate.sequence() == epoch.sequence()
+    ));
+    assert_eq!(lifecycle.retry_envelope().expect("envelope"), initial);
+}
+
+#[test]
+fn lifecycle_boundaries_and_simultaneous_children_remain_endpoint_local() {
+    let mut mouse = lifecycle(MOUSE_PROFILE);
+    let mut keyboard = lifecycle(KEYBOARD_PROFILE);
+    bootstrap_synchronized(&mut mouse, 1_000);
+    bootstrap_synchronized(&mut keyboard, 1_000);
+
+    mouse.reset_observation_anchor();
+    assert!(matches!(
+        mouse.observe(ReturnEvidence::EndpointActivity, sequence(1), time(2_000)),
+        ReturnTransition::EpochOpened(_)
+    ));
+    assert_eq!(keyboard.phase(), ReturnPhase::Synchronized);
+
+    assert_eq!(
+        keyboard.observe(ReturnEvidence::RouteDeparture, sequence(2), time(2_000)),
+        ReturnTransition::BecameUnavailable
+    );
+    assert!(matches!(
+        keyboard.observe(ReturnEvidence::RouteReturn, sequence(3), time(2_010)),
+        ReturnTransition::EpochOpened(_)
+    ));
+    assert_eq!(mouse.phase(), ReturnPhase::Returning);
+
+    let mouse_epoch = mouse.epoch().expect("mouse epoch");
+    assert_eq!(
+        mouse.observe(
+            ReturnEvidence::ApplicationOwnershipLoss,
+            sequence(2),
+            time(2_020),
+        ),
+        ReturnTransition::None
+    );
+    assert_eq!(mouse.phase(), ReturnPhase::Stable);
+    assert_eq!(mouse.epoch(), None);
+    assert!(keyboard.epoch().is_some());
+    assert_eq!(mouse_epoch.sequence(), sequence(1));
+}
+
+#[test]
+fn unknown_profiles_fail_closed_without_a_return_writer() {
+    let catalog = RuntimeProfileCatalog::load().expect("profile catalog");
+    assert!(
+        SimReturnLifecycle::from_profile(&catalog, &id("child.research.unknown"))
+            .expect("unknown profile is not an error")
+            .is_none()
+    );
+}
+
+#[test]
+fn effect_intent_survives_rescan_but_not_owner_or_process_restart() {
+    let mut effects = VolatileEffectRegistry::new(8).expect("effect registry");
+    let request = effect_request();
+    let owner = SubmissionBinding {
+        session_id: id("session-openrgb"),
+        authorization_epoch: AuthorizationEpoch::try_from(1_u64).expect("epoch"),
+        dispatch_nonce: DispatchNonce::try_from(1_u64).expect("nonce"),
+    };
+    effects
+        .capture_admitted(&request, &owner)
+        .expect("effect intent is admitted");
+    assert!(
+        effects
+            .plan_replay(
+                &request.receiver_id,
+                request.generation_id,
+                &request.frames[0].device_id,
+                id("request-rescan"),
+                id("transaction-rescan"),
+                DispatchNonce::try_from(2_u64).expect("nonce"),
+                time(20_000),
+            )
+            .expect("rescan replay planning")
+            .is_some()
+    );
+    assert_eq!(effects.remove_session(&owner.session_id), 1);
+    assert!(effects.is_empty());
+
+    let restarted = VolatileEffectRegistry::new(8).expect("new process registry");
+    assert!(restarted.is_empty());
+}
+
+fn effect_request() -> TransactionRequest {
+    let receiver_id: ReceiverId = id("receiver-1");
+    let generation_id = GenerationId::try_from(1_u64).expect("generation");
+    let device_id: LogicalDeviceId = id("mouse-1");
+    let profile_id: ProfileId = id("profile.mouse");
+    let profile_digest: ProfileDigest = id(&"b".repeat(64));
+    TransactionRequest {
+        request_id: id::<RequestId>("request-effect"),
+        transaction_id: id::<TransactionId>("transaction-effect"),
+        client_id: id::<ClientId>("client-openrgb"),
+        lease_id: id::<LeaseId>("lease-openrgb"),
+        receiver_id: receiver_id.clone(),
+        generation_id,
+        receiver_profile_id: id("profile.receiver"),
+        receiver_profile_digest: id(&"a".repeat(64)),
+        device_profiles: vec![DeviceProfileBinding {
+            device_id: device_id.clone(),
+            profile_id,
+            profile_digest,
+            application_slot_count: LedCount::try_from(1_u16).expect("LED count"),
+        }],
+        transaction_class: TransactionClass::EffectFrame,
+        stable_intents: Vec::new(),
+        deadline_ms: time(10_000),
+        resources: vec![ResourceKey {
+            receiver_id,
+            generation_id,
+            device_id: device_id.clone(),
+            kind: ResourceKind::Lighting,
+        }],
+        frames: vec![LightingFrame {
+            device_id,
+            frame_index: FrameIndex::try_from(0_u32).expect("frame index"),
+            colors: vec![RgbColor {
+                red: ColorChannel::try_from(0_u8).expect("red"),
+                green: ColorChannel::try_from(0_u8).expect("green"),
+                blue: ColorChannel::try_from(255_u8).expect("blue"),
+            }],
+        }],
+    }
+}
diff --git a/docs/generated/bridge-protocol-v6.md b/docs/generated/bridge-protocol-v6.md
new file mode 100644
index 0000000..20a7683
--- /dev/null
+++ b/docs/generated/bridge-protocol-v6.md
@@ -0,0 +1,627 @@
+# Bridge Protocol V6
+
+> Generated by `./hfx generate`. Do not edit manually.
+
+Supported protocol versions: **6 through 6**.
+
+Maximum encoded message: **1048576 bytes**. Maximum JSON nesting: **128 levels**.
+
+## Clock And Ordering Semantics
+
+`MonotonicMs` values belong to the serving bridge process monotonic clock. They are comparable only while `server_instance_id` remains unchanged; they are never wall-clock timestamps and must not be retained across bridge restart.
+
+Lease expiries and transaction deadlines are exclusive absolute instants in that clock domain. Transaction `frame_index` values are contiguous, zero-based, and ordered within one atomic request. Terminal outcomes are immutable; a client looks them up instead of replaying a request after uncertain transport.
+
+## Negotiated Features
+
+- `ownership-leases`
+- `atomic-transactions`
+- `profile-bound-transactions`
+- `semantic-stable-lighting`
+- `snapshot-profile-bindings`
+- `integration-view-projection`
+- `event-subscriptions`
+- `structured-diagnostics`
+- `return-lifecycle-projection`
+
+## Methods
+
+| Method | Request | Response | Feature |
+| --- | --- | --- | --- |
+| `negotiate` | `ClientHello` | `ServerHello` | base |
+| `snapshot` | `EmptyRequest` | `BridgeSnapshot` | base |
+| `integration-view` | `EmptyRequest` | `IntegrationView` | `integration-view-projection` |
+| `acquire-lease` | `LeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `renew-lease` | `RenewLeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `release-lease` | `ReleaseLeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `submit-transaction` | `TransactionRequest` | `TransactionResult` | `atomic-transactions` |
+| `transaction-outcome` | `TransactionLookup` | `TransactionResult` | `atomic-transactions` |
+| `subscribe` | `SubscriptionRequest` | `EventBatch` | `event-subscriptions` |
+| `diagnostics` | `EmptyRequest` | `DiagnosticSnapshot` | `structured-diagnostics` |
+
+## Records
+
+### EmptyRequest
+
+A method request with no method-specific fields.
+
+This record has no fields.
+
+### RgbColor
+
+One canonical eight-bit RGB color.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `red` | `ColorChannel` | `true` | scalar |
+| `green` | `ColorChannel` | `true` | scalar |
+| `blue` | `ColorChannel` | `true` | scalar |
+
+### ClientHello
+
+Bounded client protocol and feature offer.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `client_name` | `ClientName` | `true` | scalar |
+| `minimum_version` | `ProtocolVersion` | `true` | scalar |
+| `maximum_version` | `ProtocolVersion` | `true` | scalar |
+| `required_features` | `ProtocolFeatureId` | `true` | max 64 |
+| `optional_features` | `ProtocolFeatureId` | `true` | max 64 |
+
+### ServerHello
+
+Negotiated protocol version and bridge feature set.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `selected_version` | `ProtocolVersion` | `true` | scalar |
+| `server_instance_id` | `ServerInstanceId` | `true` | scalar |
+| `protocol_session_id` | `ProtocolSessionId` | `true` | scalar |
+| `negotiation_token` | `NegotiationToken` | `true` | scalar |
+| `bridge_version` | `ComponentVersion` | `true` | scalar |
+| `enabled_features` | `ProtocolFeatureId` | `true` | max 64 |
+| `event_buffer_capacity` | `QueueCapacity` | `true` | scalar |
+
+### ResourceKey
+
+One device-scoped writable resource.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `kind` | `ResourceKind` | `true` | scalar |
+
+### LeaseRequest
+
+Atomic request for one or more writable resources.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `duration_ms` | `LeaseDurationMs` | `true` | scalar |
+
+### LeaseGrant
+
+Granted ownership lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+| `state` | `LeaseState` | `true` | scalar |
+
+### LeaseConflict
+
+Deterministic first conflict from an otherwise atomic lease request.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `conflicting_client` | `ClientId` | `true` | scalar |
+| `conflicting_resource` | `ResourceKey` | `true` | scalar |
+
+### LeaseRejection
+
+Structured lease rejection unrelated to another owner.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### RenewLeaseRequest
+
+Idempotent renewal of one existing lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `duration_ms` | `LeaseDurationMs` | `true` | scalar |
+
+### ReleaseLeaseRequest
+
+Idempotent release of one existing lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+
+### EventCursor
+
+Complete resumable position in one event stream projection.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `stream_id` | `StreamId` | `true` | scalar |
+| `stream_epoch` | `StreamEpoch` | `true` | scalar |
+| `projection_revision` | `ProjectionRevision` | `true` | scalar |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+
+### ReturnEpoch
+
+Generation-bound endpoint return state without claiming physical lighting application.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `epoch_sequence` | `SequenceNumber` | `true` | scalar |
+| `opened_at_ms` | `MonotonicMs` | `true` | scalar |
+| `opening_evidence` | `ReturnEvidence` | `true` | scalar |
+| `phase` | `ReturnPhase` | `true` | scalar |
+| `delivery_state` | `RestoreDeliveryState` | `true` | scalar |
+
+### EndpointSnapshot
+
+Independent route, power, sleep, activity, contact, and freshness facts.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `route_kind` | `RouteKind` | `true` | scalar |
+| `route_state` | `RouteState` | `true` | scalar |
+| `connection_mode` | `ConnectionMode` | `true` | scalar |
+| `power_state` | `PowerState` | `true` | scalar |
+| `sleep_state` | `SleepState` | `true` | scalar |
+| `activity_state` | `ActivityState` | `true` | scalar |
+| `contact_state` | `ContactState` | `true` | scalar |
+| `freshness` | `FreshnessState` | `true` | scalar |
+| `confidence` | `EvidenceConfidence` | `true` | scalar |
+| `evidence_claim_id` | `EvidenceClaimId` | `false` | scalar |
+| `observed_at_ms` | `MonotonicMs` | `false` | scalar |
+| `return_epoch` | `ReturnEpoch` | `false` | scalar |
+
+### BatteryObservation
+
+Battery availability and value without collapsing unknown and unavailable.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `availability` | `TelemetryAvailability` | `true` | scalar |
+| `percentage` | `BatteryPercent` | `false` | scalar |
+| `freshness` | `FreshnessState` | `true` | scalar |
+| `confidence` | `EvidenceConfidence` | `true` | scalar |
+| `observed_at_ms` | `MonotonicMs` | `false` | scalar |
+
+### ResourceOwnershipSnapshot
+
+Current bounded application ownership for one generation-scoped resource.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `resource` | `ResourceKey` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### LogicalDeviceSnapshot
+
+Application-neutral logical controller state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `false` | scalar |
+| `profile_digest` | `ProfileDigest` | `false` | scalar |
+| `pairing` | `PairingState` | `true` | scalar |
+| `presence` | `PresenceState` | `true` | scalar |
+| `support_level` | `SupportLevel` | `true` | scalar |
+| `endpoints` | `EndpointSnapshot` | `true` | max 8 |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+
+### ReceiverSnapshot
+
+Generation-bound receiver and child inventory.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `false` | scalar |
+| `profile_digest` | `ProfileDigest` | `false` | scalar |
+| `lifecycle` | `ReceiverLifecycleState` | `true` | scalar |
+| `devices` | `LogicalDeviceSnapshot` | `true` | max 32 |
+| `ownership` | `ResourceOwnershipSnapshot` | `true` | max 96 |
+| `stable_restore_enabled` | `Boolean` | `true` | scalar |
+| `restore_state` | `RestoreState` | `true` | scalar |
+
+### BridgeSnapshot
+
+Sequence-bound complete bridge snapshot.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `receivers` | `ReceiverSnapshot` | `true` | max 16 |
+
+### LightingFrame
+
+One logical-device direct-mode frame.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `frame_index` | `FrameIndex` | `true` | scalar |
+| `colors` | `RgbColor` | `true` | max 4096 |
+
+### DeviceProfileBinding
+
+Exact profile and lighting dimensions bound to one transaction target.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `true` | scalar |
+| `profile_digest` | `ProfileDigest` | `true` | scalar |
+| `application_slot_count` | `LedCount` | `true` | scalar |
+
+### StableLightingIntent
+
+Explicit semantic stable-lighting intent for one frame target.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `mode` | `StableLightingMode` | `true` | scalar |
+
+### TransactionRequest
+
+Atomic generation- and ownership-bound operation.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `receiver_profile_id` | `ProfileId` | `true` | scalar |
+| `receiver_profile_digest` | `ProfileDigest` | `true` | scalar |
+| `device_profiles` | `DeviceProfileBinding` | `true` | max 32 |
+| `transaction_class` | `TransactionClass` | `true` | scalar |
+| `stable_intents` | `StableLightingIntent` | `true` | max 32 |
+| `deadline_ms` | `MonotonicMs` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `frames` | `LightingFrame` | `true` | max 32 |
+
+### TransactionProgress
+
+Nonterminal generation-bound transaction projection.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `request_digest` | `RequestDigest` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `state` | `TransactionState` | `true` | scalar |
+| `admission` | `QueueAdmission` | `true` | scalar |
+| `declared_frames` | `FrameCount` | `true` | scalar |
+| `delivered_frames` | `DeliveredFrameCount` | `true` | scalar |
+| `side_effect_certainty` | `SideEffectCertainty` | `true` | scalar |
+| `live_write_executed` | `Boolean` | `true` | scalar |
+
+### TransactionTerminal
+
+Immutable terminal transaction outcome retained for bounded lookup.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `request_digest` | `RequestDigest` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `state` | `TransactionState` | `true` | scalar |
+| `declared_frames` | `FrameCount` | `true` | scalar |
+| `delivered_frames` | `DeliveredFrameCount` | `true` | scalar |
+| `side_effect_certainty` | `SideEffectCertainty` | `true` | scalar |
+| `live_write_executed` | `Boolean` | `true` | scalar |
+| `automatic_retry` | `Boolean` | `true` | scalar |
+| `device_application` | `DeviceApplicationState` | `true` | scalar |
+| `terminal_sequence` | `SequenceNumber` | `true` | scalar |
+| `error_kind` | `ProtocolErrorKind` | `false` | scalar |
+| `superseded_by` | `TransactionId` | `false` | scalar |
+
+### TransactionUnavailable
+
+Outcome lookup cannot return a retained transaction record.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### TransactionLookup
+
+Idempotent lookup of one previously submitted transaction.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+
+### SubscriptionRequest
+
+Bounded event subscription cursor.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `subscription_id` | `SubscriptionId` | `false` | scalar |
+| `expected_cursor` | `EventCursor` | `false` | scalar |
+| `max_events` | `EventBatchLimit` | `true` | scalar |
+
+### BridgeEvent
+
+Sequence-bound typed event with snapshot references.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `kind` | `EventKind` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `false` | scalar |
+| `generation_id` | `GenerationId` | `false` | scalar |
+| `device_id` | `LogicalDeviceId` | `false` | scalar |
+| `lease_id` | `LeaseId` | `false` | scalar |
+| `transaction_id` | `TransactionId` | `false` | scalar |
+| `finding_id` | `FindingId` | `false` | scalar |
+
+### EventBatch
+
+Bounded event result with explicit cursor-gap state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `subscription_id` | `SubscriptionId` | `true` | scalar |
+| `next_cursor` | `EventCursor` | `true` | scalar |
+| `events` | `BridgeEvent` | `true` | max 256 |
+| `oldest_available` | `SequenceNumber` | `true` | scalar |
+| `latest_available` | `SequenceNumber` | `true` | scalar |
+| `dropped_events` | `DroppedEventCount` | `true` | scalar |
+| `cursor_gap` | `Boolean` | `true` | scalar |
+| `has_more` | `Boolean` | `true` | scalar |
+
+### DiagnosticFinding
+
+One privacy-classified actionable finding.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `finding_id` | `FindingId` | `true` | scalar |
+| `severity` | `ErrorSeverity` | `true` | scalar |
+| `cause` | `HumanMessage` | `true` | scalar |
+| `explanation` | `HumanMessage` | `true` | scalar |
+| `safe_action` | `HumanMessage` | `true` | scalar |
+| `privacy` | `PrivacyClass` | `true` | scalar |
+| `documentation` | `DocumentationPath` | `true` | scalar |
+
+### DiagnosticSnapshot
+
+Bounded bridge findings and queue health.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `findings` | `DiagnosticFinding` | `true` | max 128 |
+| `event_buffer_capacity` | `QueueCapacity` | `true` | scalar |
+| `transaction_queue_capacity` | `QueueCapacity` | `true` | scalar |
+
+### ProfileBindingView
+
+Exact immutable profile authority exposed to integrations.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `profile_id` | `ProfileId` | `true` | scalar |
+| `profile_digest` | `ProfileDigest` | `true` | scalar |
+
+### DeviceInventoryView
+
+Truthful paired-device inventory independent of application controller registration.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `profile` | `ProfileBindingView` | `false` | scalar |
+| `model_name` | `ModelName` | `false` | scalar |
+| `pairing` | `PairingState` | `true` | scalar |
+| `presence` | `PresenceState` | `true` | scalar |
+| `availability` | `InventoryAvailability` | `true` | scalar |
+| `support_level` | `SupportLevel` | `true` | scalar |
+| `endpoints` | `EndpointSnapshot` | `true` | max 8 |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+
+### PresentationView
+
+Pinned upstream presentation authority without hardware transport policy.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `upstream_id` | `UpstreamId` | `true` | scalar |
+| `owner` | `UpstreamOwner` | `true` | scalar |
+| `project_version` | `ComponentVersion` | `true` | scalar |
+| `source_revision` | `SourceRevision` | `true` | scalar |
+| `model_key` | `PresentationKey` | `true` | scalar |
+| `layout_key` | `PresentationKey` | `false` | scalar |
+| `transport_variant` | `TransportVariant` | `true` | scalar |
+
+### LightingTopologyView
+
+Application-facing lighting dimensions without receiver carrier mapping.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `physical_led_count` | `LedCount` | `true` | scalar |
+| `application_slot_count` | `LedCount` | `true` | scalar |
+| `rows` | `LedCount` | `true` | scalar |
+| `columns` | `LedCount` | `true` | scalar |
+
+### UnownedController
+
+Writable controller currently has no application owner.
+
+This record has no fields.
+
+### ViewerOwnedController
+
+Writable controller is owned by the requesting client.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### OtherOwnedController
+
+Writable controller is owned by another application client.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### ControllerActions
+
+Viewer-specific actions derived from availability and ownership.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `can_acquire` | `Boolean` | `true` | scalar |
+| `can_release` | `Boolean` | `true` | scalar |
+| `can_submit_now` | `Boolean` | `true` | scalar |
+
+### ControllerView
+
+Exact qualified receiver-backed application controller.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `receiver_profile` | `ProfileBindingView` | `true` | scalar |
+| `device_profile` | `ProfileBindingView` | `true` | scalar |
+| `model_name` | `ModelName` | `true` | scalar |
+| `presentation` | `PresentationView` | `true` | scalar |
+| `availability` | `ControllerAvailability` | `true` | scalar |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+| `lighting` | `LightingTopologyView` | `true` | scalar |
+| `resource` | `ResourceKey` | `true` | scalar |
+| `ownership` | `ControllerOwnership` | `true` | scalar |
+| `actions` | `ControllerActions` | `true` | scalar |
+
+### IntegrationReceiverView
+
+One receiver generation with complete inventory and qualified controllers.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `profile` | `ProfileBindingView` | `false` | scalar |
+| `model_name` | `ModelName` | `false` | scalar |
+| `lifecycle` | `ReceiverLifecycleState` | `true` | scalar |
+| `stable_restore_enabled` | `Boolean` | `true` | scalar |
+| `restore_state` | `RestoreState` | `true` | scalar |
+| `inventory` | `DeviceInventoryView` | `true` | max 32 |
+| `controllers` | `ControllerView` | `true` | max 32 |
+
+### IntegrationView
+
+Client-specific application view projected once by bridge policy.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `receivers` | `IntegrationReceiverView` | `true` | max 16 |
+
+### RpcError
+
+Stable structured request failure.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `false` | scalar |
+| `kind` | `ProtocolErrorKind` | `true` | scalar |
+| `message` | `HumanMessage` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+## Tagged Unions
+
+### LeaseResult
+
+Contradiction-free atomic lease outcome.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `granted` | `Granted` | `LeaseGrant` |
+| `conflict` | `Conflict` | `LeaseConflict` |
+| `rejected` | `Rejected` | `LeaseRejection` |
+
+### TransactionResult
+
+Contradiction-free current, terminal, or unavailable transaction outcome.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `progress` | `Progress` | `TransactionProgress` |
+| `terminal` | `Terminal` | `TransactionTerminal` |
+| `unavailable` | `Unavailable` | `TransactionUnavailable` |
+
+### ControllerOwnership
+
+Contradiction-free viewer-specific controller ownership.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `unowned` | `Unowned` | `UnownedController` |
+| `owned-by-viewer` | `OwnedByViewer` | `ViewerOwnedController` |
+| `owned-by-other` | `OwnedByOther` | `OtherOwnedController` |
diff --git a/docs/generated/bridge-protocol.md b/docs/generated/bridge-protocol.md
index 08d9408..8c8140f 100644
--- a/docs/generated/bridge-protocol.md
+++ b/docs/generated/bridge-protocol.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Supported protocol versions: **5 through 5**.
+Supported protocol versions: **6 through 6**.
 
 Maximum encoded message: **1048576 bytes**. Maximum JSON nesting: **128 levels**.
 
@@ -22,6 +22,7 @@ Lease expiries and transaction deadlines are exclusive absolute instants in that
 - `integration-view-projection`
 - `event-subscriptions`
 - `structured-diagnostics`
+- `return-lifecycle-projection`
 
 ## Methods
 
@@ -167,6 +168,21 @@ Complete resumable position in one event stream projection.
 | `projection_revision` | `ProjectionRevision` | `true` | scalar |
 | `sequence` | `SequenceNumber` | `true` | scalar |
 
+### ReturnEpoch
+
+Generation-bound endpoint return state without claiming physical lighting application.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `epoch_sequence` | `SequenceNumber` | `true` | scalar |
+| `opened_at_ms` | `MonotonicMs` | `true` | scalar |
+| `opening_evidence` | `ReturnEvidence` | `true` | scalar |
+| `phase` | `ReturnPhase` | `true` | scalar |
+| `delivery_state` | `RestoreDeliveryState` | `true` | scalar |
+
 ### EndpointSnapshot
 
 Independent route, power, sleep, activity, contact, and freshness facts.
@@ -185,6 +201,7 @@ Independent route, power, sleep, activity, contact, and freshness facts.
 | `confidence` | `EvidenceConfidence` | `true` | scalar |
 | `evidence_claim_id` | `EvidenceClaimId` | `false` | scalar |
 | `observed_at_ms` | `MonotonicMs` | `false` | scalar |
+| `return_epoch` | `ReturnEpoch` | `false` | scalar |
 
 ### BatteryObservation
 
diff --git a/docs/generated/domain-types.md b/docs/generated/domain-types.md
index d42247c..a3e1d68 100644
--- a/docs/generated/domain-types.md
+++ b/docs/generated/domain-types.md
@@ -111,6 +111,9 @@ These types prevent semantically different values from being passed interchangea
 - `QueueAdmission`: `enqueued`, `coalesced`, `rejected-full`, `rejected-deadline`, `rejected-invalid`
 - `RestoreState`: `idle`, `planned`, `ownership-bound`, `generation-bound`, `queued`, `applying`, `succeeded`, `failed`, `invalidated`
 - `RestoreTriggerKind`: `service-start`, `receiver-generation`, `system-resume`, `device-return`
+- `ReturnEvidence`: `application-ownership-loss`, `battery-report`, `contact-report`, `endpoint-activity`, `endpoint-identity`, `endpoint-status`, `receiver-generation`, `route-departure`, `route-return`, `system-resume`
+- `ReturnPhase`: `stable`, `quiescent-candidate`, `returning`, `synchronized`, `unavailable`
+- `RestoreDeliveryState`: `not-attempted`, `receiver-rejected`, `outcome-uncertain`, `receiver-delivered`, `child-rejected`, `child-confirmed`
 - `RestoreRecordState`: `planned`, `deferred`, `prepared`, `queued`, `applying`, `succeeded`, `failed`, `invalidated`
 - `RestoreDeferReason`: `device-sleeping`, `device-unavailable`, `device-unknown`, `ownership-conflict`, `session-unavailable`, `deadline-elapsed`, `safe-transaction-failure`
 - `RestoreInvalidationReason`: `superseded-trigger`, `stale-generation`, `intent-changed`, `profile-changed`, `restore-disabled`
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index d2fcaba..287b2f0 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,7 +33,7 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `152` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `156` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,14 +47,14 @@ The expanded source payload contains `152` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 50 | `-` |
+| `schemas` | 51 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
 | `integration-authority` | 4 | `-` |
-| `cpp-sdk-headers` | 26 | `-` |
-| `documentation` | 37 | `-` |
+| `cpp-sdk-headers` | 28 | `-` |
+| `documentation` | 38 | `-` |
 | `readme` | 1 | `-` |
 | `security-policy` | 1 | `-` |
 | `license` | 1 | `-` |
diff --git a/docs/generated/linux-runtime.md b/docs/generated/linux-runtime.md
index b01568c..0cdb95a 100644
--- a/docs/generated/linux-runtime.md
+++ b/docs/generated/linux-runtime.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical source digest: `aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8`.
+Canonical source digest: `6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723`.
 
 ## Product
 
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index c844124..bb8f8c0 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -232,7 +232,7 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 
 **Used by:** [Assurance and release evidence](#assurance), [Kernel driver contract](#driver-contract), [Error catalog](#errors), [Application integration catalog](#integrations), [Composable hardware profiles](#profiles), [Versioned bridge protocol](#protocol), [Linux runtime authority](#runtime-config), [Rust workspace](#rust-workspace), [Repository tooling](#tooling)
 
-**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`.
+**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`, `schemas/lifecycle-policy-catalog.schema.json`.
 
 **Generated projections:** `schemas/README.md`, `docs/generated/domain-types.md`.
 
@@ -310,7 +310,7 @@ Composes receiver, surface, and child identities with evidence-bound capabilitie
 
 **Used by:** [Core policy engine](#core-runtime), [Device knowledge](#device-knowledge), [Device qualification console](#device-qualification-console), [Linux HID kernel module](#kernel-module), [OpenRazer compatibility adapter](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Rust SDK](#rust-sdk), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python), [Deterministic simulator](#simulator)
 
-**Canonical sources:** `profiles/capabilities.json`, `profiles/evidence/claims.json`, `profiles/receivers/razer-hyperflux-v2-1532-00cf.json`, `profiles/surfaces/razer-hyperflux-v2-hard-edition.json`, `profiles/children/razer-basilisk-v3-pro-35k-00cd.json`, `profiles/children/razer-deathstalker-v2-pro-tkl-0296.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-13.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-21.json`.
+**Canonical sources:** `profiles/capabilities.json`, `profiles/lifecycle-policies.json`, `profiles/evidence/claims.json`, `profiles/receivers/razer-hyperflux-v2-1532-00cf.json`, `profiles/surfaces/razer-hyperflux-v2-hard-edition.json`, `profiles/children/razer-basilisk-v3-pro-35k-00cd.json`, `profiles/children/razer-deathstalker-v2-pro-tkl-0296.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-13.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-21.json`.
 
 **Generated projections:** `profiles/README.md`, `generated/profiles/catalog.json`, `docs/generated/supported-hardware.md`.
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index ae1abba..de51eca 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f`
+Profile source: `6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -10,8 +10,8 @@ Support is capability-specific. A listed model does not transfer its transport m
 
 | Profile | Kind | Identity | Runtime binding | Read capabilities | Write capabilities |
 | --- | --- | --- | --- | ---: | ---: |
-| **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `1a9dde39c257` | 7 | 7 |
-| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `133bcdf39640` | 6 | 7 |
+| **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `62f114182069` | 7 | 7 |
+| **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `46703d44d594` | 6 | 7 |
 | **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index 8ddb01b..d553bdc 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f */
+/* Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 0c0f0c6..819740b 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "c6cfe3c3fc0e88643948be4e8d9961a6f4c6a280042b7d6d1dcb0a3568216e4a",
+  "source_sha256": "287f279c6bb36b725cf056a20ad01a0bf68e9a28d9243e2ab7d69ff1a2ce5c72",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index ed140f2..5b25845 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -738,6 +738,59 @@
       "summary": "The Hard Edition surface identity and its firmware-owned charging/status indicator are reviewed observations, not a USB identity or writable RGB surface."
     }
   ],
+  "lifecycle_policies": [
+    {
+      "allowed_accelerator_evidence": [
+        "battery-report",
+        "contact-report",
+        "endpoint-activity",
+        "route-return"
+      ],
+      "allowed_open_evidence": [
+        "endpoint-activity",
+        "route-return"
+      ],
+      "delivery_semantics": "receiver-delivered-not-child-applied",
+      "id": "receiver-child.activity-assisted.v1",
+      "observation_jitter_ms": 500,
+      "qualification": "prequalification-candidate",
+      "quiescence_candidate_ms": 60000,
+      "retry_offsets_ms": [
+        0,
+        100,
+        200,
+        300,
+        500,
+        750,
+        1000,
+        1500,
+        2250,
+        3250,
+        4500,
+        6000
+      ],
+      "strategy": "activity-assisted-return-epoch",
+      "timing_authorities": [
+        {
+          "kind": "pinned-upstream-contract",
+          "source_id": "openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339",
+          "source_sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829",
+          "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
+        },
+        {
+          "kind": "pinned-upstream-contract",
+          "source_id": "driver/kernel/hyperflux-next-internal.h:21",
+          "source_sha256": "3f11ad598422577681f050b6f11535a03e2644120301ec69361a579c535ab06b",
+          "summary": "Endpoint activity is rate-limited to 250 milliseconds. A two-interval tolerance prevents report coalescing from turning the legal minimum idle setting into a brittle exact-second boundary."
+        },
+        {
+          "kind": "prequalification-hypothesis",
+          "source_id": "assurance/protected-behavior.json:natural-device-wake-restoration",
+          "summary": "The bounded retry envelope covers the longest legacy five-second settle fallback plus one second. It remains a candidate until the watched no-Spectrum matrix qualifies or replaces it."
+        }
+      ]
+    }
+  ],
   "profiles": [
     {
       "capabilities": [
@@ -891,6 +944,14 @@
       },
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
       "qualification_migrations": [
+        {
+          "from_runtime_sha256": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        },
         {
           "from_runtime_sha256": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33",
           "preserve_stage_roles": [
@@ -906,14 +967,21 @@
         "Contact, inactivity, darkness, and power-off remain distinct facts.",
         "A physical mouse power-off can retain the receiver route; watched qualification records that physical boundary without inventing a disconnect."
       ],
-      "revision": 2,
-      "runtime_sha256": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc",
+      "revision": 3,
+      "runtime_sha256": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-basilisk-v3-pro-35k-00cd.json",
       "transport": {
         "lifecycle": {
-          "device_return_settle_ms": 1000,
-          "power_off_departure_evidence": "watched-retained-route"
+          "accelerator_evidence": [
+            "contact-report",
+            "endpoint-activity"
+          ],
+          "open_evidence": [
+            "endpoint-activity"
+          ],
+          "power_off_departure_evidence": "watched-retained-route",
+          "return_policy_id": "receiver-child.activity-assisted.v1"
         },
         "lighting": {
           "application_index_to_carrier": [
@@ -1100,6 +1168,14 @@
       },
       "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
       "qualification_migrations": [
+        {
+          "from_runtime_sha256": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
+          "preserve_stage_roles": [
+            "lighting",
+            "map",
+            "telemetry"
+          ]
+        },
         {
           "from_runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb",
           "preserve_stage_roles": [
@@ -1138,19 +1214,23 @@
         "External power does not establish a direct USB data route or charging state.",
         "Receiver route value 0x0101 is indeterminate and cannot override observed keyboard activity."
       ],
-      "revision": 5,
-      "runtime_sha256": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a",
+      "revision": 6,
+      "runtime_sha256": "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json",
       "transport": {
         "lifecycle": {
-          "device_return_confirmation": {
-            "evidence": "battery-report",
-            "reassert_at_fallback": true,
-            "settle_ms": 250
-          },
-          "device_return_settle_ms": 5000,
-          "power_off_departure_evidence": "receiver-state"
+          "accelerator_evidence": [
+            "battery-report",
+            "endpoint-activity",
+            "route-return"
+          ],
+          "open_evidence": [
+            "endpoint-activity",
+            "route-return"
+          ],
+          "power_off_departure_evidence": "receiver-state",
+          "return_policy_id": "receiver-child.activity-assisted.v1"
         },
         "lighting": {
           "application_index_to_carrier": [
@@ -1425,5 +1505,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
+  "source_sha256": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
 }
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index ed56df4..4d9ec9e 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -403,6 +403,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/lifecycle-policy-catalog.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/lifecycle-policy-catalog.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/linux-runtime.schema.json",
@@ -788,6 +795,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/generated/protocol_v6_json.hpp",
+      "destination": "/usr/include/hyperflux/generated/protocol_v6_json.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/generated/protocol_v6_types.hpp",
+      "destination": "/usr/include/hyperflux/generated/protocol_v6_types.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/sdk.hpp",
@@ -956,6 +977,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "documentation",
+      "source": "docs/generated/bridge-protocol-v6.md",
+      "destination": "/usr/share/doc/hyperflux-next/generated/bridge-protocol-v6.md",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "documentation",
       "source": "docs/generated/bridge-protocol.md",
diff --git a/profiles/README.md b/profiles/README.md
index eea9ecc..df06474 100644
--- a/profiles/README.md
+++ b/profiles/README.md
@@ -26,6 +26,7 @@ Composes receiver, surface, and child identities with evidence-bound capabilitie
 ## Change Here
 
 - [`profiles/capabilities.json`](capabilities.json)
+- [`profiles/lifecycle-policies.json`](lifecycle-policies.json)
 - [`profiles/evidence/claims.json`](evidence/claims.json)
 - [`profiles/receivers/razer-hyperflux-v2-1532-00cf.json`](receivers/razer-hyperflux-v2-1532-00cf.json)
 - [`profiles/surfaces/razer-hyperflux-v2-hard-edition.json`](surfaces/razer-hyperflux-v2-hard-edition.json)
diff --git a/profiles/children/razer-basilisk-v3-pro-35k-00cd.json b/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
index 948e819..65ce945 100644
--- a/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
+++ b/profiles/children/razer-basilisk-v3-pro-35k-00cd.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
-  "revision": 2,
+  "revision": 3,
   "kind": "child",
   "device_kind": "mouse",
   "identity": {"manufacturer": "Razer", "model_name": "Razer Basilisk V3 Pro 35K", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 205},
@@ -16,9 +16,15 @@
       "route": {"available": [], "unavailable": []},
       "report_implies_route_available": true
     },
-    "lifecycle": {"power_off_departure_evidence": "watched-retained-route", "device_return_settle_ms": 1000}
+    "lifecycle": {
+      "power_off_departure_evidence": "watched-retained-route",
+      "return_policy_id": "receiver-child.activity-assisted.v1",
+      "open_evidence": ["endpoint-activity"],
+      "accelerator_evidence": ["contact-report", "endpoint-activity"]
+    }
   },
   "qualification_migrations": [
+    {"from_runtime_sha256": "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33", "preserve_stage_roles": ["lighting", "map", "telemetry"]}
   ],
   "presentation": {"upstream_id": "openrgb", "owner": "OpenRGB", "project_version": "1.0rc3", "source_commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "model_key": "basilisk_v3_pro_35k_wireless_device", "layout_key": null, "transport_variant": "wireless"},
diff --git a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
index f3b57e3..83233a1 100644
--- a/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
+++ b/profiles/children/razer-deathstalker-v2-pro-tkl-0296.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
-  "revision": 5,
+  "revision": 6,
   "kind": "child",
   "device_kind": "keyboard",
   "identity": {"manufacturer": "Razer", "model_name": "Razer DeathStalker V2 Pro Tenkeyless", "authority": "paired-product-id", "vendor_id": 5426, "product_id": 662},
@@ -16,9 +16,15 @@
       "route": {"available": [0, 3], "unavailable": [2], "indeterminate": [257]},
       "report_implies_route_available": false
     },
-    "lifecycle": {"power_off_departure_evidence": "receiver-state", "device_return_settle_ms": 5000, "device_return_confirmation": {"evidence": "battery-report", "settle_ms": 250, "reassert_at_fallback": true}}
+    "lifecycle": {
+      "power_off_departure_evidence": "receiver-state",
+      "return_policy_id": "receiver-child.activity-assisted.v1",
+      "open_evidence": ["endpoint-activity", "route-return"],
+      "accelerator_evidence": ["battery-report", "endpoint-activity", "route-return"]
+    }
   },
   "qualification_migrations": [
+    {"from_runtime_sha256": "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
     {"from_runtime_sha256": "8c96caf63c960dbcd3207b4e43321e7d034301cf8bbe87291452d4d2f7d4890d", "preserve_stage_roles": ["lighting", "map", "telemetry"]},
diff --git a/profiles/lifecycle-policies.json b/profiles/lifecycle-policies.json
new file mode 100644
index 0000000..27426e1
--- /dev/null
+++ b/profiles/lifecycle-policies.json
@@ -0,0 +1,36 @@
+{
+  "$schema": "../schemas/lifecycle-policy-catalog.schema.json",
+  "schema": "hyperflux-lifecycle-policy-catalog-v1",
+  "policies": [
+    {
+      "id": "receiver-child.activity-assisted.v1",
+      "strategy": "activity-assisted-return-epoch",
+      "qualification": "prequalification-candidate",
+      "quiescence_candidate_ms": 60000,
+      "observation_jitter_ms": 500,
+      "retry_offsets_ms": [0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000],
+      "allowed_open_evidence": ["endpoint-activity", "route-return"],
+      "allowed_accelerator_evidence": ["battery-report", "contact-report", "endpoint-activity", "route-return"],
+      "delivery_semantics": "receiver-delivered-not-child-applied",
+      "timing_authorities": [
+        {
+          "kind": "pinned-upstream-contract",
+          "source_id": "openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339",
+          "source_sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829",
+          "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
+        },
+        {
+          "kind": "pinned-upstream-contract",
+          "source_id": "driver/kernel/hyperflux-next-internal.h:21",
+          "source_sha256": "3f11ad598422577681f050b6f11535a03e2644120301ec69361a579c535ab06b",
+          "summary": "Endpoint activity is rate-limited to 250 milliseconds. A two-interval tolerance prevents report coalescing from turning the legal minimum idle setting into a brittle exact-second boundary."
+        },
+        {
+          "kind": "prequalification-hypothesis",
+          "source_id": "assurance/protected-behavior.json:natural-device-wake-restoration",
+          "summary": "The bounded retry envelope covers the longest legacy five-second settle fallback plus one second. It remains a candidate until the watched no-Spectrum matrix qualifies or replaces it."
+        }
+      ]
+    }
+  ]
+}
diff --git a/protocol/registry.json b/protocol/registry.json
index 8b18817..35af89a 100644
--- a/protocol/registry.json
+++ b/protocol/registry.json
@@ -1,7 +1,7 @@
 {
   "$schema": "../schemas/protocol-registry.schema.json",
   "schema": "hyperflux-protocol-registry-v1",
-  "current_version": 5,
+  "current_version": 6,
   "versions": [
     {
       "version": 1,
@@ -32,6 +32,12 @@
       "catalog": "v5/catalog.json",
       "sha256": "df97bf0f14e78ebced547c7896017db7c7a77a3570951dfc0b363b4f13ef2aca",
       "served_features": ["atomic-transactions", "event-subscriptions", "integration-view-projection", "ownership-leases", "profile-bound-transactions", "semantic-stable-lighting", "snapshot-profile-bindings", "structured-diagnostics"]
+    },
+    {
+      "version": 6,
+      "catalog": "v6/catalog.json",
+      "sha256": "6b7b16aeae887979de5f75fb82959450c55179dbed3142450939fd7ee8f8ce54",
+      "served_features": ["atomic-transactions", "event-subscriptions", "integration-view-projection", "ownership-leases", "profile-bound-transactions", "return-lifecycle-projection", "semantic-stable-lighting", "snapshot-profile-bindings", "structured-diagnostics"]
     }
   ]
 }
diff --git a/protocol/v6/catalog.json b/protocol/v6/catalog.json
new file mode 100644
index 0000000..9fbcda4
--- /dev/null
+++ b/protocol/v6/catalog.json
@@ -0,0 +1,569 @@
+{
+  "$schema": "../../schemas/protocol-catalog.schema.json",
+  "schema": "hyperflux-protocol-catalog-v1",
+  "minimum_version": 6,
+  "maximum_version": 6,
+  "limits": {
+    "max_message_bytes": 1048576,
+    "max_json_depth": 128
+  },
+  "features": ["ownership-leases", "atomic-transactions", "profile-bound-transactions", "semantic-stable-lighting", "snapshot-profile-bindings", "integration-view-projection", "event-subscriptions", "structured-diagnostics", "return-lifecycle-projection"],
+  "records": [
+    {
+      "name": "EmptyRequest",
+      "description": "A method request with no method-specific fields.",
+      "fields": []
+    },
+    {
+      "name": "RgbColor",
+      "description": "One canonical eight-bit RGB color.",
+      "fields": [
+        {"name": "red", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Red channel."},
+        {"name": "green", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Green channel."},
+        {"name": "blue", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Blue channel."}
+      ]
+    },
+    {
+      "name": "ClientHello",
+      "description": "Bounded client protocol and feature offer.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Process-scoped client identity."},
+        {"name": "client_name", "type": "ClientName", "required": true, "many": false, "max_items": null, "description": "User-facing application name."},
+        {"name": "minimum_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Oldest protocol accepted by the client."},
+        {"name": "maximum_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Newest protocol accepted by the client."},
+        {"name": "required_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Features without which this client cannot operate."},
+        {"name": "optional_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Features the client can use when available."}
+      ]
+    },
+    {
+      "name": "ServerHello",
+      "description": "Negotiated protocol version and bridge feature set.",
+      "fields": [
+        {"name": "selected_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Mutually supported protocol version."},
+        {"name": "server_instance_id", "type": "ServerInstanceId", "required": true, "many": false, "max_items": null, "description": "Changes whenever the bridge process identity changes."},
+        {"name": "protocol_session_id", "type": "ProtocolSessionId", "required": true, "many": false, "max_items": null, "description": "Server-issued connection ownership identity."},
+        {"name": "negotiation_token", "type": "NegotiationToken", "required": true, "many": false, "max_items": null, "description": "Binds subsequent requests to this negotiated selection."},
+        {"name": "bridge_version", "type": "ComponentVersion", "required": true, "many": false, "max_items": null, "description": "Bridge component version."},
+        {"name": "enabled_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Protocol features enabled for this connection."},
+        {"name": "event_buffer_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Maximum retained event count."}
+      ]
+    },
+    {
+      "name": "ResourceKey",
+      "description": "One device-scoped writable resource.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Receiver that owns the route."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Receiver generation to which ownership is bound."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical resource owner."},
+        {"name": "kind", "type": "ResourceKind", "required": true, "many": false, "max_items": null, "description": "Generic resource domain."}
+      ]
+    },
+    {
+      "name": "LeaseRequest",
+      "description": "Atomic request for one or more writable resources.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Requesting client."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Complete atomic resource set."},
+        {"name": "duration_ms", "type": "LeaseDurationMs", "required": true, "many": false, "max_items": null, "description": "Renewable lease duration."}
+      ]
+    },
+    {
+      "name": "LeaseGrant",
+      "description": "Granted ownership lease.",
+      "fields": [
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Atomically owned resources."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive monotonic expiry."},
+        {"name": "state", "type": "LeaseState", "required": true, "many": false, "max_items": null, "description": "Current lease state."}
+      ]
+    },
+    {
+      "name": "LeaseConflict",
+      "description": "Deterministic first conflict from an otherwise atomic lease request.",
+      "fields": [
+        {"name": "conflicting_client", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owner."},
+        {"name": "conflicting_resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "First conflict in canonical resource order."}
+      ]
+    },
+    {
+      "name": "LeaseRejection",
+      "description": "Structured lease rejection unrelated to another owner.",
+      "fields": [
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Stable rejection category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central error catalog reference."}
+      ]
+    },
+    {
+      "name": "RenewLeaseRequest",
+      "description": "Idempotent renewal of one existing lease.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease to renew."},
+        {"name": "duration_ms", "type": "LeaseDurationMs", "required": true, "many": false, "max_items": null, "description": "New bounded duration."}
+      ]
+    },
+    {
+      "name": "ReleaseLeaseRequest",
+      "description": "Idempotent release of one existing lease.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease to release."}
+      ]
+    },
+    {
+      "name": "EventCursor",
+      "description": "Complete resumable position in one event stream projection.",
+      "fields": [
+        {"name": "stream_id", "type": "StreamId", "required": true, "many": false, "max_items": null, "description": "Bridge event-stream identity."},
+        {"name": "stream_epoch", "type": "StreamEpoch", "required": true, "many": false, "max_items": null, "description": "Changes whenever the event stream restarts."},
+        {"name": "projection_revision", "type": "ProjectionRevision", "required": true, "many": false, "max_items": null, "description": "Snapshot and event projection contract revision."},
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Last event reflected by this cursor."}
+      ]
+    },
+    {
+      "name": "ReturnEpoch",
+      "description": "Generation-bound endpoint return state without claiming physical lighting application.",
+      "fields": [
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Receiver generation that owns the epoch."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical child whose endpoint is returning."},
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Exact endpoint whose return is tracked."},
+        {"name": "epoch_sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Opening evidence sequence for stale-event rejection."},
+        {"name": "opened_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Bridge-local monotonic epoch opening time."},
+        {"name": "opening_evidence", "type": "ReturnEvidence", "required": true, "many": false, "max_items": null, "description": "Typed passive evidence that opened the epoch."},
+        {"name": "phase", "type": "ReturnPhase", "required": true, "many": false, "max_items": null, "description": "Current endpoint return phase."},
+        {"name": "delivery_state", "type": "RestoreDeliveryState", "required": true, "many": false, "max_items": null, "description": "Strongest known replay-delivery fact."}
+      ]
+    },
+    {
+      "name": "EndpointSnapshot",
+      "description": "Independent route, power, sleep, activity, contact, and freshness facts.",
+      "fields": [
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Stable logical route identity."},
+        {"name": "route_kind", "type": "RouteKind", "required": true, "many": false, "max_items": null, "description": "Transport route category."},
+        {"name": "route_state", "type": "RouteState", "required": true, "many": false, "max_items": null, "description": "Current route evidence."},
+        {"name": "connection_mode", "type": "ConnectionMode", "required": true, "many": false, "max_items": null, "description": "User-facing connection mode."},
+        {"name": "power_state", "type": "PowerState", "required": true, "many": false, "max_items": null, "description": "Explicit power evidence, independent of route."},
+        {"name": "sleep_state", "type": "SleepState", "required": true, "many": false, "max_items": null, "description": "Explicit sleep evidence."},
+        {"name": "activity_state", "type": "ActivityState", "required": true, "many": false, "max_items": null, "description": "Recent activity evidence."},
+        {"name": "contact_state", "type": "ContactState", "required": true, "many": false, "max_items": null, "description": "Mat-contact evidence where applicable."},
+        {"name": "freshness", "type": "FreshnessState", "required": true, "many": false, "max_items": null, "description": "Freshness of the route projection."},
+        {"name": "confidence", "type": "EvidenceConfidence", "required": true, "many": false, "max_items": null, "description": "How directly the state was established."},
+        {"name": "evidence_claim_id", "type": "EvidenceClaimId", "required": false, "many": false, "max_items": null, "description": "Privacy-safe evidence provenance when available."},
+        {"name": "observed_at_ms", "type": "MonotonicMs", "required": false, "many": false, "max_items": null, "description": "Bridge-local observation instant."},
+        {"name": "return_epoch", "type": "ReturnEpoch", "required": false, "many": false, "max_items": null, "description": "Optional versioned return projection; receiver delivery alone never means child application."}
+      ]
+    },
+    {
+      "name": "BatteryObservation",
+      "description": "Battery availability and value without collapsing unknown and unavailable.",
+      "fields": [
+        {"name": "availability", "type": "TelemetryAvailability", "required": true, "many": false, "max_items": null, "description": "Whether a current value exists."},
+        {"name": "percentage", "type": "BatteryPercent", "required": false, "many": false, "max_items": null, "description": "Reported value only when availability is reported."},
+        {"name": "freshness", "type": "FreshnessState", "required": true, "many": false, "max_items": null, "description": "Freshness of the battery observation."},
+        {"name": "confidence", "type": "EvidenceConfidence", "required": true, "many": false, "max_items": null, "description": "How directly the value was established."},
+        {"name": "observed_at_ms", "type": "MonotonicMs", "required": false, "many": false, "max_items": null, "description": "Bridge-local observation instant."}
+      ]
+    },
+    {
+      "name": "ResourceOwnershipSnapshot",
+      "description": "Current bounded application ownership for one generation-scoped resource.",
+      "fields": [
+        {"name": "resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "Owned resource."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Authorizing lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock expiry."}
+      ]
+    },
+    {
+      "name": "LogicalDeviceSnapshot",
+      "description": "Application-neutral logical controller state.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical identity."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Device category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed product id."},
+        {"name": "profile_id", "type": "ProfileId", "required": false, "many": false, "max_items": null, "description": "Qualified profile when available."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": false, "many": false, "max_items": null, "description": "Immutable qualified child profile digest when available."},
+        {"name": "pairing", "type": "PairingState", "required": true, "many": false, "max_items": null, "description": "Receiver inventory state independent of route."},
+        {"name": "presence", "type": "PresenceState", "required": true, "many": false, "max_items": null, "description": "Derived controller presence."},
+        {"name": "support_level", "type": "SupportLevel", "required": true, "many": false, "max_items": null, "description": "Evidence-backed support level."},
+        {"name": "endpoints", "type": "EndpointSnapshot", "required": true, "many": true, "max_items": 8, "description": "Independent known routes in canonical endpoint order."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Current battery projection."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."}
+      ]
+    },
+    {
+      "name": "ReceiverSnapshot",
+      "description": "Generation-bound receiver and child inventory.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Logical receiver identity."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Current receiver generation."},
+        {"name": "profile_id", "type": "ProfileId", "required": false, "many": false, "max_items": null, "description": "Exact qualified receiver profile when available."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": false, "many": false, "max_items": null, "description": "Immutable qualified receiver profile digest when available."},
+        {"name": "lifecycle", "type": "ReceiverLifecycleState", "required": true, "many": false, "max_items": null, "description": "Receiver lifecycle state."},
+        {"name": "devices", "type": "LogicalDeviceSnapshot", "required": true, "many": true, "max_items": 32, "description": "Independent logical children."},
+        {"name": "ownership", "type": "ResourceOwnershipSnapshot", "required": true, "many": true, "max_items": 96, "description": "Current generation-scoped write ownership."},
+        {"name": "stable_restore_enabled", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether stable state restoration is enabled."},
+        {"name": "restore_state", "type": "RestoreState", "required": true, "many": false, "max_items": null, "description": "Current restoration state."}
+      ]
+    },
+    {
+      "name": "BridgeSnapshot",
+      "description": "Sequence-bound complete bridge snapshot.",
+      "fields": [
+        {"name": "cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Complete event position reflected by this snapshot."},
+        {"name": "receivers", "type": "ReceiverSnapshot", "required": true, "many": true, "max_items": 16, "description": "Exactly one current generation per receiver in canonical order."}
+      ]
+    },
+    {
+      "name": "LightingFrame",
+      "description": "One logical-device direct-mode frame.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Frame target."},
+        {"name": "frame_index", "type": "FrameIndex", "required": true, "many": false, "max_items": null, "description": "Transaction-local frame order."},
+        {"name": "colors", "type": "RgbColor", "required": true, "many": true, "max_items": 4096, "description": "Logical LED colors before carrier translation."}
+      ]
+    },
+    {
+      "name": "DeviceProfileBinding",
+      "description": "Exact profile and lighting dimensions bound to one transaction target.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical transaction target."},
+        {"name": "profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Qualified child profile selected at admission."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable profile-catalog digest selected at admission."},
+        {"name": "application_slot_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Exact logical color count required by this profile."}
+      ]
+    },
+    {
+      "name": "StableLightingIntent",
+      "description": "Explicit semantic stable-lighting intent for one frame target.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical stable-lighting target."},
+        {"name": "mode", "type": "StableLightingMode", "required": true, "many": false, "max_items": null, "description": "Stable Static or Off meaning independent of RGB payload values."}
+      ]
+    },
+    {
+      "name": "TransactionRequest",
+      "description": "Atomic generation- and ownership-bound operation.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Submitting client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Atomic ownership proof."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Receiver target."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Generation binding."},
+        {"name": "receiver_profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Exact qualified receiver profile selected at admission."},
+        {"name": "receiver_profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable receiver profile-catalog digest selected at admission."},
+        {"name": "device_profiles", "type": "DeviceProfileBinding", "required": true, "many": true, "max_items": 32, "description": "Complete canonical profile binding for every frame target."},
+        {"name": "transaction_class", "type": "TransactionClass", "required": true, "many": false, "max_items": null, "description": "Ordering and coalescing class."},
+        {"name": "stable_intents", "type": "StableLightingIntent", "required": true, "many": true, "max_items": 32, "description": "Canonical per-target semantic intent for static-lighting; empty for every other transaction class."},
+        {"name": "deadline_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Absolute monotonic deadline."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Complete ownership set."},
+        {"name": "frames", "type": "LightingFrame", "required": true, "many": true, "max_items": 32, "description": "Complete atomic frame batch."}
+      ]
+    },
+    {
+      "name": "TransactionProgress",
+      "description": "Nonterminal generation-bound transaction projection.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Original idempotency identity."},
+        {"name": "request_digest", "type": "RequestDigest", "required": true, "many": false, "max_items": null, "description": "Canonical request digest used for exact replay."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Bound receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Bound receiver generation."},
+        {"name": "state", "type": "TransactionState", "required": true, "many": false, "max_items": null, "description": "Current nonterminal state."},
+        {"name": "admission", "type": "QueueAdmission", "required": true, "many": false, "max_items": null, "description": "Bounded queue decision."},
+        {"name": "declared_frames", "type": "FrameCount", "required": true, "many": false, "max_items": null, "description": "Frames promised by the transaction."},
+        {"name": "delivered_frames", "type": "DeliveredFrameCount", "required": true, "many": false, "max_items": null, "description": "Frames terminally accepted so far."},
+        {"name": "side_effect_certainty", "type": "SideEffectCertainty", "required": true, "many": false, "max_items": null, "description": "Current transport side-effect knowledge."},
+        {"name": "live_write_executed", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether transport has begun a hardware write."}
+      ]
+    },
+    {
+      "name": "TransactionTerminal",
+      "description": "Immutable terminal transaction outcome retained for bounded lookup.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Original idempotency identity."},
+        {"name": "request_digest", "type": "RequestDigest", "required": true, "many": false, "max_items": null, "description": "Canonical request digest used for exact replay."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Bound receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Bound receiver generation."},
+        {"name": "state", "type": "TransactionState", "required": true, "many": false, "max_items": null, "description": "Terminal succeeded, failed, revoked, or superseded state."},
+        {"name": "declared_frames", "type": "FrameCount", "required": true, "many": false, "max_items": null, "description": "Frames promised by the transaction."},
+        {"name": "delivered_frames", "type": "DeliveredFrameCount", "required": true, "many": false, "max_items": null, "description": "Frames terminally accepted by transport."},
+        {"name": "side_effect_certainty", "type": "SideEffectCertainty", "required": true, "many": false, "max_items": null, "description": "Terminal transport side-effect knowledge."},
+        {"name": "live_write_executed", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether transport began a hardware write."},
+        {"name": "automatic_retry", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether exact automatic replay is safe; false after possible transport."},
+        {"name": "device_application", "type": "DeviceApplicationState", "required": true, "many": false, "max_items": null, "description": "Separate child-application evidence."},
+        {"name": "terminal_sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Immutable completion event sequence."},
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": false, "many": false, "max_items": null, "description": "Structured failure category."},
+        {"name": "superseded_by", "type": "TransactionId", "required": false, "many": false, "max_items": null, "description": "Newer unsent effect transaction that replaced this one."}
+      ]
+    },
+    {
+      "name": "TransactionUnavailable",
+      "description": "Outcome lookup cannot return a retained transaction record.",
+      "fields": [
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Requested transaction identity."},
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Unknown or evicted outcome category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central error catalog reference."}
+      ]
+    },
+    {
+      "name": "TransactionLookup",
+      "description": "Idempotent lookup of one previously submitted transaction.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Lookup request identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Original transaction owner."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction to inspect."}
+      ]
+    },
+    {
+      "name": "SubscriptionRequest",
+      "description": "Bounded event subscription cursor.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Subscribing client."},
+        {"name": "subscription_id", "type": "SubscriptionId", "required": false, "many": false, "max_items": null, "description": "Server-issued subscription identity when continuing."},
+        {"name": "expected_cursor", "type": "EventCursor", "required": false, "many": false, "max_items": null, "description": "Previously observed complete event cursor."},
+        {"name": "max_events", "type": "EventBatchLimit", "required": true, "many": false, "max_items": null, "description": "Maximum events requested in this batch."}
+      ]
+    },
+    {
+      "name": "BridgeEvent",
+      "description": "Sequence-bound typed event with snapshot references.",
+      "fields": [
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Strictly increasing sequence."},
+        {"name": "kind", "type": "EventKind", "required": true, "many": false, "max_items": null, "description": "Typed event category."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": false, "many": false, "max_items": null, "description": "Affected receiver when applicable."},
+        {"name": "generation_id", "type": "GenerationId", "required": false, "many": false, "max_items": null, "description": "Affected generation when applicable."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": false, "many": false, "max_items": null, "description": "Affected logical device when applicable."},
+        {"name": "lease_id", "type": "LeaseId", "required": false, "many": false, "max_items": null, "description": "Affected lease when applicable."},
+        {"name": "transaction_id", "type": "TransactionId", "required": false, "many": false, "max_items": null, "description": "Affected transaction when applicable."},
+        {"name": "finding_id", "type": "FindingId", "required": false, "many": false, "max_items": null, "description": "Affected finding when applicable."}
+      ]
+    },
+    {
+      "name": "EventBatch",
+      "description": "Bounded event result with explicit cursor-gap state.",
+      "fields": [
+        {"name": "subscription_id", "type": "SubscriptionId", "required": true, "many": false, "max_items": null, "description": "Subscription identity."},
+        {"name": "next_cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Cursor to supply for the next batch."},
+        {"name": "events", "type": "BridgeEvent", "required": true, "many": true, "max_items": 256, "description": "Events after the requested cursor."},
+        {"name": "oldest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Oldest retained sequence."},
+        {"name": "latest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Newest retained sequence."},
+        {"name": "dropped_events", "type": "DroppedEventCount", "required": true, "many": false, "max_items": null, "description": "Events evicted since this stream epoch began."},
+        {"name": "cursor_gap", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether the client must refresh its snapshot."},
+        {"name": "has_more", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether another retained event follows this batch."}
+      ]
+    },
+    {
+      "name": "DiagnosticFinding",
+      "description": "One privacy-classified actionable finding.",
+      "fields": [
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Stable finding code."},
+        {"name": "severity", "type": "ErrorSeverity", "required": true, "many": false, "max_items": null, "description": "User-facing severity."},
+        {"name": "cause", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Bounded technical cause."},
+        {"name": "explanation", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Plain user explanation."},
+        {"name": "safe_action", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "One safe remediation."},
+        {"name": "privacy", "type": "PrivacyClass", "required": true, "many": false, "max_items": null, "description": "Support-output privacy class."},
+        {"name": "documentation", "type": "DocumentationPath", "required": true, "many": false, "max_items": null, "description": "Stable documentation path."}
+      ]
+    },
+    {
+      "name": "DiagnosticSnapshot",
+      "description": "Bounded bridge findings and queue health.",
+      "fields": [
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Latest reflected event sequence."},
+        {"name": "findings", "type": "DiagnosticFinding", "required": true, "many": true, "max_items": 128, "description": "Active actionable findings."},
+        {"name": "event_buffer_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Configured event bound."},
+        {"name": "transaction_queue_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Configured transaction bound."}
+      ]
+    },
+    {
+      "name": "ProfileBindingView",
+      "description": "Exact immutable profile authority exposed to integrations.",
+      "fields": [
+        {"name": "profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Qualified profile identity."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable runtime profile digest."}
+      ]
+    },
+    {
+      "name": "DeviceInventoryView",
+      "description": "Truthful paired-device inventory independent of application controller registration.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical device identity."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Device category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed product id."},
+        {"name": "profile", "type": "ProfileBindingView", "required": false, "many": false, "max_items": null, "description": "Exact qualified child profile when available."},
+        {"name": "model_name", "type": "ModelName", "required": false, "many": false, "max_items": null, "description": "Qualified model name when available."},
+        {"name": "pairing", "type": "PairingState", "required": true, "many": false, "max_items": null, "description": "Receiver pairing truth."},
+        {"name": "presence", "type": "PresenceState", "required": true, "many": false, "max_items": null, "description": "Derived device presence."},
+        {"name": "availability", "type": "InventoryAvailability", "required": true, "many": false, "max_items": null, "description": "Inventory-facing availability with receiver and pairing context."},
+        {"name": "support_level", "type": "SupportLevel", "required": true, "many": false, "max_items": null, "description": "Evidence-backed support level."},
+        {"name": "endpoints", "type": "EndpointSnapshot", "required": true, "many": true, "max_items": 8, "description": "Independent known routes."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Battery truth without collapsing unavailable states."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."}
+      ]
+    },
+    {
+      "name": "PresentationView",
+      "description": "Pinned upstream presentation authority without hardware transport policy.",
+      "fields": [
+        {"name": "upstream_id", "type": "UpstreamId", "required": true, "many": false, "max_items": null, "description": "Pinned upstream catalog identity."},
+        {"name": "owner", "type": "UpstreamOwner", "required": true, "many": false, "max_items": null, "description": "Upstream project responsible for presentation."},
+        {"name": "project_version", "type": "ComponentVersion", "required": true, "many": false, "max_items": null, "description": "Pinned upstream project version."},
+        {"name": "source_revision", "type": "SourceRevision", "required": true, "many": false, "max_items": null, "description": "Pinned upstream source revision."},
+        {"name": "model_key", "type": "PresentationKey", "required": true, "many": false, "max_items": null, "description": "Upstream model registry key."},
+        {"name": "layout_key", "type": "PresentationKey", "required": false, "many": false, "max_items": null, "description": "Upstream layout registry key when applicable."},
+        {"name": "transport_variant", "type": "TransportVariant", "required": true, "many": false, "max_items": null, "description": "Presentation variant for this route."}
+      ]
+    },
+    {
+      "name": "LightingTopologyView",
+      "description": "Application-facing lighting dimensions without receiver carrier mapping.",
+      "fields": [
+        {"name": "physical_led_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Physically illuminated LED count."},
+        {"name": "application_slot_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Exact application color count."},
+        {"name": "rows", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Application layout row count."},
+        {"name": "columns", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Application layout column count."}
+      ]
+    },
+    {
+      "name": "UnownedController",
+      "description": "Writable controller currently has no application owner.",
+      "fields": []
+    },
+    {
+      "name": "ViewerOwnedController",
+      "description": "Writable controller is owned by the requesting client.",
+      "fields": [
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Current ownership lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock lease expiry."}
+      ]
+    },
+    {
+      "name": "OtherOwnedController",
+      "description": "Writable controller is owned by another application client.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Current ownership lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock lease expiry."}
+      ]
+    },
+    {
+      "name": "ControllerActions",
+      "description": "Viewer-specific actions derived from availability and ownership.",
+      "fields": [
+        {"name": "can_acquire", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer may atomically acquire this resource."},
+        {"name": "can_release", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer may release its current lease."},
+        {"name": "can_submit_now", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer owns a currently writable route."}
+      ]
+    },
+    {
+      "name": "ControllerView",
+      "description": "Exact qualified receiver-backed application controller.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Owning receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Generation binding."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical controller identity."},
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Exact usable receiver endpoint."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Controller category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Qualified product id."},
+        {"name": "receiver_profile", "type": "ProfileBindingView", "required": true, "many": false, "max_items": null, "description": "Exact receiver profile authority."},
+        {"name": "device_profile", "type": "ProfileBindingView", "required": true, "many": false, "max_items": null, "description": "Exact child profile authority."},
+        {"name": "model_name", "type": "ModelName", "required": true, "many": false, "max_items": null, "description": "Qualified model name."},
+        {"name": "presentation", "type": "PresentationView", "required": true, "many": false, "max_items": null, "description": "Pinned application presentation authority."},
+        {"name": "availability", "type": "ControllerAvailability", "required": true, "many": false, "max_items": null, "description": "Ready or sleeping controller state."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Current battery projection."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."},
+        {"name": "lighting", "type": "LightingTopologyView", "required": true, "many": false, "max_items": null, "description": "Application-facing lighting dimensions."},
+        {"name": "resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "Generation-scoped lighting ownership resource."},
+        {"name": "ownership", "type": "ControllerOwnership", "required": true, "many": false, "max_items": null, "description": "Viewer-specific ownership state."},
+        {"name": "actions", "type": "ControllerActions", "required": true, "many": false, "max_items": null, "description": "Viewer-specific safe actions."}
+      ]
+    },
+    {
+      "name": "IntegrationReceiverView",
+      "description": "One receiver generation with complete inventory and qualified controllers.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Logical receiver identity."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Current receiver generation."},
+        {"name": "profile", "type": "ProfileBindingView", "required": false, "many": false, "max_items": null, "description": "Exact receiver profile when qualified."},
+        {"name": "model_name", "type": "ModelName", "required": false, "many": false, "max_items": null, "description": "Qualified receiver model name."},
+        {"name": "lifecycle", "type": "ReceiverLifecycleState", "required": true, "many": false, "max_items": null, "description": "Current receiver lifecycle."},
+        {"name": "stable_restore_enabled", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Stable lighting restore policy."},
+        {"name": "restore_state", "type": "RestoreState", "required": true, "many": false, "max_items": null, "description": "Current restoration state."},
+        {"name": "inventory", "type": "DeviceInventoryView", "required": true, "many": true, "max_items": 32, "description": "Complete paired and observed inventory."},
+        {"name": "controllers", "type": "ControllerView", "required": true, "many": true, "max_items": 32, "description": "Exact qualified application controllers."}
+      ]
+    },
+    {
+      "name": "IntegrationView",
+      "description": "Client-specific application view projected once by bridge policy.",
+      "fields": [
+        {"name": "cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Complete event position reflected by the projection."},
+        {"name": "receivers", "type": "IntegrationReceiverView", "required": true, "many": true, "max_items": 16, "description": "Current receiver integration projections."}
+      ]
+    },
+    {
+      "name": "RpcError",
+      "description": "Stable structured request failure.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": false, "many": false, "max_items": null, "description": "Related request when parsing reached it."},
+        {"name": "kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Machine-readable failure class."},
+        {"name": "message", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Bounded user-safe explanation."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Diagnostic catalog reference."}
+      ]
+    }
+  ],
+  "unions": [
+    {
+      "name": "LeaseResult",
+      "description": "Contradiction-free atomic lease outcome.",
+      "tag": "outcome",
+      "content": "detail",
+      "variants": [
+        {"name": "Granted", "wire": "granted", "type": "LeaseGrant", "description": "Every requested resource was granted."},
+        {"name": "Conflict", "wire": "conflict", "type": "LeaseConflict", "description": "Another client owns at least one requested resource; none were granted."},
+        {"name": "Rejected", "wire": "rejected", "type": "LeaseRejection", "description": "The request failed without granting any resource."}
+      ]
+    },
+    {
+      "name": "TransactionResult",
+      "description": "Contradiction-free current, terminal, or unavailable transaction outcome.",
+      "tag": "outcome",
+      "content": "detail",
+      "variants": [
+        {"name": "Progress", "wire": "progress", "type": "TransactionProgress", "description": "The transaction has not reached a terminal state."},
+        {"name": "Terminal", "wire": "terminal", "type": "TransactionTerminal", "description": "The immutable terminal outcome is retained."},
+        {"name": "Unavailable", "wire": "unavailable", "type": "TransactionUnavailable", "description": "No retained outcome can answer this lookup."}
+      ]
+    },
+    {
+      "name": "ControllerOwnership",
+      "description": "Contradiction-free viewer-specific controller ownership.",
+      "tag": "state",
+      "content": "detail",
+      "variants": [
+        {"name": "Unowned", "wire": "unowned", "type": "UnownedController", "description": "No application currently owns the controller."},
+        {"name": "OwnedByViewer", "wire": "owned-by-viewer", "type": "ViewerOwnedController", "description": "The requesting client owns the controller."},
+        {"name": "OwnedByOther", "wire": "owned-by-other", "type": "OtherOwnedController", "description": "Another application client owns the controller."}
+      ]
+    }
+  ],
+  "methods": [
+    {"name": "negotiate", "request": "ClientHello", "response": "ServerHello", "required_feature": null, "description": "Select one compatible protocol version and optional feature set."},
+    {"name": "snapshot", "request": "EmptyRequest", "response": "BridgeSnapshot", "required_feature": null, "description": "Read one sequence-bound complete logical-device snapshot."},
+    {"name": "integration-view", "request": "EmptyRequest", "response": "IntegrationView", "required_feature": "integration-view-projection", "description": "Read one canonical client-specific inventory and controller projection."},
+    {"name": "acquire-lease", "request": "LeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Acquire a complete resource set atomically."},
+    {"name": "renew-lease", "request": "RenewLeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Renew one owned lease."},
+    {"name": "release-lease", "request": "ReleaseLeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Release one owned lease without forced takeover."},
+    {"name": "submit-transaction", "request": "TransactionRequest", "response": "TransactionResult", "required_feature": "atomic-transactions", "description": "Submit one complete generation-bound transaction."},
+    {"name": "transaction-outcome", "request": "TransactionLookup", "response": "TransactionResult", "required_feature": "atomic-transactions", "description": "Resolve a prior result without resubmitting transport."},
+    {"name": "subscribe", "request": "SubscriptionRequest", "response": "EventBatch", "required_feature": "event-subscriptions", "description": "Read bounded typed events after a sequence cursor."},
+    {"name": "diagnostics", "request": "EmptyRequest", "response": "DiagnosticSnapshot", "required_feature": "structured-diagnostics", "description": "Read privacy-classified diagnostics and queue health."}
+  ]
+}
diff --git a/protocol/v6/fixtures/transaction-request-canonical.json b/protocol/v6/fixtures/transaction-request-canonical.json
new file mode 100644
index 0000000..5308397
--- /dev/null
+++ b/protocol/v6/fixtures/transaction-request-canonical.json
@@ -0,0 +1 @@
+{"request_id":"request-digest","transaction_id":"transaction-digest","client_id":"client-1","lease_id":"lease-1","receiver_id":"receiver-1","generation_id":"1","receiver_profile_id":"profile.receiver","receiver_profile_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","device_profiles":[{"device_id":"mouse-1","profile_id":"profile.mouse-1","profile_digest":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","application_slot_count":1}],"transaction_class":"static-lighting","stable_intents":[{"device_id":"mouse-1","mode":"static"}],"deadline_ms":"100","resources":[{"receiver_id":"receiver-1","generation_id":"1","device_id":"mouse-1","kind":"lighting"}],"frames":[{"device_id":"mouse-1","frame_index":0,"colors":[{"red":1,"green":2,"blue":3}]}]}
diff --git a/runtime/linux.json b/runtime/linux.json
index 52b4e43..468fe0d 100644
--- a/runtime/linux.json
+++ b/runtime/linux.json
@@ -42,8 +42,7 @@
       "discovery_interval_ms": 100,
       "accept_poll_interval_ms": 25,
       "actor_response_timeout_ms": 30000,
-      "kernel_session_duration_ms": 120000,
-      "activity_resumption_quiet_ms": 30000
+      "kernel_session_duration_ms": 120000
     },
     "restoration": {
       "max_pending_triggers": 64,
diff --git a/schemas/README.md b/schemas/README.md
index 96286c1..b680ed5 100644
--- a/schemas/README.md
+++ b/schemas/README.md
@@ -32,6 +32,7 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 - [`schemas/local-companion.schema.json`](local-companion.schema.json)
 - [`schemas/local-snapshot.schema.json`](local-snapshot.schema.json)
 - [`schemas/licensing-policy.schema.json`](licensing-policy.schema.json)
+- [`schemas/lifecycle-policy-catalog.schema.json`](lifecycle-policy-catalog.schema.json)
 
 ## Verification
 
diff --git a/schemas/domain-catalog.json b/schemas/domain-catalog.json
index 7bc2102..ad55d89 100644
--- a/schemas/domain-catalog.json
+++ b/schemas/domain-catalog.json
@@ -101,6 +101,9 @@
     {"name": "QueueAdmission", "values": ["enqueued", "coalesced", "rejected-full", "rejected-deadline", "rejected-invalid"]},
     {"name": "RestoreState", "values": ["idle", "planned", "ownership-bound", "generation-bound", "queued", "applying", "succeeded", "failed", "invalidated"]},
     {"name": "RestoreTriggerKind", "values": ["service-start", "receiver-generation", "system-resume", "device-return"]},
+    {"name": "ReturnEvidence", "values": ["application-ownership-loss", "battery-report", "contact-report", "endpoint-activity", "endpoint-identity", "endpoint-status", "receiver-generation", "route-departure", "route-return", "system-resume"]},
+    {"name": "ReturnPhase", "values": ["stable", "quiescent-candidate", "returning", "synchronized", "unavailable"]},
+    {"name": "RestoreDeliveryState", "values": ["not-attempted", "receiver-rejected", "outcome-uncertain", "receiver-delivered", "child-rejected", "child-confirmed"]},
     {"name": "RestoreRecordState", "values": ["planned", "deferred", "prepared", "queued", "applying", "succeeded", "failed", "invalidated"]},
     {"name": "RestoreDeferReason", "values": ["device-sleeping", "device-unavailable", "device-unknown", "ownership-conflict", "session-unavailable", "deadline-elapsed", "safe-transaction-failure"]},
     {"name": "RestoreInvalidationReason", "values": ["superseded-trigger", "stale-generation", "intent-changed", "profile-changed", "restore-disabled"]},
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 5002559..78c9cff 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -128,28 +128,24 @@
     "lifecycle-policy": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["power_off_departure_evidence", "device_return_settle_ms"],
+      "required": ["power_off_departure_evidence", "return_policy_id", "open_evidence", "accelerator_evidence"],
       "properties": {
         "power_off_departure_evidence": {"enum": ["receiver-state", "watched-retained-route"]},
-        "device_return_settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000},
-        "device_return_confirmation": {
-          "oneOf": [
-            {"type": "null"},
-            {"$ref": "#/$defs/device-return-confirmation"}
-          ]
+        "return_policy_id": {"type": "string", "pattern": "^[a-z][a-z0-9.-]{0,95}$"},
+        "open_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["battery-report", "contact-report", "endpoint-activity", "route-return"]}
+        },
+        "accelerator_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["battery-report", "contact-report", "endpoint-activity", "route-return"]}
         }
       }
     },
-    "device-return-confirmation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["evidence", "settle_ms", "reassert_at_fallback"],
-      "properties": {
-        "evidence": {"enum": ["battery-report"]},
-        "settle_ms": {"type": "integer", "minimum": 0, "maximum": 30000},
-        "reassert_at_fallback": {"type": "boolean"}
-      }
-    },
     "qualification-migration": {
       "type": "object",
       "additionalProperties": false,
diff --git a/schemas/lifecycle-policy-catalog.schema.json b/schemas/lifecycle-policy-catalog.schema.json
new file mode 100644
index 0000000..e8baebf
--- /dev/null
+++ b/schemas/lifecycle-policy-catalog.schema.json
@@ -0,0 +1,81 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/lifecycle-policy-catalog-v1.json",
+  "title": "HyperFlux endpoint return lifecycle policies",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "policies"],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-lifecycle-policy-catalog-v1"},
+    "policies": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/policy"}
+    }
+  },
+  "$defs": {
+    "evidence-source": {
+      "enum": ["battery-report", "contact-report", "endpoint-activity", "route-return"]
+    },
+    "timing-authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["kind", "source_id", "summary"],
+      "properties": {
+        "kind": {"enum": ["pinned-upstream-contract", "prequalification-hypothesis", "physical-qualification"]},
+        "source_id": {"type": "string", "minLength": 1},
+        "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+        "summary": {"type": "string", "minLength": 1}
+      }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "strategy",
+        "qualification",
+        "quiescence_candidate_ms",
+        "observation_jitter_ms",
+        "retry_offsets_ms",
+        "allowed_open_evidence",
+        "allowed_accelerator_evidence",
+        "delivery_semantics",
+        "timing_authorities"
+      ],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z][a-z0-9.-]{0,95}$"},
+        "strategy": {"const": "activity-assisted-return-epoch"},
+        "qualification": {"enum": ["prequalification-candidate", "qualified"]},
+        "quiescence_candidate_ms": {"type": "integer", "minimum": 1000, "maximum": 900000},
+        "observation_jitter_ms": {"type": "integer", "minimum": 0, "maximum": 5000},
+        "retry_offsets_ms": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {"type": "integer", "minimum": 0, "maximum": 30000}
+        },
+        "allowed_open_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/evidence-source"}
+        },
+        "allowed_accelerator_evidence": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/evidence-source"}
+        },
+        "delivery_semantics": {"const": "receiver-delivered-not-child-applied"},
+        "timing_authorities": {
+          "type": "array",
+          "minItems": 2,
+          "items": {"$ref": "#/$defs/timing-authority"}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/linux-runtime.schema.json b/schemas/linux-runtime.schema.json
index 2c82146..8545f23 100644
--- a/schemas/linux-runtime.schema.json
+++ b/schemas/linux-runtime.schema.json
@@ -105,15 +105,13 @@
             "discovery_interval_ms",
             "accept_poll_interval_ms",
             "actor_response_timeout_ms",
-            "kernel_session_duration_ms",
-            "activity_resumption_quiet_ms"
+            "kernel_session_duration_ms"
           ],
           "properties": {
             "discovery_interval_ms": {"type": "integer", "minimum": 10, "maximum": 10000},
             "accept_poll_interval_ms": {"type": "integer", "minimum": 1, "maximum": 1000},
             "actor_response_timeout_ms": {"type": "integer", "minimum": 100, "maximum": 30000},
-            "kernel_session_duration_ms": {"type": "integer", "minimum": 6000, "maximum": 300000},
-            "activity_resumption_quiet_ms": {"type": "integer", "minimum": 1000, "maximum": 3600000}
+            "kernel_session_duration_ms": {"type": "integer", "minimum": 6000, "maximum": 300000}
           }
         },
         "restoration": {
diff --git a/sdk/cpp/include/hyperflux/generated/domain_json.hpp b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
index 0080654..a2541b6 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
@@ -2034,6 +2034,141 @@ template<>
     return Json(std::string(to_string(value)));
 }
 
+template<>
+[[nodiscard]] inline ReturnEvidence decode<ReturnEvidence>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected ReturnEvidence wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "application-ownership-loss")
+    {
+        return ReturnEvidence::ApplicationOwnershipLoss;
+    }
+    if(wire == "battery-report")
+    {
+        return ReturnEvidence::BatteryReport;
+    }
+    if(wire == "contact-report")
+    {
+        return ReturnEvidence::ContactReport;
+    }
+    if(wire == "endpoint-activity")
+    {
+        return ReturnEvidence::EndpointActivity;
+    }
+    if(wire == "endpoint-identity")
+    {
+        return ReturnEvidence::EndpointIdentity;
+    }
+    if(wire == "endpoint-status")
+    {
+        return ReturnEvidence::EndpointStatus;
+    }
+    if(wire == "receiver-generation")
+    {
+        return ReturnEvidence::ReceiverGeneration;
+    }
+    if(wire == "route-departure")
+    {
+        return ReturnEvidence::RouteDeparture;
+    }
+    if(wire == "route-return")
+    {
+        return ReturnEvidence::RouteReturn;
+    }
+    if(wire == "system-resume")
+    {
+        return ReturnEvidence::SystemResume;
+    }
+    throw CodecError("unknown ReturnEvidence wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<ReturnEvidence>(const ReturnEvidence& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
+template<>
+[[nodiscard]] inline ReturnPhase decode<ReturnPhase>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected ReturnPhase wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "stable")
+    {
+        return ReturnPhase::Stable;
+    }
+    if(wire == "quiescent-candidate")
+    {
+        return ReturnPhase::QuiescentCandidate;
+    }
+    if(wire == "returning")
+    {
+        return ReturnPhase::Returning;
+    }
+    if(wire == "synchronized")
+    {
+        return ReturnPhase::Synchronized;
+    }
+    if(wire == "unavailable")
+    {
+        return ReturnPhase::Unavailable;
+    }
+    throw CodecError("unknown ReturnPhase wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<ReturnPhase>(const ReturnPhase& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
+template<>
+[[nodiscard]] inline RestoreDeliveryState decode<RestoreDeliveryState>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected RestoreDeliveryState wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "not-attempted")
+    {
+        return RestoreDeliveryState::NotAttempted;
+    }
+    if(wire == "receiver-rejected")
+    {
+        return RestoreDeliveryState::ReceiverRejected;
+    }
+    if(wire == "outcome-uncertain")
+    {
+        return RestoreDeliveryState::OutcomeUncertain;
+    }
+    if(wire == "receiver-delivered")
+    {
+        return RestoreDeliveryState::ReceiverDelivered;
+    }
+    if(wire == "child-rejected")
+    {
+        return RestoreDeliveryState::ChildRejected;
+    }
+    if(wire == "child-confirmed")
+    {
+        return RestoreDeliveryState::ChildConfirmed;
+    }
+    throw CodecError("unknown RestoreDeliveryState wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<RestoreDeliveryState>(const RestoreDeliveryState& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
 template<>
 [[nodiscard]] inline RestoreRecordState decode<RestoreRecordState>(const Json& value)
 {
diff --git a/sdk/cpp/include/hyperflux/generated/domain_types.hpp b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
index 13c31fd..cbe3868 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
@@ -2173,6 +2173,84 @@ enum class RestoreTriggerKind
     return "unknown";
 }
 
+enum class ReturnEvidence
+{
+    ApplicationOwnershipLoss,
+    BatteryReport,
+    ContactReport,
+    EndpointActivity,
+    EndpointIdentity,
+    EndpointStatus,
+    ReceiverGeneration,
+    RouteDeparture,
+    RouteReturn,
+    SystemResume,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(ReturnEvidence value)
+{
+    switch(value)
+    {
+        case ReturnEvidence::ApplicationOwnershipLoss: return "application-ownership-loss";
+        case ReturnEvidence::BatteryReport: return "battery-report";
+        case ReturnEvidence::ContactReport: return "contact-report";
+        case ReturnEvidence::EndpointActivity: return "endpoint-activity";
+        case ReturnEvidence::EndpointIdentity: return "endpoint-identity";
+        case ReturnEvidence::EndpointStatus: return "endpoint-status";
+        case ReturnEvidence::ReceiverGeneration: return "receiver-generation";
+        case ReturnEvidence::RouteDeparture: return "route-departure";
+        case ReturnEvidence::RouteReturn: return "route-return";
+        case ReturnEvidence::SystemResume: return "system-resume";
+    }
+    return "unknown";
+}
+
+enum class ReturnPhase
+{
+    Stable,
+    QuiescentCandidate,
+    Returning,
+    Synchronized,
+    Unavailable,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(ReturnPhase value)
+{
+    switch(value)
+    {
+        case ReturnPhase::Stable: return "stable";
+        case ReturnPhase::QuiescentCandidate: return "quiescent-candidate";
+        case ReturnPhase::Returning: return "returning";
+        case ReturnPhase::Synchronized: return "synchronized";
+        case ReturnPhase::Unavailable: return "unavailable";
+    }
+    return "unknown";
+}
+
+enum class RestoreDeliveryState
+{
+    NotAttempted,
+    ReceiverRejected,
+    OutcomeUncertain,
+    ReceiverDelivered,
+    ChildRejected,
+    ChildConfirmed,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(RestoreDeliveryState value)
+{
+    switch(value)
+    {
+        case RestoreDeliveryState::NotAttempted: return "not-attempted";
+        case RestoreDeliveryState::ReceiverRejected: return "receiver-rejected";
+        case RestoreDeliveryState::OutcomeUncertain: return "outcome-uncertain";
+        case RestoreDeliveryState::ReceiverDelivered: return "receiver-delivered";
+        case RestoreDeliveryState::ChildRejected: return "child-rejected";
+        case RestoreDeliveryState::ChildConfirmed: return "child-confirmed";
+    }
+    return "unknown";
+}
+
 enum class RestoreRecordState
 {
     Planned,
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 9c1e02b..532f2dc 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f
+// Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac
 
 #pragma once
 
@@ -32,6 +32,57 @@ struct LightingTopology
     std::span<const std::uint16_t> application_index_to_carrier;
 };
 
+enum class PowerOffDepartureEvidence
+{
+    ReceiverState,
+    WatchedRetainedRoute,
+};
+
+enum class ReturnEvidenceSource
+{
+    BatteryReport,
+    ContactReport,
+    EndpointActivity,
+    RouteReturn,
+};
+
+enum class ReturnPolicyStrategy
+{
+    ActivityAssistedReturnEpoch,
+};
+
+enum class ReturnPolicyQualification
+{
+    PrequalificationCandidate,
+    Qualified,
+};
+
+enum class ReturnDeliverySemantics
+{
+    ReceiverDeliveredNotChildApplied,
+};
+
+struct ReturnPolicyRecord
+{
+    std::string_view id;
+    ReturnPolicyStrategy strategy;
+    ReturnPolicyQualification qualification;
+    std::uint64_t quiescence_candidate_ms;
+    std::uint64_t observation_jitter_ms;
+    std::span<const std::uint64_t> retry_offsets_ms;
+    std::span<const ReturnEvidenceSource> allowed_open_evidence;
+    std::span<const ReturnEvidenceSource> allowed_accelerator_evidence;
+    ReturnDeliverySemantics delivery_semantics;
+};
+
+struct LifecyclePolicyRecord
+{
+    PowerOffDepartureEvidence power_off_departure_evidence;
+    std::string_view return_policy_id;
+    std::span<const ReturnEvidenceSource> open_evidence;
+    std::span<const ReturnEvidenceSource> accelerator_evidence;
+};
+
 struct PresentationRecord
 {
     std::string_view upstream_id;
@@ -63,10 +114,19 @@ struct ProfileRecord
     bool exact_child_combinations;
     std::span<const CapabilityRecord> capabilities;
     const LightingTopology* lighting;
+    const LifecyclePolicyRecord* lifecycle;
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f";
+inline constexpr std::string_view profile_source_sha256 = "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac";
+
+inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
+inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
+inline constexpr std::array<ReturnEvidenceSource, 4> return_accelerator_evidence_0 {{ReturnEvidenceSource::BatteryReport, ReturnEvidenceSource::ContactReport, ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
+
+inline constexpr std::array<ReturnPolicyRecord, 1> return_policies {{
+    {"receiver-child.activity-assisted.v1", ReturnPolicyStrategy::ActivityAssistedReturnEpoch, ReturnPolicyQualification::PrequalificationCandidate, 60000, 500, return_retry_offsets_0, return_open_evidence_0, return_accelerator_evidence_0, ReturnDeliverySemantics::ReceiverDeliveredNotChildApplied},
+}};
 
 inline constexpr std::array<std::string_view, 1> receiver_protocols_0 {{"razer-hyperflux-v2"}};
 inline constexpr std::array<RouteKind, 1> routes_0 {{RouteKind::HyperfluxWireless}};
@@ -95,6 +155,14 @@ inline constexpr LightingTopology lighting_0 {
     13, 13, 13, 1, 13, carriers_0
 };
 
+inline constexpr std::array<ReturnEvidenceSource, 1> lifecycle_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity}};
+inline constexpr std::array<ReturnEvidenceSource, 2> lifecycle_accelerator_evidence_0 {{ReturnEvidenceSource::ContactReport, ReturnEvidenceSource::EndpointActivity}};
+inline constexpr LifecyclePolicyRecord lifecycle_0 {
+    PowerOffDepartureEvidence::WatchedRetainedRoute,
+    "receiver-child.activity-assisted.v1",
+    lifecycle_open_evidence_0, lifecycle_accelerator_evidence_0
+};
+
 inline constexpr PresentationRecord presentation_0 {
     "openrgb", "OpenRGB",
     "1.0rc3", "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
@@ -128,6 +196,14 @@ inline constexpr LightingTopology lighting_1 {
     84, 102, 102, 6, 17, carriers_1
 };
 
+inline constexpr std::array<ReturnEvidenceSource, 2> lifecycle_open_evidence_1 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
+inline constexpr std::array<ReturnEvidenceSource, 3> lifecycle_accelerator_evidence_1 {{ReturnEvidenceSource::BatteryReport, ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
+inline constexpr LifecyclePolicyRecord lifecycle_1 {
+    PowerOffDepartureEvidence::ReceiverState,
+    "receiver-child.activity-assisted.v1",
+    lifecycle_open_evidence_1, lifecycle_accelerator_evidence_1
+};
+
 inline constexpr PresentationRecord presentation_1 {
     "openrgb", "OpenRGB",
     "1.0rc3", "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
@@ -160,10 +236,10 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 }};
 
 inline constexpr std::array<ProfileRecord, 4> catalog {{
-    {"child.razer.basilisk-v3-pro-35k.00cd", "1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc", 2, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &presentation_0},
-    {"child.razer.deathstalker-v2-pro-tkl.0296", "133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a", 5, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &presentation_1},
-    {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr},
-    {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr},
+    {"child.razer.basilisk-v3-pro-35k.00cd", "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf", 3, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &lifecycle_0, &presentation_0},
+    {"child.razer.deathstalker-v2-pro-tkl.0296", "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63", 6, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &lifecycle_1, &presentation_1},
+    {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
+    {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr, nullptr},
 }};
 
 [[nodiscard]] constexpr const ProfileRecord* profile_by_id(std::string_view id)
@@ -178,4 +254,16 @@ inline constexpr std::array<ProfileRecord, 4> catalog {{
     return nullptr;
 }
 
+[[nodiscard]] constexpr const ReturnPolicyRecord* return_policy_by_id(std::string_view id)
+{
+    for(const auto& policy : return_policies)
+    {
+        if(policy.id == id)
+        {
+            return &policy;
+        }
+    }
+    return nullptr;
+}
+
 } // namespace hyperflux::profiles
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
index 3d55dd7..a249719 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
@@ -86,6 +86,12 @@ template<>
 template<>
 [[nodiscard]] Json encode<::hyperflux::EventCursor>(const ::hyperflux::EventCursor& value);
 
+template<>
+[[nodiscard]] ::hyperflux::ReturnEpoch decode<::hyperflux::ReturnEpoch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::ReturnEpoch>(const ::hyperflux::ReturnEpoch& value);
+
 template<>
 [[nodiscard]] ::hyperflux::EndpointSnapshot decode<::hyperflux::EndpointSnapshot>(const Json& value);
 
@@ -582,10 +588,41 @@ template<>
     return result;
 }
 
+template<>
+[[nodiscard]] inline ::hyperflux::ReturnEpoch decode<::hyperflux::ReturnEpoch>(const Json& value)
+{
+    require_object(value, {"generation_id", "device_id", "endpoint_id", "epoch_sequence", "opened_at_ms", "opening_evidence", "phase", "delivery_state"});
+    return ::hyperflux::ReturnEpoch {
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "epoch_sequence")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "opened_at_ms")),
+        decode<::hyperflux::ReturnEvidence>(required_field(value, "opening_evidence")),
+        decode<::hyperflux::ReturnPhase>(required_field(value, "phase")),
+        decode<::hyperflux::RestoreDeliveryState>(required_field(value, "delivery_state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::ReturnEpoch>(const ::hyperflux::ReturnEpoch& value)
+{
+    Json result = Json::object();
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["epoch_sequence"] = encode(value.epoch_sequence);
+    result["opened_at_ms"] = encode(value.opened_at_ms);
+    result["opening_evidence"] = encode(value.opening_evidence);
+    result["phase"] = encode(value.phase);
+    result["delivery_state"] = encode(value.delivery_state);
+    return result;
+}
+
 template<>
 [[nodiscard]] inline ::hyperflux::EndpointSnapshot decode<::hyperflux::EndpointSnapshot>(const Json& value)
 {
-    require_object(value, {"endpoint_id", "route_kind", "route_state", "connection_mode", "power_state", "sleep_state", "activity_state", "contact_state", "freshness", "confidence", "evidence_claim_id", "observed_at_ms"});
+    require_object(value, {"endpoint_id", "route_kind", "route_state", "connection_mode", "power_state", "sleep_state", "activity_state", "contact_state", "freshness", "confidence", "evidence_claim_id", "observed_at_ms", "return_epoch"});
     return ::hyperflux::EndpointSnapshot {
         decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
         decode<::hyperflux::RouteKind>(required_field(value, "route_kind")),
@@ -599,6 +636,7 @@ template<>
         decode<::hyperflux::EvidenceConfidence>(required_field(value, "confidence")),
         decode_optional_field<::hyperflux::EvidenceClaimId>(value, "evidence_claim_id"),
         decode_optional_field<::hyperflux::MonotonicMs>(value, "observed_at_ms"),
+        decode_optional_field<::hyperflux::ReturnEpoch>(value, "return_epoch"),
     };
 }
 
@@ -618,6 +656,7 @@ template<>
     result["confidence"] = encode(value.confidence);
     result["evidence_claim_id"] = value.evidence_claim_id.has_value() ? encode(*value.evidence_claim_id) : Json(nullptr);
     result["observed_at_ms"] = value.observed_at_ms.has_value() ? encode(*value.observed_at_ms) : Json(nullptr);
+    result["return_epoch"] = value.return_epoch.has_value() ? encode(*value.return_epoch) : Json(nullptr);
     return result;
 }
 
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
index f5ca7d4..61c0161 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
@@ -15,8 +15,8 @@
 namespace hyperflux
 {
 
-inline constexpr std::uint16_t minimum_protocol_version = 5;
-inline constexpr std::uint16_t maximum_protocol_version = 5;
+inline constexpr std::uint16_t minimum_protocol_version = 6;
+inline constexpr std::uint16_t maximum_protocol_version = 6;
 inline constexpr std::size_t max_wire_message_bytes = 1048576;
 inline constexpr std::size_t max_json_depth = 128;
 
@@ -136,6 +136,20 @@ struct EventCursor
     friend bool operator==(const EventCursor&, const EventCursor&) = default;
 };
 
+// Generation-bound endpoint return state without claiming physical lighting application.
+struct ReturnEpoch
+{
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    SequenceNumber epoch_sequence;
+    MonotonicMs opened_at_ms;
+    ReturnEvidence opening_evidence;
+    ReturnPhase phase;
+    RestoreDeliveryState delivery_state;
+    friend bool operator==(const ReturnEpoch&, const ReturnEpoch&) = default;
+};
+
 // Independent route, power, sleep, activity, contact, and freshness facts.
 struct EndpointSnapshot
 {
@@ -151,6 +165,7 @@ struct EndpointSnapshot
     EvidenceConfidence confidence;
     std::optional<EvidenceClaimId> evidence_claim_id;
     std::optional<MonotonicMs> observed_at_ms;
+    std::optional<ReturnEpoch> return_epoch;
     friend bool operator==(const EndpointSnapshot&, const EndpointSnapshot&) = default;
 };
 
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v6_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v6_json.hpp
new file mode 100644
index 0000000..49311b5
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v6_json.hpp
@@ -0,0 +1,1878 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "domain_json.hpp"
+#include "protocol_v6_types.hpp"
+
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace hyperflux::json_codec
+{
+
+template<>
+[[nodiscard]] ::hyperflux::v6::EmptyRequest decode<::hyperflux::v6::EmptyRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::EmptyRequest>(const ::hyperflux::v6::EmptyRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::RgbColor decode<::hyperflux::v6::RgbColor>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::RgbColor>(const ::hyperflux::v6::RgbColor& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ClientHello decode<::hyperflux::v6::ClientHello>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ClientHello>(const ::hyperflux::v6::ClientHello& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ServerHello decode<::hyperflux::v6::ServerHello>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ServerHello>(const ::hyperflux::v6::ServerHello& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ResourceKey decode<::hyperflux::v6::ResourceKey>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ResourceKey>(const ::hyperflux::v6::ResourceKey& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LeaseRequest decode<::hyperflux::v6::LeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LeaseRequest>(const ::hyperflux::v6::LeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LeaseGrant decode<::hyperflux::v6::LeaseGrant>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LeaseGrant>(const ::hyperflux::v6::LeaseGrant& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LeaseConflict decode<::hyperflux::v6::LeaseConflict>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LeaseConflict>(const ::hyperflux::v6::LeaseConflict& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LeaseRejection decode<::hyperflux::v6::LeaseRejection>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LeaseRejection>(const ::hyperflux::v6::LeaseRejection& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::RenewLeaseRequest decode<::hyperflux::v6::RenewLeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::RenewLeaseRequest>(const ::hyperflux::v6::RenewLeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ReleaseLeaseRequest decode<::hyperflux::v6::ReleaseLeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ReleaseLeaseRequest>(const ::hyperflux::v6::ReleaseLeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::EventCursor decode<::hyperflux::v6::EventCursor>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::EventCursor>(const ::hyperflux::v6::EventCursor& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ReturnEpoch decode<::hyperflux::v6::ReturnEpoch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ReturnEpoch>(const ::hyperflux::v6::ReturnEpoch& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::EndpointSnapshot decode<::hyperflux::v6::EndpointSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::EndpointSnapshot>(const ::hyperflux::v6::EndpointSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::BatteryObservation decode<::hyperflux::v6::BatteryObservation>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::BatteryObservation>(const ::hyperflux::v6::BatteryObservation& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ResourceOwnershipSnapshot decode<::hyperflux::v6::ResourceOwnershipSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ResourceOwnershipSnapshot>(const ::hyperflux::v6::ResourceOwnershipSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LogicalDeviceSnapshot decode<::hyperflux::v6::LogicalDeviceSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LogicalDeviceSnapshot>(const ::hyperflux::v6::LogicalDeviceSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ReceiverSnapshot decode<::hyperflux::v6::ReceiverSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ReceiverSnapshot>(const ::hyperflux::v6::ReceiverSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::BridgeSnapshot decode<::hyperflux::v6::BridgeSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::BridgeSnapshot>(const ::hyperflux::v6::BridgeSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LightingFrame decode<::hyperflux::v6::LightingFrame>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LightingFrame>(const ::hyperflux::v6::LightingFrame& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::DeviceProfileBinding decode<::hyperflux::v6::DeviceProfileBinding>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::DeviceProfileBinding>(const ::hyperflux::v6::DeviceProfileBinding& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::StableLightingIntent decode<::hyperflux::v6::StableLightingIntent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::StableLightingIntent>(const ::hyperflux::v6::StableLightingIntent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionRequest decode<::hyperflux::v6::TransactionRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionRequest>(const ::hyperflux::v6::TransactionRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionProgress decode<::hyperflux::v6::TransactionProgress>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionProgress>(const ::hyperflux::v6::TransactionProgress& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionTerminal decode<::hyperflux::v6::TransactionTerminal>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionTerminal>(const ::hyperflux::v6::TransactionTerminal& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionUnavailable decode<::hyperflux::v6::TransactionUnavailable>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionUnavailable>(const ::hyperflux::v6::TransactionUnavailable& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionLookup decode<::hyperflux::v6::TransactionLookup>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionLookup>(const ::hyperflux::v6::TransactionLookup& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::SubscriptionRequest decode<::hyperflux::v6::SubscriptionRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::SubscriptionRequest>(const ::hyperflux::v6::SubscriptionRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::BridgeEvent decode<::hyperflux::v6::BridgeEvent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::BridgeEvent>(const ::hyperflux::v6::BridgeEvent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::EventBatch decode<::hyperflux::v6::EventBatch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::EventBatch>(const ::hyperflux::v6::EventBatch& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::DiagnosticFinding decode<::hyperflux::v6::DiagnosticFinding>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::DiagnosticFinding>(const ::hyperflux::v6::DiagnosticFinding& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::DiagnosticSnapshot decode<::hyperflux::v6::DiagnosticSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::DiagnosticSnapshot>(const ::hyperflux::v6::DiagnosticSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ProfileBindingView decode<::hyperflux::v6::ProfileBindingView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ProfileBindingView>(const ::hyperflux::v6::ProfileBindingView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::DeviceInventoryView decode<::hyperflux::v6::DeviceInventoryView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::DeviceInventoryView>(const ::hyperflux::v6::DeviceInventoryView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::PresentationView decode<::hyperflux::v6::PresentationView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::PresentationView>(const ::hyperflux::v6::PresentationView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LightingTopologyView decode<::hyperflux::v6::LightingTopologyView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LightingTopologyView>(const ::hyperflux::v6::LightingTopologyView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::UnownedController decode<::hyperflux::v6::UnownedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::UnownedController>(const ::hyperflux::v6::UnownedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ViewerOwnedController decode<::hyperflux::v6::ViewerOwnedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ViewerOwnedController>(const ::hyperflux::v6::ViewerOwnedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::OtherOwnedController decode<::hyperflux::v6::OtherOwnedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::OtherOwnedController>(const ::hyperflux::v6::OtherOwnedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ControllerActions decode<::hyperflux::v6::ControllerActions>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ControllerActions>(const ::hyperflux::v6::ControllerActions& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ControllerView decode<::hyperflux::v6::ControllerView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ControllerView>(const ::hyperflux::v6::ControllerView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::IntegrationReceiverView decode<::hyperflux::v6::IntegrationReceiverView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::IntegrationReceiverView>(const ::hyperflux::v6::IntegrationReceiverView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::IntegrationView decode<::hyperflux::v6::IntegrationView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::IntegrationView>(const ::hyperflux::v6::IntegrationView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::RpcError decode<::hyperflux::v6::RpcError>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::RpcError>(const ::hyperflux::v6::RpcError& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::LeaseResult decode<::hyperflux::v6::LeaseResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::LeaseResult>(const ::hyperflux::v6::LeaseResult& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::TransactionResult decode<::hyperflux::v6::TransactionResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::TransactionResult>(const ::hyperflux::v6::TransactionResult& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ControllerOwnership decode<::hyperflux::v6::ControllerOwnership>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ControllerOwnership>(const ::hyperflux::v6::ControllerOwnership& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::NegotiationRequestEnvelope decode<::hyperflux::v6::NegotiationRequestEnvelope>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::NegotiationRequestEnvelope>(const ::hyperflux::v6::NegotiationRequestEnvelope& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::ErrorEnvelope decode<::hyperflux::v6::ErrorEnvelope>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::ErrorEnvelope>(const ::hyperflux::v6::ErrorEnvelope& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::RpcRequest decode<::hyperflux::v6::RpcRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::RpcRequest>(const ::hyperflux::v6::RpcRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v6::RpcResponse decode<::hyperflux::v6::RpcResponse>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v6::RpcResponse>(const ::hyperflux::v6::RpcResponse& value);
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::EmptyRequest decode<::hyperflux::v6::EmptyRequest>(const Json& value)
+{
+    require_object(value, {});
+    return ::hyperflux::v6::EmptyRequest {};
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::EmptyRequest>(const ::hyperflux::v6::EmptyRequest& value)
+{
+    Json result = Json::object();
+    static_cast<void>(value);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::RgbColor decode<::hyperflux::v6::RgbColor>(const Json& value)
+{
+    require_object(value, {"red", "green", "blue"});
+    return ::hyperflux::v6::RgbColor {
+        decode<::hyperflux::ColorChannel>(required_field(value, "red")),
+        decode<::hyperflux::ColorChannel>(required_field(value, "green")),
+        decode<::hyperflux::ColorChannel>(required_field(value, "blue")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::RgbColor>(const ::hyperflux::v6::RgbColor& value)
+{
+    Json result = Json::object();
+    result["red"] = encode(value.red);
+    result["green"] = encode(value.green);
+    result["blue"] = encode(value.blue);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ClientHello decode<::hyperflux::v6::ClientHello>(const Json& value)
+{
+    require_object(value, {"client_id", "client_name", "minimum_version", "maximum_version", "required_features", "optional_features"});
+    return ::hyperflux::v6::ClientHello {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::ClientName>(required_field(value, "client_name")),
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "minimum_version")),
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "maximum_version")),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "required_features"), 64),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "optional_features"), 64),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ClientHello>(const ::hyperflux::v6::ClientHello& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["client_name"] = encode(value.client_name);
+    result["minimum_version"] = encode(value.minimum_version);
+    result["maximum_version"] = encode(value.maximum_version);
+    result["required_features"] = encode_vector(value.required_features);
+    result["optional_features"] = encode_vector(value.optional_features);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ServerHello decode<::hyperflux::v6::ServerHello>(const Json& value)
+{
+    require_object(value, {"selected_version", "server_instance_id", "protocol_session_id", "negotiation_token", "bridge_version", "enabled_features", "event_buffer_capacity"});
+    return ::hyperflux::v6::ServerHello {
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "selected_version")),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<::hyperflux::ProtocolSessionId>(required_field(value, "protocol_session_id")),
+        decode<::hyperflux::NegotiationToken>(required_field(value, "negotiation_token")),
+        decode<::hyperflux::ComponentVersion>(required_field(value, "bridge_version")),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "enabled_features"), 64),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "event_buffer_capacity")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ServerHello>(const ::hyperflux::v6::ServerHello& value)
+{
+    Json result = Json::object();
+    result["selected_version"] = encode(value.selected_version);
+    result["server_instance_id"] = encode(value.server_instance_id);
+    result["protocol_session_id"] = encode(value.protocol_session_id);
+    result["negotiation_token"] = encode(value.negotiation_token);
+    result["bridge_version"] = encode(value.bridge_version);
+    result["enabled_features"] = encode_vector(value.enabled_features);
+    result["event_buffer_capacity"] = encode(value.event_buffer_capacity);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ResourceKey decode<::hyperflux::v6::ResourceKey>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "kind"});
+    return ::hyperflux::v6::ResourceKey {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::ResourceKind>(required_field(value, "kind")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ResourceKey>(const ::hyperflux::v6::ResourceKey& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["kind"] = encode(value.kind);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LeaseRequest decode<::hyperflux::v6::LeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "resources", "duration_ms"});
+    return ::hyperflux::v6::LeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_vector<::hyperflux::v6::ResourceKey>(required_field(value, "resources"), 32),
+        decode<::hyperflux::LeaseDurationMs>(required_field(value, "duration_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LeaseRequest>(const ::hyperflux::v6::LeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["resources"] = encode_vector(value.resources);
+    result["duration_ms"] = encode(value.duration_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LeaseGrant decode<::hyperflux::v6::LeaseGrant>(const Json& value)
+{
+    require_object(value, {"lease_id", "client_id", "resources", "expires_at_ms", "state"});
+    return ::hyperflux::v6::LeaseGrant {
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_vector<::hyperflux::v6::ResourceKey>(required_field(value, "resources"), 32),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+        decode<::hyperflux::LeaseState>(required_field(value, "state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LeaseGrant>(const ::hyperflux::v6::LeaseGrant& value)
+{
+    Json result = Json::object();
+    result["lease_id"] = encode(value.lease_id);
+    result["client_id"] = encode(value.client_id);
+    result["resources"] = encode_vector(value.resources);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    result["state"] = encode(value.state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LeaseConflict decode<::hyperflux::v6::LeaseConflict>(const Json& value)
+{
+    require_object(value, {"conflicting_client", "conflicting_resource"});
+    return ::hyperflux::v6::LeaseConflict {
+        decode<::hyperflux::ClientId>(required_field(value, "conflicting_client")),
+        decode<::hyperflux::v6::ResourceKey>(required_field(value, "conflicting_resource")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LeaseConflict>(const ::hyperflux::v6::LeaseConflict& value)
+{
+    Json result = Json::object();
+    result["conflicting_client"] = encode(value.conflicting_client);
+    result["conflicting_resource"] = encode(value.conflicting_resource);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LeaseRejection decode<::hyperflux::v6::LeaseRejection>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::v6::LeaseRejection {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LeaseRejection>(const ::hyperflux::v6::LeaseRejection& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::RenewLeaseRequest decode<::hyperflux::v6::RenewLeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id", "duration_ms"});
+    return ::hyperflux::v6::RenewLeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::LeaseDurationMs>(required_field(value, "duration_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::RenewLeaseRequest>(const ::hyperflux::v6::RenewLeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["duration_ms"] = encode(value.duration_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ReleaseLeaseRequest decode<::hyperflux::v6::ReleaseLeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id"});
+    return ::hyperflux::v6::ReleaseLeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ReleaseLeaseRequest>(const ::hyperflux::v6::ReleaseLeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::EventCursor decode<::hyperflux::v6::EventCursor>(const Json& value)
+{
+    require_object(value, {"stream_id", "stream_epoch", "projection_revision", "sequence"});
+    return ::hyperflux::v6::EventCursor {
+        decode<::hyperflux::StreamId>(required_field(value, "stream_id")),
+        decode<::hyperflux::StreamEpoch>(required_field(value, "stream_epoch")),
+        decode<::hyperflux::ProjectionRevision>(required_field(value, "projection_revision")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::EventCursor>(const ::hyperflux::v6::EventCursor& value)
+{
+    Json result = Json::object();
+    result["stream_id"] = encode(value.stream_id);
+    result["stream_epoch"] = encode(value.stream_epoch);
+    result["projection_revision"] = encode(value.projection_revision);
+    result["sequence"] = encode(value.sequence);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ReturnEpoch decode<::hyperflux::v6::ReturnEpoch>(const Json& value)
+{
+    require_object(value, {"generation_id", "device_id", "endpoint_id", "epoch_sequence", "opened_at_ms", "opening_evidence", "phase", "delivery_state"});
+    return ::hyperflux::v6::ReturnEpoch {
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "epoch_sequence")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "opened_at_ms")),
+        decode<::hyperflux::ReturnEvidence>(required_field(value, "opening_evidence")),
+        decode<::hyperflux::ReturnPhase>(required_field(value, "phase")),
+        decode<::hyperflux::RestoreDeliveryState>(required_field(value, "delivery_state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ReturnEpoch>(const ::hyperflux::v6::ReturnEpoch& value)
+{
+    Json result = Json::object();
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["epoch_sequence"] = encode(value.epoch_sequence);
+    result["opened_at_ms"] = encode(value.opened_at_ms);
+    result["opening_evidence"] = encode(value.opening_evidence);
+    result["phase"] = encode(value.phase);
+    result["delivery_state"] = encode(value.delivery_state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::EndpointSnapshot decode<::hyperflux::v6::EndpointSnapshot>(const Json& value)
+{
+    require_object(value, {"endpoint_id", "route_kind", "route_state", "connection_mode", "power_state", "sleep_state", "activity_state", "contact_state", "freshness", "confidence", "evidence_claim_id", "observed_at_ms", "return_epoch"});
+    return ::hyperflux::v6::EndpointSnapshot {
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::RouteKind>(required_field(value, "route_kind")),
+        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::ConnectionMode>(required_field(value, "connection_mode")),
+        decode<::hyperflux::PowerState>(required_field(value, "power_state")),
+        decode<::hyperflux::SleepState>(required_field(value, "sleep_state")),
+        decode<::hyperflux::ActivityState>(required_field(value, "activity_state")),
+        decode<::hyperflux::ContactState>(required_field(value, "contact_state")),
+        decode<::hyperflux::FreshnessState>(required_field(value, "freshness")),
+        decode<::hyperflux::EvidenceConfidence>(required_field(value, "confidence")),
+        decode_optional_field<::hyperflux::EvidenceClaimId>(value, "evidence_claim_id"),
+        decode_optional_field<::hyperflux::MonotonicMs>(value, "observed_at_ms"),
+        decode_optional_field<::hyperflux::v6::ReturnEpoch>(value, "return_epoch"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::EndpointSnapshot>(const ::hyperflux::v6::EndpointSnapshot& value)
+{
+    Json result = Json::object();
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["route_kind"] = encode(value.route_kind);
+    result["route_state"] = encode(value.route_state);
+    result["connection_mode"] = encode(value.connection_mode);
+    result["power_state"] = encode(value.power_state);
+    result["sleep_state"] = encode(value.sleep_state);
+    result["activity_state"] = encode(value.activity_state);
+    result["contact_state"] = encode(value.contact_state);
+    result["freshness"] = encode(value.freshness);
+    result["confidence"] = encode(value.confidence);
+    result["evidence_claim_id"] = value.evidence_claim_id.has_value() ? encode(*value.evidence_claim_id) : Json(nullptr);
+    result["observed_at_ms"] = value.observed_at_ms.has_value() ? encode(*value.observed_at_ms) : Json(nullptr);
+    result["return_epoch"] = value.return_epoch.has_value() ? encode(*value.return_epoch) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::BatteryObservation decode<::hyperflux::v6::BatteryObservation>(const Json& value)
+{
+    require_object(value, {"availability", "percentage", "freshness", "confidence", "observed_at_ms"});
+    return ::hyperflux::v6::BatteryObservation {
+        decode<::hyperflux::TelemetryAvailability>(required_field(value, "availability")),
+        decode_optional_field<::hyperflux::BatteryPercent>(value, "percentage"),
+        decode<::hyperflux::FreshnessState>(required_field(value, "freshness")),
+        decode<::hyperflux::EvidenceConfidence>(required_field(value, "confidence")),
+        decode_optional_field<::hyperflux::MonotonicMs>(value, "observed_at_ms"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::BatteryObservation>(const ::hyperflux::v6::BatteryObservation& value)
+{
+    Json result = Json::object();
+    result["availability"] = encode(value.availability);
+    result["percentage"] = value.percentage.has_value() ? encode(*value.percentage) : Json(nullptr);
+    result["freshness"] = encode(value.freshness);
+    result["confidence"] = encode(value.confidence);
+    result["observed_at_ms"] = value.observed_at_ms.has_value() ? encode(*value.observed_at_ms) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ResourceOwnershipSnapshot decode<::hyperflux::v6::ResourceOwnershipSnapshot>(const Json& value)
+{
+    require_object(value, {"resource", "client_id", "lease_id", "expires_at_ms"});
+    return ::hyperflux::v6::ResourceOwnershipSnapshot {
+        decode<::hyperflux::v6::ResourceKey>(required_field(value, "resource")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ResourceOwnershipSnapshot>(const ::hyperflux::v6::ResourceOwnershipSnapshot& value)
+{
+    Json result = Json::object();
+    result["resource"] = encode(value.resource);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LogicalDeviceSnapshot decode<::hyperflux::v6::LogicalDeviceSnapshot>(const Json& value)
+{
+    require_object(value, {"device_id", "device_kind", "product_id", "profile_id", "profile_digest", "pairing", "presence", "support_level", "endpoints", "battery", "capabilities"});
+    return ::hyperflux::v6::LogicalDeviceSnapshot {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode_optional_field<::hyperflux::ProfileId>(value, "profile_id"),
+        decode_optional_field<::hyperflux::ProfileDigest>(value, "profile_digest"),
+        decode<::hyperflux::PairingState>(required_field(value, "pairing")),
+        decode<::hyperflux::PresenceState>(required_field(value, "presence")),
+        decode<::hyperflux::SupportLevel>(required_field(value, "support_level")),
+        decode_vector<::hyperflux::v6::EndpointSnapshot>(required_field(value, "endpoints"), 8),
+        decode<::hyperflux::v6::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LogicalDeviceSnapshot>(const ::hyperflux::v6::LogicalDeviceSnapshot& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["profile_id"] = value.profile_id.has_value() ? encode(*value.profile_id) : Json(nullptr);
+    result["profile_digest"] = value.profile_digest.has_value() ? encode(*value.profile_digest) : Json(nullptr);
+    result["pairing"] = encode(value.pairing);
+    result["presence"] = encode(value.presence);
+    result["support_level"] = encode(value.support_level);
+    result["endpoints"] = encode_vector(value.endpoints);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ReceiverSnapshot decode<::hyperflux::v6::ReceiverSnapshot>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "profile_id", "profile_digest", "lifecycle", "devices", "ownership", "stable_restore_enabled", "restore_state"});
+    return ::hyperflux::v6::ReceiverSnapshot {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode_optional_field<::hyperflux::ProfileId>(value, "profile_id"),
+        decode_optional_field<::hyperflux::ProfileDigest>(value, "profile_digest"),
+        decode<::hyperflux::ReceiverLifecycleState>(required_field(value, "lifecycle")),
+        decode_vector<::hyperflux::v6::LogicalDeviceSnapshot>(required_field(value, "devices"), 32),
+        decode_vector<::hyperflux::v6::ResourceOwnershipSnapshot>(required_field(value, "ownership"), 96),
+        decode<bool>(required_field(value, "stable_restore_enabled")),
+        decode<::hyperflux::RestoreState>(required_field(value, "restore_state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ReceiverSnapshot>(const ::hyperflux::v6::ReceiverSnapshot& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["profile_id"] = value.profile_id.has_value() ? encode(*value.profile_id) : Json(nullptr);
+    result["profile_digest"] = value.profile_digest.has_value() ? encode(*value.profile_digest) : Json(nullptr);
+    result["lifecycle"] = encode(value.lifecycle);
+    result["devices"] = encode_vector(value.devices);
+    result["ownership"] = encode_vector(value.ownership);
+    result["stable_restore_enabled"] = encode(value.stable_restore_enabled);
+    result["restore_state"] = encode(value.restore_state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::BridgeSnapshot decode<::hyperflux::v6::BridgeSnapshot>(const Json& value)
+{
+    require_object(value, {"cursor", "receivers"});
+    return ::hyperflux::v6::BridgeSnapshot {
+        decode<::hyperflux::v6::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::v6::ReceiverSnapshot>(required_field(value, "receivers"), 16),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::BridgeSnapshot>(const ::hyperflux::v6::BridgeSnapshot& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["receivers"] = encode_vector(value.receivers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LightingFrame decode<::hyperflux::v6::LightingFrame>(const Json& value)
+{
+    require_object(value, {"device_id", "frame_index", "colors"});
+    return ::hyperflux::v6::LightingFrame {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::FrameIndex>(required_field(value, "frame_index")),
+        decode_vector<::hyperflux::v6::RgbColor>(required_field(value, "colors"), 4096),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LightingFrame>(const ::hyperflux::v6::LightingFrame& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["frame_index"] = encode(value.frame_index);
+    result["colors"] = encode_vector(value.colors);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::DeviceProfileBinding decode<::hyperflux::v6::DeviceProfileBinding>(const Json& value)
+{
+    require_object(value, {"device_id", "profile_id", "profile_digest", "application_slot_count"});
+    return ::hyperflux::v6::DeviceProfileBinding {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::ProfileId>(required_field(value, "profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "profile_digest")),
+        decode<::hyperflux::LedCount>(required_field(value, "application_slot_count")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::DeviceProfileBinding>(const ::hyperflux::v6::DeviceProfileBinding& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["profile_id"] = encode(value.profile_id);
+    result["profile_digest"] = encode(value.profile_digest);
+    result["application_slot_count"] = encode(value.application_slot_count);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::StableLightingIntent decode<::hyperflux::v6::StableLightingIntent>(const Json& value)
+{
+    require_object(value, {"device_id", "mode"});
+    return ::hyperflux::v6::StableLightingIntent {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::StableLightingMode>(required_field(value, "mode")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::StableLightingIntent>(const ::hyperflux::v6::StableLightingIntent& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["mode"] = encode(value.mode);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionRequest decode<::hyperflux::v6::TransactionRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "transaction_id", "client_id", "lease_id", "receiver_id", "generation_id", "receiver_profile_id", "receiver_profile_digest", "device_profiles", "transaction_class", "stable_intents", "deadline_ms", "resources", "frames"});
+    return ::hyperflux::v6::TransactionRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::ProfileId>(required_field(value, "receiver_profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "receiver_profile_digest")),
+        decode_vector<::hyperflux::v6::DeviceProfileBinding>(required_field(value, "device_profiles"), 32),
+        decode<::hyperflux::TransactionClass>(required_field(value, "transaction_class")),
+        decode_vector<::hyperflux::v6::StableLightingIntent>(required_field(value, "stable_intents"), 32),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "deadline_ms")),
+        decode_vector<::hyperflux::v6::ResourceKey>(required_field(value, "resources"), 32),
+        decode_vector<::hyperflux::v6::LightingFrame>(required_field(value, "frames"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionRequest>(const ::hyperflux::v6::TransactionRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["receiver_profile_id"] = encode(value.receiver_profile_id);
+    result["receiver_profile_digest"] = encode(value.receiver_profile_digest);
+    result["device_profiles"] = encode_vector(value.device_profiles);
+    result["transaction_class"] = encode(value.transaction_class);
+    result["stable_intents"] = encode_vector(value.stable_intents);
+    result["deadline_ms"] = encode(value.deadline_ms);
+    result["resources"] = encode_vector(value.resources);
+    result["frames"] = encode_vector(value.frames);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionProgress decode<::hyperflux::v6::TransactionProgress>(const Json& value)
+{
+    require_object(value, {"request_id", "request_digest", "transaction_id", "receiver_id", "generation_id", "state", "admission", "declared_frames", "delivered_frames", "side_effect_certainty", "live_write_executed"});
+    return ::hyperflux::v6::TransactionProgress {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::RequestDigest>(required_field(value, "request_digest")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::TransactionState>(required_field(value, "state")),
+        decode<::hyperflux::QueueAdmission>(required_field(value, "admission")),
+        decode<::hyperflux::FrameCount>(required_field(value, "declared_frames")),
+        decode<::hyperflux::DeliveredFrameCount>(required_field(value, "delivered_frames")),
+        decode<::hyperflux::SideEffectCertainty>(required_field(value, "side_effect_certainty")),
+        decode<bool>(required_field(value, "live_write_executed")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionProgress>(const ::hyperflux::v6::TransactionProgress& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["request_digest"] = encode(value.request_digest);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["state"] = encode(value.state);
+    result["admission"] = encode(value.admission);
+    result["declared_frames"] = encode(value.declared_frames);
+    result["delivered_frames"] = encode(value.delivered_frames);
+    result["side_effect_certainty"] = encode(value.side_effect_certainty);
+    result["live_write_executed"] = encode(value.live_write_executed);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionTerminal decode<::hyperflux::v6::TransactionTerminal>(const Json& value)
+{
+    require_object(value, {"request_id", "request_digest", "transaction_id", "receiver_id", "generation_id", "state", "declared_frames", "delivered_frames", "side_effect_certainty", "live_write_executed", "automatic_retry", "device_application", "terminal_sequence", "error_kind", "superseded_by"});
+    return ::hyperflux::v6::TransactionTerminal {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::RequestDigest>(required_field(value, "request_digest")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::TransactionState>(required_field(value, "state")),
+        decode<::hyperflux::FrameCount>(required_field(value, "declared_frames")),
+        decode<::hyperflux::DeliveredFrameCount>(required_field(value, "delivered_frames")),
+        decode<::hyperflux::SideEffectCertainty>(required_field(value, "side_effect_certainty")),
+        decode<bool>(required_field(value, "live_write_executed")),
+        decode<bool>(required_field(value, "automatic_retry")),
+        decode<::hyperflux::DeviceApplicationState>(required_field(value, "device_application")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "terminal_sequence")),
+        decode_optional_field<::hyperflux::ProtocolErrorKind>(value, "error_kind"),
+        decode_optional_field<::hyperflux::TransactionId>(value, "superseded_by"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionTerminal>(const ::hyperflux::v6::TransactionTerminal& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["request_digest"] = encode(value.request_digest);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["state"] = encode(value.state);
+    result["declared_frames"] = encode(value.declared_frames);
+    result["delivered_frames"] = encode(value.delivered_frames);
+    result["side_effect_certainty"] = encode(value.side_effect_certainty);
+    result["live_write_executed"] = encode(value.live_write_executed);
+    result["automatic_retry"] = encode(value.automatic_retry);
+    result["device_application"] = encode(value.device_application);
+    result["terminal_sequence"] = encode(value.terminal_sequence);
+    result["error_kind"] = value.error_kind.has_value() ? encode(*value.error_kind) : Json(nullptr);
+    result["superseded_by"] = value.superseded_by.has_value() ? encode(*value.superseded_by) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionUnavailable decode<::hyperflux::v6::TransactionUnavailable>(const Json& value)
+{
+    require_object(value, {"transaction_id", "error_kind", "finding_id"});
+    return ::hyperflux::v6::TransactionUnavailable {
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionUnavailable>(const ::hyperflux::v6::TransactionUnavailable& value)
+{
+    Json result = Json::object();
+    result["transaction_id"] = encode(value.transaction_id);
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionLookup decode<::hyperflux::v6::TransactionLookup>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "transaction_id"});
+    return ::hyperflux::v6::TransactionLookup {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionLookup>(const ::hyperflux::v6::TransactionLookup& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["transaction_id"] = encode(value.transaction_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::SubscriptionRequest decode<::hyperflux::v6::SubscriptionRequest>(const Json& value)
+{
+    require_object(value, {"client_id", "subscription_id", "expected_cursor", "max_events"});
+    return ::hyperflux::v6::SubscriptionRequest {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_optional_field<::hyperflux::SubscriptionId>(value, "subscription_id"),
+        decode_optional_field<::hyperflux::v6::EventCursor>(value, "expected_cursor"),
+        decode<::hyperflux::EventBatchLimit>(required_field(value, "max_events")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::SubscriptionRequest>(const ::hyperflux::v6::SubscriptionRequest& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["subscription_id"] = value.subscription_id.has_value() ? encode(*value.subscription_id) : Json(nullptr);
+    result["expected_cursor"] = value.expected_cursor.has_value() ? encode(*value.expected_cursor) : Json(nullptr);
+    result["max_events"] = encode(value.max_events);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::BridgeEvent decode<::hyperflux::v6::BridgeEvent>(const Json& value)
+{
+    require_object(value, {"sequence", "kind", "receiver_id", "generation_id", "device_id", "lease_id", "transaction_id", "finding_id"});
+    return ::hyperflux::v6::BridgeEvent {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode<::hyperflux::EventKind>(required_field(value, "kind")),
+        decode_optional_field<::hyperflux::ReceiverId>(value, "receiver_id"),
+        decode_optional_field<::hyperflux::GenerationId>(value, "generation_id"),
+        decode_optional_field<::hyperflux::LogicalDeviceId>(value, "device_id"),
+        decode_optional_field<::hyperflux::LeaseId>(value, "lease_id"),
+        decode_optional_field<::hyperflux::TransactionId>(value, "transaction_id"),
+        decode_optional_field<::hyperflux::FindingId>(value, "finding_id"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::BridgeEvent>(const ::hyperflux::v6::BridgeEvent& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["kind"] = encode(value.kind);
+    result["receiver_id"] = value.receiver_id.has_value() ? encode(*value.receiver_id) : Json(nullptr);
+    result["generation_id"] = value.generation_id.has_value() ? encode(*value.generation_id) : Json(nullptr);
+    result["device_id"] = value.device_id.has_value() ? encode(*value.device_id) : Json(nullptr);
+    result["lease_id"] = value.lease_id.has_value() ? encode(*value.lease_id) : Json(nullptr);
+    result["transaction_id"] = value.transaction_id.has_value() ? encode(*value.transaction_id) : Json(nullptr);
+    result["finding_id"] = value.finding_id.has_value() ? encode(*value.finding_id) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::EventBatch decode<::hyperflux::v6::EventBatch>(const Json& value)
+{
+    require_object(value, {"subscription_id", "next_cursor", "events", "oldest_available", "latest_available", "dropped_events", "cursor_gap", "has_more"});
+    return ::hyperflux::v6::EventBatch {
+        decode<::hyperflux::SubscriptionId>(required_field(value, "subscription_id")),
+        decode<::hyperflux::v6::EventCursor>(required_field(value, "next_cursor")),
+        decode_vector<::hyperflux::v6::BridgeEvent>(required_field(value, "events"), 256),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "oldest_available")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "latest_available")),
+        decode<::hyperflux::DroppedEventCount>(required_field(value, "dropped_events")),
+        decode<bool>(required_field(value, "cursor_gap")),
+        decode<bool>(required_field(value, "has_more")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::EventBatch>(const ::hyperflux::v6::EventBatch& value)
+{
+    Json result = Json::object();
+    result["subscription_id"] = encode(value.subscription_id);
+    result["next_cursor"] = encode(value.next_cursor);
+    result["events"] = encode_vector(value.events);
+    result["oldest_available"] = encode(value.oldest_available);
+    result["latest_available"] = encode(value.latest_available);
+    result["dropped_events"] = encode(value.dropped_events);
+    result["cursor_gap"] = encode(value.cursor_gap);
+    result["has_more"] = encode(value.has_more);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::DiagnosticFinding decode<::hyperflux::v6::DiagnosticFinding>(const Json& value)
+{
+    require_object(value, {"finding_id", "severity", "cause", "explanation", "safe_action", "privacy", "documentation"});
+    return ::hyperflux::v6::DiagnosticFinding {
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+        decode<::hyperflux::ErrorSeverity>(required_field(value, "severity")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "cause")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "explanation")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "safe_action")),
+        decode<::hyperflux::PrivacyClass>(required_field(value, "privacy")),
+        decode<::hyperflux::DocumentationPath>(required_field(value, "documentation")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::DiagnosticFinding>(const ::hyperflux::v6::DiagnosticFinding& value)
+{
+    Json result = Json::object();
+    result["finding_id"] = encode(value.finding_id);
+    result["severity"] = encode(value.severity);
+    result["cause"] = encode(value.cause);
+    result["explanation"] = encode(value.explanation);
+    result["safe_action"] = encode(value.safe_action);
+    result["privacy"] = encode(value.privacy);
+    result["documentation"] = encode(value.documentation);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::DiagnosticSnapshot decode<::hyperflux::v6::DiagnosticSnapshot>(const Json& value)
+{
+    require_object(value, {"sequence", "findings", "event_buffer_capacity", "transaction_queue_capacity"});
+    return ::hyperflux::v6::DiagnosticSnapshot {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode_vector<::hyperflux::v6::DiagnosticFinding>(required_field(value, "findings"), 128),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "event_buffer_capacity")),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "transaction_queue_capacity")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::DiagnosticSnapshot>(const ::hyperflux::v6::DiagnosticSnapshot& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["findings"] = encode_vector(value.findings);
+    result["event_buffer_capacity"] = encode(value.event_buffer_capacity);
+    result["transaction_queue_capacity"] = encode(value.transaction_queue_capacity);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ProfileBindingView decode<::hyperflux::v6::ProfileBindingView>(const Json& value)
+{
+    require_object(value, {"profile_id", "profile_digest"});
+    return ::hyperflux::v6::ProfileBindingView {
+        decode<::hyperflux::ProfileId>(required_field(value, "profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "profile_digest")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ProfileBindingView>(const ::hyperflux::v6::ProfileBindingView& value)
+{
+    Json result = Json::object();
+    result["profile_id"] = encode(value.profile_id);
+    result["profile_digest"] = encode(value.profile_digest);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::DeviceInventoryView decode<::hyperflux::v6::DeviceInventoryView>(const Json& value)
+{
+    require_object(value, {"device_id", "device_kind", "product_id", "profile", "model_name", "pairing", "presence", "availability", "support_level", "endpoints", "battery", "capabilities"});
+    return ::hyperflux::v6::DeviceInventoryView {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode_optional_field<::hyperflux::v6::ProfileBindingView>(value, "profile"),
+        decode_optional_field<::hyperflux::ModelName>(value, "model_name"),
+        decode<::hyperflux::PairingState>(required_field(value, "pairing")),
+        decode<::hyperflux::PresenceState>(required_field(value, "presence")),
+        decode<::hyperflux::InventoryAvailability>(required_field(value, "availability")),
+        decode<::hyperflux::SupportLevel>(required_field(value, "support_level")),
+        decode_vector<::hyperflux::v6::EndpointSnapshot>(required_field(value, "endpoints"), 8),
+        decode<::hyperflux::v6::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::DeviceInventoryView>(const ::hyperflux::v6::DeviceInventoryView& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["profile"] = value.profile.has_value() ? encode(*value.profile) : Json(nullptr);
+    result["model_name"] = value.model_name.has_value() ? encode(*value.model_name) : Json(nullptr);
+    result["pairing"] = encode(value.pairing);
+    result["presence"] = encode(value.presence);
+    result["availability"] = encode(value.availability);
+    result["support_level"] = encode(value.support_level);
+    result["endpoints"] = encode_vector(value.endpoints);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::PresentationView decode<::hyperflux::v6::PresentationView>(const Json& value)
+{
+    require_object(value, {"upstream_id", "owner", "project_version", "source_revision", "model_key", "layout_key", "transport_variant"});
+    return ::hyperflux::v6::PresentationView {
+        decode<::hyperflux::UpstreamId>(required_field(value, "upstream_id")),
+        decode<::hyperflux::UpstreamOwner>(required_field(value, "owner")),
+        decode<::hyperflux::ComponentVersion>(required_field(value, "project_version")),
+        decode<::hyperflux::SourceRevision>(required_field(value, "source_revision")),
+        decode<::hyperflux::PresentationKey>(required_field(value, "model_key")),
+        decode_optional_field<::hyperflux::PresentationKey>(value, "layout_key"),
+        decode<::hyperflux::TransportVariant>(required_field(value, "transport_variant")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::PresentationView>(const ::hyperflux::v6::PresentationView& value)
+{
+    Json result = Json::object();
+    result["upstream_id"] = encode(value.upstream_id);
+    result["owner"] = encode(value.owner);
+    result["project_version"] = encode(value.project_version);
+    result["source_revision"] = encode(value.source_revision);
+    result["model_key"] = encode(value.model_key);
+    result["layout_key"] = value.layout_key.has_value() ? encode(*value.layout_key) : Json(nullptr);
+    result["transport_variant"] = encode(value.transport_variant);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LightingTopologyView decode<::hyperflux::v6::LightingTopologyView>(const Json& value)
+{
+    require_object(value, {"physical_led_count", "application_slot_count", "rows", "columns"});
+    return ::hyperflux::v6::LightingTopologyView {
+        decode<::hyperflux::LedCount>(required_field(value, "physical_led_count")),
+        decode<::hyperflux::LedCount>(required_field(value, "application_slot_count")),
+        decode<::hyperflux::LedCount>(required_field(value, "rows")),
+        decode<::hyperflux::LedCount>(required_field(value, "columns")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LightingTopologyView>(const ::hyperflux::v6::LightingTopologyView& value)
+{
+    Json result = Json::object();
+    result["physical_led_count"] = encode(value.physical_led_count);
+    result["application_slot_count"] = encode(value.application_slot_count);
+    result["rows"] = encode(value.rows);
+    result["columns"] = encode(value.columns);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::UnownedController decode<::hyperflux::v6::UnownedController>(const Json& value)
+{
+    require_object(value, {});
+    return ::hyperflux::v6::UnownedController {};
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::UnownedController>(const ::hyperflux::v6::UnownedController& value)
+{
+    Json result = Json::object();
+    static_cast<void>(value);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ViewerOwnedController decode<::hyperflux::v6::ViewerOwnedController>(const Json& value)
+{
+    require_object(value, {"lease_id", "expires_at_ms"});
+    return ::hyperflux::v6::ViewerOwnedController {
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ViewerOwnedController>(const ::hyperflux::v6::ViewerOwnedController& value)
+{
+    Json result = Json::object();
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::OtherOwnedController decode<::hyperflux::v6::OtherOwnedController>(const Json& value)
+{
+    require_object(value, {"client_id", "lease_id", "expires_at_ms"});
+    return ::hyperflux::v6::OtherOwnedController {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::OtherOwnedController>(const ::hyperflux::v6::OtherOwnedController& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ControllerActions decode<::hyperflux::v6::ControllerActions>(const Json& value)
+{
+    require_object(value, {"can_acquire", "can_release", "can_submit_now"});
+    return ::hyperflux::v6::ControllerActions {
+        decode<bool>(required_field(value, "can_acquire")),
+        decode<bool>(required_field(value, "can_release")),
+        decode<bool>(required_field(value, "can_submit_now")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ControllerActions>(const ::hyperflux::v6::ControllerActions& value)
+{
+    Json result = Json::object();
+    result["can_acquire"] = encode(value.can_acquire);
+    result["can_release"] = encode(value.can_release);
+    result["can_submit_now"] = encode(value.can_submit_now);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ControllerView decode<::hyperflux::v6::ControllerView>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "endpoint_id", "device_kind", "product_id", "receiver_profile", "device_profile", "model_name", "presentation", "availability", "battery", "capabilities", "lighting", "resource", "ownership", "actions"});
+    return ::hyperflux::v6::ControllerView {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode<::hyperflux::v6::ProfileBindingView>(required_field(value, "receiver_profile")),
+        decode<::hyperflux::v6::ProfileBindingView>(required_field(value, "device_profile")),
+        decode<::hyperflux::ModelName>(required_field(value, "model_name")),
+        decode<::hyperflux::v6::PresentationView>(required_field(value, "presentation")),
+        decode<::hyperflux::ControllerAvailability>(required_field(value, "availability")),
+        decode<::hyperflux::v6::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+        decode<::hyperflux::v6::LightingTopologyView>(required_field(value, "lighting")),
+        decode<::hyperflux::v6::ResourceKey>(required_field(value, "resource")),
+        decode<::hyperflux::v6::ControllerOwnership>(required_field(value, "ownership")),
+        decode<::hyperflux::v6::ControllerActions>(required_field(value, "actions")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ControllerView>(const ::hyperflux::v6::ControllerView& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["receiver_profile"] = encode(value.receiver_profile);
+    result["device_profile"] = encode(value.device_profile);
+    result["model_name"] = encode(value.model_name);
+    result["presentation"] = encode(value.presentation);
+    result["availability"] = encode(value.availability);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    result["lighting"] = encode(value.lighting);
+    result["resource"] = encode(value.resource);
+    result["ownership"] = encode(value.ownership);
+    result["actions"] = encode(value.actions);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::IntegrationReceiverView decode<::hyperflux::v6::IntegrationReceiverView>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "profile", "model_name", "lifecycle", "stable_restore_enabled", "restore_state", "inventory", "controllers"});
+    return ::hyperflux::v6::IntegrationReceiverView {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode_optional_field<::hyperflux::v6::ProfileBindingView>(value, "profile"),
+        decode_optional_field<::hyperflux::ModelName>(value, "model_name"),
+        decode<::hyperflux::ReceiverLifecycleState>(required_field(value, "lifecycle")),
+        decode<bool>(required_field(value, "stable_restore_enabled")),
+        decode<::hyperflux::RestoreState>(required_field(value, "restore_state")),
+        decode_vector<::hyperflux::v6::DeviceInventoryView>(required_field(value, "inventory"), 32),
+        decode_vector<::hyperflux::v6::ControllerView>(required_field(value, "controllers"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::IntegrationReceiverView>(const ::hyperflux::v6::IntegrationReceiverView& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["profile"] = value.profile.has_value() ? encode(*value.profile) : Json(nullptr);
+    result["model_name"] = value.model_name.has_value() ? encode(*value.model_name) : Json(nullptr);
+    result["lifecycle"] = encode(value.lifecycle);
+    result["stable_restore_enabled"] = encode(value.stable_restore_enabled);
+    result["restore_state"] = encode(value.restore_state);
+    result["inventory"] = encode_vector(value.inventory);
+    result["controllers"] = encode_vector(value.controllers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::IntegrationView decode<::hyperflux::v6::IntegrationView>(const Json& value)
+{
+    require_object(value, {"cursor", "receivers"});
+    return ::hyperflux::v6::IntegrationView {
+        decode<::hyperflux::v6::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::v6::IntegrationReceiverView>(required_field(value, "receivers"), 16),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::IntegrationView>(const ::hyperflux::v6::IntegrationView& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["receivers"] = encode_vector(value.receivers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::RpcError decode<::hyperflux::v6::RpcError>(const Json& value)
+{
+    require_object(value, {"request_id", "kind", "message", "finding_id"});
+    return ::hyperflux::v6::RpcError {
+        decode_optional_field<::hyperflux::RequestId>(value, "request_id"),
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "kind")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "message")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::RpcError>(const ::hyperflux::v6::RpcError& value)
+{
+    Json result = Json::object();
+    result["request_id"] = value.request_id.has_value() ? encode(*value.request_id) : Json(nullptr);
+    result["kind"] = encode(value.kind);
+    result["message"] = encode(value.message);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::LeaseResult decode<::hyperflux::v6::LeaseResult>(const Json& value)
+{
+    require_object(value, {"outcome", "detail"});
+    const auto& tag_value = required_field(value, "outcome");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("LeaseResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "granted")
+    {
+        return ::hyperflux::v6::LeaseResult {::hyperflux::v6::LeaseResultGranted {
+            decode<::hyperflux::v6::LeaseGrant>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "conflict")
+    {
+        return ::hyperflux::v6::LeaseResult {::hyperflux::v6::LeaseResultConflict {
+            decode<::hyperflux::v6::LeaseConflict>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "rejected")
+    {
+        return ::hyperflux::v6::LeaseResult {::hyperflux::v6::LeaseResultRejected {
+            decode<::hyperflux::v6::LeaseRejection>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown LeaseResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::LeaseResult>(const ::hyperflux::v6::LeaseResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"outcome", std::string(Alternative::outcome)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::TransactionResult decode<::hyperflux::v6::TransactionResult>(const Json& value)
+{
+    require_object(value, {"outcome", "detail"});
+    const auto& tag_value = required_field(value, "outcome");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("TransactionResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "progress")
+    {
+        return ::hyperflux::v6::TransactionResult {::hyperflux::v6::TransactionResultProgress {
+            decode<::hyperflux::v6::TransactionProgress>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "terminal")
+    {
+        return ::hyperflux::v6::TransactionResult {::hyperflux::v6::TransactionResultTerminal {
+            decode<::hyperflux::v6::TransactionTerminal>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "unavailable")
+    {
+        return ::hyperflux::v6::TransactionResult {::hyperflux::v6::TransactionResultUnavailable {
+            decode<::hyperflux::v6::TransactionUnavailable>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown TransactionResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::TransactionResult>(const ::hyperflux::v6::TransactionResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"outcome", std::string(Alternative::outcome)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ControllerOwnership decode<::hyperflux::v6::ControllerOwnership>(const Json& value)
+{
+    require_object(value, {"state", "detail"});
+    const auto& tag_value = required_field(value, "state");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("ControllerOwnership tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "unowned")
+    {
+        return ::hyperflux::v6::ControllerOwnership {::hyperflux::v6::ControllerOwnershipUnowned {
+            decode<::hyperflux::v6::UnownedController>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "owned-by-viewer")
+    {
+        return ::hyperflux::v6::ControllerOwnership {::hyperflux::v6::ControllerOwnershipOwnedByViewer {
+            decode<::hyperflux::v6::ViewerOwnedController>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "owned-by-other")
+    {
+        return ::hyperflux::v6::ControllerOwnership {::hyperflux::v6::ControllerOwnershipOwnedByOther {
+            decode<::hyperflux::v6::OtherOwnedController>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown ControllerOwnership tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ControllerOwnership>(const ::hyperflux::v6::ControllerOwnership& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"state", std::string(Alternative::state)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::NegotiationRequestEnvelope decode<::hyperflux::v6::NegotiationRequestEnvelope>(const Json& value)
+{
+    require_object(value, {"request_id", "params"});
+    return ::hyperflux::v6::NegotiationRequestEnvelope {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::v6::ClientHello>(required_field(value, "params")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::NegotiationRequestEnvelope>(const ::hyperflux::v6::NegotiationRequestEnvelope& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"params", encode(value.params)},
+    };
+}
+
+template<typename T>
+[[nodiscard]] ::hyperflux::v6::SessionRequestEnvelope<T> decode_session_request(
+    const Json& value)
+{
+    require_object(value, {"request_id", "protocol_session_id", "negotiation_token", "params"});
+    return ::hyperflux::v6::SessionRequestEnvelope<T> {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ProtocolSessionId>(required_field(value, "protocol_session_id")),
+        decode<::hyperflux::NegotiationToken>(required_field(value, "negotiation_token")),
+        decode<T>(required_field(value, "params")),
+    };
+}
+
+template<typename T>
+[[nodiscard]] Json encode_session_request(
+    const ::hyperflux::v6::SessionRequestEnvelope<T>& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"protocol_session_id", encode(value.protocol_session_id)},
+        {"negotiation_token", encode(value.negotiation_token)},
+        {"params", encode(value.params)},
+    };
+}
+
+template<typename T>
+[[nodiscard]] ::hyperflux::v6::SuccessEnvelope<T> decode_success(const Json& value)
+{
+    require_object(value, {"request_id", "server_instance_id", "result"});
+    return ::hyperflux::v6::SuccessEnvelope<T> {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<T>(required_field(value, "result")),
+    };
+}
+
+template<typename T>
+[[nodiscard]] Json encode_success(
+    const ::hyperflux::v6::SuccessEnvelope<T>& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"server_instance_id", encode(value.server_instance_id)},
+        {"result", encode(value.result)},
+    };
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::ErrorEnvelope decode<::hyperflux::v6::ErrorEnvelope>(const Json& value)
+{
+    require_object(value, {"request_id", "server_instance_id", "error"});
+    return ::hyperflux::v6::ErrorEnvelope {
+        decode_optional_field<::hyperflux::RequestId>(value, "request_id"),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<::hyperflux::v6::RpcError>(required_field(value, "error")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::ErrorEnvelope>(const ::hyperflux::v6::ErrorEnvelope& value)
+{
+    return Json {
+        {"request_id", value.request_id.has_value() ? encode(*value.request_id) : Json(nullptr)},
+        {"server_instance_id", encode(value.server_instance_id)},
+        {"error", encode(value.error)},
+    };
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::RpcRequest decode<::hyperflux::v6::RpcRequest>(const Json& value)
+{
+    require_object(value, {"method", "request"});
+    const auto& method_value = required_field(value, "method");
+    if(!method_value.is_string())
+    {
+        throw CodecError("RPC request method must be a string");
+    }
+    const auto method = method_value.get<std::string>();
+    const auto& envelope = required_field(value, "request");
+    if(method == "negotiate")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestNegotiate {decode<::hyperflux::v6::NegotiationRequestEnvelope>(envelope)}};
+    }
+    if(method == "snapshot")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestSnapshot {decode_session_request<::hyperflux::v6::EmptyRequest>(envelope)}};
+    }
+    if(method == "integration-view")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestIntegrationView {decode_session_request<::hyperflux::v6::EmptyRequest>(envelope)}};
+    }
+    if(method == "acquire-lease")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestAcquireLease {decode_session_request<::hyperflux::v6::LeaseRequest>(envelope)}};
+    }
+    if(method == "renew-lease")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestRenewLease {decode_session_request<::hyperflux::v6::RenewLeaseRequest>(envelope)}};
+    }
+    if(method == "release-lease")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestReleaseLease {decode_session_request<::hyperflux::v6::ReleaseLeaseRequest>(envelope)}};
+    }
+    if(method == "submit-transaction")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestSubmitTransaction {decode_session_request<::hyperflux::v6::TransactionRequest>(envelope)}};
+    }
+    if(method == "transaction-outcome")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestTransactionOutcome {decode_session_request<::hyperflux::v6::TransactionLookup>(envelope)}};
+    }
+    if(method == "subscribe")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestSubscribe {decode_session_request<::hyperflux::v6::SubscriptionRequest>(envelope)}};
+    }
+    if(method == "diagnostics")
+    {
+        return ::hyperflux::v6::RpcRequest {::hyperflux::v6::RpcRequestDiagnostics {decode_session_request<::hyperflux::v6::EmptyRequest>(envelope)}};
+    }
+    throw CodecError("unknown RPC request method");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::RpcRequest>(const ::hyperflux::v6::RpcRequest& value)
+{
+    return std::visit(
+        [](const auto& request) {
+            using Request = std::decay_t<decltype(request)>;
+            Json envelope;
+            if constexpr(std::is_same_v<Request, ::hyperflux::v6::RpcRequestNegotiate>)
+            {
+                envelope = encode(request.request);
+            }
+            else
+            {
+                envelope = encode_session_request(request.request);
+            }
+            return Json {
+                {"method", std::string(Request::method)},
+                {"request", std::move(envelope)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v6::RpcResponse decode<::hyperflux::v6::RpcResponse>(const Json& value)
+{
+    require_object(value, {"type", "response"});
+    const auto& type_value = required_field(value, "type");
+    if(!type_value.is_string())
+    {
+        throw CodecError("RPC response type must be a string");
+    }
+    const auto type = type_value.get<std::string>();
+    const auto& envelope = required_field(value, "response");
+    if(type == "negotiate-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseNegotiateSuccess {
+            decode_success<::hyperflux::v6::ServerHello>(envelope)
+        }};
+    }
+    if(type == "snapshot-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseSnapshotSuccess {
+            decode_success<::hyperflux::v6::BridgeSnapshot>(envelope)
+        }};
+    }
+    if(type == "integration-view-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseIntegrationViewSuccess {
+            decode_success<::hyperflux::v6::IntegrationView>(envelope)
+        }};
+    }
+    if(type == "acquire-lease-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseAcquireLeaseSuccess {
+            decode_success<::hyperflux::v6::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "renew-lease-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseRenewLeaseSuccess {
+            decode_success<::hyperflux::v6::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "release-lease-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseReleaseLeaseSuccess {
+            decode_success<::hyperflux::v6::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "submit-transaction-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseSubmitTransactionSuccess {
+            decode_success<::hyperflux::v6::TransactionResult>(envelope)
+        }};
+    }
+    if(type == "transaction-outcome-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseTransactionOutcomeSuccess {
+            decode_success<::hyperflux::v6::TransactionResult>(envelope)
+        }};
+    }
+    if(type == "subscribe-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseSubscribeSuccess {
+            decode_success<::hyperflux::v6::EventBatch>(envelope)
+        }};
+    }
+    if(type == "diagnostics-success")
+    {
+        return ::hyperflux::v6::RpcResponse {::hyperflux::v6::RpcResponseDiagnosticsSuccess {
+            decode_success<::hyperflux::v6::DiagnosticSnapshot>(envelope)
+        }};
+    }
+    if(type == "error")
+    {
+        return ::hyperflux::v6::RpcResponse {decode<::hyperflux::v6::ErrorEnvelope>(envelope)};
+    }
+    throw CodecError("unknown RPC response type");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v6::RpcResponse>(const ::hyperflux::v6::RpcResponse& value)
+{
+    return std::visit(
+        [](const auto& response) {
+            using Response = std::decay_t<decltype(response)>;
+            if constexpr(std::is_same_v<Response, ::hyperflux::v6::ErrorEnvelope>)
+            {
+                return Json {
+                    {"type", "error"},
+                    {"response", encode(response)},
+                };
+            }
+            else
+            {
+                return Json {
+                    {"type", std::string(Response::type)},
+                    {"response", encode_success(response.response)},
+                };
+            }
+        },
+        value);
+}
+
+} // namespace hyperflux::json_codec
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v6_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v6_types.hpp
new file mode 100644
index 0000000..7f8d50d
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v6_types.hpp
@@ -0,0 +1,790 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "domain_types.hpp"
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string_view>
+#include <variant>
+#include <vector>
+
+namespace hyperflux::v6
+{
+
+inline constexpr std::uint16_t minimum_protocol_version = 6;
+inline constexpr std::uint16_t maximum_protocol_version = 6;
+inline constexpr std::size_t max_wire_message_bytes = 1048576;
+inline constexpr std::size_t max_json_depth = 128;
+
+// A method request with no method-specific fields.
+struct EmptyRequest
+{
+    friend bool operator==(const EmptyRequest&, const EmptyRequest&) = default;
+};
+
+// One canonical eight-bit RGB color.
+struct RgbColor
+{
+    ColorChannel red;
+    ColorChannel green;
+    ColorChannel blue;
+    friend bool operator==(const RgbColor&, const RgbColor&) = default;
+};
+
+// Bounded client protocol and feature offer.
+struct ClientHello
+{
+    ClientId client_id;
+    ClientName client_name;
+    ProtocolVersion minimum_version;
+    ProtocolVersion maximum_version;
+    std::vector<ProtocolFeatureId> required_features;
+    std::vector<ProtocolFeatureId> optional_features;
+    friend bool operator==(const ClientHello&, const ClientHello&) = default;
+};
+
+// Negotiated protocol version and bridge feature set.
+struct ServerHello
+{
+    ProtocolVersion selected_version;
+    ServerInstanceId server_instance_id;
+    ProtocolSessionId protocol_session_id;
+    NegotiationToken negotiation_token;
+    ComponentVersion bridge_version;
+    std::vector<ProtocolFeatureId> enabled_features;
+    QueueCapacity event_buffer_capacity;
+    friend bool operator==(const ServerHello&, const ServerHello&) = default;
+};
+
+// One device-scoped writable resource.
+struct ResourceKey
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    ResourceKind kind;
+    friend bool operator==(const ResourceKey&, const ResourceKey&) = default;
+};
+
+// Atomic request for one or more writable resources.
+struct LeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    std::vector<ResourceKey> resources;
+    LeaseDurationMs duration_ms;
+    friend bool operator==(const LeaseRequest&, const LeaseRequest&) = default;
+};
+
+// Granted ownership lease.
+struct LeaseGrant
+{
+    LeaseId lease_id;
+    ClientId client_id;
+    std::vector<ResourceKey> resources;
+    MonotonicMs expires_at_ms;
+    LeaseState state;
+    friend bool operator==(const LeaseGrant&, const LeaseGrant&) = default;
+};
+
+// Deterministic first conflict from an otherwise atomic lease request.
+struct LeaseConflict
+{
+    ClientId conflicting_client;
+    ResourceKey conflicting_resource;
+    friend bool operator==(const LeaseConflict&, const LeaseConflict&) = default;
+};
+
+// Structured lease rejection unrelated to another owner.
+struct LeaseRejection
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const LeaseRejection&, const LeaseRejection&) = default;
+};
+
+// Idempotent renewal of one existing lease.
+struct RenewLeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    LeaseDurationMs duration_ms;
+    friend bool operator==(const RenewLeaseRequest&, const RenewLeaseRequest&) = default;
+};
+
+// Idempotent release of one existing lease.
+struct ReleaseLeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    friend bool operator==(const ReleaseLeaseRequest&, const ReleaseLeaseRequest&) = default;
+};
+
+// Complete resumable position in one event stream projection.
+struct EventCursor
+{
+    StreamId stream_id;
+    StreamEpoch stream_epoch;
+    ProjectionRevision projection_revision;
+    SequenceNumber sequence;
+    friend bool operator==(const EventCursor&, const EventCursor&) = default;
+};
+
+// Generation-bound endpoint return state without claiming physical lighting application.
+struct ReturnEpoch
+{
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    SequenceNumber epoch_sequence;
+    MonotonicMs opened_at_ms;
+    ReturnEvidence opening_evidence;
+    ReturnPhase phase;
+    RestoreDeliveryState delivery_state;
+    friend bool operator==(const ReturnEpoch&, const ReturnEpoch&) = default;
+};
+
+// Independent route, power, sleep, activity, contact, and freshness facts.
+struct EndpointSnapshot
+{
+    EndpointId endpoint_id;
+    RouteKind route_kind;
+    RouteState route_state;
+    ConnectionMode connection_mode;
+    PowerState power_state;
+    SleepState sleep_state;
+    ActivityState activity_state;
+    ContactState contact_state;
+    FreshnessState freshness;
+    EvidenceConfidence confidence;
+    std::optional<EvidenceClaimId> evidence_claim_id;
+    std::optional<MonotonicMs> observed_at_ms;
+    std::optional<ReturnEpoch> return_epoch;
+    friend bool operator==(const EndpointSnapshot&, const EndpointSnapshot&) = default;
+};
+
+// Battery availability and value without collapsing unknown and unavailable.
+struct BatteryObservation
+{
+    TelemetryAvailability availability;
+    std::optional<BatteryPercent> percentage;
+    FreshnessState freshness;
+    EvidenceConfidence confidence;
+    std::optional<MonotonicMs> observed_at_ms;
+    friend bool operator==(const BatteryObservation&, const BatteryObservation&) = default;
+};
+
+// Current bounded application ownership for one generation-scoped resource.
+struct ResourceOwnershipSnapshot
+{
+    ResourceKey resource;
+    ClientId client_id;
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const ResourceOwnershipSnapshot&, const ResourceOwnershipSnapshot&) = default;
+};
+
+// Application-neutral logical controller state.
+struct LogicalDeviceSnapshot
+{
+    LogicalDeviceId device_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    std::optional<ProfileId> profile_id;
+    std::optional<ProfileDigest> profile_digest;
+    PairingState pairing;
+    PresenceState presence;
+    SupportLevel support_level;
+    std::vector<EndpointSnapshot> endpoints;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    friend bool operator==(const LogicalDeviceSnapshot&, const LogicalDeviceSnapshot&) = default;
+};
+
+// Generation-bound receiver and child inventory.
+struct ReceiverSnapshot
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    std::optional<ProfileId> profile_id;
+    std::optional<ProfileDigest> profile_digest;
+    ReceiverLifecycleState lifecycle;
+    std::vector<LogicalDeviceSnapshot> devices;
+    std::vector<ResourceOwnershipSnapshot> ownership;
+    bool stable_restore_enabled;
+    RestoreState restore_state;
+    friend bool operator==(const ReceiverSnapshot&, const ReceiverSnapshot&) = default;
+};
+
+// Sequence-bound complete bridge snapshot.
+struct BridgeSnapshot
+{
+    EventCursor cursor;
+    std::vector<ReceiverSnapshot> receivers;
+    friend bool operator==(const BridgeSnapshot&, const BridgeSnapshot&) = default;
+};
+
+// One logical-device direct-mode frame.
+struct LightingFrame
+{
+    LogicalDeviceId device_id;
+    FrameIndex frame_index;
+    std::vector<RgbColor> colors;
+    friend bool operator==(const LightingFrame&, const LightingFrame&) = default;
+};
+
+// Exact profile and lighting dimensions bound to one transaction target.
+struct DeviceProfileBinding
+{
+    LogicalDeviceId device_id;
+    ProfileId profile_id;
+    ProfileDigest profile_digest;
+    LedCount application_slot_count;
+    friend bool operator==(const DeviceProfileBinding&, const DeviceProfileBinding&) = default;
+};
+
+// Explicit semantic stable-lighting intent for one frame target.
+struct StableLightingIntent
+{
+    LogicalDeviceId device_id;
+    StableLightingMode mode;
+    friend bool operator==(const StableLightingIntent&, const StableLightingIntent&) = default;
+};
+
+// Atomic generation- and ownership-bound operation.
+struct TransactionRequest
+{
+    RequestId request_id;
+    TransactionId transaction_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    ProfileId receiver_profile_id;
+    ProfileDigest receiver_profile_digest;
+    std::vector<DeviceProfileBinding> device_profiles;
+    TransactionClass transaction_class;
+    std::vector<StableLightingIntent> stable_intents;
+    MonotonicMs deadline_ms;
+    std::vector<ResourceKey> resources;
+    std::vector<LightingFrame> frames;
+    friend bool operator==(const TransactionRequest&, const TransactionRequest&) = default;
+};
+
+// Nonterminal generation-bound transaction projection.
+struct TransactionProgress
+{
+    RequestId request_id;
+    RequestDigest request_digest;
+    TransactionId transaction_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    TransactionState state;
+    QueueAdmission admission;
+    FrameCount declared_frames;
+    DeliveredFrameCount delivered_frames;
+    SideEffectCertainty side_effect_certainty;
+    bool live_write_executed;
+    friend bool operator==(const TransactionProgress&, const TransactionProgress&) = default;
+};
+
+// Immutable terminal transaction outcome retained for bounded lookup.
+struct TransactionTerminal
+{
+    RequestId request_id;
+    RequestDigest request_digest;
+    TransactionId transaction_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    TransactionState state;
+    FrameCount declared_frames;
+    DeliveredFrameCount delivered_frames;
+    SideEffectCertainty side_effect_certainty;
+    bool live_write_executed;
+    bool automatic_retry;
+    DeviceApplicationState device_application;
+    SequenceNumber terminal_sequence;
+    std::optional<ProtocolErrorKind> error_kind;
+    std::optional<TransactionId> superseded_by;
+    friend bool operator==(const TransactionTerminal&, const TransactionTerminal&) = default;
+};
+
+// Outcome lookup cannot return a retained transaction record.
+struct TransactionUnavailable
+{
+    TransactionId transaction_id;
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const TransactionUnavailable&, const TransactionUnavailable&) = default;
+};
+
+// Idempotent lookup of one previously submitted transaction.
+struct TransactionLookup
+{
+    RequestId request_id;
+    ClientId client_id;
+    TransactionId transaction_id;
+    friend bool operator==(const TransactionLookup&, const TransactionLookup&) = default;
+};
+
+// Bounded event subscription cursor.
+struct SubscriptionRequest
+{
+    ClientId client_id;
+    std::optional<SubscriptionId> subscription_id;
+    std::optional<EventCursor> expected_cursor;
+    EventBatchLimit max_events;
+    friend bool operator==(const SubscriptionRequest&, const SubscriptionRequest&) = default;
+};
+
+// Sequence-bound typed event with snapshot references.
+struct BridgeEvent
+{
+    SequenceNumber sequence;
+    EventKind kind;
+    std::optional<ReceiverId> receiver_id;
+    std::optional<GenerationId> generation_id;
+    std::optional<LogicalDeviceId> device_id;
+    std::optional<LeaseId> lease_id;
+    std::optional<TransactionId> transaction_id;
+    std::optional<FindingId> finding_id;
+    friend bool operator==(const BridgeEvent&, const BridgeEvent&) = default;
+};
+
+// Bounded event result with explicit cursor-gap state.
+struct EventBatch
+{
+    SubscriptionId subscription_id;
+    EventCursor next_cursor;
+    std::vector<BridgeEvent> events;
+    SequenceNumber oldest_available;
+    SequenceNumber latest_available;
+    DroppedEventCount dropped_events;
+    bool cursor_gap;
+    bool has_more;
+    friend bool operator==(const EventBatch&, const EventBatch&) = default;
+};
+
+// One privacy-classified actionable finding.
+struct DiagnosticFinding
+{
+    FindingId finding_id;
+    ErrorSeverity severity;
+    HumanMessage cause;
+    HumanMessage explanation;
+    HumanMessage safe_action;
+    PrivacyClass privacy;
+    DocumentationPath documentation;
+    friend bool operator==(const DiagnosticFinding&, const DiagnosticFinding&) = default;
+};
+
+// Bounded bridge findings and queue health.
+struct DiagnosticSnapshot
+{
+    SequenceNumber sequence;
+    std::vector<DiagnosticFinding> findings;
+    QueueCapacity event_buffer_capacity;
+    QueueCapacity transaction_queue_capacity;
+    friend bool operator==(const DiagnosticSnapshot&, const DiagnosticSnapshot&) = default;
+};
+
+// Exact immutable profile authority exposed to integrations.
+struct ProfileBindingView
+{
+    ProfileId profile_id;
+    ProfileDigest profile_digest;
+    friend bool operator==(const ProfileBindingView&, const ProfileBindingView&) = default;
+};
+
+// Truthful paired-device inventory independent of application controller registration.
+struct DeviceInventoryView
+{
+    LogicalDeviceId device_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    std::optional<ProfileBindingView> profile;
+    std::optional<ModelName> model_name;
+    PairingState pairing;
+    PresenceState presence;
+    InventoryAvailability availability;
+    SupportLevel support_level;
+    std::vector<EndpointSnapshot> endpoints;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    friend bool operator==(const DeviceInventoryView&, const DeviceInventoryView&) = default;
+};
+
+// Pinned upstream presentation authority without hardware transport policy.
+struct PresentationView
+{
+    UpstreamId upstream_id;
+    UpstreamOwner owner;
+    ComponentVersion project_version;
+    SourceRevision source_revision;
+    PresentationKey model_key;
+    std::optional<PresentationKey> layout_key;
+    TransportVariant transport_variant;
+    friend bool operator==(const PresentationView&, const PresentationView&) = default;
+};
+
+// Application-facing lighting dimensions without receiver carrier mapping.
+struct LightingTopologyView
+{
+    LedCount physical_led_count;
+    LedCount application_slot_count;
+    LedCount rows;
+    LedCount columns;
+    friend bool operator==(const LightingTopologyView&, const LightingTopologyView&) = default;
+};
+
+// Writable controller currently has no application owner.
+struct UnownedController
+{
+    friend bool operator==(const UnownedController&, const UnownedController&) = default;
+};
+
+// Writable controller is owned by the requesting client.
+struct ViewerOwnedController
+{
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const ViewerOwnedController&, const ViewerOwnedController&) = default;
+};
+
+// Writable controller is owned by another application client.
+struct OtherOwnedController
+{
+    ClientId client_id;
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const OtherOwnedController&, const OtherOwnedController&) = default;
+};
+
+// Viewer-specific actions derived from availability and ownership.
+struct ControllerActions
+{
+    bool can_acquire;
+    bool can_release;
+    bool can_submit_now;
+    friend bool operator==(const ControllerActions&, const ControllerActions&) = default;
+};
+
+// Stable structured request failure.
+struct RpcError
+{
+    std::optional<RequestId> request_id;
+    ProtocolErrorKind kind;
+    HumanMessage message;
+    FindingId finding_id;
+    friend bool operator==(const RpcError&, const RpcError&) = default;
+};
+
+// Every requested resource was granted.
+struct LeaseResultGranted
+{
+    static constexpr std::string_view outcome = "granted";
+    LeaseGrant detail;
+    friend bool operator==(const LeaseResultGranted&, const LeaseResultGranted&) = default;
+};
+
+// Another client owns at least one requested resource; none were granted.
+struct LeaseResultConflict
+{
+    static constexpr std::string_view outcome = "conflict";
+    LeaseConflict detail;
+    friend bool operator==(const LeaseResultConflict&, const LeaseResultConflict&) = default;
+};
+
+// The request failed without granting any resource.
+struct LeaseResultRejected
+{
+    static constexpr std::string_view outcome = "rejected";
+    LeaseRejection detail;
+    friend bool operator==(const LeaseResultRejected&, const LeaseResultRejected&) = default;
+};
+
+// Contradiction-free atomic lease outcome.
+using LeaseResult = std::variant<LeaseResultGranted, LeaseResultConflict, LeaseResultRejected>;
+
+// The transaction has not reached a terminal state.
+struct TransactionResultProgress
+{
+    static constexpr std::string_view outcome = "progress";
+    TransactionProgress detail;
+    friend bool operator==(const TransactionResultProgress&, const TransactionResultProgress&) = default;
+};
+
+// The immutable terminal outcome is retained.
+struct TransactionResultTerminal
+{
+    static constexpr std::string_view outcome = "terminal";
+    TransactionTerminal detail;
+    friend bool operator==(const TransactionResultTerminal&, const TransactionResultTerminal&) = default;
+};
+
+// No retained outcome can answer this lookup.
+struct TransactionResultUnavailable
+{
+    static constexpr std::string_view outcome = "unavailable";
+    TransactionUnavailable detail;
+    friend bool operator==(const TransactionResultUnavailable&, const TransactionResultUnavailable&) = default;
+};
+
+// Contradiction-free current, terminal, or unavailable transaction outcome.
+using TransactionResult = std::variant<TransactionResultProgress, TransactionResultTerminal, TransactionResultUnavailable>;
+
+// No application currently owns the controller.
+struct ControllerOwnershipUnowned
+{
+    static constexpr std::string_view state = "unowned";
+    UnownedController detail;
+    friend bool operator==(const ControllerOwnershipUnowned&, const ControllerOwnershipUnowned&) = default;
+};
+
+// The requesting client owns the controller.
+struct ControllerOwnershipOwnedByViewer
+{
+    static constexpr std::string_view state = "owned-by-viewer";
+    ViewerOwnedController detail;
+    friend bool operator==(const ControllerOwnershipOwnedByViewer&, const ControllerOwnershipOwnedByViewer&) = default;
+};
+
+// Another application client owns the controller.
+struct ControllerOwnershipOwnedByOther
+{
+    static constexpr std::string_view state = "owned-by-other";
+    OtherOwnedController detail;
+    friend bool operator==(const ControllerOwnershipOwnedByOther&, const ControllerOwnershipOwnedByOther&) = default;
+};
+
+// Contradiction-free viewer-specific controller ownership.
+using ControllerOwnership = std::variant<ControllerOwnershipUnowned, ControllerOwnershipOwnedByViewer, ControllerOwnershipOwnedByOther>;
+
+// Exact qualified receiver-backed application controller.
+struct ControllerView
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    ProfileBindingView receiver_profile;
+    ProfileBindingView device_profile;
+    ModelName model_name;
+    PresentationView presentation;
+    ControllerAvailability availability;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    LightingTopologyView lighting;
+    ResourceKey resource;
+    ControllerOwnership ownership;
+    ControllerActions actions;
+    friend bool operator==(const ControllerView&, const ControllerView&) = default;
+};
+
+// One receiver generation with complete inventory and qualified controllers.
+struct IntegrationReceiverView
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    std::optional<ProfileBindingView> profile;
+    std::optional<ModelName> model_name;
+    ReceiverLifecycleState lifecycle;
+    bool stable_restore_enabled;
+    RestoreState restore_state;
+    std::vector<DeviceInventoryView> inventory;
+    std::vector<ControllerView> controllers;
+    friend bool operator==(const IntegrationReceiverView&, const IntegrationReceiverView&) = default;
+};
+
+// Client-specific application view projected once by bridge policy.
+struct IntegrationView
+{
+    EventCursor cursor;
+    std::vector<IntegrationReceiverView> receivers;
+    friend bool operator==(const IntegrationView&, const IntegrationView&) = default;
+};
+
+struct NegotiationRequestEnvelope
+{
+    RequestId request_id;
+    ClientHello params;
+};
+
+template<typename T>
+struct SessionRequestEnvelope
+{
+    RequestId request_id;
+    ProtocolSessionId protocol_session_id;
+    NegotiationToken negotiation_token;
+    T params;
+};
+
+struct RpcRequestNegotiate
+{
+    static constexpr std::string_view method = "negotiate";
+    NegotiationRequestEnvelope request;
+};
+
+struct RpcRequestSnapshot
+{
+    static constexpr std::string_view method = "snapshot";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestIntegrationView
+{
+    static constexpr std::string_view method = "integration-view";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestAcquireLease
+{
+    static constexpr std::string_view method = "acquire-lease";
+    SessionRequestEnvelope<LeaseRequest> request;
+};
+
+struct RpcRequestRenewLease
+{
+    static constexpr std::string_view method = "renew-lease";
+    SessionRequestEnvelope<RenewLeaseRequest> request;
+};
+
+struct RpcRequestReleaseLease
+{
+    static constexpr std::string_view method = "release-lease";
+    SessionRequestEnvelope<ReleaseLeaseRequest> request;
+};
+
+struct RpcRequestSubmitTransaction
+{
+    static constexpr std::string_view method = "submit-transaction";
+    SessionRequestEnvelope<TransactionRequest> request;
+};
+
+struct RpcRequestTransactionOutcome
+{
+    static constexpr std::string_view method = "transaction-outcome";
+    SessionRequestEnvelope<TransactionLookup> request;
+};
+
+struct RpcRequestSubscribe
+{
+    static constexpr std::string_view method = "subscribe";
+    SessionRequestEnvelope<SubscriptionRequest> request;
+};
+
+struct RpcRequestDiagnostics
+{
+    static constexpr std::string_view method = "diagnostics";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+using RpcRequest = std::variant<RpcRequestNegotiate, RpcRequestSnapshot, RpcRequestIntegrationView, RpcRequestAcquireLease, RpcRequestRenewLease, RpcRequestReleaseLease, RpcRequestSubmitTransaction, RpcRequestTransactionOutcome, RpcRequestSubscribe, RpcRequestDiagnostics>;
+
+template<typename T>
+struct SuccessEnvelope
+{
+    RequestId request_id;
+    ServerInstanceId server_instance_id;
+    T result;
+};
+
+struct ErrorEnvelope
+{
+    std::optional<RequestId> request_id;
+    ServerInstanceId server_instance_id;
+    RpcError error;
+};
+
+struct RpcResponseNegotiateSuccess
+{
+    static constexpr std::string_view type = "negotiate-success";
+    SuccessEnvelope<ServerHello> response;
+};
+
+struct RpcResponseSnapshotSuccess
+{
+    static constexpr std::string_view type = "snapshot-success";
+    SuccessEnvelope<BridgeSnapshot> response;
+};
+
+struct RpcResponseIntegrationViewSuccess
+{
+    static constexpr std::string_view type = "integration-view-success";
+    SuccessEnvelope<IntegrationView> response;
+};
+
+struct RpcResponseAcquireLeaseSuccess
+{
+    static constexpr std::string_view type = "acquire-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseRenewLeaseSuccess
+{
+    static constexpr std::string_view type = "renew-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseReleaseLeaseSuccess
+{
+    static constexpr std::string_view type = "release-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseSubmitTransactionSuccess
+{
+    static constexpr std::string_view type = "submit-transaction-success";
+    SuccessEnvelope<TransactionResult> response;
+};
+
+struct RpcResponseTransactionOutcomeSuccess
+{
+    static constexpr std::string_view type = "transaction-outcome-success";
+    SuccessEnvelope<TransactionResult> response;
+};
+
+struct RpcResponseSubscribeSuccess
+{
+    static constexpr std::string_view type = "subscribe-success";
+    SuccessEnvelope<EventBatch> response;
+};
+
+struct RpcResponseDiagnosticsSuccess
+{
+    static constexpr std::string_view type = "diagnostics-success";
+    SuccessEnvelope<DiagnosticSnapshot> response;
+};
+
+using RpcResponse = std::variant<RpcResponseNegotiateSuccess, RpcResponseSnapshotSuccess, RpcResponseIntegrationViewSuccess, RpcResponseAcquireLeaseSuccess, RpcResponseRenewLeaseSuccess, RpcResponseReleaseLeaseSuccess, RpcResponseSubmitTransactionSuccess, RpcResponseTransactionOutcomeSuccess, RpcResponseSubscribeSuccess, RpcResponseDiagnosticsSuccess, ErrorEnvelope>;
+
+struct MethodDescriptor
+{
+    std::string_view name;
+    std::string_view request;
+    std::string_view response;
+    std::optional<std::string_view> required_feature;
+};
+
+inline constexpr MethodDescriptor methods[10] = {
+    {"negotiate", "ClientHello", "ServerHello", std::nullopt},
+    {"snapshot", "EmptyRequest", "BridgeSnapshot", std::nullopt},
+    {"integration-view", "EmptyRequest", "IntegrationView", std::optional<std::string_view>("integration-view-projection")},
+    {"acquire-lease", "LeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"renew-lease", "RenewLeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"release-lease", "ReleaseLeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"submit-transaction", "TransactionRequest", "TransactionResult", std::optional<std::string_view>("atomic-transactions")},
+    {"transaction-outcome", "TransactionLookup", "TransactionResult", std::optional<std::string_view>("atomic-transactions")},
+    {"subscribe", "SubscriptionRequest", "EventBatch", std::optional<std::string_view>("event-subscriptions")},
+    {"diagnostics", "EmptyRequest", "DiagnosticSnapshot", std::optional<std::string_view>("structured-diagnostics")},
+};
+
+} // namespace hyperflux::v6
diff --git a/sdk/python/hyperflux_sdk/generated/domain_types.py b/sdk/python/hyperflux_sdk/generated/domain_types.py
index d674d86..8b5a723 100644
--- a/sdk/python/hyperflux_sdk/generated/domain_types.py
+++ b/sdk/python/hyperflux_sdk/generated/domain_types.py
@@ -983,6 +983,36 @@ class RestoreTriggerKind(str, Enum):
     DEVICE_RETURN = "device-return"
 
 
+class ReturnEvidence(str, Enum):
+    APPLICATION_OWNERSHIP_LOSS = "application-ownership-loss"
+    BATTERY_REPORT = "battery-report"
+    CONTACT_REPORT = "contact-report"
+    ENDPOINT_ACTIVITY = "endpoint-activity"
+    ENDPOINT_IDENTITY = "endpoint-identity"
+    ENDPOINT_STATUS = "endpoint-status"
+    RECEIVER_GENERATION = "receiver-generation"
+    ROUTE_DEPARTURE = "route-departure"
+    ROUTE_RETURN = "route-return"
+    SYSTEM_RESUME = "system-resume"
+
+
+class ReturnPhase(str, Enum):
+    STABLE = "stable"
+    QUIESCENT_CANDIDATE = "quiescent-candidate"
+    RETURNING = "returning"
+    SYNCHRONIZED = "synchronized"
+    UNAVAILABLE = "unavailable"
+
+
+class RestoreDeliveryState(str, Enum):
+    NOT_ATTEMPTED = "not-attempted"
+    RECEIVER_REJECTED = "receiver-rejected"
+    OUTCOME_UNCERTAIN = "outcome-uncertain"
+    RECEIVER_DELIVERED = "receiver-delivered"
+    CHILD_REJECTED = "child-rejected"
+    CHILD_CONFIRMED = "child-confirmed"
+
+
 class RestoreRecordState(str, Enum):
     PLANNED = "planned"
     DEFERRED = "deferred"
@@ -1192,6 +1222,9 @@ class ErrorSeverity(str, Enum):
     "QueueAdmission",
     "RestoreState",
     "RestoreTriggerKind",
+    "ReturnEvidence",
+    "ReturnPhase",
+    "RestoreDeliveryState",
     "RestoreRecordState",
     "RestoreDeferReason",
     "RestoreInvalidationReason",
diff --git a/sdk/python/hyperflux_sdk/generated/linux_runtime.py b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
index d899783..7570102 100644
--- a/sdk/python/hyperflux_sdk/generated/linux_runtime.py
+++ b/sdk/python/hyperflux_sdk/generated/linux_runtime.py
@@ -1,7 +1,7 @@
 """Generated by ./hfx generate. Do not edit manually."""
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-LINUX_RUNTIME_SHA256 = "aac369013b10c3b861f16e2ff76dc58fd4fcbdc75f7ec400c2a8444b101cd3c8"
+LINUX_RUNTIME_SHA256 = "6f2f7cba6c66679f0f3b6093c15f13a73a449a7f612040304c29cc132b79a723"
 PRODUCT_DISPLAY_NAME = "HyperFlux Next"
 PRODUCT_VERSION = "0.0.0-dev.1"
 PACKAGE_NAME = "hyperflux-next-linux"
@@ -47,7 +47,6 @@
 ACCEPT_POLL_INTERVAL_MS = 25
 ACTOR_RESPONSE_TIMEOUT_MS = 30000
 KERNEL_SESSION_DURATION_MS = 120000
-ACTIVITY_RESUMPTION_QUIET_MS = 30000
 RESTORATION_MAX_PENDING_TRIGGERS = 64
 RESTORATION_MAX_PENDING_CLAIMS = 4096
 RESTORATION_CLAIMS_PER_TICK = 1
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 5df0d0c..1c6a123 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f'
+PROFILE_SOURCE_SHA256: Final = '6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -455,6 +455,38 @@
                                        'source_id': 'engineering-laboratory'}],
                       'summary': 'The Hard Edition surface identity and its firmware-owned charging/status indicator '
                                  'are reviewed observations, not a USB identity or writable RGB surface.'}],
+ 'lifecycle_policies': [{'allowed_accelerator_evidence': ['battery-report',
+                                                          'contact-report',
+                                                          'endpoint-activity',
+                                                          'route-return'],
+                         'allowed_open_evidence': ['endpoint-activity', 'route-return'],
+                         'delivery_semantics': 'receiver-delivered-not-child-applied',
+                         'id': 'receiver-child.activity-assisted.v1',
+                         'observation_jitter_ms': 500,
+                         'qualification': 'prequalification-candidate',
+                         'quiescence_candidate_ms': 60000,
+                         'retry_offsets_ms': [0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000],
+                         'strategy': 'activity-assisted-return-epoch',
+                         'timing_authorities': [{'kind': 'pinned-upstream-contract',
+                                                 'source_id': 'openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339',
+                                                 'source_sha256': '3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829',
+                                                 'summary': 'The pinned upstream idle-time command accepts 60 through '
+                                                            '900 seconds; 60 seconds is therefore a conservative '
+                                                            'quiescent candidate, never a claim that the endpoint '
+                                                            'slept.'},
+                                                {'kind': 'pinned-upstream-contract',
+                                                 'source_id': 'driver/kernel/hyperflux-next-internal.h:21',
+                                                 'source_sha256': '3f11ad598422577681f050b6f11535a03e2644120301ec69361a579c535ab06b',
+                                                 'summary': 'Endpoint activity is rate-limited to 250 milliseconds. A '
+                                                            'two-interval tolerance prevents report coalescing from '
+                                                            'turning the legal minimum idle setting into a brittle '
+                                                            'exact-second boundary.'},
+                                                {'kind': 'prequalification-hypothesis',
+                                                 'source_id': 'assurance/protected-behavior.json:natural-device-wake-restoration',
+                                                 'summary': 'The bounded retry envelope covers the longest legacy '
+                                                            'five-second settle fallback plus one second. It remains a '
+                                                            'candidate until the watched no-Spectrum matrix qualifies '
+                                                            'or replaces it.'}]}],
  'profiles': [{'capabilities': [{'access': 'read',
                                  'evidence_claims': ['claim.child.00cd.passive-identity-telemetry'],
                                  'id': 'identity.model',
@@ -535,19 +567,23 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.basilisk-v3-pro-35k.00cd',
-               'qualification_migrations': [{'from_runtime_sha256': 'f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33',
+               'qualification_migrations': [{'from_runtime_sha256': '1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
+                                            {'from_runtime_sha256': 'f72d38a70e9f4f7fb56848937abafa4773902de64b9d07b22e11c12df6dbfe33',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']}],
                'restrictions': ['Another Basilisk name or PID inherits no map.',
                                 'OpenRGB owns zone labels and geometry presentation.',
                                 'Contact, inactivity, darkness, and power-off remain distinct facts.',
                                 'A physical mouse power-off can retain the receiver route; watched qualification '
                                 'records that physical boundary without inventing a disconnect.'],
-               'revision': 2,
-               'runtime_sha256': '1a9dde39c257beb4d51dcd43e4e56c57ee782d59d9b49834557591eaea04dfcc',
+               'revision': 3,
+               'runtime_sha256': '62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-basilisk-v3-pro-35k-00cd.json',
-               'transport': {'lifecycle': {'device_return_settle_ms': 1000,
-                                           'power_off_departure_evidence': 'watched-retained-route'},
+               'transport': {'lifecycle': {'accelerator_evidence': ['contact-report', 'endpoint-activity'],
+                                           'open_evidence': ['endpoint-activity'],
+                                           'power_off_departure_evidence': 'watched-retained-route',
+                                           'return_policy_id': 'receiver-child.activity-assisted.v1'},
                              'lighting': {'application_index_to_carrier': [1, 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
                                           'application_slot_count': 13,
                                           'carrier_count': 13,
@@ -635,7 +671,9 @@
                                 'transport_variant': 'wireless',
                                 'upstream_id': 'openrgb'},
                'profile_id': 'child.razer.deathstalker-v2-pro-tkl.0296',
-               'qualification_migrations': [{'from_runtime_sha256': '31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb',
+               'qualification_migrations': [{'from_runtime_sha256': '133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a',
+                                             'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
+                                            {'from_runtime_sha256': '31f80ff672cb56d6bed5df320c45cda68cf14c0181d7b93428f1f8f7891032eb',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
                                             {'from_runtime_sha256': '88e5b7d79e5434f141f5767b07dcc707b13a5d0e0c1fbe0ebc894f57638e7e1c',
                                              'preserve_stage_roles': ['lighting', 'map', 'telemetry']},
@@ -648,15 +686,16 @@
                                 'External power does not establish a direct USB data route or charging state.',
                                 'Receiver route value 0x0101 is indeterminate and cannot override observed keyboard '
                                 'activity.'],
-               'revision': 5,
-               'runtime_sha256': '133bcdf39640187c3a6c6d7e3a6fc39cf85cf55d1883f344acf1d973891d9b1a',
+               'revision': 6,
+               'runtime_sha256': '46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/children/razer-deathstalker-v2-pro-tkl-0296.json',
-               'transport': {'lifecycle': {'device_return_confirmation': {'evidence': 'battery-report',
-                                                                          'reassert_at_fallback': True,
-                                                                          'settle_ms': 250},
-                                           'device_return_settle_ms': 5000,
-                                           'power_off_departure_evidence': 'receiver-state'},
+               'transport': {'lifecycle': {'accelerator_evidence': ['battery-report',
+                                                                    'endpoint-activity',
+                                                                    'route-return'],
+                                           'open_evidence': ['endpoint-activity', 'route-return'],
+                                           'power_off_departure_evidence': 'receiver-state',
+                                           'return_policy_id': 'receiver-child.activity-assisted.v1'},
                              'lighting': {'application_index_to_carrier': [0,
                                                                            1,
                                                                            2,
@@ -845,7 +884,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f'}
+ 'source_sha256': '6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_types.py b/sdk/python/hyperflux_sdk/generated/protocol_types.py
index 1f834ab..f8943c3 100644
--- a/sdk/python/hyperflux_sdk/generated/protocol_types.py
+++ b/sdk/python/hyperflux_sdk/generated/protocol_types.py
@@ -61,7 +61,10 @@
     RequestDigest,
     RequestId,
     ResourceKind,
+    RestoreDeliveryState,
     RestoreState,
+    ReturnEvidence,
+    ReturnPhase,
     RouteKind,
     RouteState,
     SequenceNumber,
@@ -85,8 +88,8 @@
 
 T = TypeVar("T")
 
-MINIMUM_PROTOCOL_VERSION = 5
-MAXIMUM_PROTOCOL_VERSION = 5
+MINIMUM_PROTOCOL_VERSION = 6
+MAXIMUM_PROTOCOL_VERSION = 6
 MAX_WIRE_MESSAGE_BYTES = 1048576
 MAX_JSON_DEPTH = 128
 FIELD_LIMITS = {
@@ -123,6 +126,7 @@
     "integration-view-projection",
     "event-subscriptions",
     "structured-diagnostics",
+    "return-lifecycle-projection",
 )
 
 @dataclass(frozen=True, slots=True)
@@ -230,6 +234,19 @@ class EventCursor:
     sequence: SequenceNumber
 
 
+@dataclass(frozen=True, slots=True)
+class ReturnEpoch:
+    """Generation-bound endpoint return state without claiming physical lighting application."""
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    epoch_sequence: SequenceNumber
+    opened_at_ms: MonotonicMs
+    opening_evidence: ReturnEvidence
+    phase: ReturnPhase
+    delivery_state: RestoreDeliveryState
+
+
 @dataclass(frozen=True, slots=True)
 class EndpointSnapshot:
     """Independent route, power, sleep, activity, contact, and freshness facts."""
@@ -245,6 +262,7 @@ class EndpointSnapshot:
     confidence: EvidenceConfidence
     evidence_claim_id: EvidenceClaimId | None
     observed_at_ms: MonotonicMs | None
+    return_epoch: ReturnEpoch | None
 
 
 @dataclass(frozen=True, slots=True)
@@ -839,6 +857,7 @@ class RpcResponseDiagnosticsSuccess:
     "RenewLeaseRequest",
     "ReleaseLeaseRequest",
     "EventCursor",
+    "ReturnEpoch",
     "EndpointSnapshot",
     "BatteryObservation",
     "ResourceOwnershipSnapshot",
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_v6_types.py b/sdk/python/hyperflux_sdk/generated/protocol_v6_types.py
new file mode 100644
index 0000000..f8943c3
--- /dev/null
+++ b/sdk/python/hyperflux_sdk/generated/protocol_v6_types.py
@@ -0,0 +1,930 @@
+"""Generated by ./hfx generate. Do not edit manually."""
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from dataclasses import dataclass
+from typing import ClassVar, Generic, TypeAlias, TypeVar
+
+from .domain_types import (
+    ActivityState,
+    BatteryPercent,
+    CapabilityId,
+    ClientId,
+    ClientName,
+    ColorChannel,
+    ComponentVersion,
+    ConnectionMode,
+    ContactState,
+    ControllerAvailability,
+    DeliveredFrameCount,
+    DeviceApplicationState,
+    DeviceKind,
+    DocumentationPath,
+    DroppedEventCount,
+    EndpointId,
+    ErrorSeverity,
+    EventBatchLimit,
+    EventKind,
+    EvidenceClaimId,
+    EvidenceConfidence,
+    FindingId,
+    FrameCount,
+    FrameIndex,
+    FreshnessState,
+    GenerationId,
+    HumanMessage,
+    InventoryAvailability,
+    LeaseDurationMs,
+    LeaseId,
+    LeaseState,
+    LedCount,
+    LogicalDeviceId,
+    ModelName,
+    MonotonicMs,
+    NegotiationToken,
+    PairingState,
+    PowerState,
+    PresenceState,
+    PresentationKey,
+    PrivacyClass,
+    ProductId,
+    ProfileDigest,
+    ProfileId,
+    ProjectionRevision,
+    ProtocolErrorKind,
+    ProtocolFeatureId,
+    ProtocolSessionId,
+    ProtocolVersion,
+    QueueAdmission,
+    QueueCapacity,
+    ReceiverId,
+    ReceiverLifecycleState,
+    RequestDigest,
+    RequestId,
+    ResourceKind,
+    RestoreDeliveryState,
+    RestoreState,
+    ReturnEvidence,
+    ReturnPhase,
+    RouteKind,
+    RouteState,
+    SequenceNumber,
+    ServerInstanceId,
+    SideEffectCertainty,
+    SleepState,
+    SourceRevision,
+    StableLightingMode,
+    StreamEpoch,
+    StreamId,
+    SubscriptionId,
+    SupportLevel,
+    TelemetryAvailability,
+    TransactionClass,
+    TransactionId,
+    TransactionState,
+    TransportVariant,
+    UpstreamId,
+    UpstreamOwner,
+)
+
+T = TypeVar("T")
+
+MINIMUM_PROTOCOL_VERSION = 6
+MAXIMUM_PROTOCOL_VERSION = 6
+MAX_WIRE_MESSAGE_BYTES = 1048576
+MAX_JSON_DEPTH = 128
+FIELD_LIMITS = {
+    ("ClientHello", "required_features"): 64,
+    ("ClientHello", "optional_features"): 64,
+    ("ServerHello", "enabled_features"): 64,
+    ("LeaseRequest", "resources"): 32,
+    ("LeaseGrant", "resources"): 32,
+    ("LogicalDeviceSnapshot", "endpoints"): 8,
+    ("LogicalDeviceSnapshot", "capabilities"): 128,
+    ("ReceiverSnapshot", "devices"): 32,
+    ("ReceiverSnapshot", "ownership"): 96,
+    ("BridgeSnapshot", "receivers"): 16,
+    ("LightingFrame", "colors"): 4096,
+    ("TransactionRequest", "device_profiles"): 32,
+    ("TransactionRequest", "stable_intents"): 32,
+    ("TransactionRequest", "resources"): 32,
+    ("TransactionRequest", "frames"): 32,
+    ("EventBatch", "events"): 256,
+    ("DiagnosticSnapshot", "findings"): 128,
+    ("DeviceInventoryView", "endpoints"): 8,
+    ("DeviceInventoryView", "capabilities"): 128,
+    ("ControllerView", "capabilities"): 128,
+    ("IntegrationReceiverView", "inventory"): 32,
+    ("IntegrationReceiverView", "controllers"): 32,
+    ("IntegrationView", "receivers"): 16,
+}
+SUPPORTED_FEATURES = (
+    "ownership-leases",
+    "atomic-transactions",
+    "profile-bound-transactions",
+    "semantic-stable-lighting",
+    "snapshot-profile-bindings",
+    "integration-view-projection",
+    "event-subscriptions",
+    "structured-diagnostics",
+    "return-lifecycle-projection",
+)
+
+@dataclass(frozen=True, slots=True)
+class EmptyRequest:
+    """A method request with no method-specific fields."""
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class RgbColor:
+    """One canonical eight-bit RGB color."""
+    red: ColorChannel
+    green: ColorChannel
+    blue: ColorChannel
+
+
+@dataclass(frozen=True, slots=True)
+class ClientHello:
+    """Bounded client protocol and feature offer."""
+    client_id: ClientId
+    client_name: ClientName
+    minimum_version: ProtocolVersion
+    maximum_version: ProtocolVersion
+    required_features: tuple[ProtocolFeatureId, ...]
+    optional_features: tuple[ProtocolFeatureId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class ServerHello:
+    """Negotiated protocol version and bridge feature set."""
+    selected_version: ProtocolVersion
+    server_instance_id: ServerInstanceId
+    protocol_session_id: ProtocolSessionId
+    negotiation_token: NegotiationToken
+    bridge_version: ComponentVersion
+    enabled_features: tuple[ProtocolFeatureId, ...]
+    event_buffer_capacity: QueueCapacity
+
+
+@dataclass(frozen=True, slots=True)
+class ResourceKey:
+    """One device-scoped writable resource."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    kind: ResourceKind
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseRequest:
+    """Atomic request for one or more writable resources."""
+    request_id: RequestId
+    client_id: ClientId
+    resources: tuple[ResourceKey, ...]
+    duration_ms: LeaseDurationMs
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseGrant:
+    """Granted ownership lease."""
+    lease_id: LeaseId
+    client_id: ClientId
+    resources: tuple[ResourceKey, ...]
+    expires_at_ms: MonotonicMs
+    state: LeaseState
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseConflict:
+    """Deterministic first conflict from an otherwise atomic lease request."""
+    conflicting_client: ClientId
+    conflicting_resource: ResourceKey
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseRejection:
+    """Structured lease rejection unrelated to another owner."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class RenewLeaseRequest:
+    """Idempotent renewal of one existing lease."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+    duration_ms: LeaseDurationMs
+
+
+@dataclass(frozen=True, slots=True)
+class ReleaseLeaseRequest:
+    """Idempotent release of one existing lease."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+
+
+@dataclass(frozen=True, slots=True)
+class EventCursor:
+    """Complete resumable position in one event stream projection."""
+    stream_id: StreamId
+    stream_epoch: StreamEpoch
+    projection_revision: ProjectionRevision
+    sequence: SequenceNumber
+
+
+@dataclass(frozen=True, slots=True)
+class ReturnEpoch:
+    """Generation-bound endpoint return state without claiming physical lighting application."""
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    epoch_sequence: SequenceNumber
+    opened_at_ms: MonotonicMs
+    opening_evidence: ReturnEvidence
+    phase: ReturnPhase
+    delivery_state: RestoreDeliveryState
+
+
+@dataclass(frozen=True, slots=True)
+class EndpointSnapshot:
+    """Independent route, power, sleep, activity, contact, and freshness facts."""
+    endpoint_id: EndpointId
+    route_kind: RouteKind
+    route_state: RouteState
+    connection_mode: ConnectionMode
+    power_state: PowerState
+    sleep_state: SleepState
+    activity_state: ActivityState
+    contact_state: ContactState
+    freshness: FreshnessState
+    confidence: EvidenceConfidence
+    evidence_claim_id: EvidenceClaimId | None
+    observed_at_ms: MonotonicMs | None
+    return_epoch: ReturnEpoch | None
+
+
+@dataclass(frozen=True, slots=True)
+class BatteryObservation:
+    """Battery availability and value without collapsing unknown and unavailable."""
+    availability: TelemetryAvailability
+    percentage: BatteryPercent | None
+    freshness: FreshnessState
+    confidence: EvidenceConfidence
+    observed_at_ms: MonotonicMs | None
+
+
+@dataclass(frozen=True, slots=True)
+class ResourceOwnershipSnapshot:
+    """Current bounded application ownership for one generation-scoped resource."""
+    resource: ResourceKey
+    client_id: ClientId
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class LogicalDeviceSnapshot:
+    """Application-neutral logical controller state."""
+    device_id: LogicalDeviceId
+    device_kind: DeviceKind
+    product_id: ProductId
+    profile_id: ProfileId | None
+    profile_digest: ProfileDigest | None
+    pairing: PairingState
+    presence: PresenceState
+    support_level: SupportLevel
+    endpoints: tuple[EndpointSnapshot, ...]
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class ReceiverSnapshot:
+    """Generation-bound receiver and child inventory."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    profile_id: ProfileId | None
+    profile_digest: ProfileDigest | None
+    lifecycle: ReceiverLifecycleState
+    devices: tuple[LogicalDeviceSnapshot, ...]
+    ownership: tuple[ResourceOwnershipSnapshot, ...]
+    stable_restore_enabled: bool
+    restore_state: RestoreState
+
+
+@dataclass(frozen=True, slots=True)
+class BridgeSnapshot:
+    """Sequence-bound complete bridge snapshot."""
+    cursor: EventCursor
+    receivers: tuple[ReceiverSnapshot, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class LightingFrame:
+    """One logical-device direct-mode frame."""
+    device_id: LogicalDeviceId
+    frame_index: FrameIndex
+    colors: tuple[RgbColor, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class DeviceProfileBinding:
+    """Exact profile and lighting dimensions bound to one transaction target."""
+    device_id: LogicalDeviceId
+    profile_id: ProfileId
+    profile_digest: ProfileDigest
+    application_slot_count: LedCount
+
+
+@dataclass(frozen=True, slots=True)
+class StableLightingIntent:
+    """Explicit semantic stable-lighting intent for one frame target."""
+    device_id: LogicalDeviceId
+    mode: StableLightingMode
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionRequest:
+    """Atomic generation- and ownership-bound operation."""
+    request_id: RequestId
+    transaction_id: TransactionId
+    client_id: ClientId
+    lease_id: LeaseId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    receiver_profile_id: ProfileId
+    receiver_profile_digest: ProfileDigest
+    device_profiles: tuple[DeviceProfileBinding, ...]
+    transaction_class: TransactionClass
+    stable_intents: tuple[StableLightingIntent, ...]
+    deadline_ms: MonotonicMs
+    resources: tuple[ResourceKey, ...]
+    frames: tuple[LightingFrame, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionProgress:
+    """Nonterminal generation-bound transaction projection."""
+    request_id: RequestId
+    request_digest: RequestDigest
+    transaction_id: TransactionId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    state: TransactionState
+    admission: QueueAdmission
+    declared_frames: FrameCount
+    delivered_frames: DeliveredFrameCount
+    side_effect_certainty: SideEffectCertainty
+    live_write_executed: bool
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionTerminal:
+    """Immutable terminal transaction outcome retained for bounded lookup."""
+    request_id: RequestId
+    request_digest: RequestDigest
+    transaction_id: TransactionId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    state: TransactionState
+    declared_frames: FrameCount
+    delivered_frames: DeliveredFrameCount
+    side_effect_certainty: SideEffectCertainty
+    live_write_executed: bool
+    automatic_retry: bool
+    device_application: DeviceApplicationState
+    terminal_sequence: SequenceNumber
+    error_kind: ProtocolErrorKind | None
+    superseded_by: TransactionId | None
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionUnavailable:
+    """Outcome lookup cannot return a retained transaction record."""
+    transaction_id: TransactionId
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionLookup:
+    """Idempotent lookup of one previously submitted transaction."""
+    request_id: RequestId
+    client_id: ClientId
+    transaction_id: TransactionId
+
+
+@dataclass(frozen=True, slots=True)
+class SubscriptionRequest:
+    """Bounded event subscription cursor."""
+    client_id: ClientId
+    subscription_id: SubscriptionId | None
+    expected_cursor: EventCursor | None
+    max_events: EventBatchLimit
+
+
+@dataclass(frozen=True, slots=True)
+class BridgeEvent:
+    """Sequence-bound typed event with snapshot references."""
+    sequence: SequenceNumber
+    kind: EventKind
+    receiver_id: ReceiverId | None
+    generation_id: GenerationId | None
+    device_id: LogicalDeviceId | None
+    lease_id: LeaseId | None
+    transaction_id: TransactionId | None
+    finding_id: FindingId | None
+
+
+@dataclass(frozen=True, slots=True)
+class EventBatch:
+    """Bounded event result with explicit cursor-gap state."""
+    subscription_id: SubscriptionId
+    next_cursor: EventCursor
+    events: tuple[BridgeEvent, ...]
+    oldest_available: SequenceNumber
+    latest_available: SequenceNumber
+    dropped_events: DroppedEventCount
+    cursor_gap: bool
+    has_more: bool
+
+
+@dataclass(frozen=True, slots=True)
+class DiagnosticFinding:
+    """One privacy-classified actionable finding."""
+    finding_id: FindingId
+    severity: ErrorSeverity
+    cause: HumanMessage
+    explanation: HumanMessage
+    safe_action: HumanMessage
+    privacy: PrivacyClass
+    documentation: DocumentationPath
+
+
+@dataclass(frozen=True, slots=True)
+class DiagnosticSnapshot:
+    """Bounded bridge findings and queue health."""
+    sequence: SequenceNumber
+    findings: tuple[DiagnosticFinding, ...]
+    event_buffer_capacity: QueueCapacity
+    transaction_queue_capacity: QueueCapacity
+
+
+@dataclass(frozen=True, slots=True)
+class ProfileBindingView:
+    """Exact immutable profile authority exposed to integrations."""
+    profile_id: ProfileId
+    profile_digest: ProfileDigest
+
+
+@dataclass(frozen=True, slots=True)
+class DeviceInventoryView:
+    """Truthful paired-device inventory independent of application controller registration."""
+    device_id: LogicalDeviceId
+    device_kind: DeviceKind
+    product_id: ProductId
+    profile: ProfileBindingView | None
+    model_name: ModelName | None
+    pairing: PairingState
+    presence: PresenceState
+    availability: InventoryAvailability
+    support_level: SupportLevel
+    endpoints: tuple[EndpointSnapshot, ...]
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class PresentationView:
+    """Pinned upstream presentation authority without hardware transport policy."""
+    upstream_id: UpstreamId
+    owner: UpstreamOwner
+    project_version: ComponentVersion
+    source_revision: SourceRevision
+    model_key: PresentationKey
+    layout_key: PresentationKey | None
+    transport_variant: TransportVariant
+
+
+@dataclass(frozen=True, slots=True)
+class LightingTopologyView:
+    """Application-facing lighting dimensions without receiver carrier mapping."""
+    physical_led_count: LedCount
+    application_slot_count: LedCount
+    rows: LedCount
+    columns: LedCount
+
+
+@dataclass(frozen=True, slots=True)
+class UnownedController:
+    """Writable controller currently has no application owner."""
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class ViewerOwnedController:
+    """Writable controller is owned by the requesting client."""
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class OtherOwnedController:
+    """Writable controller is owned by another application client."""
+    client_id: ClientId
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerActions:
+    """Viewer-specific actions derived from availability and ownership."""
+    can_acquire: bool
+    can_release: bool
+    can_submit_now: bool
+
+
+@dataclass(frozen=True, slots=True)
+class RpcError:
+    """Stable structured request failure."""
+    request_id: RequestId | None
+    kind: ProtocolErrorKind
+    message: HumanMessage
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultGranted:
+    """Every requested resource was granted."""
+    OUTCOME: ClassVar[str] = "granted"
+    detail: LeaseGrant
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultConflict:
+    """Another client owns at least one requested resource; none were granted."""
+    OUTCOME: ClassVar[str] = "conflict"
+    detail: LeaseConflict
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultRejected:
+    """The request failed without granting any resource."""
+    OUTCOME: ClassVar[str] = "rejected"
+    detail: LeaseRejection
+
+
+LeaseResult: TypeAlias = LeaseResultGranted | LeaseResultConflict | LeaseResultRejected
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultProgress:
+    """The transaction has not reached a terminal state."""
+    OUTCOME: ClassVar[str] = "progress"
+    detail: TransactionProgress
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultTerminal:
+    """The immutable terminal outcome is retained."""
+    OUTCOME: ClassVar[str] = "terminal"
+    detail: TransactionTerminal
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultUnavailable:
+    """No retained outcome can answer this lookup."""
+    OUTCOME: ClassVar[str] = "unavailable"
+    detail: TransactionUnavailable
+
+
+TransactionResult: TypeAlias = TransactionResultProgress | TransactionResultTerminal | TransactionResultUnavailable
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipUnowned:
+    """No application currently owns the controller."""
+    STATE: ClassVar[str] = "unowned"
+    detail: UnownedController
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipOwnedByViewer:
+    """The requesting client owns the controller."""
+    STATE: ClassVar[str] = "owned-by-viewer"
+    detail: ViewerOwnedController
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipOwnedByOther:
+    """Another application client owns the controller."""
+    STATE: ClassVar[str] = "owned-by-other"
+    detail: OtherOwnedController
+
+
+ControllerOwnership: TypeAlias = ControllerOwnershipUnowned | ControllerOwnershipOwnedByViewer | ControllerOwnershipOwnedByOther
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerView:
+    """Exact qualified receiver-backed application controller."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    device_kind: DeviceKind
+    product_id: ProductId
+    receiver_profile: ProfileBindingView
+    device_profile: ProfileBindingView
+    model_name: ModelName
+    presentation: PresentationView
+    availability: ControllerAvailability
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+    lighting: LightingTopologyView
+    resource: ResourceKey
+    ownership: ControllerOwnership
+    actions: ControllerActions
+
+
+@dataclass(frozen=True, slots=True)
+class IntegrationReceiverView:
+    """One receiver generation with complete inventory and qualified controllers."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    profile: ProfileBindingView | None
+    model_name: ModelName | None
+    lifecycle: ReceiverLifecycleState
+    stable_restore_enabled: bool
+    restore_state: RestoreState
+    inventory: tuple[DeviceInventoryView, ...]
+    controllers: tuple[ControllerView, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class IntegrationView:
+    """Client-specific application view projected once by bridge policy."""
+    cursor: EventCursor
+    receivers: tuple[IntegrationReceiverView, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class NegotiationRequestEnvelope:
+    request_id: RequestId
+    params: ClientHello
+
+
+@dataclass(frozen=True, slots=True)
+class SessionRequestEnvelope(Generic[T]):
+    request_id: RequestId
+    protocol_session_id: ProtocolSessionId
+    negotiation_token: NegotiationToken
+    params: T
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNegotiate:
+    METHOD: ClassVar[str] = "negotiate"
+    request: NegotiationRequestEnvelope
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSnapshot:
+    METHOD: ClassVar[str] = "snapshot"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestIntegrationView:
+    METHOD: ClassVar[str] = "integration-view"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestAcquireLease:
+    METHOD: ClassVar[str] = "acquire-lease"
+    request: SessionRequestEnvelope[LeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestRenewLease:
+    METHOD: ClassVar[str] = "renew-lease"
+    request: SessionRequestEnvelope[RenewLeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestReleaseLease:
+    METHOD: ClassVar[str] = "release-lease"
+    request: SessionRequestEnvelope[ReleaseLeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSubmitTransaction:
+    METHOD: ClassVar[str] = "submit-transaction"
+    request: SessionRequestEnvelope[TransactionRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestTransactionOutcome:
+    METHOD: ClassVar[str] = "transaction-outcome"
+    request: SessionRequestEnvelope[TransactionLookup]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSubscribe:
+    METHOD: ClassVar[str] = "subscribe"
+    request: SessionRequestEnvelope[SubscriptionRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestDiagnostics:
+    METHOD: ClassVar[str] = "diagnostics"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+RpcRequest: TypeAlias = RpcRequestNegotiate | RpcRequestSnapshot | RpcRequestIntegrationView | RpcRequestAcquireLease | RpcRequestRenewLease | RpcRequestReleaseLease | RpcRequestSubmitTransaction | RpcRequestTransactionOutcome | RpcRequestSubscribe | RpcRequestDiagnostics
+
+
+@dataclass(frozen=True, slots=True)
+class SuccessEnvelope(Generic[T]):
+    request_id: RequestId
+    server_instance_id: ServerInstanceId
+    result: T
+
+
+@dataclass(frozen=True, slots=True)
+class ErrorEnvelope:
+    request_id: RequestId | None
+    server_instance_id: ServerInstanceId
+    error: RpcError
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNegotiateSuccess:
+    TYPE: ClassVar[str] = "negotiate-success"
+    response: SuccessEnvelope[ServerHello]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSnapshotSuccess:
+    TYPE: ClassVar[str] = "snapshot-success"
+    response: SuccessEnvelope[BridgeSnapshot]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseIntegrationViewSuccess:
+    TYPE: ClassVar[str] = "integration-view-success"
+    response: SuccessEnvelope[IntegrationView]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseAcquireLeaseSuccess:
+    TYPE: ClassVar[str] = "acquire-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseRenewLeaseSuccess:
+    TYPE: ClassVar[str] = "renew-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseReleaseLeaseSuccess:
+    TYPE: ClassVar[str] = "release-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSubmitTransactionSuccess:
+    TYPE: ClassVar[str] = "submit-transaction-success"
+    response: SuccessEnvelope[TransactionResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseTransactionOutcomeSuccess:
+    TYPE: ClassVar[str] = "transaction-outcome-success"
+    response: SuccessEnvelope[TransactionResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSubscribeSuccess:
+    TYPE: ClassVar[str] = "subscribe-success"
+    response: SuccessEnvelope[EventBatch]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseDiagnosticsSuccess:
+    TYPE: ClassVar[str] = "diagnostics-success"
+    response: SuccessEnvelope[DiagnosticSnapshot]
+
+
+RpcResponse: TypeAlias = RpcResponseNegotiateSuccess | RpcResponseSnapshotSuccess | RpcResponseIntegrationViewSuccess | RpcResponseAcquireLeaseSuccess | RpcResponseRenewLeaseSuccess | RpcResponseReleaseLeaseSuccess | RpcResponseSubmitTransactionSuccess | RpcResponseTransactionOutcomeSuccess | RpcResponseSubscribeSuccess | RpcResponseDiagnosticsSuccess | ErrorEnvelope
+
+
+METHODS = (
+    ("negotiate", "ClientHello", "ServerHello", None),
+    ("snapshot", "EmptyRequest", "BridgeSnapshot", None),
+    ("integration-view", "EmptyRequest", "IntegrationView", "integration-view-projection"),
+    ("acquire-lease", "LeaseRequest", "LeaseResult", "ownership-leases"),
+    ("renew-lease", "RenewLeaseRequest", "LeaseResult", "ownership-leases"),
+    ("release-lease", "ReleaseLeaseRequest", "LeaseResult", "ownership-leases"),
+    ("submit-transaction", "TransactionRequest", "TransactionResult", "atomic-transactions"),
+    ("transaction-outcome", "TransactionLookup", "TransactionResult", "atomic-transactions"),
+    ("subscribe", "SubscriptionRequest", "EventBatch", "event-subscriptions"),
+    ("diagnostics", "EmptyRequest", "DiagnosticSnapshot", "structured-diagnostics"),
+)
+
+__all__ = [
+    "MAXIMUM_PROTOCOL_VERSION",
+    "FIELD_LIMITS",
+    "MAX_JSON_DEPTH",
+    "MAX_WIRE_MESSAGE_BYTES",
+    "METHODS",
+    "MINIMUM_PROTOCOL_VERSION",
+    "SUPPORTED_FEATURES",
+    "EmptyRequest",
+    "RgbColor",
+    "ClientHello",
+    "ServerHello",
+    "ResourceKey",
+    "LeaseRequest",
+    "LeaseGrant",
+    "LeaseConflict",
+    "LeaseRejection",
+    "RenewLeaseRequest",
+    "ReleaseLeaseRequest",
+    "EventCursor",
+    "ReturnEpoch",
+    "EndpointSnapshot",
+    "BatteryObservation",
+    "ResourceOwnershipSnapshot",
+    "LogicalDeviceSnapshot",
+    "ReceiverSnapshot",
+    "BridgeSnapshot",
+    "LightingFrame",
+    "DeviceProfileBinding",
+    "StableLightingIntent",
+    "TransactionRequest",
+    "TransactionProgress",
+    "TransactionTerminal",
+    "TransactionUnavailable",
+    "TransactionLookup",
+    "SubscriptionRequest",
+    "BridgeEvent",
+    "EventBatch",
+    "DiagnosticFinding",
+    "DiagnosticSnapshot",
+    "ProfileBindingView",
+    "DeviceInventoryView",
+    "PresentationView",
+    "LightingTopologyView",
+    "UnownedController",
+    "ViewerOwnedController",
+    "OtherOwnedController",
+    "ControllerActions",
+    "RpcError",
+    "LeaseResultGranted",
+    "LeaseResultConflict",
+    "LeaseResultRejected",
+    "LeaseResult",
+    "TransactionResultProgress",
+    "TransactionResultTerminal",
+    "TransactionResultUnavailable",
+    "TransactionResult",
+    "ControllerOwnershipUnowned",
+    "ControllerOwnershipOwnedByViewer",
+    "ControllerOwnershipOwnedByOther",
+    "ControllerOwnership",
+    "ControllerView",
+    "IntegrationReceiverView",
+    "IntegrationView",
+    "NegotiationRequestEnvelope",
+    "SessionRequestEnvelope",
+    "SuccessEnvelope",
+    "ErrorEnvelope",
+    "RpcRequestNegotiate",
+    "RpcRequestSnapshot",
+    "RpcRequestIntegrationView",
+    "RpcRequestAcquireLease",
+    "RpcRequestRenewLease",
+    "RpcRequestReleaseLease",
+    "RpcRequestSubmitTransaction",
+    "RpcRequestTransactionOutcome",
+    "RpcRequestSubscribe",
+    "RpcRequestDiagnostics",
+    "RpcRequest",
+    "RpcResponseNegotiateSuccess",
+    "RpcResponseSnapshotSuccess",
+    "RpcResponseIntegrationViewSuccess",
+    "RpcResponseAcquireLeaseSuccess",
+    "RpcResponseRenewLeaseSuccess",
+    "RpcResponseReleaseLeaseSuccess",
+    "RpcResponseSubmitTransactionSuccess",
+    "RpcResponseTransactionOutcomeSuccess",
+    "RpcResponseSubscribeSuccess",
+    "RpcResponseDiagnosticsSuccess",
+    "RpcResponse",
+]
diff --git a/tests/cpp/domain_types_smoke.cpp b/tests/cpp/domain_types_smoke.cpp
index bf71572..d7b5a56 100644
--- a/tests/cpp/domain_types_smoke.cpp
+++ b/tests/cpp/domain_types_smoke.cpp
@@ -9,6 +9,7 @@
 #include <hyperflux/generated/protocol_v3_types.hpp>
 #include <hyperflux/generated/protocol_v4_types.hpp>
 #include <hyperflux/generated/protocol_v5_types.hpp>
+#include <hyperflux/generated/protocol_v6_types.hpp>
 
 #include <string_view>
 
@@ -37,8 +38,8 @@ int main()
     {
         return 3;
     }
-    static_assert(minimum_protocol_version == 5);
-    static_assert(maximum_protocol_version == 5);
+    static_assert(minimum_protocol_version == 6);
+    static_assert(maximum_protocol_version == 6);
     static_assert(v1::minimum_protocol_version == 1);
     static_assert(v1::maximum_protocol_version == 1);
     static_assert(v2::minimum_protocol_version == 2);
@@ -49,6 +50,8 @@ int main()
     static_assert(v4::maximum_protocol_version == 4);
     static_assert(v5::minimum_protocol_version == 5);
     static_assert(v5::maximum_protocol_version == 5);
+    static_assert(v6::minimum_protocol_version == 6);
+    static_assert(v6::maximum_protocol_version == 6);
     if(methods[0].name != std::string_view{"negotiate"}
        || methods[0].required_feature.has_value())
     {
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 2836387..f6a9b67 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "cc98c9d6c123f43e5da5a8b82b0221702d14ec00469a2a2c7dd239e267a2476f"
+  "source_sha256": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
 }
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index f2a1e4f..0550fd1 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -18,6 +18,7 @@
     _runtime_profile_digest,
     _validate_capabilities,
     _validate_candidates,
+    _validate_lifecycle_policy_catalog,
     _validate_profiles,
     compiled_catalog,
     composition_fixtures,
@@ -36,6 +37,47 @@ def validation_copies(self) -> tuple[list[dict], dict[str, dict], dict[str, dict
         claim_index = {claim["id"]: claim for claim in deepcopy(self.inputs.evidence["claims"])}
         return profiles, capability_index, claim_index
 
+    def lifecycle_policy_index(self) -> dict[str, dict]:
+        return _validate_lifecycle_policy_catalog(
+            deepcopy(self.inputs.lifecycle_policies)
+        )
+
+    def runtime_profile_digest(
+        self,
+        profile: dict,
+        capability_index: dict[str, dict],
+        lifecycle_policy_index: dict[str, dict] | None = None,
+    ) -> str:
+        policies = (
+            self.lifecycle_policy_index()
+            if lifecycle_policy_index is None
+            else lifecycle_policy_index
+        )
+        return _runtime_profile_digest(
+            profile,
+            capability_index,
+            policies,
+        )
+
+    def validate_profiles(
+        self,
+        profiles: list[dict],
+        capability_index: dict[str, dict],
+        claim_index: dict[str, dict],
+        lifecycle_policy_index: dict[str, dict] | None = None,
+    ) -> None:
+        policies = (
+            self.lifecycle_policy_index()
+            if lifecycle_policy_index is None
+            else lifecycle_policy_index
+        )
+        _validate_profiles(
+            profiles,
+            capability_index,
+            claim_index,
+            policies,
+        )
+
     def test_canonical_profiles_compile_deterministically(self) -> None:
         first = compiled_catalog(ROOT)
         second = compiled_catalog(ROOT)
@@ -50,34 +92,34 @@ def test_runtime_digest_is_profile_local_and_ignores_presentation_only_edits(sel
         profiles, capabilities, _ = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        mouse_before = _runtime_profile_digest(mouse, capabilities)
-        keyboard_before = _runtime_profile_digest(keyboard, capabilities)
+        mouse_before = self.runtime_profile_digest(mouse, capabilities)
+        keyboard_before = self.runtime_profile_digest(keyboard, capabilities)
 
         mouse["presentation"]["model_key"] = "presentation-only-change"
-        self.assertEqual(_runtime_profile_digest(mouse, capabilities), mouse_before)
+        self.assertEqual(self.runtime_profile_digest(mouse, capabilities), mouse_before)
 
         mouse["transport"]["lighting"]["application_index_to_carrier"][0] = 0
-        self.assertNotEqual(_runtime_profile_digest(mouse, capabilities), mouse_before)
-        self.assertEqual(_runtime_profile_digest(keyboard, capabilities), keyboard_before)
+        self.assertNotEqual(self.runtime_profile_digest(mouse, capabilities), mouse_before)
+        self.assertEqual(self.runtime_profile_digest(keyboard, capabilities), keyboard_before)
 
     def test_child_presentation_is_exact_typed_and_route_bound(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["presentation"]["surprise"] = "drift"
         with self.assertRaisesRegex(ModelError, "unsupported keys: surprise"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["presentation"]["source_commit"] = "short"
         with self.assertRaisesRegex(ModelError, "40 lowercase hex"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["presentation"]["transport_variant"] = "wired"
         with self.assertRaisesRegex(ModelError, "no matching device route"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_non_child_presentation_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
@@ -86,7 +128,7 @@ def test_non_child_presentation_is_rejected(self) -> None:
             next(profile for profile in profiles if profile["kind"] == "child")["presentation"]
         )
         with self.assertRaisesRegex(ModelError, "only child profiles"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_mouse_and_keyboard_require_no_sibling(self) -> None:
         for profile in self.inputs.profiles:
@@ -97,34 +139,34 @@ def test_exact_combination_key_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         profiles[0]["required_children"] = ["mouse", "keyboard"]
         with self.assertRaisesRegex(ModelError, "exact-combination keys are forbidden"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_child_sibling_dependency_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         child = next(profile for profile in profiles if profile["kind"] == "child")
         child["compatibility"]["required_sibling_kinds"] = ["keyboard"]
         with self.assertRaisesRegex(ModelError, "must not require a sibling"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_compatibility_is_kind_specific_bounded_and_route_checked(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         child = next(profile for profile in profiles if profile["kind"] == "child")
         child["compatibility"]["surprise"] = True
         with self.assertRaisesRegex(ModelError, "unsupported keys: surprise"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         child = next(profile for profile in profiles if profile["kind"] == "child")
         child["compatibility"]["routes"] = ["imaginary-route"]
         with self.assertRaisesRegex(ModelError, "invalid route kind"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_writable_capability_without_physical_evidence_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         claim = claims["claim.child.00cd.complete-led-map"]
         claim["evidence_level"] = "source-reviewed"
         with self.assertRaisesRegex(ModelError, "lacks public physical qualification"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_surface_usb_identity_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
@@ -132,136 +174,157 @@ def test_surface_usb_identity_is_rejected(self) -> None:
         surface["identity"]["vendor_id"] = 0x1532
         surface["identity"]["product_id"] = 0x00CF
         with self.assertRaisesRegex(ModelError, "must not invent USB identity"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_incomplete_or_repeated_carrier_map_is_rejected(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["transport"]["lighting"]["application_index_to_carrier"][1] = 1
         with self.assertRaisesRegex(ModelError, "repeats a receiver carrier"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_passive_decoder_is_lane_bound_disjoint_and_profile_local(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["transport"]["passive"]["endpoint_lane"] = "keyboard"
         with self.assertRaisesRegex(ModelError, "passive lane contradicts"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
         keyboard["transport"]["passive"]["route"]["unavailable"].append(3)
         keyboard["transport"]["passive"]["route"]["unavailable"].sort()
         with self.assertRaisesRegex(ModelError, "route values must be disjoint"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
         keyboard["transport"]["passive"]["route"]["indeterminate"].append(3)
         keyboard["transport"]["passive"]["route"]["indeterminate"].sort()
         with self.assertRaisesRegex(ModelError, "route values must be disjoint"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         del mouse["transport"]["passive"]
         with self.assertRaisesRegex(ModelError, "passive telemetry requires a decoder"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_passive_semantics_participate_in_runtime_profile_digest(self) -> None:
         profiles, capabilities, _ = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
-        before = _runtime_profile_digest(mouse, capabilities)
+        before = self.runtime_profile_digest(mouse, capabilities)
         mouse["transport"]["passive"]["contact"]["on_mat"] = [2]
-        self.assertNotEqual(_runtime_profile_digest(mouse, capabilities), before)
+        self.assertNotEqual(self.runtime_profile_digest(mouse, capabilities), before)
 
-    def test_lifecycle_policy_is_bounded_profile_local_and_digest_bound(self) -> None:
+    def test_lifecycle_profile_evidence_is_policy_bounded_and_digest_bound(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
-        before = _runtime_profile_digest(mouse, capabilities)
-        mouse["transport"]["lifecycle"]["device_return_settle_ms"] = 1_001
-        _validate_profiles(profiles, capabilities, claims)
-        self.assertNotEqual(_runtime_profile_digest(mouse, capabilities), before)
+        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
+        before = self.runtime_profile_digest(mouse, capabilities)
+        sibling_before = self.runtime_profile_digest(keyboard, capabilities)
+        mouse["transport"]["lifecycle"]["accelerator_evidence"] = [
+            "battery-report",
+            "contact-report",
+            "endpoint-activity",
+        ]
+        self.validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(self.runtime_profile_digest(mouse, capabilities), before)
+        self.assertEqual(self.runtime_profile_digest(keyboard, capabilities), sibling_before)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
-        mouse["transport"]["lifecycle"]["device_return_settle_ms"] = 0
-        with self.assertRaisesRegex(ModelError, "requires a positive settle time"):
-            _validate_profiles(profiles, capabilities, claims)
+        mouse["transport"]["lifecycle"]["return_policy_id"] = "missing.policy"
+        with self.assertRaisesRegex(ModelError, "unknown return policy"):
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["transport"]["passive"]["route"]["unavailable"] = [2]
         with self.assertRaisesRegex(ModelError, "contradicts passive route evidence"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        before = _runtime_profile_digest(keyboard, capabilities)
-        keyboard["transport"]["lifecycle"]["device_return_settle_ms"] = 1_001
-        _validate_profiles(profiles, capabilities, claims)
-        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
-        self.assertEqual(
-            keyboard["transport"]["lifecycle"]["power_off_departure_evidence"],
-            "receiver-state",
-        )
+        keyboard["transport"]["lifecycle"]["accelerator_evidence"].append("contact-report")
+        keyboard["transport"]["lifecycle"]["accelerator_evidence"].sort()
+        with self.assertRaisesRegex(ModelError, "contact return evidence lacks a decoder"):
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
-        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        before = _runtime_profile_digest(keyboard, capabilities)
-        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["settle_ms"] = 251
-        _validate_profiles(profiles, capabilities, claims)
-        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
+        mouse["transport"]["lifecycle"]["open_evidence"] = ["route-return"]
+        mouse["transport"]["lifecycle"]["accelerator_evidence"] = ["route-return"]
+        with self.assertRaisesRegex(ModelError, "route-return evidence lacks departure values"):
+            self.validate_profiles(profiles, capabilities, claims)
 
+    def test_lifecycle_policy_timing_is_central_bounded_and_authority_backed(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
+        mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        before = _runtime_profile_digest(keyboard, capabilities)
-        keyboard["transport"]["lifecycle"]["device_return_confirmation"][
-            "reassert_at_fallback"
-        ] = False
-        _validate_profiles(profiles, capabilities, claims)
-        self.assertNotEqual(_runtime_profile_digest(keyboard, capabilities), before)
+        before_mouse = self.runtime_profile_digest(mouse, capabilities)
+        before_keyboard = self.runtime_profile_digest(keyboard, capabilities)
+
+        catalog = deepcopy(self.inputs.lifecycle_policies)
+        catalog["policies"][0]["retry_offsets_ms"][-1] = 6_100
+        policies = _validate_lifecycle_policy_catalog(catalog)
+        self.validate_profiles(profiles, capabilities, claims, policies)
+        self.assertNotEqual(
+            self.runtime_profile_digest(mouse, capabilities, policies), before_mouse
+        )
+        self.assertNotEqual(
+            self.runtime_profile_digest(keyboard, capabilities, policies), before_keyboard
+        )
 
-        profiles, capabilities, claims = self.validation_copies()
-        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        keyboard["transport"]["lifecycle"]["device_return_confirmation"][
-            "reassert_at_fallback"
-        ] = 1
-        with self.assertRaisesRegex(ModelError, "fallback reassertion must be boolean"):
-            _validate_profiles(profiles, capabilities, claims)
+        metadata_only = deepcopy(self.inputs.lifecycle_policies)
+        metadata_only["policies"][0]["timing_authorities"][1]["summary"] += " More detail."
+        metadata_policies = _validate_lifecycle_policy_catalog(metadata_only)
+        self.assertEqual(
+            self.runtime_profile_digest(mouse, capabilities, metadata_policies), before_mouse
+        )
 
-        profiles, capabilities, claims = self.validation_copies()
-        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["evidence"] = "activity"
-        with self.assertRaisesRegex(ModelError, "unsupported return confirmation evidence"):
-            _validate_profiles(profiles, capabilities, claims)
+        invalid = deepcopy(self.inputs.lifecycle_policies)
+        invalid["policies"][0]["retry_offsets_ms"] = [0, 100, 100]
+        with self.assertRaisesRegex(ModelError, "retry offsets must be unique"):
+            _validate_lifecycle_policy_catalog(invalid)
 
-        profiles, capabilities, claims = self.validation_copies()
-        keyboard = next(profile for profile in profiles if profile["device_kind"] == "keyboard")
-        keyboard["transport"]["lifecycle"]["device_return_confirmation"]["settle_ms"] = 5_000
-        with self.assertRaisesRegex(ModelError, "confirmation must precede"):
-            _validate_profiles(profiles, capabilities, claims)
+        invalid = deepcopy(self.inputs.lifecycle_policies)
+        invalid["policies"][0]["quiescence_candidate_ms"] = 999
+        with self.assertRaisesRegex(ModelError, "quiescence candidate is out of bounds"):
+            _validate_lifecycle_policy_catalog(invalid)
+
+        invalid = deepcopy(self.inputs.lifecycle_policies)
+        invalid["policies"][0]["observation_jitter_ms"] = 60_000
+        with self.assertRaisesRegex(ModelError, "observation jitter tolerance is out of bounds"):
+            _validate_lifecycle_policy_catalog(invalid)
+
+        invalid = deepcopy(self.inputs.lifecycle_policies)
+        invalid["policies"][0]["timing_authorities"] = [
+            invalid["policies"][0]["timing_authorities"][1]
+        ]
+        with self.assertRaisesRegex(ModelError, "timing values require explicit authorities"):
+            _validate_lifecycle_policy_catalog(invalid)
 
     def test_qualification_migrations_are_exact_and_do_not_change_runtime_identity(self) -> None:
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
-        with_migration = _runtime_profile_digest(mouse, capabilities)
+        with_migration = self.runtime_profile_digest(mouse, capabilities)
         del mouse["qualification_migrations"]
-        self.assertEqual(_runtime_profile_digest(mouse, capabilities), with_migration)
+        self.assertEqual(self.runtime_profile_digest(mouse, capabilities), with_migration)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["qualification_migrations"][0]["preserve_stage_roles"] = ["identity"]
         with self.assertRaisesRegex(ModelError, "unsupported stage roles: identity"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
         profiles, capabilities, claims = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
         mouse["qualification_migrations"][0]["from_runtime_sha256"] = (
-            _runtime_profile_digest(mouse, capabilities)
+            self.runtime_profile_digest(mouse, capabilities)
         )
         with self.assertRaisesRegex(ModelError, "already equals the current runtime profile"):
-            _validate_profiles(profiles, capabilities, claims)
+            self.validate_profiles(profiles, capabilities, claims)
 
     def test_qualification_migration_rust_is_rustfmt_stable(self) -> None:
         migration = {
diff --git a/tests/test_protocol.py b/tests/test_protocol.py
index 975409e..8b5fe50 100644
--- a/tests/test_protocol.py
+++ b/tests/test_protocol.py
@@ -21,8 +21,8 @@
 class ProtocolCompilerTests(unittest.TestCase):
     def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
         registry = load_protocol_registry(ROOT)
-        self.assertEqual(registry.current_version, 5)
-        self.assertEqual([item.version for item in registry.versions], [1, 2, 3, 4, 5])
+        self.assertEqual(registry.current_version, 6)
+        self.assertEqual([item.version for item in registry.versions], [1, 2, 3, 4, 5, 6])
         self.assertEqual(
             registry.versions[0].source_sha256,
             "ed3df1f1627ca8a836f509ead3ab7dc7a4cbc6116f6da4accb2cc53e7500859f",
@@ -51,6 +51,7 @@ def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
             if record.name == "ReceiverSnapshot"
         )
         v5 = registry.versions[4].catalog
+        v6 = registry.versions[5].catalog
         self.assertNotIn(
             "device_profiles", [field.name for field in v1_transaction.fields]
         )
@@ -81,6 +82,14 @@ def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
         self.assertIn("profile_digest", [field.name for field in v4_snapshot.fields])
         self.assertIn("integration-view-projection", registry.versions[4].served_features)
         self.assertIn("ControllerOwnership", [union.name for union in v5.unions])
+        self.assertIn(
+            "return-lifecycle-projection", registry.versions[5].served_features
+        )
+        self.assertIn("ReturnEpoch", [record.name for record in v6.records])
+        v6_endpoint = next(
+            record for record in v6.records if record.name == "EndpointSnapshot"
+        )
+        self.assertIn("return_epoch", [field.name for field in v6_endpoint.fields])
         first = load_protocol_catalog(ROOT)
         second = load_protocol_catalog(ROOT)
         self.assertEqual(first, second)
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 94a667e..4d2f863 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -98,8 +98,6 @@ def rust_constants(runtime: LinuxRuntime) -> str:
             f"{bridge.timing.actor_response_timeout_ms:_};",
             "pub const KERNEL_SESSION_DURATION_MS: u64 = "
             f"{bridge.timing.kernel_session_duration_ms:_};",
-            "pub const ACTIVITY_RESUMPTION_QUIET_MS: u64 = "
-            f"{bridge.timing.activity_resumption_quiet_ms:_};",
             "pub const RESTORATION_MAX_PENDING_TRIGGERS: usize = "
             f"{bridge.restoration.max_pending_triggers:_};",
             "pub const RESTORATION_MAX_PENDING_CLAIMS: usize = "
@@ -173,7 +171,6 @@ def python_constants(runtime: LinuxRuntime) -> str:
         ("ACCEPT_POLL_INTERVAL_MS", bridge.timing.accept_poll_interval_ms),
         ("ACTOR_RESPONSE_TIMEOUT_MS", bridge.timing.actor_response_timeout_ms),
         ("KERNEL_SESSION_DURATION_MS", bridge.timing.kernel_session_duration_ms),
-        ("ACTIVITY_RESUMPTION_QUIET_MS", bridge.timing.activity_resumption_quiet_ms),
         ("RESTORATION_MAX_PENDING_TRIGGERS", bridge.restoration.max_pending_triggers),
         ("RESTORATION_MAX_PENDING_CLAIMS", bridge.restoration.max_pending_claims),
         ("RESTORATION_CLAIMS_PER_TICK", bridge.restoration.claims_per_tick),
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index c5f5d16..964a548 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -24,6 +24,31 @@ def _rust_variants(type_name: str, values: list[str]) -> str:
     return "&[" + ", ".join(f"{type_name}::{_variant(value)}" for value in values) + "]"
 
 
+def _rust_variant_field(
+    field_name: str, type_name: str, values: list[str], *, indent: str
+) -> list[str]:
+    tokens = [f"{type_name}::{_variant(value)}" for value in values]
+    single_line = f"{indent}{field_name}: &[{', '.join(tokens)}],"
+    if len(single_line) <= 100:
+        return [single_line]
+    return [
+        f"{indent}{field_name}: &[",
+        *(f"{indent}    {token}," for token in tokens),
+        f"{indent}],",
+    ]
+
+
+def _rust_number_field(field_name: str, values: list[int], *, indent: str) -> list[str]:
+    single_line = f"{indent}{field_name}: &[{', '.join(str(value) for value in values)}],"
+    if len(values) <= 8 and len(single_line) <= 100:
+        return [single_line]
+    return [
+        f"{indent}{field_name}: &[",
+        *_wrapped_numbers(values, indent=f"{indent}    "),
+        f"{indent}],",
+    ]
+
+
 def _rust_qualification_migrations(index: int, migrations: list[dict[str, Any]]) -> list[str]:
     declaration = (
         f"const QUALIFICATION_MIGRATIONS_{index}: &[QualificationMigrationRecord]"
@@ -222,22 +247,48 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
-        "pub enum DeviceReturnConfirmationEvidence {",
+        "pub enum ReturnEvidenceSource {",
         "    BatteryReport,",
+        "    ContactReport,",
+        "    EndpointActivity,",
+        "    RouteReturn,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum ReturnPolicyStrategy {",
+        "    ActivityAssistedReturnEpoch,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum ReturnPolicyQualification {",
+        "    PrequalificationCandidate,",
+        "    Qualified,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum ReturnDeliverySemantics {",
+        "    ReceiverDeliveredNotChildApplied,",
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
-        "pub struct DeviceReturnConfirmationRecord {",
-        "    pub evidence: DeviceReturnConfirmationEvidence,",
-        "    pub settle_ms: u64,",
-        "    pub reassert_at_fallback: bool,",
+        "pub struct ReturnPolicyRecord {",
+        "    pub id: &'static str,",
+        "    pub strategy: ReturnPolicyStrategy,",
+        "    pub qualification: ReturnPolicyQualification,",
+        "    pub quiescence_candidate_ms: u64,",
+        "    pub observation_jitter_ms: u64,",
+        "    pub retry_offsets_ms: &'static [u64],",
+        "    pub allowed_open_evidence: &'static [ReturnEvidenceSource],",
+        "    pub allowed_accelerator_evidence: &'static [ReturnEvidenceSource],",
+        "    pub delivery_semantics: ReturnDeliverySemantics,",
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct LifecyclePolicyRecord {",
         "    pub power_off_departure_evidence: PowerOffDepartureEvidence,",
-        "    pub device_return_settle_ms: u64,",
-        "    pub device_return_confirmation: Option<DeviceReturnConfirmationRecord>,",
+        "    pub return_policy_id: &'static str,",
+        "    pub open_evidence: &'static [ReturnEvidenceSource],",
+        "    pub accelerator_evidence: &'static [ReturnEvidenceSource],",
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
@@ -286,6 +337,49 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         f'    "{catalog["source_sha256"]}";',
         "",
     ]
+    policies = catalog["lifecycle_policies"]
+    single_policy = len(policies) == 1
+    lines.append(
+        "pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {"
+        if single_policy
+        else "pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &["
+    )
+    for policy in policies:
+        if not single_policy:
+            lines.append("    ReturnPolicyRecord {")
+        indent = "    " if single_policy else "        "
+        lines.extend(
+            [
+                f'{indent}id: {json.dumps(policy["id"])},',
+                f"{indent}strategy: ReturnPolicyStrategy::"
+                f"{_variant(policy['strategy'])},",
+                f"{indent}qualification: ReturnPolicyQualification::"
+                f"{_variant(policy['qualification'])},",
+                f"{indent}quiescence_candidate_ms: {policy['quiescence_candidate_ms']},",
+                f"{indent}observation_jitter_ms: {policy['observation_jitter_ms']},",
+                *_rust_number_field(
+                    "retry_offsets_ms", policy["retry_offsets_ms"], indent=indent
+                ),
+                *_rust_variant_field(
+                    "allowed_open_evidence",
+                    "ReturnEvidenceSource",
+                    policy["allowed_open_evidence"],
+                    indent=indent,
+                ),
+                *_rust_variant_field(
+                    "allowed_accelerator_evidence",
+                    "ReturnEvidenceSource",
+                    policy["allowed_accelerator_evidence"],
+                    indent=indent,
+                ),
+                f"{indent}delivery_semantics: ReturnDeliverySemantics::"
+                f"{_variant(policy['delivery_semantics'])},",
+            ]
+        )
+        lines.append("}];" if single_policy else "    },")
+    if not single_policy:
+        lines.append("];")
+    lines.append("")
     capability_defs = {item["id"]: item for item in catalog["capabilities"]}
     for index, profile in enumerate(catalog["profiles"]):
         capabilities_name = f"CAPABILITIES_{index}"
@@ -376,28 +470,29 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         lifecycle = profile.get("transport", {}).get("lifecycle")
         if lifecycle:
             departure = _variant(lifecycle["power_off_departure_evidence"])
-            confirmation = lifecycle.get("device_return_confirmation")
-            if confirmation:
-                confirmation_evidence = _variant(confirmation["evidence"])
-                confirmation_lines = [
-                    "            device_return_confirmation: Some(DeviceReturnConfirmationRecord {",
-                    "                evidence: DeviceReturnConfirmationEvidence::"
-                    f"{confirmation_evidence},",
-                    f"                settle_ms: {confirmation['settle_ms']},",
-                    "                reassert_at_fallback: "
-                    f"{str(confirmation['reassert_at_fallback']).lower()},",
-                    "            }),",
-                ]
-            else:
-                confirmation_lines = ["            device_return_confirmation: None,"]
             lifecycle_lines = [
                 "        lifecycle: Some(LifecyclePolicyRecord {",
                 "            power_off_departure_evidence: "
                 f"PowerOffDepartureEvidence::{departure},",
-                f"            device_return_settle_ms: {lifecycle['device_return_settle_ms']},",
-                *confirmation_lines,
-                "        }),",
+                f'            return_policy_id: {json.dumps(lifecycle["return_policy_id"])},',
             ]
+            lifecycle_lines.extend(
+                _rust_variant_field(
+                    "open_evidence",
+                    "ReturnEvidenceSource",
+                    lifecycle["open_evidence"],
+                    indent="            ",
+                )
+            )
+            lifecycle_lines.extend(
+                _rust_variant_field(
+                    "accelerator_evidence",
+                    "ReturnEvidenceSource",
+                    lifecycle["accelerator_evidence"],
+                    indent="            ",
+                )
+            )
+            lifecycle_lines.append("        }),")
         else:
             lifecycle_lines = ["        lifecycle: None,"]
         presentation = profile.get("presentation")
@@ -488,6 +583,11 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
             "    })",
             "}",
             "",
+            "#[must_use]",
+            "pub fn return_policy_by_id(id: &str) -> Option<&'static ReturnPolicyRecord> {",
+            "    RETURN_POLICIES.iter().find(|policy| policy.id == id)",
+            "}",
+            "",
         ]
     )
     return "\n".join(lines)
@@ -530,6 +630,57 @@ def cpp_catalog(catalog: dict[str, Any]) -> str:
         "    std::span<const std::uint16_t> application_index_to_carrier;",
         "};",
         "",
+        "enum class PowerOffDepartureEvidence",
+        "{",
+        "    ReceiverState,",
+        "    WatchedRetainedRoute,",
+        "};",
+        "",
+        "enum class ReturnEvidenceSource",
+        "{",
+        "    BatteryReport,",
+        "    ContactReport,",
+        "    EndpointActivity,",
+        "    RouteReturn,",
+        "};",
+        "",
+        "enum class ReturnPolicyStrategy",
+        "{",
+        "    ActivityAssistedReturnEpoch,",
+        "};",
+        "",
+        "enum class ReturnPolicyQualification",
+        "{",
+        "    PrequalificationCandidate,",
+        "    Qualified,",
+        "};",
+        "",
+        "enum class ReturnDeliverySemantics",
+        "{",
+        "    ReceiverDeliveredNotChildApplied,",
+        "};",
+        "",
+        "struct ReturnPolicyRecord",
+        "{",
+        "    std::string_view id;",
+        "    ReturnPolicyStrategy strategy;",
+        "    ReturnPolicyQualification qualification;",
+        "    std::uint64_t quiescence_candidate_ms;",
+        "    std::uint64_t observation_jitter_ms;",
+        "    std::span<const std::uint64_t> retry_offsets_ms;",
+        "    std::span<const ReturnEvidenceSource> allowed_open_evidence;",
+        "    std::span<const ReturnEvidenceSource> allowed_accelerator_evidence;",
+        "    ReturnDeliverySemantics delivery_semantics;",
+        "};",
+        "",
+        "struct LifecyclePolicyRecord",
+        "{",
+        "    PowerOffDepartureEvidence power_off_departure_evidence;",
+        "    std::string_view return_policy_id;",
+        "    std::span<const ReturnEvidenceSource> open_evidence;",
+        "    std::span<const ReturnEvidenceSource> accelerator_evidence;",
+        "};",
+        "",
         "struct PresentationRecord",
         "{",
         "    std::string_view upstream_id;",
@@ -561,12 +712,46 @@ def cpp_catalog(catalog: dict[str, Any]) -> str:
         "    bool exact_child_combinations;",
         "    std::span<const CapabilityRecord> capabilities;",
         "    const LightingTopology* lighting;",
+        "    const LifecyclePolicyRecord* lifecycle;",
         "    const PresentationRecord* presentation;",
         "};",
         "",
         f'inline constexpr std::string_view profile_source_sha256 = "{catalog["source_sha256"]}";',
         "",
     ]
+    for index, policy in enumerate(catalog["lifecycle_policies"]):
+        offsets = ", ".join(str(value) for value in policy["retry_offsets_ms"])
+        open_evidence = ", ".join(
+            f"ReturnEvidenceSource::{_variant(value)}" for value in policy["allowed_open_evidence"]
+        )
+        accelerator_evidence = ", ".join(
+            f"ReturnEvidenceSource::{_variant(value)}"
+            for value in policy["allowed_accelerator_evidence"]
+        )
+        lines.extend(
+            [
+                f"inline constexpr std::array<std::uint64_t, {len(policy['retry_offsets_ms'])}> return_retry_offsets_{index} {{{{{offsets}}}}};",
+                f"inline constexpr std::array<ReturnEvidenceSource, {len(policy['allowed_open_evidence'])}> return_open_evidence_{index} {{{{{open_evidence}}}}};",
+                f"inline constexpr std::array<ReturnEvidenceSource, {len(policy['allowed_accelerator_evidence'])}> return_accelerator_evidence_{index} {{{{{accelerator_evidence}}}}};",
+                "",
+            ]
+        )
+    lines.append(
+        f"inline constexpr std::array<ReturnPolicyRecord, {len(catalog['lifecycle_policies'])}> return_policies {{{{"
+    )
+    for index, policy in enumerate(catalog["lifecycle_policies"]):
+        lines.append(
+            "    {"
+            f'{json.dumps(policy["id"])}, '
+            f"ReturnPolicyStrategy::{_variant(policy['strategy'])}, "
+            f"ReturnPolicyQualification::{_variant(policy['qualification'])}, "
+            f"{policy['quiescence_candidate_ms']}, {policy['observation_jitter_ms']}, "
+            f"return_retry_offsets_{index}, "
+            f"return_open_evidence_{index}, return_accelerator_evidence_{index}, "
+            f"ReturnDeliverySemantics::{_variant(policy['delivery_semantics'])}"
+            "},"
+        )
+    lines.extend(["}};", ""])
     for index, profile in enumerate(catalog["profiles"]):
         compatibility = profile.get("compatibility", {})
         receiver_protocols = compatibility.get("receiver_protocols", [])
@@ -609,6 +794,27 @@ def cpp_catalog(catalog: dict[str, Any]) -> str:
                     "",
                 ]
             )
+        lifecycle = profile.get("transport", {}).get("lifecycle")
+        if lifecycle:
+            open_evidence = ", ".join(
+                f"ReturnEvidenceSource::{_variant(value)}" for value in lifecycle["open_evidence"]
+            )
+            accelerator_evidence = ", ".join(
+                f"ReturnEvidenceSource::{_variant(value)}"
+                for value in lifecycle["accelerator_evidence"]
+            )
+            lines.extend(
+                [
+                    f"inline constexpr std::array<ReturnEvidenceSource, {len(lifecycle['open_evidence'])}> lifecycle_open_evidence_{index} {{{{{open_evidence}}}}};",
+                    f"inline constexpr std::array<ReturnEvidenceSource, {len(lifecycle['accelerator_evidence'])}> lifecycle_accelerator_evidence_{index} {{{{{accelerator_evidence}}}}};",
+                    f"inline constexpr LifecyclePolicyRecord lifecycle_{index} {{",
+                    f"    PowerOffDepartureEvidence::{_variant(lifecycle['power_off_departure_evidence'])},",
+                    f"    {json.dumps(lifecycle['return_policy_id'])},",
+                    f"    lifecycle_open_evidence_{index}, lifecycle_accelerator_evidence_{index}",
+                    "};",
+                    "",
+                ]
+            )
         presentation = profile.get("presentation")
         if presentation:
             layout_key = (
@@ -641,13 +847,14 @@ def cpp_catalog(catalog: dict[str, Any]) -> str:
         )
         exact_child_combinations = str(compatibility.get("exact_child_combinations", False)).lower()
         lighting = f"&lighting_{index}" if profile.get("transport", {}).get("lighting") else "nullptr"
+        lifecycle = f"&lifecycle_{index}" if profile.get("transport", {}).get("lifecycle") else "nullptr"
         presentation = f"&presentation_{index}" if profile.get("presentation") else "nullptr"
         lines.append(
             "    {"
             f'"{profile["profile_id"]}", "{profile["runtime_sha256"]}", {profile["revision"]}, ProfileKind::{_variant(profile["kind"])}, '
             f'DeviceKind::{_variant(profile["device_kind"])}, {str(has_usb).lower()}, {vendor}, {product}, '
             f'"{profile["identity"]["model_name"]}", {backend_id}, {protocol_family}, receiver_protocols_{index}, routes_{index}, '
-            f'supported_child_kinds_{index}, required_sibling_kinds_{index}, {exact_child_combinations}, capabilities_{index}, {lighting}, {presentation}'
+            f'supported_child_kinds_{index}, required_sibling_kinds_{index}, {exact_child_combinations}, capabilities_{index}, {lighting}, {lifecycle}, {presentation}'
             "},"
         )
     lines.extend(
@@ -666,6 +873,18 @@ def cpp_catalog(catalog: dict[str, Any]) -> str:
             "    return nullptr;",
             "}",
             "",
+            "[[nodiscard]] constexpr const ReturnPolicyRecord* return_policy_by_id(std::string_view id)",
+            "{",
+            "    for(const auto& policy : return_policies)",
+            "    {",
+            "        if(policy.id == id)",
+            "        {",
+            "            return &policy;",
+            "        }",
+            "    }",
+            "    return nullptr;",
+            "}",
+            "",
             "} // namespace hyperflux::profiles",
             "",
         ]
diff --git a/tools/hfxdev/linux_runtime.py b/tools/hfxdev/linux_runtime.py
index 9525843..7a3d94e 100644
--- a/tools/hfxdev/linux_runtime.py
+++ b/tools/hfxdev/linux_runtime.py
@@ -49,7 +49,6 @@
     "accept_poll_interval_ms",
     "actor_response_timeout_ms",
     "kernel_session_duration_ms",
-    "activity_resumption_quiet_ms",
 }
 BRIDGE_RESTORATION_KEYS = {
     "max_pending_triggers",
@@ -120,7 +119,6 @@ class BridgeTiming:
     accept_poll_interval_ms: int
     actor_response_timeout_ms: int
     kernel_session_duration_ms: int
-    activity_resumption_quiet_ms: int
 
 
 @dataclass(frozen=True)
@@ -436,12 +434,6 @@ def load_linux_runtime(root: Path) -> LinuxRuntime:
             kernel_session_duration_ms=_bounded_integer(
                 timing_value["kernel_session_duration_ms"], "kernel session duration", 6000, 300000
             ),
-            activity_resumption_quiet_ms=_bounded_integer(
-                timing_value["activity_resumption_quiet_ms"],
-                "activity resumption quiet interval",
-                1000,
-                3_600_000,
-            ),
         ),
         restoration=BridgeRestoration(
             max_pending_triggers=_bounded_integer(
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 9783b3d..56ec85e 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -76,17 +76,41 @@
 }
 LIFECYCLE_KEYS = {
     "power_off_departure_evidence",
-    "device_return_settle_ms",
-    "device_return_confirmation",
-}
-LIFECYCLE_REQUIRED_KEYS = {
-    "power_off_departure_evidence",
-    "device_return_settle_ms",
+    "return_policy_id",
+    "open_evidence",
+    "accelerator_evidence",
 }
+LIFECYCLE_REQUIRED_KEYS = LIFECYCLE_KEYS
 POWER_OFF_DEPARTURE_EVIDENCE = {"receiver-state", "watched-retained-route"}
-DEVICE_RETURN_CONFIRMATION_KEYS = {"evidence", "settle_ms", "reassert_at_fallback"}
-DEVICE_RETURN_CONFIRMATION_EVIDENCE = {"battery-report"}
-MAX_DEVICE_RETURN_SETTLE_MS = 30_000
+RETURN_EVIDENCE_SOURCES = {
+    "battery-report",
+    "contact-report",
+    "endpoint-activity",
+    "route-return",
+}
+LIFECYCLE_POLICY_KEYS = {
+    "id",
+    "strategy",
+    "qualification",
+    "quiescence_candidate_ms",
+    "observation_jitter_ms",
+    "retry_offsets_ms",
+    "allowed_open_evidence",
+    "allowed_accelerator_evidence",
+    "delivery_semantics",
+    "timing_authorities",
+}
+LIFECYCLE_TIMING_AUTHORITY_KEYS = {"kind", "source_id", "source_sha256", "summary"}
+LIFECYCLE_POLICY_STRATEGIES = {"activity-assisted-return-epoch"}
+LIFECYCLE_POLICY_QUALIFICATIONS = {"prequalification-candidate", "qualified"}
+LIFECYCLE_TIMING_AUTHORITY_KINDS = {
+    "pinned-upstream-contract",
+    "prequalification-hypothesis",
+    "physical-qualification",
+}
+MAX_RETURN_RETRY_ATTEMPTS = 32
+MAX_RETURN_RETRY_WINDOW_MS = 30_000
+MAX_QUIESCENCE_CANDIDATE_MS = 900_000
 QUALIFICATION_MIGRATION_KEYS = {"from_runtime_sha256", "preserve_stage_roles"}
 QUALIFICATION_MIGRATION_STAGE_ROLES = {"lighting", "map", "telemetry"}
 PASSIVE_TELEMETRY_CAPABILITIES = {
@@ -106,6 +130,7 @@
 class ProfileInputs:
     capabilities: dict[str, Any]
     evidence: dict[str, Any]
+    lifecycle_policies: dict[str, Any]
     profiles: tuple[dict[str, Any], ...]
     candidates: tuple[dict[str, Any], ...]
     source_sha256: str
@@ -126,7 +151,9 @@ def _source_digest(documents: list[tuple[str, dict[str, Any]]]) -> str:
 
 
 def _runtime_profile_digest(
-    profile: dict[str, Any], capability_index: dict[str, dict[str, Any]]
+    profile: dict[str, Any],
+    capability_index: dict[str, dict[str, Any]],
+    lifecycle_policy_index: dict[str, dict[str, Any]],
 ) -> str:
     identity = profile["identity"]
     runtime_identity = {
@@ -134,6 +161,17 @@ def _runtime_profile_digest(
         for key in ("authority", "vendor_id", "product_id", "variant_key")
         if key in identity
     }
+    transport = deepcopy(profile.get("transport", {}))
+    lifecycle = transport.get("lifecycle")
+    if lifecycle is not None:
+        policy = lifecycle_policy_index[lifecycle["return_policy_id"]]
+        lifecycle["resolved_return_policy"] = {
+            "strategy": policy["strategy"],
+            "quiescence_candidate_ms": policy["quiescence_candidate_ms"],
+            "observation_jitter_ms": policy["observation_jitter_ms"],
+            "retry_offsets_ms": policy["retry_offsets_ms"],
+            "delivery_semantics": policy["delivery_semantics"],
+        }
     runtime_contract = {
         "schema": "hyperflux-runtime-profile-binding-v1",
         "profile_id": profile["profile_id"],
@@ -142,7 +180,7 @@ def _runtime_profile_digest(
         "device_kind": profile["device_kind"],
         "identity": runtime_identity,
         "compatibility": profile["compatibility"],
-        "transport": profile.get("transport", {}),
+        "transport": transport,
         "capabilities": [
             {
                 "id": capability["id"],
@@ -477,7 +515,9 @@ def _raw_values(value: object, label: str) -> list[int]:
     return value
 
 
-def _validate_passive(profile: dict[str, Any]) -> None:
+def _validate_passive(
+    profile: dict[str, Any], lifecycle_policy_index: dict[str, dict[str, Any]]
+) -> None:
     transport = profile.get("transport", {})
     if not isinstance(transport, dict):
         raise ModelError(f"{profile['profile_id']}: transport must be an object")
@@ -526,7 +566,7 @@ def _validate_passive(profile: dict[str, Any]) -> None:
     if passive is None:
         if needs_passive:
             raise ModelError(f"{profile['profile_id']}: passive telemetry requires a decoder")
-        _validate_lifecycle_policy(profile, transport, passive)
+        _validate_lifecycle_policy(profile, transport, passive, lifecycle_policy_index)
         return
     if not isinstance(passive, dict):
         raise ModelError(f"{profile['profile_id']}: passive decoder must be an object")
@@ -577,13 +617,119 @@ def _validate_passive(profile: dict[str, Any]) -> None:
         available or unavailable or passive["report_implies_route_available"]
     ):
         raise ModelError(f"{profile['profile_id']}: connection evidence has no route decoder")
-    _validate_lifecycle_policy(profile, transport, passive)
+    _validate_lifecycle_policy(profile, transport, passive, lifecycle_policy_index)
+
+
+def _validate_lifecycle_policy_catalog(catalog: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    if catalog.get("schema") != "hyperflux-lifecycle-policy-catalog-v1":
+        raise ModelError("unsupported lifecycle policy catalog schema")
+    _expect_keys(catalog, {"$schema", "schema", "policies"}, "lifecycle policy catalog")
+    policies = catalog.get("policies")
+    if not isinstance(policies, list) or not policies:
+        raise ModelError("lifecycle policy catalog is empty")
+    identifiers: list[str] = []
+    for policy in policies:
+        if not isinstance(policy, dict):
+            raise ModelError("lifecycle policy must be an object")
+        _expect_keys(policy, LIFECYCLE_POLICY_KEYS, "lifecycle policy")
+        missing = sorted(LIFECYCLE_POLICY_KEYS - set(policy))
+        if missing:
+            raise ModelError(f"incomplete lifecycle policy: {', '.join(missing)}")
+        identifier = _expect_nonempty_string(policy["id"], "lifecycle policy id")
+        identifiers.append(identifier)
+        if policy["strategy"] not in LIFECYCLE_POLICY_STRATEGIES:
+            raise ModelError(f"{identifier}: unsupported lifecycle strategy")
+        qualification = policy["qualification"]
+        if qualification not in LIFECYCLE_POLICY_QUALIFICATIONS:
+            raise ModelError(f"{identifier}: invalid lifecycle qualification")
+        quiescence_ms = policy["quiescence_candidate_ms"]
+        if (
+            isinstance(quiescence_ms, bool)
+            or not isinstance(quiescence_ms, int)
+            or not 1_000 <= quiescence_ms <= MAX_QUIESCENCE_CANDIDATE_MS
+        ):
+            raise ModelError(f"{identifier}: quiescence candidate is out of bounds")
+        observation_jitter_ms = policy["observation_jitter_ms"]
+        if (
+            isinstance(observation_jitter_ms, bool)
+            or not isinstance(observation_jitter_ms, int)
+            or not 0 <= observation_jitter_ms <= 5_000
+            or observation_jitter_ms >= quiescence_ms
+        ):
+            raise ModelError(f"{identifier}: observation jitter tolerance is out of bounds")
+        offsets = policy["retry_offsets_ms"]
+        if (
+            not isinstance(offsets, list)
+            or not 2 <= len(offsets) <= MAX_RETURN_RETRY_ATTEMPTS
+            or any(isinstance(value, bool) or not isinstance(value, int) for value in offsets)
+            or offsets != sorted(set(offsets))
+            or offsets[0] != 0
+            or offsets[-1] > MAX_RETURN_RETRY_WINDOW_MS
+        ):
+            raise ModelError(
+                f"{identifier}: retry offsets must be unique, increasing, begin at zero, and remain bounded"
+            )
+        open_evidence = _expect_unique_string_list(
+            policy["allowed_open_evidence"],
+            f"{identifier} allowed open evidence",
+            allow_empty=False,
+        )
+        accelerator_evidence = _expect_unique_string_list(
+            policy["allowed_accelerator_evidence"],
+            f"{identifier} allowed accelerator evidence",
+            allow_empty=False,
+        )
+        if set(open_evidence) - RETURN_EVIDENCE_SOURCES or set(accelerator_evidence) - RETURN_EVIDENCE_SOURCES:
+            raise ModelError(f"{identifier}: unsupported return evidence source")
+        if not set(open_evidence) <= set(accelerator_evidence):
+            raise ModelError(f"{identifier}: opening evidence must also accelerate an active epoch")
+        if policy["delivery_semantics"] != "receiver-delivered-not-child-applied":
+            raise ModelError(f"{identifier}: lifecycle delivery semantics overclaim child application")
+        authorities = policy["timing_authorities"]
+        if not isinstance(authorities, list) or len(authorities) < 2:
+            raise ModelError(f"{identifier}: timing values require explicit authorities")
+        authority_kinds: set[str] = set()
+        for authority in authorities:
+            if not isinstance(authority, dict):
+                raise ModelError(f"{identifier}: timing authority must be an object")
+            _expect_keys(authority, LIFECYCLE_TIMING_AUTHORITY_KEYS, f"{identifier} timing authority")
+            missing_authority = {"kind", "source_id", "summary"} - set(authority)
+            if missing_authority:
+                raise ModelError(
+                    f"{identifier}: incomplete timing authority: {', '.join(sorted(missing_authority))}"
+                )
+            kind = authority["kind"]
+            if kind not in LIFECYCLE_TIMING_AUTHORITY_KINDS:
+                raise ModelError(f"{identifier}: unsupported timing authority kind")
+            authority_kinds.add(kind)
+            _expect_nonempty_string(authority["source_id"], f"{identifier} timing source")
+            _expect_nonempty_string(authority["summary"], f"{identifier} timing summary")
+            source_sha256 = authority.get("source_sha256")
+            if source_sha256 is not None and (
+                not isinstance(source_sha256, str)
+                or DIGEST_PATTERN.fullmatch(source_sha256) is None
+            ):
+                raise ModelError(f"{identifier}: timing source digest must be lowercase SHA-256")
+            if kind == "pinned-upstream-contract" and source_sha256 is None:
+                raise ModelError(f"{identifier}: pinned timing authority requires a source digest")
+        if "pinned-upstream-contract" not in authority_kinds:
+            raise ModelError(f"{identifier}: quiescence timing lacks a pinned upstream contract")
+        if qualification == "prequalification-candidate":
+            if "prequalification-hypothesis" not in authority_kinds:
+                raise ModelError(f"{identifier}: candidate retry timing lacks an explicit hypothesis")
+        elif "physical-qualification" not in authority_kinds:
+            raise ModelError(f"{identifier}: qualified retry timing lacks physical evidence")
+    require_unique(identifiers, "lifecycle policy id")
+    if identifiers != sorted(identifiers):
+        raise ModelError("lifecycle policies must be sorted by id")
+    return {policy["id"]: policy for policy in policies}
 
 
 def _validate_lifecycle_policy(
     profile: dict[str, Any],
     transport: dict[str, Any],
     passive: object,
+    lifecycle_policy_index: dict[str, dict[str, Any]],
 ) -> None:
     lifecycle = transport.get("lifecycle")
     if lifecycle is None:
@@ -599,13 +745,30 @@ def _validate_lifecycle_policy(
     departure = lifecycle["power_off_departure_evidence"]
     if departure not in POWER_OFF_DEPARTURE_EVIDENCE:
         raise ModelError(f"{profile['profile_id']}: unsupported power-off departure evidence")
-    settle_ms = lifecycle["device_return_settle_ms"]
-    if (
-        isinstance(settle_ms, bool)
-        or not isinstance(settle_ms, int)
-        or not 0 <= settle_ms <= MAX_DEVICE_RETURN_SETTLE_MS
-    ):
-        raise ModelError(f"{profile['profile_id']}: device-return settle time is out of bounds")
+    policy_id = lifecycle["return_policy_id"]
+    policy = lifecycle_policy_index.get(policy_id)
+    if policy is None:
+        raise ModelError(f"{profile['profile_id']}: unknown return policy: {policy_id}")
+    open_evidence = _expect_unique_string_list(
+        lifecycle["open_evidence"],
+        f"{profile['profile_id']} return opening evidence",
+        allow_empty=False,
+    )
+    accelerator_evidence = _expect_unique_string_list(
+        lifecycle["accelerator_evidence"],
+        f"{profile['profile_id']} return accelerator evidence",
+        allow_empty=False,
+    )
+    if not set(open_evidence) <= set(policy["allowed_open_evidence"]):
+        raise ModelError(f"{profile['profile_id']}: opening evidence is not allowed by its return policy")
+    if not set(accelerator_evidence) <= set(policy["allowed_accelerator_evidence"]):
+        raise ModelError(
+            f"{profile['profile_id']}: accelerator evidence is not allowed by its return policy"
+        )
+    if not set(open_evidence) <= set(accelerator_evidence):
+        raise ModelError(
+            f"{profile['profile_id']}: opening evidence must also accelerate an active epoch"
+        )
     if departure == "watched-retained-route":
         if (
             not isinstance(passive, dict)
@@ -615,56 +778,23 @@ def _validate_lifecycle_policy(
             raise ModelError(
                 f"{profile['profile_id']}: retained-route departure contradicts passive route evidence"
             )
-        if settle_ms == 0:
-            raise ModelError(
-                f"{profile['profile_id']}: retained-route return requires a positive settle time"
-            )
-    confirmation = lifecycle.get("device_return_confirmation")
-    if confirmation is None:
-        return
-    if not isinstance(confirmation, dict):
-        raise ModelError(
-            f"{profile['profile_id']}: device-return confirmation must be an object or null"
-        )
-    _expect_keys(
-        confirmation,
-        DEVICE_RETURN_CONFIRMATION_KEYS,
-        f"{profile['profile_id']} device-return confirmation",
-    )
-    missing = sorted(DEVICE_RETURN_CONFIRMATION_KEYS - set(confirmation))
-    if missing:
-        raise ModelError(
-            f"{profile['profile_id']}: incomplete device-return confirmation: "
-            f"{', '.join(missing)}"
-        )
-    evidence = confirmation["evidence"]
-    if evidence not in DEVICE_RETURN_CONFIRMATION_EVIDENCE:
-        raise ModelError(f"{profile['profile_id']}: unsupported return confirmation evidence")
-    confirmation_settle_ms = confirmation["settle_ms"]
-    if (
-        isinstance(confirmation_settle_ms, bool)
-        or not isinstance(confirmation_settle_ms, int)
-        or not 0 <= confirmation_settle_ms <= MAX_DEVICE_RETURN_SETTLE_MS
+    evidence = set(open_evidence) | set(accelerator_evidence)
+    if evidence & {"battery-report", "contact-report", "endpoint-activity", "route-return"} and not isinstance(passive, dict):
+        raise ModelError(f"{profile['profile_id']}: return evidence requires a passive decoder")
+    if "contact-report" in evidence and (
+        profile["device_kind"] != "mouse"
+        or passive["contact"] is None
+        or not passive["contact"]["on_mat"]
     ):
-        raise ModelError(
-            f"{profile['profile_id']}: return confirmation settle time is out of bounds"
-        )
-    if settle_ms == 0 or confirmation_settle_ms >= settle_ms:
-        raise ModelError(
-            f"{profile['profile_id']}: confirmation must precede a positive return fallback"
-        )
-    if not isinstance(confirmation["reassert_at_fallback"], bool):
-        raise ModelError(
-            f"{profile['profile_id']}: return fallback reassertion must be boolean"
-        )
-    if evidence == "battery-report" and not isinstance(passive, dict):
-        raise ModelError(
-            f"{profile['profile_id']}: battery confirmation requires a passive decoder"
-        )
+        raise ModelError(f"{profile['profile_id']}: contact return evidence lacks a decoder")
+    if "route-return" in evidence and not passive["route"]["unavailable"]:
+        raise ModelError(f"{profile['profile_id']}: route-return evidence lacks departure values")
 
 
 def _validate_qualification_migrations(
-    profile: dict[str, Any], capability_index: dict[str, dict[str, Any]]
+    profile: dict[str, Any],
+    capability_index: dict[str, dict[str, Any]],
+    lifecycle_policy_index: dict[str, dict[str, Any]],
 ) -> None:
     migrations = profile.get("qualification_migrations")
     if migrations is None:
@@ -692,7 +822,9 @@ def _validate_qualification_migrations(
     }:
         available_roles.add("lighting")
 
-    current_digest = _runtime_profile_digest(profile, capability_index)
+    current_digest = _runtime_profile_digest(
+        profile, capability_index, lifecycle_policy_index
+    )
     predecessors: list[str] = []
     for index, migration in enumerate(migrations):
         label = f"{identifier} qualification migration {index}"
@@ -806,6 +938,7 @@ def _validate_profiles(
     profiles: list[dict[str, Any]],
     capability_index: dict[str, dict[str, Any]],
     claim_index: dict[str, dict[str, Any]],
+    lifecycle_policy_index: dict[str, dict[str, Any]],
 ) -> None:
     profile_ids = [profile["profile_id"] for profile in profiles]
     require_unique(profile_ids, "hardware profile id")
@@ -897,22 +1030,27 @@ def _validate_profiles(
         if kind == "surface" and any(capability_index[item["id"]]["access"] == "write" for item in capabilities):
             raise ModelError(f"{identifier}: surface profile exposes an unqualified write")
         _validate_lighting(profile)
-        _validate_passive(profile)
-        _validate_qualification_migrations(profile, capability_index)
+        _validate_passive(profile, lifecycle_policy_index)
+        _validate_qualification_migrations(
+            profile, capability_index, lifecycle_policy_index
+        )
     require_unique(identities, "profile hardware identity")
 
 
 def load_profile_inputs(root: Path) -> ProfileInputs:
     capabilities = load_json(root / "profiles" / "capabilities.json")
     evidence = load_json(root / "profiles" / "evidence" / "claims.json")
+    lifecycle_policies = load_json(root / "profiles" / "lifecycle-policies.json")
     documents, profiles, candidate_catalogs = _load_documents(root)
     documents.extend(
         [
             ("profiles/capabilities.json", capabilities),
             ("profiles/evidence/claims.json", evidence),
+            ("profiles/lifecycle-policies.json", lifecycle_policies),
         ]
     )
     capability_index = _validate_capabilities(capabilities)
+    lifecycle_policy_index = _validate_lifecycle_policy_catalog(lifecycle_policies)
     snapshot_ids, candidates = _validate_candidates(candidate_catalogs)
     profile_ids = {profile.get("profile_id") for profile in profiles if isinstance(profile.get("profile_id"), str)}
     claims = _validate_evidence(
@@ -928,11 +1066,12 @@ def load_profile_inputs(root: Path) -> ProfileInputs:
             raise ModelError(f"{catalog['snapshot_id']}: source claim does not cover candidate snapshot")
         if claim["qualifies_capabilities"]:
             raise ModelError(f"{catalog['snapshot_id']}: candidate source claim must not qualify capabilities")
-    _validate_profiles(profiles, capability_index, claims)
+    _validate_profiles(profiles, capability_index, claims, lifecycle_policy_index)
     _validate_presentation_sources(profiles, upstream_index(root))
     return ProfileInputs(
         capabilities=capabilities,
         evidence=evidence,
+        lifecycle_policies=lifecycle_policies,
         profiles=tuple(sorted(profiles, key=lambda value: value["profile_id"])),
         candidates=tuple(sorted(candidates, key=lambda value: (value["snapshot_id"], value["id"]))),
         source_sha256=_source_digest(documents),
@@ -942,13 +1081,18 @@ def load_profile_inputs(root: Path) -> ProfileInputs:
 def compiled_catalog(root: Path) -> dict[str, Any]:
     inputs = load_profile_inputs(root)
     capability_index = {item["id"]: item for item in inputs.capabilities["capabilities"]}
+    lifecycle_policy_index = {
+        item["id"]: item for item in inputs.lifecycle_policies["policies"]
+    }
     profiles: list[dict[str, Any]] = []
     for profile in inputs.profiles:
         compiled = deepcopy({key: value for key, value in profile.items() if key != "$schema"})
         compiled["source_path"] = compiled.pop("_source_path")
         for capability in compiled["capabilities"]:
             capability["access"] = capability_index[capability["id"]]["access"]
-        compiled["runtime_sha256"] = _runtime_profile_digest(profile, capability_index)
+        compiled["runtime_sha256"] = _runtime_profile_digest(
+            profile, capability_index, lifecycle_policy_index
+        )
         profiles.append(compiled)
     return {
         "schema": "hyperflux-compiled-profile-catalog-v1",
@@ -962,6 +1106,7 @@ def compiled_catalog(root: Path) -> dict[str, Any]:
         },
         "capabilities": deepcopy(inputs.capabilities["capabilities"]),
         "evidence_claims": deepcopy(inputs.evidence["claims"]),
+        "lifecycle_policies": deepcopy(inputs.lifecycle_policies["policies"]),
         "profiles": profiles,
         "candidates": deepcopy(list(inputs.candidates)),
     }
diff --git a/tools/hfxdev/verification_run.py b/tools/hfxdev/verification_run.py
index 39b0b04..f41306c 100644
--- a/tools/hfxdev/verification_run.py
+++ b/tools/hfxdev/verification_run.py
@@ -45,7 +45,7 @@
     ("integration-catalog", "integrations/catalog.json", "file"),
     ("performance-budgets", "assurance/performance-budgets.json", "file"),
     ("protected-behavior", "assurance/protected-behavior.json", "file"),
-    ("protocol-catalog", "protocol/v5/catalog.json", "file"),
+    ("protocol-catalog", "protocol/v6/catalog.json", "file"),
     ("release-gates", "assurance/release-gates.json", "file"),
     ("replay-fixtures", "tests/fixtures/replay", "tree"),
     ("shadow-fixtures", "tests/fixtures/shadow", "tree"),

From 29bf5ab1ccb7d99775e7392c3980de4da4b6209d Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 15:52:23 +0400
Subject: [PATCH 34/67] Keep package binaries within reviewed size budgets

---
 tests/test_package_pipeline.py   | 1 +
 tools/hfxdev/package_pipeline.py | 1 +
 2 files changed, 2 insertions(+)

diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index bbfd464..b86be62 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -234,6 +234,7 @@ def test_build_environment_remaps_source_output_and_dependency_paths(self) -> No
             self.assertIn(f"-ffile-prefix-map={private}=", environment["CFLAGS"])
             self.assertIn(f"-fdebug-prefix-map={private}=", environment["CXXFLAGS"])
         self.assertEqual(environment["CARGO_NET_OFFLINE"], "true")
+        self.assertEqual(environment["CARGO_PROFILE_RELEASE_STRIP"], "symbols")
         self.assertEqual(environment["PIP_NO_INDEX"], "1")
         self.assertEqual(environment["CC"], "clang")
         self.assertEqual(environment["CMAKE_GENERATOR"], "Ninja")
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index 53227f6..4744a85 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -173,6 +173,7 @@ def _base_environment(root: Path, output: Path, epoch: int) -> dict[str, str]:
             "PYTHONHASHSEED": "0",
             "CARGO_INCREMENTAL": "0",
             "CARGO_NET_OFFLINE": "true",
+            "CARGO_PROFILE_RELEASE_STRIP": "symbols",
             "CARGO_TARGET_DIR": str(output / "work" / "cargo-target"),
             "RUSTFLAGS": rust_remap,
             "PIP_DISABLE_PIP_VERSION_CHECK": "1",

From 13975278cda3c7284b1478602ac1cdbd6849b1f4 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Fri, 24 Jul 2026 16:28:19 +0400
Subject: [PATCH 35/67] Recover profile migrations across package restart

---
 crates/hfx-daemon/src/restoration.rs | 396 +++++++++++++++++++++++----
 1 file changed, 340 insertions(+), 56 deletions(-)

diff --git a/crates/hfx-daemon/src/restoration.rs b/crates/hfx-daemon/src/restoration.rs
index 6ff22d2..68e0888 100644
--- a/crates/hfx-daemon/src/restoration.rs
+++ b/crates/hfx-daemon/src/restoration.rs
@@ -83,6 +83,12 @@ enum ScheduledTriggerPurpose {
     ReturnAttempt(u8),
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum PendingClaimSchedule {
+    At(MonotonicMs),
+    Trigger(RestoreTriggerKind),
+}
+
 #[derive(Clone, Debug)]
 struct ScheduledClaim {
     receiver_id: ReceiverId,
@@ -650,48 +656,31 @@ impl RestorationScheduler {
                     | DesiredEffectReplayStatus::Invalidated => {}
                 }
             }
-            let migrated = controller.rebind_compatible_stable_intents(&scheduled.trigger)?;
+            let Some(migrated) = self.rebind_or_recover_blocking_claims(
+                controller,
+                &trigger_id,
+                &mut scheduled,
+                now,
+                report,
+            )?
+            else {
+                if newly_configured {
+                    self.configured_receivers.insert(receiver_id);
+                }
+                return Ok(());
+            };
             let pending = newly_configured
                 .then(|| controller.pending_records(&scheduled.trigger.receiver_id))
                 .transpose()?
                 .unwrap_or_default();
-            if pending.is_empty() || migrated > 0 {
-                match controller.plan_restore(&scheduled.trigger) {
-                    Ok(RestorePlanResult::Planned(records)) => {
-                        for record in records {
-                            self.schedule_trigger_record(record, scheduled.trigger.kind, now)?;
-                        }
-                        report.triggers_planned += 1;
-                    }
-                    Ok(RestorePlanResult::NoStableIntents) => {
-                        report.triggers_planned += 1;
-                    }
-                    Ok(RestorePlanResult::Disabled) => {
-                        return Err(RestorationError::RuntimeDisabled.into());
-                    }
-                    Err(
-                        RestorationError::PriorClaimUnresolved
-                        | RestorationError::PriorOutcomeUncertain,
-                    ) => {
-                        let recovered =
-                            controller.pending_records(&scheduled.trigger.receiver_id)?;
-                        report.claims_recovered += recovered.len();
-                        for record in recovered {
-                            self.schedule_record(record, now)?;
-                        }
-                        if scheduled.purpose == ScheduledTriggerPurpose::Primary {
-                            scheduled.due = due_after(now, self.retry_interval_ms)?;
-                            self.triggers.insert(trigger_id, scheduled);
-                        }
-                    }
-                    Err(error) => return Err(error.into()),
-                }
-            } else {
-                report.claims_recovered += pending.len();
-                for record in pending {
-                    self.schedule_trigger_record(record, scheduled.trigger.kind, now)?;
-                }
-            }
+            self.plan_or_recover_trigger(
+                controller,
+                &trigger_id,
+                &mut scheduled,
+                pending.is_empty() || migrated > 0,
+                now,
+                report,
+            )?;
             if newly_configured {
                 self.configured_receivers.insert(receiver_id);
             }
@@ -699,6 +688,88 @@ impl RestorationScheduler {
         Ok(())
     }
 
+    fn plan_or_recover_trigger<C: RestorationController>(
+        &mut self,
+        controller: &mut C,
+        trigger_id: &RestoreTriggerId,
+        scheduled: &mut ScheduledTrigger,
+        should_plan: bool,
+        now: MonotonicMs,
+        report: &mut RestorationTickReport,
+    ) -> Result<(), RestorationScheduleError> {
+        if !should_plan {
+            report.claims_recovered += self.synchronize_pending_claims(
+                controller,
+                &scheduled.trigger.receiver_id,
+                PendingClaimSchedule::Trigger(scheduled.trigger.kind),
+                now,
+            )?;
+            return Ok(());
+        }
+        match controller.plan_restore(&scheduled.trigger) {
+            Ok(RestorePlanResult::Planned(_) | RestorePlanResult::NoStableIntents) => {
+                self.synchronize_pending_claims(
+                    controller,
+                    &scheduled.trigger.receiver_id,
+                    PendingClaimSchedule::Trigger(scheduled.trigger.kind),
+                    now,
+                )?;
+                report.triggers_planned += 1;
+            }
+            Ok(RestorePlanResult::Disabled) => {
+                return Err(RestorationError::RuntimeDisabled.into());
+            }
+            Err(
+                RestorationError::PriorClaimUnresolved | RestorationError::PriorOutcomeUncertain,
+            ) => {
+                report.claims_recovered += self.synchronize_pending_claims(
+                    controller,
+                    &scheduled.trigger.receiver_id,
+                    PendingClaimSchedule::At(now),
+                    now,
+                )?;
+                if scheduled.purpose == ScheduledTriggerPurpose::Primary {
+                    scheduled.due = due_after(now, self.retry_interval_ms)?;
+                    self.triggers.insert(trigger_id.clone(), scheduled.clone());
+                }
+            }
+            Err(error) => return Err(error.into()),
+        }
+        Ok(())
+    }
+
+    fn rebind_or_recover_blocking_claims<C: RestorationController>(
+        &mut self,
+        controller: &mut C,
+        trigger_id: &RestoreTriggerId,
+        scheduled: &mut ScheduledTrigger,
+        now: MonotonicMs,
+        report: &mut RestorationTickReport,
+    ) -> Result<Option<usize>, RestorationScheduleError> {
+        match controller.rebind_compatible_stable_intents(&scheduled.trigger) {
+            Ok(migrated) => Ok(Some(migrated)),
+            Err(
+                RestorationError::PriorClaimUnresolved | RestorationError::PriorOutcomeUncertain,
+            ) => {
+                // Reconcile the blocking claim in this actor tick. The
+                // migration retry remains delayed, so an equal due time cannot
+                // starve the claim behind the trigger forever.
+                report.claims_recovered += self.synchronize_pending_claims(
+                    controller,
+                    &scheduled.trigger.receiver_id,
+                    PendingClaimSchedule::At(now),
+                    now,
+                )?;
+                if scheduled.purpose == ScheduledTriggerPurpose::Primary {
+                    scheduled.due = due_after(now, self.retry_interval_ms)?;
+                    self.triggers.insert(trigger_id.clone(), scheduled.clone());
+                }
+                Ok(None)
+            }
+            Err(error) => Err(error.into()),
+        }
+    }
+
     fn process_due_claim<C: RestorationController>(
         &mut self,
         controller: &mut C,
@@ -726,24 +797,17 @@ impl RestorationScheduler {
         ) {
             Ok(advance) => advance,
             Err(
-                RestorationError::PriorClaimUnresolved | RestorationError::PriorOutcomeUncertain,
+                RestorationError::PriorClaimUnresolved
+                | RestorationError::PriorOutcomeUncertain
+                | RestorationError::UnknownClaim,
             ) => {
-                let recovered = controller.pending_records(&scheduled.receiver_id)?;
-                report.claims_recovered += recovered.len();
-                if recovered.is_empty() {
-                    self.claims.insert(
-                        claim_id,
-                        ScheduledClaim {
-                            due: due_after(now, self.retry_interval_ms)?,
-                            ..scheduled
-                        },
-                    );
-                } else {
-                    let retry_due = due_after(now, self.retry_interval_ms)?;
-                    for record in recovered {
-                        self.schedule_record(record, retry_due)?;
-                    }
-                }
+                let retry_due = due_after(now, self.retry_interval_ms)?;
+                report.claims_recovered += self.synchronize_pending_claims(
+                    controller,
+                    &scheduled.receiver_id,
+                    PendingClaimSchedule::At(retry_due),
+                    now,
+                )?;
                 return Ok(true);
             }
             Err(error) => return Err(error.into()),
@@ -776,6 +840,36 @@ impl RestorationScheduler {
         Ok(true)
     }
 
+    fn synchronize_pending_claims<C: RestorationController>(
+        &mut self,
+        controller: &C,
+        receiver_id: &ReceiverId,
+        schedule: PendingClaimSchedule,
+        now: MonotonicMs,
+    ) -> Result<usize, RestorationScheduleError> {
+        let pending = controller.pending_records(receiver_id)?;
+        let pending_ids = pending
+            .iter()
+            .map(|record| record.claim_id.clone())
+            .collect::<BTreeSet<_>>();
+        self.claims.retain(|claim_id, claim| {
+            claim.receiver_id != *receiver_id || pending_ids.contains(claim_id)
+        });
+        let count = pending.len();
+        for record in pending {
+            if self.claims.contains_key(&record.claim_id) {
+                continue;
+            }
+            match schedule {
+                PendingClaimSchedule::At(due) => self.schedule_record(record, due)?,
+                PendingClaimSchedule::Trigger(trigger_kind) => {
+                    self.schedule_trigger_record(record, trigger_kind, now)?;
+                }
+            }
+        }
+        Ok(count)
+    }
+
     fn schedule(
         &mut self,
         kind: RestoreTriggerKind,
@@ -1289,7 +1383,22 @@ mod tests {
             &mut self,
             _trigger: &RestoreTrigger,
         ) -> Result<RestorePlanResult, RestorationError> {
-            self.plans.remove(0)
+            let result = self.plans.remove(0);
+            if let Ok(RestorePlanResult::Planned(records)) = &result {
+                for record in records {
+                    self.pending.retain(|pending| {
+                        pending.device_id != record.device_id || pending.claim_id == record.claim_id
+                    });
+                    if !self
+                        .pending
+                        .iter()
+                        .any(|pending| pending.claim_id == record.claim_id)
+                    {
+                        self.pending.push(record.clone());
+                    }
+                }
+            }
+            result
         }
 
         fn advance_claim(
@@ -2136,6 +2245,72 @@ mod tests {
         assert!(scheduler.claims.contains_key(&current.claim_id));
     }
 
+    #[test]
+    fn startup_reconciles_a_claim_before_retrying_profile_migration() {
+        let prior = record(
+            "claim-prior",
+            RestoreRecordStatus::Deferred(RestoreDeferred {
+                reason: RestoreDeferReason::DeviceUnknown,
+                prior_outcome: None,
+            }),
+        );
+        let current = record("claim-current", RestoreRecordStatus::Planned);
+        let mut controller = MigratingController {
+            inner: FakeController {
+                now: time(10),
+                plans: vec![Ok(RestorePlanResult::Planned(vec![current.clone()]))],
+                pending: vec![prior.clone()],
+                advances: vec![
+                    Ok(RestoreAdvanceResult::Terminal(delivered_record(
+                        "claim-prior",
+                        "mouse-1",
+                    ))),
+                    Ok(RestoreAdvanceResult::Terminal(delivered_record(
+                        "claim-current",
+                        "mouse-1",
+                    ))),
+                ],
+                dispatches: Vec::new(),
+                policy_calls: 0,
+                advance_calls: 0,
+                dispatch_calls: 0,
+            },
+            migrations: vec![Err(RestorationError::PriorClaimUnresolved), Ok(1)],
+        };
+        let receiver_id: ReceiverId = id("receiver-1");
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_service_start(receiver_id.clone(), generation(1))
+            .expect("service trigger schedules");
+
+        let first = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("blocking claim is reconciled without stopping the runtime");
+
+        assert_eq!(first.claims_recovered, 1);
+        assert_eq!(first.claims_terminal, 1);
+        assert_eq!(controller.inner.advance_calls, 1);
+        assert!(scheduler.configured_receivers.contains(&receiver_id));
+        assert!(
+            scheduler
+                .triggers
+                .values()
+                .any(|scheduled| scheduled.trigger.kind == RestoreTriggerKind::ServiceStart)
+        );
+
+        controller.inner.pending.clear();
+        controller.inner.now = time(1_010);
+        let second = scheduler
+            .tick_with(&mut controller, &sessions())
+            .expect("compatible migration retries after reconciliation");
+
+        assert_eq!(second.triggers_planned, 1);
+        assert_eq!(second.claims_terminal, 1);
+        assert!(controller.migrations.is_empty());
+        assert!(controller.inner.plans.is_empty());
+        assert!(controller.inner.advances.is_empty());
+    }
+
     #[test]
     fn return_envelope_prefers_live_effect_and_falls_back_only_after_invalidation() {
         let mut controller = EffectController {
@@ -2292,6 +2467,115 @@ mod tests {
         assert_eq!(controller.advance_calls, 1);
     }
 
+    #[test]
+    fn superseding_plan_resynchronizes_compacted_pending_claims() {
+        let old_keyboard = record_for_device(
+            "claim-keyboard-old",
+            "keyboard-1",
+            RestoreRecordStatus::Planned,
+        );
+        let current_keyboard = record_for_device(
+            "claim-keyboard-current",
+            "keyboard-1",
+            RestoreRecordStatus::Planned,
+        );
+        let mouse = record_for_device("claim-mouse", "mouse-1", RestoreRecordStatus::Planned);
+        let mut controller = FakeController {
+            now: time(10),
+            plans: vec![Ok(RestorePlanResult::Planned(vec![
+                current_keyboard.clone(),
+            ]))],
+            pending: vec![old_keyboard.clone(), mouse.clone()],
+            advances: Vec::new(),
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let receiver_id: ReceiverId = id("receiver-1");
+        let mut scheduler = scheduler();
+        scheduler.configured_receivers.insert(receiver_id.clone());
+        scheduler
+            .schedule_record(old_keyboard.clone(), time(20))
+            .expect("old keyboard claim schedules");
+        scheduler
+            .schedule_record(mouse.clone(), time(30))
+            .expect("mouse claim schedules");
+        scheduler
+            .schedule_device_return_epoch_at(
+                receiver_id,
+                generation(1),
+                id("keyboard-1"),
+                SequenceNumber::try_from(2_u64).expect("sequence"),
+                time(10),
+                &[0, 1],
+            )
+            .expect("keyboard return schedules");
+        let mut report = RestorationTickReport::default();
+
+        scheduler
+            .process_due_trigger(&mut controller, &sessions(), time(10), &mut report)
+            .expect("superseding plan resynchronizes scheduler claims");
+
+        assert_eq!(report.triggers_planned, 1);
+        assert!(!scheduler.claims.contains_key(&old_keyboard.claim_id));
+        assert!(scheduler.claims.contains_key(&current_keyboard.claim_id));
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&mouse.claim_id)
+                .expect("sibling claim remains scheduled")
+                .due,
+            time(30)
+        );
+    }
+
+    #[test]
+    fn compacted_volatile_claim_recovers_from_durable_authority() {
+        let compacted = record_for_device(
+            "claim-keyboard-compacted",
+            "keyboard-1",
+            RestoreRecordStatus::Planned,
+        );
+        let current = record_for_device(
+            "claim-keyboard-current",
+            "keyboard-1",
+            RestoreRecordStatus::Planned,
+        );
+        let mut controller = FakeController {
+            now: time(10),
+            plans: Vec::new(),
+            pending: vec![current.clone()],
+            advances: vec![Err(RestorationError::UnknownClaim)],
+            dispatches: Vec::new(),
+            policy_calls: 0,
+            advance_calls: 0,
+            dispatch_calls: 0,
+        };
+        let mut scheduler = scheduler();
+        scheduler
+            .schedule_record(compacted.clone(), time(10))
+            .expect("compacted volatile claim schedules");
+        let mut report = RestorationTickReport::default();
+
+        assert!(
+            scheduler
+                .process_due_claim(&mut controller, &sessions(), time(10), &mut report)
+                .expect("unknown volatile claim reloads durable authority")
+        );
+
+        assert_eq!(report.claims_recovered, 1);
+        assert!(!scheduler.claims.contains_key(&compacted.claim_id));
+        assert_eq!(
+            scheduler
+                .claims
+                .get(&current.claim_id)
+                .expect("current durable claim schedules")
+                .due,
+            time(1_010)
+        );
+    }
+
     #[test]
     fn overlapping_resume_and_device_return_preserve_the_latest_exact_envelope() {
         let mut scheduler = scheduler();

From d579e9a18ff32ab9bf5e5fb1a0c66502b3836925 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 08:25:10 +0400
Subject: [PATCH 36/67] assurance: freeze native tunnel baseline

---
 assurance/candidate-baseline.json      |  79 ++++++++++++++++++
 docs/generated/installation.md         |   4 +-
 packaging/generated/install-plan.json  |   7 ++
 schemas/candidate-baseline.schema.json | 110 +++++++++++++++++++++++++
 tests/test_assurance.py                |  36 +++++++-
 5 files changed, 233 insertions(+), 3 deletions(-)
 create mode 100644 assurance/candidate-baseline.json
 create mode 100644 schemas/candidate-baseline.schema.json

diff --git a/assurance/candidate-baseline.json b/assurance/candidate-baseline.json
new file mode 100644
index 0000000..27075f7
--- /dev/null
+++ b/assurance/candidate-baseline.json
@@ -0,0 +1,79 @@
+{
+  "$schema": "../schemas/candidate-baseline.schema.json",
+  "schema": "hyperflux-candidate-baseline-v1",
+  "baseline": {
+    "id": "universal-return-1397527",
+    "revision": "13975278cda3c7284b1478602ac1cdbd6849b1f4",
+    "commit_epoch": 1784899106,
+    "branch": "fix/universal-return-restoration",
+    "purpose": "Immutable pre-semantic-readiness baseline for universal first-writable restoration."
+  },
+  "packages": {
+    "candidate": {
+      "source_revision": "13975278cda3c7284b1478602ac1cdbd6849b1f4",
+      "file": "hyperflux-next-linux-0.0.0_dev.1-1-x86_64.pkg.tar.zst",
+      "sha256": "4f7849b4a815f1b62120c878ff68f839484fc50d923b95830224d58e3f20d054",
+      "size": 4807330,
+      "manifest_sha256": "412bf856f7a12f59c3d102ad6f89e5442da0e78ebe31b808bb400a2aaa528456"
+    },
+    "rollback": {
+      "source_revision": "9e1c7b6724302b3ef8742c32e0a68bb43a2e9499",
+      "file": "hyperflux-next-linux-0.0.0_dev.1-1-x86_64.pkg.tar.zst",
+      "sha256": "183d37658d192e977b0c2f381660aeb118a0f736bfb33ec8ac691130d42cb456",
+      "size": 5194140,
+      "manifest_sha256": "27545824a03e839c7e594b87c779db68c33a3e8096f898641b34f7827bb49ed0"
+    }
+  },
+  "profiles": {
+    "source_sha256": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac",
+    "runtime": [
+      {
+        "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+        "sha256": "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
+      },
+      {
+        "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+        "sha256": "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63"
+      },
+      {
+        "profile_id": "receiver.razer.hyperflux-v2.1532-00cf",
+        "sha256": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
+      },
+      {
+        "profile_id": "surface.razer.hyperflux-v2-hard-edition",
+        "sha256": "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9"
+      }
+    ]
+  },
+  "verification": {
+    "schema": "hyperflux-verification-run-v1",
+    "run_id": "hfxv-15883ee2d3e1a5a18c52",
+    "lane": "full-software",
+    "status": "passed",
+    "nodes": 31,
+    "duration_ms": 477496,
+    "result_sha256": "f127347d88256bca3b2b9d9940f7887407a95133773c65e9c1f60eb2dc457640"
+  },
+  "protected_behavior": {
+    "schema": "hyperflux-protected-behavior-v1",
+    "sha256": "a1ac35d18ddb2f743a5287fdc03466e029fbadcc7e61ee356037c22c6fe908dc"
+  },
+  "change_boundary": {
+    "default_no_touch": [
+      "application integrations",
+      "identity and battery decoding",
+      "input forwarding",
+      "proven receiver-renewal restoration",
+      "proven service-start restoration",
+      "proven system-resume restoration",
+      "qualified LED maps",
+      "receiver frame encoder"
+    ],
+    "approval_required": [
+      "existing qualified map or decoder change",
+      "kernel or UAPI change",
+      "protocol-v6 semantic change",
+      "proven restoration behavior change"
+    ]
+  }
+}
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 287b2f0..7f54ba8 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,7 +33,7 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `156` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `157` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,7 +47,7 @@ The expanded source payload contains `156` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 51 | `-` |
+| `schemas` | 52 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 4d9ec9e..903f822 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -249,6 +249,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/candidate-baseline.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/candidate-baseline.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/candidate-catalog.schema.json",
diff --git a/schemas/candidate-baseline.schema.json b/schemas/candidate-baseline.schema.json
new file mode 100644
index 0000000..5aeab34
--- /dev/null
+++ b/schemas/candidate-baseline.schema.json
@@ -0,0 +1,110 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/candidate-baseline-v1.json",
+  "title": "Frozen HyperFlux candidate baseline",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "baseline", "packages", "profiles", "verification", "protected_behavior", "change_boundary"],
+  "properties": {
+    "$schema": {"const": "../schemas/candidate-baseline.schema.json"},
+    "schema": {"const": "hyperflux-candidate-baseline-v1"},
+    "baseline": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "revision", "commit_epoch", "branch", "purpose"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{0,127}$"},
+        "revision": {"$ref": "#/$defs/revision"},
+        "commit_epoch": {"type": "integer", "minimum": 1, "maximum": 4102444800},
+        "branch": {"type": "string", "minLength": 1, "maxLength": 160},
+        "purpose": {"type": "string", "minLength": 1, "maxLength": 512}
+      }
+    },
+    "packages": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidate", "rollback"],
+      "properties": {
+        "candidate": {"$ref": "#/$defs/package"},
+        "rollback": {"$ref": "#/$defs/package"}
+      }
+    },
+    "profiles": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source_sha256", "runtime"],
+      "properties": {
+        "source_sha256": {"$ref": "#/$defs/digest"},
+        "runtime": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["profile_id", "sha256"],
+            "properties": {
+              "profile_id": {"$ref": "#/$defs/identifier"},
+              "sha256": {"$ref": "#/$defs/digest"}
+            }
+          }
+        }
+      }
+    },
+    "verification": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "run_id", "lane", "status", "nodes", "duration_ms", "result_sha256"],
+      "properties": {
+        "schema": {"const": "hyperflux-verification-run-v1"},
+        "run_id": {"type": "string", "pattern": "^hfxv-[0-9a-f]{20}$"},
+        "lane": {"const": "full-software"},
+        "status": {"const": "passed"},
+        "nodes": {"type": "integer", "minimum": 1, "maximum": 256},
+        "duration_ms": {"type": "integer", "minimum": 0, "maximum": 86400000},
+        "result_sha256": {"$ref": "#/$defs/digest"}
+      }
+    },
+    "protected_behavior": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["schema", "sha256"],
+      "properties": {
+        "schema": {"const": "hyperflux-protected-behavior-v1"},
+        "sha256": {"$ref": "#/$defs/digest"}
+      }
+    },
+    "change_boundary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["default_no_touch", "approval_required"],
+      "properties": {
+        "default_no_touch": {"$ref": "#/$defs/stringSet"},
+        "approval_required": {"$ref": "#/$defs/stringSet"}
+      }
+    }
+  },
+  "$defs": {
+    "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "identifier": {"type": "string", "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$"},
+    "stringSet": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"type": "string", "minLength": 1, "maxLength": 256}
+    },
+    "package": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source_revision", "file", "sha256", "size", "manifest_sha256"],
+      "properties": {
+        "source_revision": {"$ref": "#/$defs/revision"},
+        "file": {"type": "string", "pattern": "^[A-Za-z0-9_.+-]+$"},
+        "sha256": {"$ref": "#/$defs/digest"},
+        "size": {"type": "integer", "minimum": 1, "maximum": 1073741824},
+        "manifest_sha256": {"$ref": "#/$defs/digest"}
+      }
+    }
+  }
+}
diff --git a/tests/test_assurance.py b/tests/test_assurance.py
index ee99f29..4897636 100644
--- a/tests/test_assurance.py
+++ b/tests/test_assurance.py
@@ -14,7 +14,7 @@
 
 from hfxdev.formal_model import load_formal_model, run_formal_model
 from hfxdev.generators.supply_chain import spdx_json
-from hfxdev.model import ModelError
+from hfxdev.model import ModelError, load_json, sha256_file
 from hfxdev.performance import (
     load_performance_budgets,
     verify_package_performance_budgets,
@@ -87,6 +87,40 @@ def test_protected_behavior_separates_integrations_from_core_changes(self) -> No
             baseline.advanced_change_requires_approval(mixed_advanced_change)
         )
 
+    def test_candidate_baseline_binds_the_exact_protected_system(self) -> None:
+        baseline = load_json(ROOT / "assurance" / "candidate-baseline.json")
+        self.assertEqual(baseline["schema"], "hyperflux-candidate-baseline-v1")
+        self.assertEqual(
+            baseline["baseline"]["revision"],
+            "13975278cda3c7284b1478602ac1cdbd6849b1f4",
+        )
+        self.assertEqual(
+            baseline["packages"]["candidate"]["sha256"],
+            "4f7849b4a815f1b62120c878ff68f839484fc50d923b95830224d58e3f20d054",
+        )
+        self.assertEqual(
+            baseline["packages"]["rollback"]["sha256"],
+            "183d37658d192e977b0c2f381660aeb118a0f736bfb33ec8ac691130d42cb456",
+        )
+        self.assertEqual(
+            sha256_file(ROOT / "assurance" / "protected-behavior.json"),
+            baseline["protected_behavior"]["sha256"],
+        )
+
+        catalog = load_json(ROOT / "generated" / "profiles" / "catalog.json")
+        self.assertEqual(catalog["source_sha256"], baseline["profiles"]["source_sha256"])
+        runtime_digests = {
+            profile["profile_id"]: profile["runtime_sha256"]
+            for profile in catalog["profiles"]
+        }
+        self.assertEqual(
+            runtime_digests,
+            {
+                profile["profile_id"]: profile["sha256"]
+                for profile in baseline["profiles"]["runtime"]
+            },
+        )
+
     def test_static_and_package_performance_budgets_fail_closed(self) -> None:
         static = verify_static_performance_budgets(ROOT, self.metrics)
         self.assertEqual(static["bridge-command-queue-capacity"], 128.0)

From b99e00d68703291c79976cc8cd7098a3c5dcab09 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 08:55:16 +0400
Subject: [PATCH 37/67] integrations: bind native OpenRazer control authority

---
 architecture/repository-atlas.json            |   2 +-
 docs/generated/installation.md                |   6 +-
 docs/generated/repository-atlas.md            |   2 +-
 integrations/openrazer/README.md              |   2 +
 .../openrazer/native-control-policy.json      | 140 +++
 .../openrazer/native-method-inventory.json    | 801 ++++++++++++++++++
 packaging/generated/install-plan.json         |  28 +
 ...penrazer-native-control-policy.schema.json |  89 ++
 ...nrazer-native-method-inventory.schema.json | 151 ++++
 tests/test_integrations.py                    |  50 ++
 tools/hfxdev/cli.py                           |   8 +
 tools/hfxdev/native_control.py                | 543 ++++++++++++
 tools/hfxdev/openrazer.py                     |   5 +
 tools/hfxdev/verify.py                        |  14 +
 verification/tests.json                       |   4 +-
 15 files changed, 1838 insertions(+), 7 deletions(-)
 create mode 100644 integrations/openrazer/native-control-policy.json
 create mode 100644 integrations/openrazer/native-method-inventory.json
 create mode 100644 schemas/openrazer-native-control-policy.schema.json
 create mode 100644 schemas/openrazer-native-method-inventory.schema.json
 create mode 100644 tools/hfxdev/native_control.py

diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index 5bb5313..58dea59 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -139,7 +139,7 @@
       "inputs": ["SDK state", "Pinned OpenRazer metadata", "Compatibility contract"],
       "outputs": ["Private compatibility service", "Generated presentation metadata"],
       "public_contracts": ["Opt-in isolation", "SDK-only access", "No suppression of unrelated devices"],
-      "canonical_files": ["integrations/openrazer/import.json", "integrations/openrazer/metadata.json", "integrations/openrazer/compatibility.json"],
+      "canonical_files": ["integrations/openrazer/import.json", "integrations/openrazer/metadata.json", "integrations/openrazer/compatibility.json", "integrations/openrazer/native-control-policy.json", "integrations/openrazer/native-method-inventory.json"],
       "generated_files": ["integrations/openrazer/README.md", "sdk/python/hyperflux_sdk/generated/openrazer_metadata.py"],
       "verification": ["openrazer-metadata-contracts", "openrazer-compatibility-contracts"],
       "limitations": ["Compatibility covers modeled client behavior, not every OpenRazer daemon extension"],
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 7f54ba8..b5c1418 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,7 +33,7 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `157` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `161` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,12 +47,12 @@ The expanded source payload contains `157` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 52 | `-` |
+| `schemas` | 54 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
-| `integration-authority` | 4 | `-` |
+| `integration-authority` | 6 | `-` |
 | `cpp-sdk-headers` | 28 | `-` |
 | `documentation` | 38 | `-` |
 | `readme` | 1 | `-` |
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index bb8f8c0..f2bcf6b 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -414,7 +414,7 @@ Provides an isolated compatibility surface for legacy OpenRazer clients without
 
 **Used by:** [Packaging and installation](#packaging), [Polychromatic adapter](#polychromatic-adapter)
 
-**Canonical sources:** `integrations/openrazer/import.json`, `integrations/openrazer/metadata.json`, `integrations/openrazer/compatibility.json`.
+**Canonical sources:** `integrations/openrazer/import.json`, `integrations/openrazer/metadata.json`, `integrations/openrazer/compatibility.json`, `integrations/openrazer/native-control-policy.json`, `integrations/openrazer/native-method-inventory.json`.
 
 **Generated projections:** `integrations/openrazer/README.md`, `sdk/python/hyperflux_sdk/generated/openrazer_metadata.py`.
 
diff --git a/integrations/openrazer/README.md b/integrations/openrazer/README.md
index 20eb1e5..dd42b92 100644
--- a/integrations/openrazer/README.md
+++ b/integrations/openrazer/README.md
@@ -28,6 +28,8 @@ Provides an isolated compatibility surface for legacy OpenRazer clients without
 - [`integrations/openrazer/import.json`](import.json)
 - [`integrations/openrazer/metadata.json`](metadata.json)
 - [`integrations/openrazer/compatibility.json`](compatibility.json)
+- [`integrations/openrazer/native-control-policy.json`](native-control-policy.json)
+- [`integrations/openrazer/native-method-inventory.json`](native-method-inventory.json)
 
 ## Verification
 
diff --git a/integrations/openrazer/native-control-policy.json b/integrations/openrazer/native-control-policy.json
new file mode 100644
index 0000000..ff51926
--- /dev/null
+++ b/integrations/openrazer/native-control-policy.json
@@ -0,0 +1,140 @@
+{
+  "$schema": "../../schemas/openrazer-native-control-policy.schema.json",
+  "schema": "hyperflux-openrazer-native-control-policy-v1",
+  "upstream_id": "openrazer",
+  "source_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "scope": "transport-facing-exact-wireless-classes",
+  "report_size": 90,
+  "common_methods": [
+    "get_device_mode",
+    "get_device_name",
+    "get_firmware",
+    "get_matrix_dims",
+    "get_serial",
+    "has_matrix",
+    "set_device_mode"
+  ],
+  "kind_methods": {
+    "keyboard": [
+      "get_keyboard_layout"
+    ],
+    "mouse": []
+  },
+  "classifications": {
+    "read_only": [
+      "get_battery",
+      "get_brightness",
+      "get_device_mode",
+      "get_dpi_stages",
+      "get_dpi_xy",
+      "get_firmware",
+      "get_game_mode",
+      "get_idle_time",
+      "get_keyboard_layout",
+      "get_logo_brightness",
+      "get_low_battery_threshold",
+      "get_macro_effect",
+      "get_macro_mode",
+      "get_poll_rate",
+      "get_scroll_acceleration",
+      "get_scroll_brightness",
+      "get_scroll_mode",
+      "get_scroll_smart_reel",
+      "get_serial",
+      "is_charging"
+    ],
+    "reversible_with_readback": [
+      {"method": "set_brightness", "readback": "get_brightness"},
+      {"method": "set_device_mode", "readback": "get_device_mode"},
+      {"method": "set_dpi_stages", "readback": "get_dpi_stages"},
+      {"method": "set_dpi_xy", "readback": "get_dpi_xy"},
+      {"method": "set_game_mode", "readback": "get_game_mode"},
+      {"method": "set_idle_time", "readback": "get_idle_time"},
+      {"method": "set_logo_brightness", "readback": "get_logo_brightness"},
+      {"method": "set_low_battery_threshold", "readback": "get_low_battery_threshold"},
+      {"method": "set_macro_effect", "readback": "get_macro_effect"},
+      {"method": "set_macro_mode", "readback": "get_macro_mode"},
+      {"method": "set_poll_rate", "readback": "get_poll_rate"},
+      {"method": "set_scroll_acceleration", "readback": "get_scroll_acceleration"},
+      {"method": "set_scroll_brightness", "readback": "get_scroll_brightness"},
+      {"method": "set_scroll_mode", "readback": "get_scroll_mode"},
+      {"method": "set_scroll_smart_reel", "readback": "get_scroll_smart_reel"}
+    ],
+    "software_only": [
+      "add_macro",
+      "delete_macro",
+      "get_device_name",
+      "get_device_type_keyboard",
+      "get_device_type_mouse",
+      "get_macros",
+      "get_matrix_dims",
+      "has_matrix",
+      "max_dpi"
+    ],
+    "unsafe": [
+      "set_breath_dual_effect",
+      "set_breath_random_effect",
+      "set_breath_single_effect",
+      "set_custom_effect",
+      "set_key_row",
+      "set_logo_none",
+      "set_logo_spectrum",
+      "set_logo_static",
+      "set_logo_wave",
+      "set_none_effect",
+      "set_reactive_effect",
+      "set_ripple_effect",
+      "set_ripple_effect_random_colour",
+      "set_scroll_none",
+      "set_scroll_spectrum",
+      "set_scroll_static",
+      "set_scroll_wave",
+      "set_spectrum_effect",
+      "set_starlight_dual_effect",
+      "set_starlight_random_effect",
+      "set_starlight_single_effect",
+      "set_static_effect",
+      "set_wave_effect"
+    ]
+  },
+  "qualification_probes": [
+    {
+      "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+      "methods": [
+        "get_firmware",
+        "get_serial",
+        "get_device_mode",
+        "get_battery",
+        "is_charging",
+        "get_dpi_xy",
+        "get_dpi_stages",
+        "get_poll_rate",
+        "get_idle_time",
+        "get_low_battery_threshold",
+        "get_scroll_mode",
+        "get_scroll_acceleration",
+        "get_scroll_smart_reel",
+        "get_brightness",
+        "get_logo_brightness",
+        "get_scroll_brightness"
+      ]
+    },
+    {
+      "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+      "methods": [
+        "get_firmware",
+        "get_serial",
+        "get_device_mode",
+        "get_keyboard_layout",
+        "get_battery",
+        "is_charging",
+        "get_game_mode",
+        "get_macro_mode",
+        "get_macro_effect"
+      ]
+    }
+  ],
+  "privacy_overrides": {
+    "get_serial": "redacted-equality-only"
+  }
+}
diff --git a/integrations/openrazer/native-method-inventory.json b/integrations/openrazer/native-method-inventory.json
new file mode 100644
index 0000000..b152137
--- /dev/null
+++ b/integrations/openrazer/native-method-inventory.json
@@ -0,0 +1,801 @@
+{
+  "$schema": "../../schemas/openrazer-native-method-inventory.schema.json",
+  "schema": "hyperflux-openrazer-native-method-inventory-v1",
+  "upstream": {
+    "id": "openrazer",
+    "repository": "https://github.com/openrazer/openrazer.git",
+    "version": "3.12.1-41-g6820f9d",
+    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
+  },
+  "policy_sha256": "0d2b4e21cc66e8bb85519eeaf9e47ef42b1885cf0b9c4ea3145782080e376d14",
+  "metadata_selection_sha256": "0bd97b07f4c8f9d2c99ac3a3622477704661d5069bd984a0ef8d4a72bf32998f",
+  "report_size": 90,
+  "source_files": [
+    {
+      "path": "daemon/openrazer_daemon/hardware/device_base.py",
+      "sha256": "7dcece1e1d9afb84d672f3995acd0cb5f24e8e908f212dba2601a50f4fab362d"
+    },
+    {
+      "path": "daemon/openrazer_daemon/hardware/keyboards.py",
+      "sha256": "a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9"
+    },
+    {
+      "path": "daemon/openrazer_daemon/hardware/mouse.py",
+      "sha256": "c36180167f3f07f2299eb2653dd171ce6086a5cb0c30a898d9ee2be3dc3c4c03"
+    },
+    {
+      "path": "driver/razerchromacommon.c",
+      "sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829"
+    },
+    {
+      "path": "driver/razerchromacommon.h",
+      "sha256": "b271c8aff5de897266f73a7fff054a57454f47055120daf697877db4740ac68b"
+    },
+    {
+      "path": "driver/razercommon.c",
+      "sha256": "984c3f95cba20710e84f3eed8a26b1e2eddf0f8b6e5fe8bca51a32166744509e"
+    },
+    {
+      "path": "driver/razercommon.h",
+      "sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65"
+    },
+    {
+      "path": "driver/razerkbd_driver.c",
+      "sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df"
+    },
+    {
+      "path": "driver/razerkbd_driver.h",
+      "sha256": "068af601b5f1adc79eaebdcbcd728a5062cf258607229990e1ad9b999ebb1a80"
+    },
+    {
+      "path": "driver/razermouse_driver.c",
+      "sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff"
+    },
+    {
+      "path": "driver/razermouse_driver.h",
+      "sha256": "7a34037673253eb5e75889333a3e63dd59924cc7a9b5c14b294a2ee40947b336"
+    }
+  ],
+  "devices": [
+    {
+      "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+      "wireless_identity": {
+        "vendor_id": 5426,
+        "product_id": 205,
+        "model_name": "Razer Basilisk V3 Pro 35K (Wireless)",
+        "device_kind": "mouse",
+        "transport_variant": "wireless"
+      },
+      "direct_usb_reference": {
+        "vendor_id": 5426,
+        "product_id": 204,
+        "model_name": "Razer Basilisk V3 Pro 35K (Wired)",
+        "device_kind": "mouse",
+        "transport_variant": "wired",
+        "class_name": "RazerBasiliskV3Pro35KWired",
+        "source_path": "daemon/openrazer_daemon/hardware/mouse.py",
+        "source_line": 1703
+      },
+      "source": {
+        "path": "daemon/openrazer_daemon/hardware/mouse.py",
+        "class_name": "RazerBasiliskV3Pro35KWireless",
+        "sha256": "c36180167f3f07f2299eb2653dd171ce6086a5cb0c30a898d9ee2be3dc3c4c03"
+      },
+      "methods": [
+        {
+          "id": "get_battery",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_brightness",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_mode",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_name",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_type_mouse",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_dpi_stages",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_dpi_xy",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_firmware",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_idle_time",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_logo_brightness",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_low_battery_threshold",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_matrix_dims",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_poll_rate",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_scroll_acceleration",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_scroll_brightness",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_scroll_mode",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_scroll_smart_reel",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_serial",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "redacted-equality-only"
+        },
+        {
+          "id": "has_matrix",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "is_charging",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "max_dpi",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_brightness",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_brightness",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_custom_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_device_mode",
+          "origin": "common-daemon-api",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_device_mode",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_dpi_stages",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_dpi_stages",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_dpi_xy",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_dpi_xy",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_idle_time",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_idle_time",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_key_row",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_logo_brightness",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_logo_brightness",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_logo_none",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_logo_spectrum",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_logo_static",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_logo_wave",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_low_battery_threshold",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_low_battery_threshold",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_none_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_poll_rate",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_poll_rate",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_acceleration",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_scroll_acceleration",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_brightness",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_scroll_brightness",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_mode",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_scroll_mode",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_none",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_smart_reel",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_scroll_smart_reel",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_spectrum",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_static",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_scroll_wave",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_spectrum_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_static_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_wave_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        }
+      ],
+      "qualification_probes": [
+        "get_firmware",
+        "get_serial",
+        "get_device_mode",
+        "get_battery",
+        "is_charging",
+        "get_dpi_xy",
+        "get_dpi_stages",
+        "get_poll_rate",
+        "get_idle_time",
+        "get_low_battery_threshold",
+        "get_scroll_mode",
+        "get_scroll_acceleration",
+        "get_scroll_smart_reel",
+        "get_brightness",
+        "get_logo_brightness",
+        "get_scroll_brightness"
+      ]
+    },
+    {
+      "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+      "wireless_identity": {
+        "vendor_id": 5426,
+        "product_id": 662,
+        "model_name": "Razer DeathStalker V2 Pro TKL (Wireless)",
+        "device_kind": "keyboard",
+        "transport_variant": "wireless"
+      },
+      "direct_usb_reference": {
+        "vendor_id": 5426,
+        "product_id": 664,
+        "model_name": "Razer DeathStalker V2 Pro TKL (Wired)",
+        "device_kind": "keyboard",
+        "transport_variant": "wired",
+        "class_name": "RazerDeathStalkerV2ProTKLWired",
+        "source_path": "daemon/openrazer_daemon/hardware/keyboards.py",
+        "source_line": 1451
+      },
+      "source": {
+        "path": "daemon/openrazer_daemon/hardware/keyboards.py",
+        "class_name": "RazerDeathStalkerV2ProTKLWireless",
+        "sha256": "a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9"
+      },
+      "methods": [
+        {
+          "id": "add_macro",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "delete_macro",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_battery",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_mode",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_name",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_device_type_keyboard",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_firmware",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_game_mode",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_keyboard_layout",
+          "origin": "device-kind-mixin",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_macro_effect",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_macro_mode",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_macros",
+          "origin": "advertised",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_matrix_dims",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "get_serial",
+          "origin": "common-daemon-api",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "redacted-equality-only"
+        },
+        {
+          "id": "has_matrix",
+          "origin": "common-daemon-api",
+          "classification": "software-only",
+          "transport": "software-only",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "is_charging",
+          "origin": "advertised",
+          "classification": "read-only",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_breath_dual_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_breath_random_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_breath_single_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_custom_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_device_mode",
+          "origin": "common-daemon-api",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_device_mode",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_game_mode",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_game_mode",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_key_row",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_macro_effect",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_macro_effect",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_macro_mode",
+          "origin": "advertised",
+          "classification": "reversible-with-readback",
+          "transport": "feature-report",
+          "readback": "get_macro_mode",
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_none_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_reactive_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_ripple_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_ripple_effect_random_colour",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_spectrum_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_starlight_dual_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_starlight_random_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_starlight_single_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_static_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        },
+        {
+          "id": "set_wave_effect",
+          "origin": "advertised",
+          "classification": "unsafe",
+          "transport": "feature-report",
+          "readback": null,
+          "privacy": "summary-only"
+        }
+      ],
+      "qualification_probes": [
+        "get_firmware",
+        "get_serial",
+        "get_device_mode",
+        "get_keyboard_layout",
+        "get_battery",
+        "is_charging",
+        "get_game_mode",
+        "get_macro_mode",
+        "get_macro_effect"
+      ]
+    }
+  ]
+}
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 903f822..79ba571 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -459,6 +459,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-control-policy.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-control-policy.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-method-inventory.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-method-inventory.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/package-build-manifest.schema.json",
@@ -683,6 +697,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-control-policy.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-control-policy.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-method-inventory.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-method-inventory.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/generated/domain_json.hpp",
diff --git a/schemas/openrazer-native-control-policy.schema.json b/schemas/openrazer-native-control-policy.schema.json
new file mode 100644
index 0000000..b5b778e
--- /dev/null
+++ b/schemas/openrazer-native-control-policy.schema.json
@@ -0,0 +1,89 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-control-policy-v1.json",
+  "title": "OpenRazer native-control method policy",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "upstream_id",
+    "source_commit",
+    "scope",
+    "report_size",
+    "common_methods",
+    "kind_methods",
+    "classifications",
+    "qualification_probes",
+    "privacy_overrides"
+  ],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-openrazer-native-control-policy-v1"},
+    "upstream_id": {"const": "openrazer"},
+    "source_commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "scope": {"const": "transport-facing-exact-wireless-classes"},
+    "report_size": {"const": 90},
+    "common_methods": {"$ref": "#/$defs/method-list"},
+    "kind_methods": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["keyboard", "mouse"],
+      "properties": {
+        "keyboard": {"$ref": "#/$defs/method-list"},
+        "mouse": {"$ref": "#/$defs/method-list"}
+      }
+    },
+    "classifications": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["read_only", "reversible_with_readback", "software_only", "unsafe"],
+      "properties": {
+        "read_only": {"$ref": "#/$defs/method-list"},
+        "reversible_with_readback": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["method", "readback"],
+            "properties": {
+              "method": {"$ref": "#/$defs/method"},
+              "readback": {"$ref": "#/$defs/method"}
+            }
+          }
+        },
+        "software_only": {"$ref": "#/$defs/method-list"},
+        "unsafe": {"$ref": "#/$defs/method-list"}
+      }
+    },
+    "qualification_probes": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 128,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["profile_id", "methods"],
+        "properties": {
+          "profile_id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$"},
+          "methods": {"$ref": "#/$defs/method-list"}
+        }
+      }
+    },
+    "privacy_overrides": {
+      "type": "object",
+      "propertyNames": {"$ref": "#/$defs/method"},
+      "additionalProperties": {
+        "enum": ["summary-only", "redacted-equality-only"]
+      }
+    }
+  },
+  "$defs": {
+    "method": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+    "method-list": {
+      "type": "array",
+      "uniqueItems": true,
+      "items": {"$ref": "#/$defs/method"}
+    }
+  }
+}
diff --git a/schemas/openrazer-native-method-inventory.schema.json b/schemas/openrazer-native-method-inventory.schema.json
new file mode 100644
index 0000000..0c73e35
--- /dev/null
+++ b/schemas/openrazer-native-method-inventory.schema.json
@@ -0,0 +1,151 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-method-inventory-v1.json",
+  "title": "Source-bound OpenRazer native-control method inventory",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "upstream",
+    "policy_sha256",
+    "metadata_selection_sha256",
+    "report_size",
+    "source_files",
+    "devices"
+  ],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-openrazer-native-method-inventory-v1"},
+    "upstream": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "repository", "version", "commit", "license_expression"],
+      "properties": {
+        "id": {"const": "openrazer"},
+        "repository": {"type": "string", "minLength": 1},
+        "version": {"type": "string", "minLength": 1},
+        "commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        "license_expression": {"type": "string", "minLength": 1}
+      }
+    },
+    "policy_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "metadata_selection_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "report_size": {"const": 90},
+    "source_files": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "sha256"],
+        "properties": {
+          "path": {"type": "string", "pattern": "^[A-Za-z0-9_./-]+$"},
+          "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+        }
+      }
+    },
+    "devices": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 128,
+      "items": {"$ref": "#/$defs/device"}
+    }
+  },
+  "$defs": {
+    "identity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["vendor_id", "product_id", "model_name", "device_kind", "transport_variant"],
+      "properties": {
+        "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "model_name": {"type": "string", "minLength": 1},
+        "device_kind": {"enum": ["keyboard", "mouse"]},
+        "transport_variant": {"enum": ["wireless", "wired"]}
+      }
+    },
+    "device": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "profile_id",
+        "wireless_identity",
+        "direct_usb_reference",
+        "source",
+        "methods",
+        "qualification_probes"
+      ],
+      "properties": {
+        "profile_id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$"},
+        "wireless_identity": {"$ref": "#/$defs/identity"},
+        "direct_usb_reference": {"$ref": "#/$defs/direct-reference"},
+        "source": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["path", "class_name", "sha256"],
+          "properties": {
+            "path": {"type": "string"},
+            "class_name": {"type": "string"},
+            "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+          }
+        },
+        "methods": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["id", "origin", "classification", "transport", "readback", "privacy"],
+            "properties": {
+              "id": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+              "origin": {"enum": ["advertised", "common-daemon-api", "device-kind-mixin"]},
+              "classification": {
+                "enum": ["read-only", "reversible-with-readback", "software-only", "unsafe"]
+              },
+              "transport": {"enum": ["feature-report", "software-only"]},
+              "readback": {
+                "oneOf": [
+                  {"type": "null"},
+                  {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"}
+                ]
+              },
+              "privacy": {"enum": ["summary-only", "redacted-equality-only"]}
+            }
+          }
+        },
+        "qualification_probes": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"}
+        }
+      }
+    },
+    "direct-reference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "vendor_id",
+        "product_id",
+        "model_name",
+        "device_kind",
+        "transport_variant",
+        "class_name",
+        "source_path",
+        "source_line"
+      ],
+      "properties": {
+        "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "model_name": {"type": "string", "minLength": 1},
+        "device_kind": {"enum": ["keyboard", "mouse"]},
+        "transport_variant": {"const": "wired"},
+        "class_name": {"type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"},
+        "source_path": {"type": "string"},
+        "source_line": {"type": "integer", "minimum": 1}
+      }
+    }
+  }
+}
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 62e15ca..eca0b84 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -22,7 +22,13 @@
 )
 from hfxdev.model import ModelError
 from hfxdev.model import load_json as model_load_json
+import hfxdev.native_control as native_control
 import hfxdev.openrazer as openrazer
+from hfxdev.native_control import (
+    load_native_control_policy,
+    load_native_method_inventory,
+    transformed_native_inventory,
+)
 from hfxdev.openrazer import (
     _ClassCatalog,
     load_import_selection,
@@ -111,6 +117,40 @@ def test_openrazer_import_is_pinned_licensed_and_profile_bound(self) -> None:
             self.assertTrue(device["presentation"]["has_matrix"])
             self.assertEqual(device["advertised_methods"], sorted(device["advertised_methods"]))
 
+    def test_openrazer_native_method_inventory_is_exact_and_fail_closed(self) -> None:
+        policy = load_native_control_policy(ROOT)
+        inventory = load_native_method_inventory(ROOT)
+        self.assertEqual(policy["report_size"], 90)
+        self.assertEqual(inventory["report_size"], 90)
+        self.assertEqual(inventory["upstream"]["commit"], policy["source_commit"])
+
+        devices = {value["profile_id"]: value for value in inventory["devices"]}
+        mouse = devices["child.razer.basilisk-v3-pro-35k.00cd"]
+        keyboard = devices["child.razer.deathstalker-v2-pro-tkl.0296"]
+        self.assertEqual(mouse["wireless_identity"]["product_id"], 0x00CD)
+        self.assertEqual(mouse["direct_usb_reference"]["product_id"], 0x00CC)
+        self.assertEqual(keyboard["wireless_identity"]["product_id"], 0x0296)
+        self.assertEqual(keyboard["direct_usb_reference"]["product_id"], 0x0298)
+
+        for device in devices.values():
+            methods = {value["id"]: value for value in device["methods"]}
+            self.assertEqual(methods["get_serial"]["classification"], "read-only")
+            self.assertEqual(methods["get_serial"]["privacy"], "redacted-equality-only")
+            for probe in device["qualification_probes"]:
+                self.assertEqual(methods[probe]["classification"], "read-only")
+            for method in methods.values():
+                if method["classification"] == "reversible-with-readback":
+                    self.assertIn(method["readback"], methods)
+
+    def test_openrazer_native_policy_rejects_an_unclassified_upstream_method(self) -> None:
+        metadata = deepcopy(load_imported_metadata(ROOT))
+        metadata["devices"][0]["advertised_methods"].append("new_unreviewed_method")
+        metadata["devices"][0]["advertised_methods"].sort()
+
+        with patch.object(native_control, "load_imported_metadata", return_value=metadata):
+            with self.assertRaisesRegex(ModelError, "unclassified: new_unreviewed_method"):
+                load_native_control_policy(ROOT)
+
     def test_openrazer_python_metadata_is_generated_from_the_pinned_import(self) -> None:
         metadata = load_imported_metadata(ROOT)
         rendered = python_openrazer_metadata(metadata)
@@ -125,6 +165,16 @@ def test_openrazer_import_matches_exact_pinned_checkout_when_available(self) ->
         source = Path(source_value)
         self.assertEqual(transformed_metadata(ROOT, source), load_imported_metadata(ROOT))
 
+    def test_openrazer_native_inventory_matches_exact_checkout_when_available(self) -> None:
+        source_value = os.environ.get("HFX_OPENRAZER_SOURCE_DIR")
+        if source_value is None:
+            self.skipTest("HFX_OPENRAZER_SOURCE_DIR is not configured")
+        source = Path(source_value)
+        self.assertEqual(
+            transformed_native_inventory(ROOT, source),
+            load_native_method_inventory(ROOT),
+        )
+
     def test_openrazer_import_rejects_nested_metadata_drift(self) -> None:
         metadata = deepcopy(load_imported_metadata(ROOT))
         metadata["devices"][0]["source"]["class_name"] = "DifferentDevice"
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 3d9a5a0..01db899 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -13,6 +13,7 @@
 from .governance import load_github_governance
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
+from .native_control import write_native_method_inventory
 from .distribution_package import build_distribution_package
 from .github_sync import COMPONENTS as GITHUB_COMPONENTS
 from .github_sync import apply as apply_github
@@ -252,6 +253,13 @@ def main(arguments: list[str] | None = None) -> int:
         if args.command == "import":
             destination = write_imported_metadata(root, args.source.resolve())
             print(f"Imported {args.upstream}: {destination.relative_to(root)}")
+            native_destination = write_native_method_inventory(
+                root, args.source.resolve()
+            )
+            print(
+                "Imported OpenRazer native control: "
+                f"{native_destination.relative_to(root)}"
+            )
             return 0
         if args.command == "knowledge":
             paths = import_upstream_catalogs(
diff --git a/tools/hfxdev/native_control.py b/tools/hfxdev/native_control.py
new file mode 100644
index 0000000..ba24cf3
--- /dev/null
+++ b/tools/hfxdev/native_control.py
@@ -0,0 +1,543 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from copy import deepcopy
+import hashlib
+import json
+from pathlib import Path
+import re
+from typing import Any
+
+from .integrations import upstream_index
+from .model import ModelError, load_json, require_unique, sha256_file
+from .openrazer import (
+    _ClassCatalog,
+    _model_name,
+    _source_commit,
+    load_import_selection,
+    load_imported_metadata,
+    transformed_metadata,
+)
+
+
+POLICY_SCHEMA = "hyperflux-openrazer-native-control-policy-v1"
+INVENTORY_SCHEMA = "hyperflux-openrazer-native-method-inventory-v1"
+METHOD_PATTERN = re.compile(r"[a-z][a-z0-9_]{0,127}\Z")
+PROFILE_PATTERN = re.compile(r"child\.[a-z0-9.-]+\Z")
+SHA256_PATTERN = re.compile(r"[0-9a-f]{64}\Z")
+
+POLICY_KEYS = {
+    "$schema",
+    "schema",
+    "upstream_id",
+    "source_commit",
+    "scope",
+    "report_size",
+    "common_methods",
+    "kind_methods",
+    "classifications",
+    "qualification_probes",
+    "privacy_overrides",
+}
+CLASSIFICATION_KEYS = {
+    "read_only",
+    "reversible_with_readback",
+    "software_only",
+    "unsafe",
+}
+INVENTORY_KEYS = {
+    "$schema",
+    "schema",
+    "upstream",
+    "policy_sha256",
+    "metadata_selection_sha256",
+    "report_size",
+    "source_files",
+    "devices",
+}
+DEVICE_KEYS = {
+    "profile_id",
+    "wireless_identity",
+    "direct_usb_reference",
+    "source",
+    "methods",
+    "qualification_probes",
+}
+METHOD_KEYS = {
+    "id",
+    "origin",
+    "classification",
+    "transport",
+    "readback",
+    "privacy",
+}
+DIRECT_REFERENCE_KEYS = {
+    "vendor_id",
+    "product_id",
+    "model_name",
+    "device_kind",
+    "transport_variant",
+    "class_name",
+    "source_path",
+    "source_line",
+}
+
+COMMON_SOURCE_PATHS = (
+    "daemon/openrazer_daemon/hardware/device_base.py",
+    "driver/razercommon.c",
+    "driver/razercommon.h",
+    "driver/razerchromacommon.c",
+    "driver/razerchromacommon.h",
+)
+KIND_SOURCE_PATHS = {
+    "keyboard": (
+        "daemon/openrazer_daemon/hardware/keyboards.py",
+        "driver/razerkbd_driver.c",
+        "driver/razerkbd_driver.h",
+    ),
+    "mouse": (
+        "daemon/openrazer_daemon/hardware/mouse.py",
+        "driver/razermouse_driver.c",
+        "driver/razermouse_driver.h",
+    ),
+}
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def _digest(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _exact_keys(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - set(value))
+    extras = sorted(set(value) - expected)
+    if missing:
+        raise ModelError(f"{label}: missing keys: {', '.join(missing)}")
+    if extras:
+        raise ModelError(f"{label}: unsupported keys: {', '.join(extras)}")
+
+
+def _method_list(value: Any, label: str, *, sorted_required: bool) -> list[str]:
+    if (
+        not isinstance(value, list)
+        or len(value) > 512
+        or any(not isinstance(item, str) or METHOD_PATTERN.fullmatch(item) is None for item in value)
+    ):
+        raise ModelError(f"{label}: expected a bounded method list")
+    require_unique(value, label)
+    if sorted_required and value != sorted(value):
+        raise ModelError(f"{label}: methods must be sorted")
+    return value
+
+
+def _policy_digest(policy: dict[str, Any]) -> str:
+    return _digest({key: value for key, value in policy.items() if key != "$schema"})
+
+
+def _expected_methods(
+    metadata: dict[str, Any], policy: dict[str, Any]
+) -> dict[str, set[str]]:
+    expected: dict[str, set[str]] = {}
+    for device in metadata["devices"]:
+        methods = set(device["advertised_methods"])
+        methods.update(policy["common_methods"])
+        methods.update(policy["kind_methods"][device["identity"]["device_kind"]])
+        expected[device["profile_id"]] = methods
+    return expected
+
+
+def _classification_index(policy: dict[str, Any]) -> dict[str, dict[str, Any]]:
+    index: dict[str, dict[str, Any]] = {}
+    for method in policy["classifications"]["read_only"]:
+        index[method] = {
+            "classification": "read-only",
+            "transport": "feature-report",
+            "readback": None,
+        }
+    for value in policy["classifications"]["reversible_with_readback"]:
+        index[value["method"]] = {
+            "classification": "reversible-with-readback",
+            "transport": "feature-report",
+            "readback": value["readback"],
+        }
+    for method in policy["classifications"]["software_only"]:
+        index[method] = {
+            "classification": "software-only",
+            "transport": "software-only",
+            "readback": None,
+        }
+    for method in policy["classifications"]["unsafe"]:
+        index[method] = {
+            "classification": "unsafe",
+            "transport": "feature-report",
+            "readback": None,
+        }
+    return index
+
+
+def load_native_control_policy(root: Path) -> dict[str, Any]:
+    path = root / "integrations" / "openrazer" / "native-control-policy.json"
+    policy = load_json(path)
+    _exact_keys(policy, POLICY_KEYS, "OpenRazer native-control policy")
+    if policy["$schema"] != "../../schemas/openrazer-native-control-policy.schema.json":
+        raise ModelError("OpenRazer native-control policy schema reference is not canonical")
+    if policy["schema"] != POLICY_SCHEMA:
+        raise ModelError("unsupported OpenRazer native-control policy schema")
+    upstream = upstream_index(root).get(policy["upstream_id"])
+    if upstream is None or upstream["id"] != "openrazer":
+        raise ModelError("OpenRazer native-control policy names an unknown upstream")
+    if policy["source_commit"] != upstream["commit"]:
+        raise ModelError("OpenRazer native-control policy differs from the upstream pin")
+    if policy["scope"] != "transport-facing-exact-wireless-classes":
+        raise ModelError("OpenRazer native-control policy has an unsupported scope")
+    if policy["report_size"] != 90:
+        raise ModelError("OpenRazer native control must use one 90-byte feature report")
+
+    common = _method_list(policy["common_methods"], "common methods", sorted_required=True)
+    kind_methods = policy["kind_methods"]
+    if not isinstance(kind_methods, dict):
+        raise ModelError("OpenRazer kind methods must be an object")
+    _exact_keys(kind_methods, {"keyboard", "mouse"}, "OpenRazer kind methods")
+    for kind in ("keyboard", "mouse"):
+        _method_list(kind_methods[kind], f"{kind} methods", sorted_required=True)
+
+    classifications = policy["classifications"]
+    if not isinstance(classifications, dict):
+        raise ModelError("OpenRazer method classifications must be an object")
+    _exact_keys(classifications, CLASSIFICATION_KEYS, "OpenRazer method classifications")
+    classified_groups: list[list[str]] = []
+    for key in ("read_only", "software_only", "unsafe"):
+        classified_groups.append(
+            _method_list(
+                classifications[key],
+                key.replace("_", " "),
+                sorted_required=True,
+            )
+        )
+    reversible = classifications["reversible_with_readback"]
+    if not isinstance(reversible, list) or len(reversible) > 512:
+        raise ModelError("reversible methods must be a bounded list")
+    reversible_methods: list[str] = []
+    read_only = set(classifications["read_only"])
+    for index, value in enumerate(reversible):
+        label = f"reversible method {index}"
+        if not isinstance(value, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(value, {"method", "readback"}, label)
+        method, readback = value["method"], value["readback"]
+        if (
+            not isinstance(method, str)
+            or METHOD_PATTERN.fullmatch(method) is None
+            or not isinstance(readback, str)
+            or METHOD_PATTERN.fullmatch(readback) is None
+        ):
+            raise ModelError(f"{label}: invalid method name")
+        if readback not in read_only:
+            raise ModelError(f"{label}: readback is not classified read-only")
+        reversible_methods.append(method)
+    require_unique(reversible_methods, "reversible method")
+    if reversible_methods != sorted(reversible_methods):
+        raise ModelError("reversible methods must be sorted")
+    classified_groups.append(reversible_methods)
+    flat = [method for group in classified_groups for method in group]
+    require_unique(flat, "classified method")
+
+    metadata = load_imported_metadata(root)
+    expected_by_profile = _expected_methods(metadata, policy)
+    expected_union = set().union(*expected_by_profile.values())
+    if set(flat) != expected_union:
+        missing = sorted(expected_union - set(flat))
+        unused = sorted(set(flat) - expected_union)
+        details = []
+        if missing:
+            details.append(f"unclassified: {', '.join(missing)}")
+        if unused:
+            details.append(f"not exposed: {', '.join(unused)}")
+        raise ModelError("OpenRazer native-control method drift: " + "; ".join(details))
+
+    probes = policy["qualification_probes"]
+    if not isinstance(probes, list) or not probes:
+        raise ModelError("OpenRazer qualification probes are empty")
+    probe_profiles: list[str] = []
+    for index, probe in enumerate(probes):
+        label = f"OpenRazer qualification probe {index}"
+        if not isinstance(probe, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(probe, {"profile_id", "methods"}, label)
+        profile_id = probe["profile_id"]
+        if not isinstance(profile_id, str) or PROFILE_PATTERN.fullmatch(profile_id) is None:
+            raise ModelError(f"{label}: invalid profile id")
+        methods = _method_list(probe["methods"], f"{label} methods", sorted_required=False)
+        if profile_id not in expected_by_profile:
+            raise ModelError(f"{label}: unknown profile")
+        if not set(methods) <= expected_by_profile[profile_id]:
+            raise ModelError(f"{label}: includes a method absent from the exact class")
+        if not set(methods) <= read_only:
+            raise ModelError(f"{label}: includes a method that is not read-only")
+        probe_profiles.append(profile_id)
+    require_unique(probe_profiles, "qualification probe profile")
+    if set(probe_profiles) != set(expected_by_profile):
+        raise ModelError("OpenRazer qualification probes do not cover every exact class")
+
+    privacy = policy["privacy_overrides"]
+    if not isinstance(privacy, dict):
+        raise ModelError("OpenRazer privacy overrides must be an object")
+    for method, mode in privacy.items():
+        if method not in read_only or mode not in {"summary-only", "redacted-equality-only"}:
+            raise ModelError("OpenRazer privacy override is invalid")
+    if privacy.get("get_serial") != "redacted-equality-only":
+        raise ModelError("OpenRazer serial probes must be redacted")
+    if not common:
+        raise ModelError("OpenRazer common method authority is empty")
+    return policy
+
+
+def _direct_usb_reference(
+    catalog: _ClassCatalog,
+    class_name: str,
+    wireless_identity: dict[str, Any],
+) -> dict[str, Any]:
+    for ancestor in catalog.linearization(class_name)[1:]:
+        parsed = catalog.classes[ancestor]
+        try:
+            vendor_id = catalog.field(ancestor, "USB_VID")
+            product_id = catalog.field(ancestor, "USB_PID")
+        except KeyError:
+            continue
+        model_name = _model_name(parsed, strict=False)
+        if "(Wired)" not in model_name or product_id == wireless_identity["product_id"]:
+            continue
+        if vendor_id != wireless_identity["vendor_id"]:
+            raise ModelError(f"OpenRazer wired ancestor {ancestor} changes vendor identity")
+        return {
+            "vendor_id": vendor_id,
+            "product_id": product_id,
+            "model_name": model_name,
+            "device_kind": wireless_identity["device_kind"],
+            "transport_variant": "wired",
+            "class_name": ancestor,
+            "source_path": parsed.source_file,
+            "source_line": parsed.line,
+        }
+    raise ModelError(f"OpenRazer class {class_name} has no exact wired reference ancestor")
+
+
+def _source_file_records(source_root: Path, metadata: dict[str, Any]) -> list[dict[str, str]]:
+    paths = set(COMMON_SOURCE_PATHS)
+    for device in metadata["devices"]:
+        paths.add(device["source"]["path"])
+        paths.update(KIND_SOURCE_PATHS[device["identity"]["device_kind"]])
+    records: list[dict[str, str]] = []
+    for relative in sorted(paths):
+        path = source_root / relative
+        if path.is_symlink() or not path.is_file():
+            raise ModelError(f"OpenRazer native-control source is missing or symbolic: {relative}")
+        records.append({"path": relative, "sha256": sha256_file(path)})
+    return records
+
+
+def transformed_native_inventory(root: Path, source_root: Path) -> dict[str, Any]:
+    source_root = source_root.resolve()
+    policy = load_native_control_policy(root)
+    metadata = load_imported_metadata(root)
+    if _source_commit(source_root) != policy["source_commit"]:
+        raise ModelError("OpenRazer native-control checkout does not match the immutable pin")
+    if transformed_metadata(root, source_root) != metadata:
+        raise ModelError("OpenRazer metadata must be refreshed before native-control import")
+
+    catalog = _ClassCatalog(source_root)
+    selection = load_import_selection(root)
+    selected_by_profile = {value["profile_id"]: value for value in selection["devices"]}
+    classification = _classification_index(policy)
+    probes = {value["profile_id"]: value["methods"] for value in policy["qualification_probes"]}
+    privacy = policy["privacy_overrides"]
+    devices: list[dict[str, Any]] = []
+    for device in metadata["devices"]:
+        profile_id = device["profile_id"]
+        selected = selected_by_profile[profile_id]
+        wireless_identity = deepcopy(device["identity"])
+        method_names = set(device["advertised_methods"])
+        method_names.update(policy["common_methods"])
+        method_names.update(policy["kind_methods"][wireless_identity["device_kind"]])
+        methods: list[dict[str, Any]] = []
+        for method in sorted(method_names):
+            record = deepcopy(classification[method])
+            if method in device["advertised_methods"]:
+                origin = "advertised"
+            elif method in policy["common_methods"]:
+                origin = "common-daemon-api"
+            else:
+                origin = "device-kind-mixin"
+            methods.append(
+                {
+                    "id": method,
+                    "origin": origin,
+                    **record,
+                    "privacy": privacy.get(method, "summary-only"),
+                }
+            )
+        devices.append(
+            {
+                "profile_id": profile_id,
+                "wireless_identity": wireless_identity,
+                "direct_usb_reference": _direct_usb_reference(
+                    catalog, selected["class_name"], wireless_identity
+                ),
+                "source": deepcopy(device["source"]),
+                "methods": methods,
+                "qualification_probes": deepcopy(probes[profile_id]),
+            }
+        )
+    upstream = upstream_index(root)["openrazer"]
+    return {
+        "$schema": "../../schemas/openrazer-native-method-inventory.schema.json",
+        "schema": INVENTORY_SCHEMA,
+        "upstream": {
+            key: upstream[key]
+            for key in ("id", "repository", "version", "commit", "license_expression")
+        },
+        "policy_sha256": _policy_digest(policy),
+        "metadata_selection_sha256": metadata["selection_sha256"],
+        "report_size": policy["report_size"],
+        "source_files": _source_file_records(source_root, metadata),
+        "devices": devices,
+    }
+
+
+def load_native_method_inventory(root: Path) -> dict[str, Any]:
+    path = root / "integrations" / "openrazer" / "native-method-inventory.json"
+    inventory = load_json(path)
+    _exact_keys(inventory, INVENTORY_KEYS, "OpenRazer native method inventory")
+    if inventory["$schema"] != "../../schemas/openrazer-native-method-inventory.schema.json":
+        raise ModelError("OpenRazer native method inventory schema reference is not canonical")
+    if inventory["schema"] != INVENTORY_SCHEMA:
+        raise ModelError("unsupported OpenRazer native method inventory schema")
+    policy = load_native_control_policy(root)
+    metadata = load_imported_metadata(root)
+    if inventory["policy_sha256"] != _policy_digest(policy):
+        raise ModelError("OpenRazer native method inventory policy is stale")
+    if inventory["metadata_selection_sha256"] != metadata["selection_sha256"]:
+        raise ModelError("OpenRazer native method inventory metadata selection is stale")
+    upstream = upstream_index(root)["openrazer"]
+    expected_upstream = {
+        key: upstream[key]
+        for key in ("id", "repository", "version", "commit", "license_expression")
+    }
+    if inventory["upstream"] != expected_upstream:
+        raise ModelError("OpenRazer native method inventory upstream binding has drifted")
+    if inventory["report_size"] != policy["report_size"]:
+        raise ModelError("OpenRazer native method inventory report size has drifted")
+
+    sources = inventory["source_files"]
+    if not isinstance(sources, list) or not sources:
+        raise ModelError("OpenRazer native method inventory source binding is empty")
+    source_paths: list[str] = []
+    for index, source in enumerate(sources):
+        if not isinstance(source, dict):
+            raise ModelError(f"OpenRazer native source {index}: expected an object")
+        _exact_keys(source, {"path", "sha256"}, f"OpenRazer native source {index}")
+        if (
+            not isinstance(source["path"], str)
+            or Path(source["path"]).is_absolute()
+            or ".." in Path(source["path"]).parts
+            or not isinstance(source["sha256"], str)
+            or SHA256_PATTERN.fullmatch(source["sha256"]) is None
+        ):
+            raise ModelError(f"OpenRazer native source {index}: invalid source binding")
+        source_paths.append(source["path"])
+    require_unique(source_paths, "OpenRazer native source path")
+    if source_paths != sorted(source_paths):
+        raise ModelError("OpenRazer native source bindings must be sorted")
+
+    metadata_by_profile = {value["profile_id"]: value for value in metadata["devices"]}
+    expected_by_profile = _expected_methods(metadata, policy)
+    classification = _classification_index(policy)
+    probes = {value["profile_id"]: value["methods"] for value in policy["qualification_probes"]}
+    devices = inventory["devices"]
+    if not isinstance(devices, list) or not devices:
+        raise ModelError("OpenRazer native method inventory has no devices")
+    profile_ids: list[str] = []
+    for index, device in enumerate(devices):
+        label = f"OpenRazer native device {index}"
+        if not isinstance(device, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(device, DEVICE_KEYS, label)
+        profile_id = device["profile_id"]
+        if not isinstance(profile_id, str) or PROFILE_PATTERN.fullmatch(profile_id) is None:
+            raise ModelError(f"{label}: invalid profile id")
+        metadata_device = metadata_by_profile.get(profile_id)
+        if metadata_device is None:
+            raise ModelError(f"{label}: profile is absent from imported metadata")
+        if device["wireless_identity"] != metadata_device["identity"]:
+            raise ModelError(f"{label}: wireless identity has drifted")
+        if device["source"] != metadata_device["source"]:
+            raise ModelError(f"{label}: class source has drifted")
+        direct = device["direct_usb_reference"]
+        if not isinstance(direct, dict):
+            raise ModelError(f"{label}: direct USB reference must be an object")
+        _exact_keys(direct, DIRECT_REFERENCE_KEYS, f"{label} direct USB reference")
+        if (
+            direct["vendor_id"] != metadata_device["identity"]["vendor_id"]
+            or direct["product_id"] == metadata_device["identity"]["product_id"]
+            or direct["device_kind"] != metadata_device["identity"]["device_kind"]
+            or direct["transport_variant"] != "wired"
+            or not isinstance(direct["source_line"], int)
+            or direct["source_line"] < 1
+        ):
+            raise ModelError(f"{label}: invalid direct USB reference")
+
+        method_records = device["methods"]
+        if not isinstance(method_records, list) or not method_records:
+            raise ModelError(f"{label}: method inventory is empty")
+        method_ids: list[str] = []
+        for method_index, method in enumerate(method_records):
+            method_label = f"{label} method {method_index}"
+            if not isinstance(method, dict):
+                raise ModelError(f"{method_label}: expected an object")
+            _exact_keys(method, METHOD_KEYS, method_label)
+            method_id = method["id"]
+            if method_id not in expected_by_profile[profile_id]:
+                raise ModelError(f"{method_label}: method is absent from the exact class")
+            expected = classification[method_id]
+            for key in ("classification", "transport", "readback"):
+                if method[key] != expected[key]:
+                    raise ModelError(f"{method_label}: {key} differs from policy")
+            expected_origin = (
+                "advertised"
+                if method_id in metadata_device["advertised_methods"]
+                else (
+                    "common-daemon-api"
+                    if method_id in policy["common_methods"]
+                    else "device-kind-mixin"
+                )
+            )
+            if method["origin"] != expected_origin:
+                raise ModelError(f"{method_label}: origin differs from the exact class")
+            expected_privacy = policy["privacy_overrides"].get(method_id, "summary-only")
+            if method["privacy"] != expected_privacy:
+                raise ModelError(f"{method_label}: privacy handling differs from policy")
+            method_ids.append(method_id)
+        require_unique(method_ids, f"{label} method")
+        if method_ids != sorted(method_ids) or set(method_ids) != expected_by_profile[profile_id]:
+            raise ModelError(f"{label}: method inventory is incomplete or unsorted")
+        if device["qualification_probes"] != probes[profile_id]:
+            raise ModelError(f"{label}: qualification probe order has drifted")
+        profile_ids.append(profile_id)
+    require_unique(profile_ids, "OpenRazer native profile")
+    if profile_ids != sorted(metadata_by_profile):
+        raise ModelError("OpenRazer native method inventory does not cover the exact selection")
+    return inventory
+
+
+def write_native_method_inventory(root: Path, source_root: Path) -> Path:
+    destination = root / "integrations" / "openrazer" / "native-method-inventory.json"
+    value = transformed_native_inventory(root, source_root)
+    destination.write_text(
+        json.dumps(value, indent=2, ensure_ascii=True) + "\n",
+        encoding="utf-8",
+    )
+    return destination
diff --git a/tools/hfxdev/openrazer.py b/tools/hfxdev/openrazer.py
index dcc9433..ba30373 100644
--- a/tools/hfxdev/openrazer.py
+++ b/tools/hfxdev/openrazer.py
@@ -286,6 +286,11 @@ def resolve(
                 continue
         return parsed, values
 
+    def linearization(self, class_name: str) -> tuple[str, ...]:
+        """Return the source-bound local class precedence order."""
+
+        return self._linearization(class_name)
+
 
 def _model_name(parsed: _ParsedClass, *, strict: bool) -> str:
     line = parsed.docstring.splitlines()[0].strip().rstrip(".") if parsed.docstring else ""
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index a1f279e..ee6fdc6 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -26,6 +26,11 @@
 from .licensing import verify_licensing_policy
 from .local_companion import load_local_companion
 from .migration import execute_shadow_comparison, load_shadow_fixture
+from .native_control import (
+    load_native_control_policy,
+    load_native_method_inventory,
+    transformed_native_inventory,
+)
 from .openrazer import (
     extract_openrazer_catalog,
     load_imported_metadata,
@@ -168,6 +173,8 @@ def _check_integration_contract(root: Path) -> None:
     load_integration_catalog(root)
     load_openrazer_compatibility_contract(root)
     load_imported_metadata(root)
+    load_native_control_policy(root)
+    load_native_method_inventory(root)
 
 
 def _tool_environment(root: Path) -> dict[str, str]:
@@ -608,6 +615,13 @@ def _run_openrazer_metadata_contracts(root: Path, _node: TestNode) -> None:
     actual = load_imported_metadata(root)
     if actual != expected:
         raise ModelError("committed OpenRazer metadata is stale; rerun ./hfx import openrazer")
+    expected_native = transformed_native_inventory(root, source)
+    actual_native = load_native_method_inventory(root)
+    if actual_native != expected_native:
+        raise ModelError(
+            "committed OpenRazer native method inventory is stale; "
+            "rerun ./hfx import openrazer"
+        )
 
 
 def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
diff --git a/verification/tests.json b/verification/tests.json
index e163ba7..7bd509a 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -49,7 +49,7 @@
       "timeout_seconds": 10,
       "dependencies": ["schema-contracts"],
       "isolation": "shared",
-      "cache_inputs": ["integrations/**/*.json", "schemas/integration-catalog.schema.json", "tools/hfxdev/integrations.py", "tools/hfxdev/openrazer.py"],
+      "cache_inputs": ["integrations/**/*.json", "schemas/integration-catalog.schema.json", "schemas/openrazer-native-*.schema.json", "tools/hfxdev/integrations.py", "tools/hfxdev/native_control.py", "tools/hfxdev/openrazer.py"],
       "produced_evidence": ["integration-contract-result"],
       "resume_policy": "reuse-verified"
     },
@@ -157,7 +157,7 @@
       "timeout_seconds": 30,
       "dependencies": ["integration-contracts", "profile-contracts"],
       "isolation": "exclusive-process",
-      "cache_inputs": ["integrations/openrazer/*.json", "profiles/children/*.json", "schemas/imported-device-metadata.schema.json", "schemas/upstream-metadata-import.schema.json", "tools/hfxdev/openrazer.py"],
+      "cache_inputs": ["integrations/openrazer/*.json", "profiles/children/*.json", "schemas/imported-device-metadata.schema.json", "schemas/openrazer-native-*.schema.json", "schemas/upstream-metadata-import.schema.json", "tools/hfxdev/native_control.py", "tools/hfxdev/openrazer.py"],
       "produced_evidence": ["openrazer-metadata-result"],
       "resume_policy": "rerun"
     },

From 8487cc5fd637bb3a27291d8129607d52e63ab982 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 10:37:38 +0400
Subject: [PATCH 38/67] feat: add generic native receiver exchange

---
 Cargo.lock                                    |    1 +
 .../tests/fixtures/rust-qualified-mouse.json  |    4 +-
 .../tests/fixtures/rust-qualified-pair.json   |    4 +-
 architecture/repository-atlas.json            |   20 +-
 assurance/generated/hyperflux-next.spdx.json  |    7 +-
 crates/hfx-bridge/Cargo.toml                  |    1 +
 crates/hfx-bridge/src/backend.rs              |  336 ++-
 crates/hfx-bridge/src/lib.rs                  |    9 +-
 crates/hfx-bridge/src/native_exchange.rs      |  209 ++
 crates/hfx-bridge/src/native_projection.rs    |  145 ++
 crates/hfx-bridge/src/native_routes.rs        |  534 ++++
 crates/hfx-bridge/src/rpc.rs                  |   62 +-
 crates/hfx-bridge/src/runtime_identity.rs     |   31 +-
 crates/hfx-bridge/src/session.rs              |   14 +-
 crates/hfx-bridge/tests/core_backend.rs       |  108 +-
 crates/hfx-bridge/tests/native_projection.rs  |  159 ++
 crates/hfx-bridge/tests/rpc_framing.rs        |    2 +-
 crates/hfx-core/src/lib.rs                    |   16 +-
 crates/hfx-core/src/ports.rs                  |   74 +-
 crates/hfx-domain/src/generated.rs            |  308 +++
 crates/hfx-kernel-transport/README.md         |    4 +-
 crates/hfx-kernel-transport/src/error.rs      |   10 +
 crates/hfx-kernel-transport/src/generated.rs  |   99 +
 crates/hfx-kernel-transport/src/io.rs         |   42 +-
 crates/hfx-kernel-transport/src/ioctl_sys.rs  |   33 +-
 crates/hfx-kernel-transport/src/lib.rs        |    9 +
 crates/hfx-kernel-transport/src/native.rs     |  187 ++
 crates/hfx-kernel-transport/src/reader.rs     |   18 +-
 crates/hfx-kernel-transport/src/router.rs     |   36 +-
 crates/hfx-kernel-transport/src/transport.rs  |  291 ++-
 crates/hfx-kernel-transport/tests/adapter.rs  |  253 +-
 crates/hfx-profiles/src/catalog.rs            |    7 +-
 crates/hfx-profiles/src/generated.rs          |   49 +-
 crates/hfx-protocol/src/generated.rs          |  225 +-
 crates/hfx-protocol/src/generated_v7.rs       | 1300 ++++++++++
 crates/hfx-protocol/src/generated_versions.rs |   21 +-
 crates/hfx-protocol/src/wire.rs               |  282 ++-
 crates/hfx-protocol/tests/protocol.rs         |   18 +-
 .../hfx-protocol/tests/wire_and_snapshot.rs   |  273 +-
 crates/hfx-sdk/src/client.rs                  |  118 +-
 crates/hfx-sdk/src/error.rs                   |    6 +
 crates/hfx-sdk/src/lib.rs                     |    5 +-
 crates/hfx-sdk/tests/sdk_contract.rs          |  153 +-
 docs/generated/bridge-protocol-v7.md          |  744 ++++++
 docs/generated/bridge-protocol.md             |  119 +-
 docs/generated/domain-types.md                |    9 +-
 docs/generated/installation.md                |   10 +-
 docs/generated/kernel-uapi.md                 |   22 +-
 docs/generated/repository-atlas.md            |   10 +-
 docs/generated/supply-chain.md                |    2 +-
 docs/generated/supported-hardware.md          |    4 +-
 driver/README.md                              |    4 +-
 driver/kernel/Makefile                        |    1 +
 .../generated/hyperflux_receiver_profiles.inc |   17 +-
 driver/kernel/hyperflux-next-core.c           |   16 +-
 driver/kernel/hyperflux-next-internal.h       |   26 +
 driver/kernel/hyperflux-next-native.c         |  685 +++++
 driver/kernel/hyperflux-next-profile.c        |    6 +-
 driver/kernel/hyperflux-next-profile.h        |   22 +
 driver/kernel/hyperflux-next-session.c        |    4 +
 driver/kernel/uapi/hyperflux_next.h           |   49 +
 generated/knowledge/catalog.json              |    2 +-
 generated/profiles/catalog.json               |   23 +-
 packaging/generated/install-plan.json         |   42 +
 .../razer-hyperflux-v2-1532-00cf.json         |   22 +-
 protocol/registry.json                        |    8 +-
 protocol/v7/catalog.json                      |  677 +++++
 schemas/README.md                             |    2 +
 schemas/domain-catalog.json                   |   15 +-
 schemas/hardware-profile.schema.json          |   29 +
 .../kernel-uapi-native-exchange.schema.json   |   90 +
 schemas/kernel-uapi-registry.schema.json      |   29 +
 .../hyperflux/generated/domain_json.hpp       |  122 +
 .../hyperflux/generated/domain_types.hpp      |  157 ++
 .../hyperflux/generated/profile_catalog.hpp   |    6 +-
 .../hyperflux/generated/protocol_json.hpp     |  350 +++
 .../hyperflux/generated/protocol_types.hpp    |  170 +-
 .../hyperflux/generated/protocol_v7_json.hpp  | 2228 +++++++++++++++++
 .../hyperflux/generated/protocol_v7_types.hpp |  950 +++++++
 .../hyperflux_sdk/generated/domain_types.py   |   77 +
 .../generated/profile_catalog.py              |   15 +-
 .../hyperflux_sdk/generated/protocol_types.py |  186 +-
 .../generated/protocol_v7_types.py            | 1108 ++++++++
 tests/c/kernel_uapi_smoke.c                   |    7 +
 tests/cpp/domain_types_smoke.cpp              |    7 +-
 tests/cpp/kernel_profile_table_smoke.cpp      |   39 +-
 .../generated/profile-compositions.json       |    2 +-
 tests/test_assurance.py                       |   47 +-
 tests/test_kernel_driver.py                   |   49 +
 tests/test_kernel_uapi.py                     |   60 +-
 tests/test_profiles.py                        |   29 +
 tests/test_protocol.py                        |   17 +-
 tools/hfxdev/generators/kernel_uapi.py        |  243 +-
 tools/hfxdev/generators/profiles.py           |   99 +-
 tools/hfxdev/kernel_uapi.py                   |  155 +-
 tools/hfxdev/profiles.py                      |   81 +-
 tools/hfxdev/render.py                        |    4 +-
 uapi/README.md                                |    2 +-
 uapi/native-exchange-v2.json                  |   74 +
 uapi/registry.json                            |   22 +
 100 files changed, 14152 insertions(+), 326 deletions(-)
 create mode 100644 crates/hfx-bridge/src/native_exchange.rs
 create mode 100644 crates/hfx-bridge/src/native_projection.rs
 create mode 100644 crates/hfx-bridge/src/native_routes.rs
 create mode 100644 crates/hfx-bridge/tests/native_projection.rs
 create mode 100644 crates/hfx-kernel-transport/src/native.rs
 create mode 100644 crates/hfx-protocol/src/generated_v7.rs
 create mode 100644 docs/generated/bridge-protocol-v7.md
 create mode 100644 driver/kernel/hyperflux-next-native.c
 create mode 100644 protocol/v7/catalog.json
 create mode 100644 schemas/kernel-uapi-native-exchange.schema.json
 create mode 100644 schemas/kernel-uapi-registry.schema.json
 create mode 100644 sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
 create mode 100644 sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
 create mode 100644 sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
 create mode 100644 uapi/native-exchange-v2.json
 create mode 100644 uapi/registry.json

diff --git a/Cargo.lock b/Cargo.lock
index 8ddecc4..dfd2657 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -81,6 +81,7 @@ dependencies = [
  "rustix",
  "serde",
  "serde_json",
+ "sha2",
 ]
 
 [[package]]
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index f6c6e90..e27572f 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
+    "profile_catalog_digest": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
+        "digest": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 3fec05c..fe6a459 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
+    "profile_catalog_digest": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
+        "digest": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index 58dea59..bb7a75a 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -27,7 +27,7 @@
       "inputs": ["Architecture invariants", "Canonical subsystem requirements"],
       "outputs": ["Validated canonical data", "Generator input contracts"],
       "public_contracts": ["Additional properties rejected", "Stable schema identifiers", "Safe repository-relative paths"],
-      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json", "schemas/lifecycle-policy-catalog.schema.json"],
+      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json", "schemas/lifecycle-policy-catalog.schema.json", "schemas/kernel-uapi-registry.schema.json", "schemas/kernel-uapi-native-exchange.schema.json"],
       "generated_files": ["schemas/README.md", "docs/generated/domain-types.md"],
       "verification": ["schema-contracts", "repository-atlas-contracts"],
       "limitations": ["Schemas validate structure and bounded values, not real hardware behavior"],
@@ -261,12 +261,12 @@
     },
     {
       "id": "kernel-transport", "title": "Kernel transport adapter", "path": "crates/hfx-kernel-transport", "category": "runtime", "status": "implemented",
-      "purpose": "Adapts the generated kernel UAPI into bounded Rust observation, routing, and envelope I/O.",
+      "purpose": "Adapts the generated kernel UAPI into bounded Rust observation, routing, envelope I/O, and qualified native exchanges.",
       "owns": ["Kernel device I/O", "UAPI encoding", "Receiver route adaptation"],
-      "must_not_own": ["Qualification policy", "Application identity", "Unbounded raw reports"],
+      "must_not_own": ["Qualification policy", "Application identity", "Unbounded or unqualified raw reports"],
       "inputs": ["Generated kernel UAPI", "Kernel session device", "Qualified bridge actions"],
-      "outputs": ["Typed observations", "Bounded transport outcomes"],
-      "public_contracts": ["Exclusive writer session", "Generation-bound envelope", "No HID access in integrations"],
+      "outputs": ["Typed observations", "Bounded transport outcomes", "Correlated native exchange outcomes"],
+      "public_contracts": ["Exclusive writer session", "Generation-bound envelope", "No HID access in integrations", "Uncertain native writes are never replayed"],
       "canonical_files": ["crates/hfx-kernel-transport/Cargo.toml", "crates/hfx-kernel-transport/src/lib.rs", "crates/hfx-kernel-transport/src/transport.rs"],
       "generated_files": ["crates/hfx-kernel-transport/README.md", "crates/hfx-kernel-transport/src/generated.rs"],
       "verification": ["rust-unit", "kernel-profile-contracts"],
@@ -293,17 +293,17 @@
     },
     {
       "id": "driver-contract", "title": "Kernel driver contract", "path": "driver", "category": "runtime", "status": "implemented",
-      "purpose": "Defines the generated userspace ABI and the strict boundary around the in-kernel receiver transport.",
+      "purpose": "Defines additive generated userspace ABIs and the strict boundary around the in-kernel receiver transport.",
       "owns": ["Kernel UAPI authority", "Driver source boundary", "Session-device contract"],
       "must_not_own": ["Retail presentation", "Effects", "Application ownership"],
       "inputs": ["Architecture transport limits", "Profile-safe receiver identity", "Protocol envelope requirements"],
-      "outputs": ["Generated UAPI header", "Kernel module source"],
-      "public_contracts": ["Input remains independent", "One exclusive writer", "Bounded opaque envelopes"],
-      "canonical_files": ["uapi/kernel-uapi.json"],
+      "outputs": ["Generated UAPI header", "Kernel module source", "Rust UAPI bindings"],
+      "public_contracts": ["Input remains independent", "One exclusive writer", "Bounded opaque envelopes", "Version-1 ABI remains byte-compatible"],
+      "canonical_files": ["uapi/registry.json", "uapi/kernel-uapi.json", "uapi/native-exchange-v2.json"],
       "generated_files": ["driver/README.md", "driver/kernel/uapi/hyperflux_next.h", "docs/generated/kernel-uapi.md"],
       "verification": ["kernel-profile-contracts"],
       "limitations": ["Live loading and physical validation are outside this software-only mission"],
-      "safe_change_workflow": ["Change the canonical UAPI", "Regenerate kernel and Rust bindings", "Run UAPI, kernel, SDK, and package contracts"],
+      "safe_change_workflow": ["Add a catalog without rewriting an existing ABI", "Regenerate kernel and Rust bindings", "Run ABI-freeze, kernel, SDK, and package contracts"],
       "related_docs": ["docs/architecture/kernel.md", "docs/generated/kernel-uapi.md"],
       "depends_on": ["architecture", "schemas"]
     },
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 0bc528f..3ff4150 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/2874becb4636df0d25308c3cdd27b18585424476379ec3ea74ea87a781344253",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/92006b9561017382240993dd195de5c217e9e6fcc2e3614e6061698fd16b201d",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
@@ -1257,6 +1257,11 @@
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Cargo-serde-json-1.0.150"
     },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-bridge-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-sha2-0.11.0"
+    },
     {
       "spdxElementId": "SPDXRef-Cargo-hfx-core-0.0.0-dev.1",
       "relationshipType": "DEPENDS_ON",
diff --git a/crates/hfx-bridge/Cargo.toml b/crates/hfx-bridge/Cargo.toml
index 153b5ba..99187db 100644
--- a/crates/hfx-bridge/Cargo.toml
+++ b/crates/hfx-bridge/Cargo.toml
@@ -16,6 +16,7 @@ hfx-protocol = { path = "../hfx-protocol" }
 rustix.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+sha2.workspace = true
 
 [lints]
 workspace = true
diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index df0bec6..092028b 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -4,31 +4,39 @@ use crate::{
     AuthorizedSession, BackendRequestContext, BridgeRpcBackend, GenerationActivationOutcome,
     GenerationOrchestrationError, GenerationOrchestrator, LifecycleObservation,
     LifecycleObservationError, LifecycleObservationOrchestrator, LifecycleObservationOutcome,
-    ReceiverDisconnectCompletionOutcome, ReceiverDisconnectObservation, ReceiverDisconnectOutcome,
-    ReceiverGenerationObservation, RestorationRuntime, RpcFailure, RuntimeIdentityError,
-    RuntimeIdentityIssuer, RuntimeProfileAuthority, SessionIdentitySource, SessionRegistry,
-    SnapshotProjectionError, SnapshotProjector, SubscriptionRegistry, SubscriptionRegistryError,
+    NativeExchangeJournal, NativeExchangeJournalError, NativeRouteJournal, NativeRouteJournalError,
+    NativeRouteProjectionError, ReceiverDisconnectCompletionOutcome, ReceiverDisconnectObservation,
+    ReceiverDisconnectOutcome, ReceiverGenerationObservation, RestorationRuntime, RpcFailure,
+    RuntimeIdentityError, RuntimeIdentityIssuer, RuntimeProfileAuthority, SessionIdentitySource,
+    SessionRegistry, SnapshotProjectionError, SnapshotProjector, SubscriptionRegistry,
+    SubscriptionRegistryError, project_native_routes,
 };
 use hfx_core::{
     BoundedEventLog, Clock, DesiredEffectError, DiagnosticRegistry, DiagnosticRegistryError,
     DispatchResult, EventDraft, EventLogError, EventSink, LeaseManager, LeaseManagerError,
-    LifecycleLimits, OutcomeJournalError, OutcomeLookup, PersistedStableIntent, ProfileRegistry,
-    ReceiverLifecycleRegistry, ReceiverTransport, RestorationAuthority, RestorationError,
-    RestoreAdvanceResult, RestorePlanResult, RestoreRecord, RestoreTrigger, SessionAuthority,
-    StableCommitOutcome, SubmissionResult, TransactionCoordinator, TransactionCoordinatorError,
-    TransactionQueueError, VolatileEffectRegistry, WallClock,
+    LifecycleLimits, NATIVE_REPORT_BYTES, NativeEndpointLane, NativeTransportDispatch,
+    NativeTransportResult, OutcomeJournalError, OutcomeLookup, PersistedStableIntent,
+    ProfileRegistry, ReceiverLifecycleRegistry, ReceiverTransport, RestorationAuthority,
+    RestorationError, RestoreAdvanceResult, RestorePlanResult, RestoreRecord, RestoreTrigger,
+    SessionAuthority, StableCommitOutcome, SubmissionResult, TransactionCoordinator,
+    TransactionCoordinatorError, TransactionQueueError, VolatileEffectRegistry, WallClock,
 };
 use hfx_domain::{
-    EventKind, FindingId, LeaseDurationMs, MonotonicMs, ProjectionRevision, ProtocolErrorKind,
-    QueueCapacity, ReceiverId, RestoreClaimId, StreamEpoch, StreamId,
+    DeviceKind, EventKind, FindingId, LeaseDurationMs, MonotonicMs, NativeReportHex,
+    NativeRouteAccess, ProjectionRevision, ProtocolErrorKind, QueueCapacity, ReceiverId,
+    ResourceKind, RestoreClaimId, RouteState, StreamEpoch, StreamId,
 };
 use hfx_errors::ErrorCode;
 use hfx_integration_model::project_integration_view;
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, EventBatch, IntegrationView, LeaseRequest, LeaseResult,
-    ReleaseLeaseRequest, RenewLeaseRequest, SubscriptionRequest, TransactionLookup,
-    TransactionRequest, TransactionResult, TransactionUnavailable, validate_lease_request,
+    NativeExchangeMatchedResponse, NativeExchangeNotSent, NativeExchangeOutcome,
+    NativeExchangeRequest, NativeExchangeResult, NativeExchangeUncertain, NativeRouteEventBatch,
+    NativeRouteInventory, ReleaseLeaseRequest, RenewLeaseRequest, SubscriptionRequest,
+    TransactionLookup, TransactionRequest, TransactionResult, TransactionUnavailable,
+    validate_lease_request,
 };
+use sha2::{Digest, Sha256};
 use std::fmt;
 use std::ops::Deref;
 
@@ -83,6 +91,8 @@ pub enum CoreBridgeBackendError {
     Event(EventLogError),
     Diagnostic(DiagnosticRegistryError),
     Subscription(SubscriptionRegistryError),
+    NativeRoute(NativeRouteJournalError),
+    NativeExchange(NativeExchangeJournalError),
 }
 
 impl fmt::Display for CoreBridgeBackendError {
@@ -94,6 +104,8 @@ impl fmt::Display for CoreBridgeBackendError {
             Self::Event(_) => "event stream initialization failed",
             Self::Diagnostic(_) => "diagnostic registry initialization failed",
             Self::Subscription(_) => "subscription registry initialization failed",
+            Self::NativeRoute(_) => "native route journal initialization failed",
+            Self::NativeExchange(_) => "native exchange journal initialization failed",
         })
     }
 }
@@ -117,6 +129,9 @@ pub struct CoreBridgeBackend<C, W, T, R, S> {
     events: BoundedEventLog,
     diagnostics: DiagnosticRegistry,
     subscriptions: SubscriptionRegistry,
+    native_routes: NativeRouteJournal,
+    native_exchanges: NativeExchangeJournal,
+    native_subscriptions: SubscriptionRegistry,
     event_sink: S,
 }
 
@@ -174,6 +189,19 @@ where
         let subscriptions =
             SubscriptionRegistry::new(usize::from(config.subscription_capacity.get()))
                 .map_err(CoreBridgeBackendError::Subscription)?;
+        let native_routes = NativeRouteJournal::new(
+            &config.stream_id,
+            config.stream_epoch,
+            config.projection_revision,
+            usize::from(config.event_capacity.get()),
+        )
+        .map_err(CoreBridgeBackendError::NativeRoute)?;
+        let native_exchanges =
+            NativeExchangeJournal::new(usize::from(config.transaction_capacity.get()))
+                .map_err(CoreBridgeBackendError::NativeExchange)?;
+        let native_subscriptions =
+            SubscriptionRegistry::new(usize::from(config.subscription_capacity.get()))
+                .map_err(CoreBridgeBackendError::Subscription)?;
         Ok(Self {
             config,
             clock,
@@ -189,6 +217,9 @@ where
             events,
             diagnostics,
             subscriptions,
+            native_routes,
+            native_exchanges,
+            native_subscriptions,
             event_sink,
         })
     }
@@ -632,7 +663,9 @@ where
 
     #[must_use]
     pub fn active_subscriptions(&self) -> usize {
-        self.subscriptions.len()
+        self.subscriptions
+            .len()
+            .saturating_add(self.native_subscriptions.len())
     }
 
     fn authorize(context: BackendRequestContext<'_>) -> Result<(), RpcFailure> {
@@ -659,8 +692,23 @@ where
         }
     }
 
-    fn qualify_resources(&self, request: &LeaseRequest) -> Result<(), RpcFailure> {
+    fn synchronize_native_routes(&mut self) -> Result<(), RpcFailure> {
+        let routes = project_native_routes(&self.receivers, &self.profiles)
+            .map_err(native_projection_failure)?;
+        self.native_routes
+            .synchronize(routes, &mut self.identities)
+            .map_err(native_route_failure)
+    }
+
+    fn qualify_resources(&mut self, request: &LeaseRequest) -> Result<(), RpcFailure> {
         validate_lease_request(request).map_err(|_| request_failure())?;
+        if request
+            .resources
+            .iter()
+            .any(|resource| resource.kind == ResourceKind::NativeControl)
+        {
+            self.synchronize_native_routes()?;
+        }
         let profiles = self.profiles.view(&self.receivers);
         for resource in &request.resources {
             if self.transport.current_generation(&resource.receiver_id)
@@ -668,14 +716,38 @@ where
             {
                 return Err(generation_failure());
             }
-            if !self
-                .transport
-                .write_available(&resource.receiver_id, resource.generation_id)
-            {
-                return Err(transport_unavailable_failure());
-            }
-            if !profiles.supports(resource) {
-                return Err(profile_failure());
+            match resource.kind {
+                ResourceKind::Lighting => {
+                    if !self
+                        .transport
+                        .write_available(&resource.receiver_id, resource.generation_id)
+                    {
+                        return Err(transport_unavailable_failure());
+                    }
+                    if !profiles.supports(resource) {
+                        return Err(profile_failure());
+                    }
+                }
+                ResourceKind::NativeControl => {
+                    let route = self
+                        .native_routes
+                        .route_for_resource(resource)
+                        .ok_or_else(profile_failure)?;
+                    if route.access != NativeRouteAccess::Qualified
+                        || route.route_state != RouteState::Available
+                    {
+                        return Err(profile_failure());
+                    }
+                    if !self
+                        .transport
+                        .native_exchange_available(&resource.receiver_id, resource.generation_id)
+                    {
+                        return Err(transport_unavailable_failure());
+                    }
+                }
+                ResourceKind::Settings | ResourceKind::Pairing => {
+                    return Err(profile_failure());
+                }
             }
         }
         Ok(())
@@ -933,10 +1005,126 @@ where
         ))
     }
 
+    fn native_enumerate(
+        &mut self,
+        context: BackendRequestContext<'_>,
+    ) -> Result<NativeRouteInventory, RpcFailure> {
+        Self::authorize(context)?;
+        self.tick()?;
+        self.synchronize_native_routes()?;
+        Ok(self.native_routes.inventory())
+    }
+
+    fn native_transact(
+        &mut self,
+        context: BackendRequestContext<'_>,
+        request: NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        Self::authorize_client(context, &request.client_id)?;
+        self.tick()?;
+        if let Some(outcome) = self
+            .native_exchanges
+            .retained(&request)
+            .map_err(native_exchange_failure)?
+        {
+            return Ok(outcome);
+        }
+
+        self.synchronize_native_routes()?;
+        let route = self
+            .native_routes
+            .route_by_token(&request.route_token)
+            .cloned()
+            .ok_or_else(profile_failure)?;
+        if route.access != NativeRouteAccess::Qualified
+            || route.route_state != RouteState::Available
+        {
+            return Err(profile_failure());
+        }
+        let resource = route.resource.clone().ok_or_else(profile_failure)?;
+        if !self.leases.owns(
+            &request.client_id,
+            &request.lease_id,
+            std::slice::from_ref(&resource),
+            self.clock.now(),
+        ) {
+            return Err(ownership_failure());
+        }
+        if self.transport.current_generation(&route.receiver_id) != Some(route.generation_id) {
+            return Err(generation_failure());
+        }
+        if !self
+            .transport
+            .native_exchange_available(&route.receiver_id, route.generation_id)
+        {
+            return Err(transport_unavailable_failure());
+        }
+        if usize::from(route.report_bytes.get()) != NATIVE_REPORT_BYTES {
+            return Err(profile_failure());
+        }
+
+        let endpoint = match route.device_kind {
+            DeviceKind::Mouse => NativeEndpointLane::Pointer,
+            DeviceKind::Keyboard => NativeEndpointLane::Keyboard,
+            _ => return Err(profile_failure()),
+        };
+        let report = decode_native_report(&request.report)?;
+        let route_token_digest = native_route_token_digest(&request.route_token);
+        let dispatch = NativeTransportDispatch {
+            session_id: context.session().session_id.clone(),
+            authorization_epoch: context.session().authorization_epoch,
+            dispatch_nonce: self.identities.dispatch_nonce().map_err(identity_failure)?,
+            receiver_id: route.receiver_id,
+            generation_id: route.generation_id,
+            endpoint,
+            route_token_digest,
+            report,
+            timeout_ms: request.timeout_ms,
+        };
+        let transport_outcome = self.transport.native_exchange(&dispatch);
+        let result = if transport_outcome.dispatch_nonce != dispatch.dispatch_nonce
+            || transport_outcome.route_token_digest != dispatch.route_token_digest
+        {
+            NativeExchangeResult::MayHaveBeenSent(NativeExchangeUncertain {
+                error_kind: ProtocolErrorKind::OutcomeUnknown,
+                finding_id: finding(ErrorCode::HfxTransport002),
+            })
+        } else {
+            protocol_native_result(&transport_outcome.result)?
+        };
+        let outcome = NativeExchangeOutcome {
+            request_id: request.request_id.clone(),
+            route_token: request.route_token.clone(),
+            result,
+        };
+        self.native_exchanges
+            .remember(request, outcome.clone())
+            .map_err(native_exchange_failure)?;
+        Ok(outcome)
+    }
+
+    fn native_watch(
+        &mut self,
+        context: BackendRequestContext<'_>,
+        request: SubscriptionRequest,
+    ) -> Result<NativeRouteEventBatch, RpcFailure> {
+        Self::authorize_client(context, &request.client_id)?;
+        self.tick()?;
+        self.synchronize_native_routes()?;
+        let subscription_id = self
+            .native_subscriptions
+            .resolve(context.session(), &request, &mut self.identities)
+            .map_err(subscription_failure)?;
+        self.native_routes
+            .read(subscription_id, &request)
+            .map_err(native_route_failure)
+    }
+
     fn disconnect(&mut self, session: &AuthorizedSession) -> Result<(), RpcFailure> {
         self.tick()?;
         self.desired_effects.remove_session(&session.session_id);
         let _ = self.subscriptions.revoke_session(session);
+        let _ = self.native_subscriptions.revoke_session(session);
         let released = self.leases.release_client(&session.client_id);
         let mut first_failure = None;
         for grant in released {
@@ -960,10 +1148,112 @@ fn finding(code: ErrorCode) -> FindingId {
         .expect("generated error codes satisfy the finding identity bound")
 }
 
+fn decode_native_report(value: &NativeReportHex) -> Result<[u8; NATIVE_REPORT_BYTES], RpcFailure> {
+    let bytes = value.as_str().as_bytes();
+    if bytes.len() != NATIVE_REPORT_BYTES * 2 {
+        return Err(request_failure());
+    }
+    let mut report = [0_u8; NATIVE_REPORT_BYTES];
+    for (index, pair) in bytes.chunks_exact(2).enumerate() {
+        let high = decode_lower_hex(pair[0]).ok_or_else(request_failure)?;
+        let low = decode_lower_hex(pair[1]).ok_or_else(request_failure)?;
+        report[index] = (high << 4) | low;
+    }
+    Ok(report)
+}
+
+const fn decode_lower_hex(value: u8) -> Option<u8> {
+    match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        _ => None,
+    }
+}
+
+fn encode_native_report(report: &[u8; NATIVE_REPORT_BYTES]) -> Result<NativeReportHex, RpcFailure> {
+    const LOWER_HEX: &[u8; 16] = b"0123456789abcdef";
+    let mut encoded = String::with_capacity(NATIVE_REPORT_BYTES * 2);
+    for byte in report {
+        encoded.push(char::from(LOWER_HEX[usize::from(byte >> 4)]));
+        encoded.push(char::from(LOWER_HEX[usize::from(byte & 0x0f)]));
+    }
+    NativeReportHex::try_from(encoded).map_err(|_| RpcFailure::internal())
+}
+
+fn native_route_token_digest(token: &hfx_domain::NativeRouteToken) -> [u8; 32] {
+    Sha256::digest(token.as_str().as_bytes()).into()
+}
+
+fn protocol_native_result(
+    result: &NativeTransportResult,
+) -> Result<NativeExchangeResult, RpcFailure> {
+    Ok(match result {
+        NativeTransportResult::NotSent { error_kind } => {
+            NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                error_kind: *error_kind,
+                finding_id: native_finding(*error_kind, false),
+            })
+        }
+        NativeTransportResult::MayHaveBeenSent { error_kind } => {
+            NativeExchangeResult::MayHaveBeenSent(NativeExchangeUncertain {
+                error_kind: *error_kind,
+                finding_id: native_finding(*error_kind, true),
+            })
+        }
+        NativeTransportResult::MatchedResponse(response) => {
+            NativeExchangeResult::MatchedResponse(NativeExchangeMatchedResponse {
+                response: encode_native_report(response)?,
+            })
+        }
+    })
+}
+
+fn native_finding(error_kind: ProtocolErrorKind, uncertain: bool) -> FindingId {
+    if uncertain {
+        return finding(ErrorCode::HfxTransport002);
+    }
+    finding(match error_kind {
+        ProtocolErrorKind::IncompatibleVersion => ErrorCode::HfxProtocol001,
+        ProtocolErrorKind::UnsupportedFeature => ErrorCode::HfxProfile001,
+        ProtocolErrorKind::InvalidRequest => ErrorCode::HfxRequest001,
+        ProtocolErrorKind::OwnershipConflict => ErrorCode::HfxOwnership002,
+        ProtocolErrorKind::StaleGeneration => ErrorCode::HfxGeneration001,
+        ProtocolErrorKind::DeadlineExceeded => ErrorCode::HfxDeadline001,
+        ProtocolErrorKind::QueueFull => ErrorCode::HfxQueue001,
+        ProtocolErrorKind::TransportFailure => ErrorCode::HfxTransport001,
+        ProtocolErrorKind::OutcomeUnknown => ErrorCode::HfxOutcome001,
+        ProtocolErrorKind::OutcomeEvicted => ErrorCode::HfxOutcome002,
+        ProtocolErrorKind::InternalFailure => ErrorCode::HfxInternal001,
+    })
+}
+
 fn desired_effect_failure(_error: DesiredEffectError) -> RpcFailure {
     RpcFailure::internal()
 }
 
+fn native_projection_failure(_error: NativeRouteProjectionError) -> RpcFailure {
+    RpcFailure::internal()
+}
+
+fn native_route_failure(error: NativeRouteJournalError) -> RpcFailure {
+    match error {
+        NativeRouteJournalError::SubscriptionMismatch => request_failure(),
+        NativeRouteJournalError::RouteCapacity => queue_failure(),
+        NativeRouteJournalError::InvalidCapacity
+        | NativeRouteJournalError::Identity(_)
+        | NativeRouteJournalError::InvalidStreamIdentity
+        | NativeRouteJournalError::SequenceExhausted
+        | NativeRouteJournalError::DropCounterExhausted => RpcFailure::internal(),
+    }
+}
+
+fn native_exchange_failure(error: NativeExchangeJournalError) -> RpcFailure {
+    match error {
+        NativeExchangeJournalError::RequestIdentityReused => request_failure(),
+        NativeExchangeJournalError::InvalidCapacity => RpcFailure::internal(),
+    }
+}
+
 const fn request_failure() -> RpcFailure {
     RpcFailure::new(ErrorCode::HfxRequest001, ProtocolErrorKind::InvalidRequest)
 }
diff --git a/crates/hfx-bridge/src/lib.rs b/crates/hfx-bridge/src/lib.rs
index f043152..29ba4cf 100644
--- a/crates/hfx-bridge/src/lib.rs
+++ b/crates/hfx-bridge/src/lib.rs
@@ -7,6 +7,9 @@ mod backend;
 mod clock;
 mod connection;
 mod generation;
+mod native_exchange;
+mod native_projection;
+mod native_routes;
 mod observation;
 mod persistence;
 mod profile_authority;
@@ -41,11 +44,15 @@ pub use hfx_protocol::{
     read_rpc_response, read_rpc_response_for_version, write_rpc_request,
     write_rpc_request_for_version, write_rpc_response, write_rpc_response_for_version,
 };
+pub use native_exchange::{NativeExchangeJournal, NativeExchangeJournalError};
+pub use native_projection::{
+    NATIVE_EXCHANGE_CAPABILITY_ID, NativeRouteProjectionError, project_native_routes,
+};
+pub use native_routes::{NativeRouteJournal, NativeRouteJournalError};
 pub use observation::{
     AppliedLifecycleObservation, LifecycleObservation, LifecycleObservationError,
     LifecycleObservationKind, LifecycleObservationOrchestrator, LifecycleObservationOutcome,
 };
-
 pub use persistence::{
     AtomicFileCommitter, BRIDGE_PERSISTENCE_SCHEMA, BridgePersistenceDocument,
     DEFAULT_MAX_PERSISTED_RECEIVERS, DEFAULT_MAX_PERSISTENCE_BYTES, FilePersistenceConfig,
diff --git a/crates/hfx-bridge/src/native_exchange.rs b/crates/hfx-bridge/src/native_exchange.rs
new file mode 100644
index 0000000..124a7d5
--- /dev/null
+++ b/crates/hfx-bridge/src/native_exchange.rs
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_domain::{ClientId, RequestId};
+use hfx_protocol::{NativeExchangeOutcome, NativeExchangeRequest};
+use std::collections::{BTreeMap, VecDeque};
+use std::fmt;
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct NativeRequestKey {
+    client_id: ClientId,
+    request_id: RequestId,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct NativeExchangeRecord {
+    request: NativeExchangeRequest,
+    outcome: NativeExchangeOutcome,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeExchangeJournalError {
+    InvalidCapacity,
+    RequestIdentityReused,
+}
+
+impl fmt::Display for NativeExchangeJournalError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidCapacity => "native exchange journal capacity is invalid",
+            Self::RequestIdentityReused => {
+                "native exchange request identity was reused with different content"
+            }
+        })
+    }
+}
+
+impl std::error::Error for NativeExchangeJournalError {}
+
+/// Bounded process-local idempotency journal for synchronous native exchanges.
+#[derive(Clone, Debug)]
+pub struct NativeExchangeJournal {
+    capacity: usize,
+    order: VecDeque<NativeRequestKey>,
+    records: BTreeMap<NativeRequestKey, NativeExchangeRecord>,
+}
+
+impl NativeExchangeJournal {
+    /// Creates a bounded terminal native-exchange history.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`NativeExchangeJournalError::InvalidCapacity`] for a zero or
+    /// oversized bound.
+    pub fn new(capacity: usize) -> Result<Self, NativeExchangeJournalError> {
+        if !(1..=4096).contains(&capacity) {
+            return Err(NativeExchangeJournalError::InvalidCapacity);
+        }
+        Ok(Self {
+            capacity,
+            order: VecDeque::with_capacity(capacity),
+            records: BTreeMap::new(),
+        })
+    }
+
+    /// Resolves an exact retained request without issuing a transport call.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`NativeExchangeJournalError::RequestIdentityReused`] when the
+    /// same client request identity names different content.
+    pub fn retained(
+        &self,
+        request: &NativeExchangeRequest,
+    ) -> Result<Option<NativeExchangeOutcome>, NativeExchangeJournalError> {
+        let key = NativeRequestKey {
+            client_id: request.client_id.clone(),
+            request_id: request.request_id.clone(),
+        };
+        let Some(record) = self.records.get(&key) else {
+            return Ok(None);
+        };
+        if record.request != *request {
+            return Err(NativeExchangeJournalError::RequestIdentityReused);
+        }
+        Ok(Some(record.outcome.clone()))
+    }
+
+    /// Retains one terminal outcome, evicting the oldest bounded entry.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`NativeExchangeJournalError::RequestIdentityReused`] for a
+    /// contradictory request or terminal result.
+    pub fn remember(
+        &mut self,
+        request: NativeExchangeRequest,
+        outcome: NativeExchangeOutcome,
+    ) -> Result<(), NativeExchangeJournalError> {
+        let key = NativeRequestKey {
+            client_id: request.client_id.clone(),
+            request_id: request.request_id.clone(),
+        };
+        if let Some(record) = self.records.get(&key) {
+            return if record.request == request && record.outcome == outcome {
+                Ok(())
+            } else {
+                Err(NativeExchangeJournalError::RequestIdentityReused)
+            };
+        }
+        if self.records.len() == self.capacity
+            && let Some(expired) = self.order.pop_front()
+        {
+            self.records.remove(&expired);
+        }
+        self.order.push_back(key.clone());
+        self.records
+            .insert(key, NativeExchangeRecord { request, outcome });
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.records.len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.records.is_empty()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        FindingId, LeaseId, NativeExchangeTimeoutMs, NativeReportHex, NativeRouteToken,
+        ProtocolErrorKind,
+    };
+    use hfx_protocol::{NativeExchangeNotSent, NativeExchangeResult};
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is valid")
+    }
+
+    fn request(client: &str, request: &str, fill: char) -> NativeExchangeRequest {
+        NativeExchangeRequest {
+            request_id: text(request),
+            client_id: text(client),
+            lease_id: text::<LeaseId>("lease-1"),
+            route_token: text::<NativeRouteToken>(&"a".repeat(64)),
+            report: text::<NativeReportHex>(&fill.to_string().repeat(180)),
+            timeout_ms: NativeExchangeTimeoutMs::try_from(100_u16).expect("timeout is valid"),
+        }
+    }
+
+    fn outcome(request: &NativeExchangeRequest) -> NativeExchangeOutcome {
+        NativeExchangeOutcome {
+            request_id: request.request_id.clone(),
+            route_token: request.route_token.clone(),
+            result: NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                error_kind: ProtocolErrorKind::TransportFailure,
+                finding_id: text::<FindingId>("HFX-TRANSPORT-001"),
+            }),
+        }
+    }
+
+    #[test]
+    fn exact_replay_is_retained_and_contradictory_reuse_is_rejected() {
+        let mut journal = NativeExchangeJournal::new(2).expect("capacity is valid");
+        let original = request("client-1", "request-1", '0');
+        let retained = outcome(&original);
+        journal
+            .remember(original.clone(), retained.clone())
+            .expect("first result is retained");
+
+        assert_eq!(journal.retained(&original), Ok(Some(retained)));
+        assert_eq!(
+            journal.retained(&request("client-1", "request-1", '1')),
+            Err(NativeExchangeJournalError::RequestIdentityReused)
+        );
+    }
+
+    #[test]
+    fn terminal_history_is_bounded_per_client_and_request_identity() {
+        let mut journal = NativeExchangeJournal::new(2).expect("capacity is valid");
+        let first = request("client-1", "request-1", '0');
+        let second = request("client-1", "request-2", '1');
+        let third = request("client-2", "request-1", '2');
+        for request in [&first, &second, &third] {
+            journal
+                .remember(request.clone(), outcome(request))
+                .expect("result is retained");
+        }
+
+        assert_eq!(journal.len(), 2);
+        assert_eq!(journal.retained(&first), Ok(None));
+        assert!(
+            journal
+                .retained(&second)
+                .expect("lookup succeeds")
+                .is_some()
+        );
+        assert!(journal.retained(&third).expect("lookup succeeds").is_some());
+    }
+}
diff --git a/crates/hfx-bridge/src/native_projection.rs b/crates/hfx-bridge/src/native_projection.rs
new file mode 100644
index 0000000..41b776a
--- /dev/null
+++ b/crates/hfx-bridge/src/native_projection.rs
@@ -0,0 +1,145 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::RuntimeProfileAuthority;
+use hfx_core::{EndpointLifecycle, ReceiverLifecycleRegistry};
+use hfx_domain::{
+    ActivityState, NativeProtocolFamily, NativeReportByteCount, NativeRouteAccess, PowerState,
+    RouteKind, RouteState, SleepState, SupportLevel,
+};
+use hfx_protocol::NativeRoute;
+use std::fmt;
+
+/// Child capability required before an observed route may issue a writable
+/// native-control token. Catalog membership alone never grants this claim.
+pub const NATIVE_EXCHANGE_CAPABILITY_ID: &str = "native.feature-report-exchange";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeRouteProjectionError {
+    InvalidProtocolFamily,
+    InvalidReportSize,
+    MissingReceiverVendor,
+}
+
+impl fmt::Display for NativeRouteProjectionError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidProtocolFamily => "native protocol family is invalid",
+            Self::InvalidReportSize => "native report size is invalid",
+            Self::MissingReceiverVendor => "native receiver profile has no USB vendor identity",
+        })
+    }
+}
+
+impl std::error::Error for NativeRouteProjectionError {}
+
+/// Projects all receiver-backed child endpoints without exposing host paths.
+///
+/// Exact known children and unknown candidates share this path. Only a
+/// production-qualified writable child capability changes access from
+/// `candidate` to `qualified`; the bridge engine contains no PID branches.
+///
+/// # Errors
+///
+/// Returns a typed generated-profile error if the bound receiver's native
+/// protocol family, report size, or USB vendor identity is invalid.
+pub fn project_native_routes(
+    receivers: &ReceiverLifecycleRegistry,
+    profiles: &RuntimeProfileAuthority,
+) -> Result<Vec<NativeRoute>, NativeRouteProjectionError> {
+    let view = profiles.view(receivers);
+    let mut routes = Vec::new();
+    for receiver in receivers.iter() {
+        let receiver_id = receiver.receiver_id();
+        let Some(generation) = receiver.current() else {
+            continue;
+        };
+        let Some(binding) = profiles.binding(receiver_id) else {
+            continue;
+        };
+        if binding.generation_id != generation.generation_id() {
+            continue;
+        }
+        let Some(receiver_profile) = profiles.catalog().profile(&binding.profile_id) else {
+            continue;
+        };
+        let Some(native) = receiver_profile.native_exchange else {
+            continue;
+        };
+        let vendor_id = receiver_profile
+            .vendor_id
+            .ok_or(NativeRouteProjectionError::MissingReceiverVendor)?;
+        let protocol_family = NativeProtocolFamily::try_from(native.protocol_family)
+            .map_err(|_| NativeRouteProjectionError::InvalidProtocolFamily)?;
+        let report_bytes = NativeReportByteCount::try_from(native.report_bytes)
+            .map_err(|_| NativeRouteProjectionError::InvalidReportSize)?;
+
+        for device in generation.devices() {
+            let child_profile =
+                view.profile_for_device(receiver_id, generation.generation_id(), device);
+            let access = if child_profile.is_some_and(native_exchange_is_qualified) {
+                NativeRouteAccess::Qualified
+            } else {
+                NativeRouteAccess::Candidate
+            };
+            for endpoint in device
+                .endpoints()
+                .filter(|endpoint| endpoint.identity().route_kind() == RouteKind::HyperfluxWireless)
+            {
+                routes.push(NativeRoute {
+                    receiver_id: receiver_id.clone(),
+                    generation_id: generation.generation_id(),
+                    device_id: device.identity().device_id().clone(),
+                    endpoint_id: endpoint.identity().endpoint_id().clone(),
+                    device_kind: device.identity().device_kind(),
+                    vendor_id,
+                    product_id: device.identity().product_id(),
+                    route_state: native_route_state(endpoint),
+                    access,
+                    protocol_family: protocol_family.clone(),
+                    report_bytes,
+                    route_token: None,
+                    resource: None,
+                });
+            }
+        }
+    }
+    routes.sort_by(|left, right| {
+        (
+            &left.receiver_id,
+            left.generation_id,
+            &left.device_id,
+            &left.endpoint_id,
+        )
+            .cmp(&(
+                &right.receiver_id,
+                right.generation_id,
+                &right.device_id,
+                &right.endpoint_id,
+            ))
+    });
+    Ok(routes)
+}
+
+fn native_exchange_is_qualified(profile: &hfx_profiles::RuntimeProfile) -> bool {
+    profile.capabilities.iter().any(|capability| {
+        capability.id.as_str() == NATIVE_EXCHANGE_CAPABILITY_ID
+            && capability.writable
+            && capability.support_level == SupportLevel::ProductionQualified
+    })
+}
+
+fn native_route_state(endpoint: &EndpointLifecycle) -> RouteState {
+    match endpoint.route().value() {
+        RouteState::Available => RouteState::Available,
+        RouteState::Unavailable => RouteState::Unavailable,
+        RouteState::Stale => RouteState::Stale,
+        RouteState::Unknown if endpoint.power().value() == PowerState::Off => {
+            RouteState::Unavailable
+        }
+        RouteState::Unknown if endpoint.activity().value() == ActivityState::Active => {
+            RouteState::Available
+        }
+        RouteState::Unknown if endpoint.sleep().value() == SleepState::Asleep => RouteState::Stale,
+        RouteState::Unknown => RouteState::Unknown,
+    }
+}
diff --git a/crates/hfx-bridge/src/native_routes.rs b/crates/hfx-bridge/src/native_routes.rs
new file mode 100644
index 0000000..dae0ebb
--- /dev/null
+++ b/crates/hfx-bridge/src/native_routes.rs
@@ -0,0 +1,534 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::{RuntimeIdentityError, RuntimeIdentityIssuer};
+use hfx_domain::{
+    DroppedEventCount, NativeRouteAccess, NativeRouteEventKind, ProjectionRevision, ReceiverId,
+    ResourceKind, SequenceNumber, StreamEpoch, StreamId, SubscriptionId,
+};
+use hfx_protocol::{
+    EventCursor, NativeRoute, NativeRouteEvent, NativeRouteEventBatch, NativeRouteInventory,
+    ResourceKey, SubscriptionRequest,
+};
+use sha2::{Digest, Sha256};
+use std::collections::{BTreeMap, VecDeque};
+use std::fmt;
+
+const MAX_NATIVE_ROUTES: usize = 32;
+
+#[allow(clippy::struct_field_names)]
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct NativeRouteKey {
+    receiver_id: ReceiverId,
+    device_id: hfx_domain::LogicalDeviceId,
+    endpoint_id: hfx_domain::EndpointId,
+}
+
+impl From<&NativeRoute> for NativeRouteKey {
+    fn from(route: &NativeRoute) -> Self {
+        Self {
+            receiver_id: route.receiver_id.clone(),
+            device_id: route.device_id.clone(),
+            endpoint_id: route.endpoint_id.clone(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeRouteJournalError {
+    InvalidCapacity,
+    RouteCapacity,
+    Identity(RuntimeIdentityError),
+    InvalidStreamIdentity,
+    SequenceExhausted,
+    DropCounterExhausted,
+    SubscriptionMismatch,
+}
+
+impl fmt::Display for NativeRouteJournalError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidCapacity => "native route event capacity is invalid",
+            Self::RouteCapacity => "native route inventory exceeds its public bound",
+            Self::Identity(_) => "native route token generation failed",
+            Self::InvalidStreamIdentity => "native route stream identity is invalid",
+            Self::SequenceExhausted => "native route event sequence is exhausted",
+            Self::DropCounterExhausted => "native route event drop counter is exhausted",
+            Self::SubscriptionMismatch => "native route subscription cursor does not match",
+        })
+    }
+}
+
+impl std::error::Error for NativeRouteJournalError {}
+
+/// Bounded current-route registry and transition journal for protocol v7.
+///
+/// Tokens are issued only for qualified, currently available routes. A new
+/// generation receives a new token, while exact refreshes preserve authority.
+#[derive(Clone, Debug)]
+pub struct NativeRouteJournal {
+    stream_id: StreamId,
+    stream_epoch: StreamEpoch,
+    projection_revision: ProjectionRevision,
+    capacity: usize,
+    current: BTreeMap<NativeRouteKey, NativeRoute>,
+    events: VecDeque<NativeRouteEvent>,
+    latest: SequenceNumber,
+    dropped: DroppedEventCount,
+}
+
+impl NativeRouteJournal {
+    /// Creates a route stream with identity derived from the ordinary event stream.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed capacity or generated stream-identity failure.
+    pub fn new(
+        base_stream_id: &StreamId,
+        stream_epoch: StreamEpoch,
+        projection_revision: ProjectionRevision,
+        capacity: usize,
+    ) -> Result<Self, NativeRouteJournalError> {
+        if !(1..=4096).contains(&capacity) {
+            return Err(NativeRouteJournalError::InvalidCapacity);
+        }
+        let mut hasher = Sha256::new();
+        hasher.update(b"hyperflux-native-route-stream-v1\0");
+        hasher.update(base_stream_id.as_str().as_bytes());
+        let stream_id = StreamId::try_from(format!(
+            "native-routes-{}",
+            lowercase_hex(hasher.finalize().as_slice())
+        ))
+        .map_err(|_| NativeRouteJournalError::InvalidStreamIdentity)?;
+        Ok(Self {
+            stream_id,
+            stream_epoch,
+            projection_revision,
+            capacity,
+            current: BTreeMap::new(),
+            events: VecDeque::with_capacity(capacity),
+            latest: SequenceNumber::try_from(0_u64)
+                .map_err(|_| NativeRouteJournalError::SequenceExhausted)?,
+            dropped: DroppedEventCount::try_from(0_u64)
+                .map_err(|_| NativeRouteJournalError::DropCounterExhausted)?,
+        })
+    }
+
+    /// Atomically replaces the projected route set and records its transitions.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed route bound, identity, sequence, or drop-counter
+    /// failure without partially changing the journal or identity issuer.
+    pub fn synchronize(
+        &mut self,
+        routes: Vec<NativeRoute>,
+        identities: &mut RuntimeIdentityIssuer,
+    ) -> Result<(), NativeRouteJournalError> {
+        if routes.len() > MAX_NATIVE_ROUTES {
+            return Err(NativeRouteJournalError::RouteCapacity);
+        }
+        let mut next = self.clone();
+        let mut next_identities = identities.clone();
+        next.synchronize_inner(routes, &mut next_identities)?;
+        *self = next;
+        *identities = next_identities;
+        Ok(())
+    }
+
+    fn synchronize_inner(
+        &mut self,
+        routes: Vec<NativeRoute>,
+        identities: &mut RuntimeIdentityIssuer,
+    ) -> Result<(), NativeRouteJournalError> {
+        let mut incoming = BTreeMap::new();
+        for mut route in routes {
+            let key = NativeRouteKey::from(&route);
+            if incoming.contains_key(&key) {
+                return Err(NativeRouteJournalError::RouteCapacity);
+            }
+            self.bind_route_authority(&key, &mut route, identities)?;
+            incoming.insert(key, route);
+        }
+
+        let previous = self.current.clone();
+        for (key, route) in &incoming {
+            match previous.get(key) {
+                None => self.append(route_event_kind(route), route.clone())?,
+                Some(old) if old.generation_id != route.generation_id => {
+                    self.append(NativeRouteEventKind::GenerationReplaced, route.clone())?;
+                }
+                Some(old) if old != route => self.append(route_event_kind(route), route.clone())?,
+                Some(_) => {}
+            }
+        }
+        for (key, old) in previous {
+            if !incoming.contains_key(&key) {
+                let mut unavailable = old;
+                unavailable.route_state = hfx_domain::RouteState::Unavailable;
+                unavailable.route_token = None;
+                unavailable.resource = None;
+                self.append(NativeRouteEventKind::Unavailable, unavailable)?;
+            }
+        }
+        self.current = incoming;
+        Ok(())
+    }
+
+    fn bind_route_authority(
+        &self,
+        key: &NativeRouteKey,
+        route: &mut NativeRoute,
+        identities: &mut RuntimeIdentityIssuer,
+    ) -> Result<(), NativeRouteJournalError> {
+        let writable = route.access == NativeRouteAccess::Qualified
+            && route.route_state == hfx_domain::RouteState::Available;
+        if !writable {
+            route.route_token = None;
+            route.resource = None;
+            return Ok(());
+        }
+        if let Some(previous) = self.current.get(key)
+            && previous.generation_id == route.generation_id
+            && previous.access == NativeRouteAccess::Qualified
+            && previous.route_state == hfx_domain::RouteState::Available
+            && let Some(token) = &previous.route_token
+        {
+            route.route_token = Some(token.clone());
+        } else {
+            route.route_token = Some(
+                identities
+                    .native_route_token()
+                    .map_err(NativeRouteJournalError::Identity)?,
+            );
+        }
+        route.resource = Some(ResourceKey {
+            receiver_id: route.receiver_id.clone(),
+            generation_id: route.generation_id,
+            device_id: route.device_id.clone(),
+            kind: ResourceKind::NativeControl,
+        });
+        Ok(())
+    }
+
+    fn append(
+        &mut self,
+        kind: NativeRouteEventKind,
+        route: NativeRoute,
+    ) -> Result<(), NativeRouteJournalError> {
+        let next = self
+            .latest
+            .get()
+            .checked_add(1)
+            .ok_or(NativeRouteJournalError::SequenceExhausted)?;
+        let sequence = SequenceNumber::try_from(next)
+            .map_err(|_| NativeRouteJournalError::SequenceExhausted)?;
+        if self.events.len() == self.capacity {
+            let dropped = self
+                .dropped
+                .get()
+                .checked_add(1)
+                .ok_or(NativeRouteJournalError::DropCounterExhausted)?;
+            self.dropped = DroppedEventCount::try_from(dropped)
+                .map_err(|_| NativeRouteJournalError::DropCounterExhausted)?;
+            self.events.pop_front();
+        }
+        self.latest = sequence;
+        self.events.push_back(NativeRouteEvent {
+            sequence,
+            kind,
+            route,
+        });
+        Ok(())
+    }
+
+    #[must_use]
+    pub fn inventory(&self) -> NativeRouteInventory {
+        NativeRouteInventory {
+            cursor: self.cursor(),
+            routes: self.current.values().cloned().collect(),
+        }
+    }
+
+    #[must_use]
+    pub fn route_by_token(&self, token: &hfx_domain::NativeRouteToken) -> Option<&NativeRoute> {
+        self.current
+            .values()
+            .find(|route| route.route_token.as_ref() == Some(token))
+    }
+
+    #[must_use]
+    pub fn route_for_resource(&self, resource: &ResourceKey) -> Option<&NativeRoute> {
+        self.current
+            .values()
+            .find(|route| route.resource.as_ref() == Some(resource))
+    }
+
+    /// Reads one bounded route-event batch for an exact subscription cursor.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed subscription, sequence, or cursor-accounting failure.
+    pub fn read(
+        &self,
+        subscription_id: SubscriptionId,
+        request: &SubscriptionRequest,
+    ) -> Result<NativeRouteEventBatch, NativeRouteJournalError> {
+        if request
+            .subscription_id
+            .as_ref()
+            .is_some_and(|expected| expected != &subscription_id)
+        {
+            return Err(NativeRouteJournalError::SubscriptionMismatch);
+        }
+        let stream_mismatch = request.expected_cursor.as_ref().is_some_and(|cursor| {
+            cursor.stream_id != self.stream_id
+                || cursor.stream_epoch != self.stream_epoch
+                || cursor.projection_revision != self.projection_revision
+        });
+        let oldest = self
+            .events
+            .front()
+            .map_or(self.latest, |event| event.sequence);
+        let lower_bound = oldest.get().saturating_sub(1);
+        let requested = request
+            .expected_cursor
+            .as_ref()
+            .map_or(0, |cursor| cursor.sequence.get());
+        let cursor_gap =
+            stream_mismatch || requested < lower_bound || requested > self.latest.get();
+        let events = if cursor_gap {
+            Vec::new()
+        } else {
+            self.events
+                .iter()
+                .filter(|event| event.sequence.get() > requested)
+                .take(usize::from(request.max_events.get()))
+                .cloned()
+                .collect::<Vec<_>>()
+        };
+        let next_sequence = events
+            .last()
+            .map_or(requested, |event| event.sequence.get());
+        let next_sequence = SequenceNumber::try_from(next_sequence)
+            .map_err(|_| NativeRouteJournalError::SequenceExhausted)?;
+        Ok(NativeRouteEventBatch {
+            subscription_id,
+            next_cursor: EventCursor {
+                stream_id: self.stream_id.clone(),
+                stream_epoch: self.stream_epoch,
+                projection_revision: self.projection_revision,
+                sequence: next_sequence,
+            },
+            events,
+            oldest_available: oldest,
+            latest_available: self.latest,
+            dropped_events: self.dropped,
+            cursor_gap,
+            has_more: !cursor_gap && next_sequence < self.latest,
+        })
+    }
+
+    #[must_use]
+    pub fn cursor(&self) -> EventCursor {
+        EventCursor {
+            stream_id: self.stream_id.clone(),
+            stream_epoch: self.stream_epoch,
+            projection_revision: self.projection_revision,
+            sequence: self.latest,
+        }
+    }
+}
+
+fn route_event_kind(route: &NativeRoute) -> NativeRouteEventKind {
+    if route.route_state == hfx_domain::RouteState::Available {
+        NativeRouteEventKind::Available
+    } else {
+        NativeRouteEventKind::Unavailable
+    }
+}
+
+fn lowercase_hex(bytes: &[u8]) -> String {
+    let mut value = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        use std::fmt::Write as _;
+        write!(value, "{byte:02x}").expect("writing to a String cannot fail");
+    }
+    value
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{SessionIdentityError, SessionIdentitySource};
+    use hfx_domain::{
+        DeviceKind, EventBatchLimit, GenerationId, NativeProtocolFamily, NativeReportByteCount,
+        ProductId, RouteState, VendorId,
+    };
+
+    #[derive(Debug)]
+    struct DeterministicSource;
+
+    impl SessionIdentitySource for DeterministicSource {
+        fn fill_bytes(&mut self, destination: &mut [u8]) -> Result<(), SessionIdentityError> {
+            for (index, byte) in destination.iter_mut().enumerate() {
+                *byte = u8::try_from(index).expect("test entropy index fits");
+            }
+            Ok(())
+        }
+    }
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is valid")
+    }
+
+    fn journal(capacity: usize) -> (NativeRouteJournal, RuntimeIdentityIssuer) {
+        let stream_id = text::<StreamId>("events-1");
+        let journal = NativeRouteJournal::new(
+            &stream_id,
+            StreamEpoch::try_from(1_u64).expect("epoch is valid"),
+            ProjectionRevision::try_from(1_u32).expect("revision is valid"),
+            capacity,
+        )
+        .expect("journal initializes");
+        let mut source = DeterministicSource;
+        let identities = RuntimeIdentityIssuer::new(&mut source).expect("identity issuer starts");
+        (journal, identities)
+    }
+
+    fn route(generation: u64, access: NativeRouteAccess, state: RouteState) -> NativeRoute {
+        NativeRoute {
+            receiver_id: text("receiver-1"),
+            generation_id: GenerationId::try_from(generation).expect("generation is valid"),
+            device_id: text("mouse-1"),
+            endpoint_id: text("pointer"),
+            device_kind: DeviceKind::Mouse,
+            vendor_id: VendorId::try_from(0x1532_u16).expect("vendor is valid"),
+            product_id: ProductId::try_from(0x00cd_u16).expect("product is valid"),
+            route_state: state,
+            access,
+            protocol_family: text::<NativeProtocolFamily>("razer-feature-report-v1"),
+            report_bytes: NativeReportByteCount::try_from(90_u16).expect("report size is valid"),
+            route_token: None,
+            resource: None,
+        }
+    }
+
+    #[test]
+    fn candidate_routes_never_receive_write_authority() {
+        let (mut journal, mut identities) = journal(4);
+        journal
+            .synchronize(
+                vec![route(
+                    1,
+                    NativeRouteAccess::Candidate,
+                    RouteState::Available,
+                )],
+                &mut identities,
+            )
+            .expect("candidate route synchronizes");
+
+        let route = &journal.inventory().routes[0];
+        assert!(route.route_token.is_none());
+        assert!(route.resource.is_none());
+        assert_eq!(journal.cursor().sequence.get(), 1);
+    }
+
+    #[test]
+    fn exact_generation_reuses_token_and_replacement_rotates_it() {
+        let (mut journal, mut identities) = journal(8);
+        let qualified = route(1, NativeRouteAccess::Qualified, RouteState::Available);
+        journal
+            .synchronize(vec![qualified.clone()], &mut identities)
+            .expect("first route synchronizes");
+        let first = journal.inventory().routes[0]
+            .route_token
+            .clone()
+            .expect("qualified route has a token");
+
+        journal
+            .synchronize(vec![qualified], &mut identities)
+            .expect("exact refresh is idempotent");
+        assert_eq!(journal.cursor().sequence.get(), 1);
+        assert_eq!(
+            journal.inventory().routes[0].route_token.as_ref(),
+            Some(&first)
+        );
+
+        journal
+            .synchronize(
+                vec![route(
+                    2,
+                    NativeRouteAccess::Qualified,
+                    RouteState::Available,
+                )],
+                &mut identities,
+            )
+            .expect("new generation synchronizes");
+        let replacement = &journal.inventory().routes[0];
+        assert_ne!(replacement.route_token.as_ref(), Some(&first));
+        assert_eq!(journal.cursor().sequence.get(), 2);
+        assert_eq!(
+            journal.events.back().map(|event| event.kind),
+            Some(NativeRouteEventKind::GenerationReplaced)
+        );
+    }
+
+    #[test]
+    fn removed_routes_are_reported_and_old_cursors_gap_after_eviction() {
+        let (mut journal, mut identities) = journal(2);
+        journal
+            .synchronize(
+                vec![route(
+                    1,
+                    NativeRouteAccess::Candidate,
+                    RouteState::Available,
+                )],
+                &mut identities,
+            )
+            .expect("first route synchronizes");
+        let old_cursor = journal.cursor();
+        journal
+            .synchronize(
+                vec![route(1, NativeRouteAccess::Candidate, RouteState::Stale)],
+                &mut identities,
+            )
+            .expect("stale route synchronizes");
+        journal
+            .synchronize(Vec::new(), &mut identities)
+            .expect("removal synchronizes");
+
+        let request = SubscriptionRequest {
+            client_id: text("client-1"),
+            subscription_id: Some(text("subscription-1")),
+            expected_cursor: Some(old_cursor),
+            max_events: EventBatchLimit::try_from(8_u16).expect("batch limit is valid"),
+        };
+        let batch = journal
+            .read(text("subscription-1"), &request)
+            .expect("bounded events are readable");
+        assert!(!batch.cursor_gap);
+        assert_eq!(batch.events.len(), 2);
+        assert_eq!(batch.events[1].kind, NativeRouteEventKind::Unavailable);
+        assert!(journal.inventory().routes.is_empty());
+
+        let beginning = EventCursor {
+            sequence: SequenceNumber::try_from(0_u64).expect("zero sequence is valid"),
+            ..journal.cursor()
+        };
+        let gap = journal
+            .read(
+                text("subscription-1"),
+                &SubscriptionRequest {
+                    expected_cursor: Some(beginning),
+                    ..request
+                },
+            )
+            .expect("gap is represented");
+        assert!(gap.cursor_gap);
+        assert!(gap.events.is_empty());
+    }
+}
diff --git a/crates/hfx-bridge/src/rpc.rs b/crates/hfx-bridge/src/rpc.rs
index 3d66cff..3d1e626 100644
--- a/crates/hfx-bridge/src/rpc.rs
+++ b/crates/hfx-bridge/src/rpc.rs
@@ -9,8 +9,10 @@ use hfx_domain::{FindingId, HumanMessage, ProtocolErrorKind, RequestId, ServerIn
 use hfx_errors::{ErrorCode, error_by_code};
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, ErrorEnvelope, EventBatch, IntegrationView, LeaseRequest,
-    LeaseResult, ReleaseLeaseRequest, RenewLeaseRequest, RpcError, RpcRequest, RpcResponse,
-    SubscriptionRequest, SuccessEnvelope, TransactionLookup, TransactionRequest, TransactionResult,
+    LeaseResult, NativeExchangeOutcome, NativeExchangeRequest, NativeRouteEventBatch,
+    NativeRouteInventory, ReleaseLeaseRequest, RenewLeaseRequest, RpcError, RpcRequest,
+    RpcResponse, SubscriptionRequest, SuccessEnvelope, TransactionLookup, TransactionRequest,
+    TransactionResult,
 };
 use std::fmt;
 
@@ -227,6 +229,53 @@ pub trait BridgeRpcBackend {
         context: BackendRequestContext<'_>,
     ) -> Result<DiagnosticSnapshot, RpcFailure>;
 
+    /// Enumerates generation-bound receiver child routes without host paths.
+    ///
+    /// # Errors
+    ///
+    /// The default rejects the additive method as unsupported.
+    fn native_enumerate(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+    ) -> Result<NativeRouteInventory, RpcFailure> {
+        Err(RpcFailure::new(
+            ErrorCode::HfxProtocol002,
+            ProtocolErrorKind::UnsupportedFeature,
+        ))
+    }
+
+    /// Performs one exact lease-bound opaque receiver child exchange.
+    ///
+    /// # Errors
+    ///
+    /// The default rejects the additive method as unsupported.
+    fn native_transact(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+        _request: NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        Err(RpcFailure::new(
+            ErrorCode::HfxProtocol002,
+            ProtocolErrorKind::UnsupportedFeature,
+        ))
+    }
+
+    /// Reads bounded native-route lifecycle changes after one cursor.
+    ///
+    /// # Errors
+    ///
+    /// The default rejects the additive method as unsupported.
+    fn native_watch(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+        _request: SubscriptionRequest,
+    ) -> Result<NativeRouteEventBatch, RpcFailure> {
+        Err(RpcFailure::new(
+            ErrorCode::HfxProtocol002,
+            ProtocolErrorKind::UnsupportedFeature,
+        ))
+    }
+
     /// Releases client-owned resources and invalidates queued work after the
     /// registry has already revoked session authority.
     ///
@@ -325,6 +374,15 @@ impl ConnectionDispatcher {
             RpcRequest::Diagnostics(_) => backend
                 .diagnostics(context)
                 .map(|result| RpcResponse::DiagnosticsSuccess(self.success(request_id, result))),
+            RpcRequest::NativeEnumerate(_) => backend.native_enumerate(context).map(|result| {
+                RpcResponse::NativeEnumerateSuccess(self.success(request_id, result))
+            }),
+            RpcRequest::NativeTransact(envelope) => backend
+                .native_transact(context, envelope.params)
+                .map(|result| RpcResponse::NativeTransactSuccess(self.success(request_id, result))),
+            RpcRequest::NativeWatch(envelope) => backend
+                .native_watch(context, envelope.params)
+                .map(|result| RpcResponse::NativeWatchSuccess(self.success(request_id, result))),
             RpcRequest::Negotiate(_) => unreachable!("negotiation returned before method routing"),
         };
         response.unwrap_or_else(|failure| self.error_response(Some(error_request_id), failure))
diff --git a/crates/hfx-bridge/src/runtime_identity.rs b/crates/hfx-bridge/src/runtime_identity.rs
index e944d0c..43fc9d2 100644
--- a/crates/hfx-bridge/src/runtime_identity.rs
+++ b/crates/hfx-bridge/src/runtime_identity.rs
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{SessionIdentityError, SessionIdentitySource};
-use hfx_domain::{DispatchNonce, LeaseId, RequestId, SubscriptionId, TransactionId};
+use hfx_domain::{
+    DispatchNonce, LeaseId, NativeRouteToken, RequestId, SubscriptionId, TransactionId,
+};
+use sha2::{Digest, Sha256};
 use std::fmt;
 
 const PROCESS_PREFIX_BYTES: usize = 16;
@@ -110,6 +113,32 @@ impl RuntimeIdentityIssuer {
             .map_err(|_| RuntimeIdentityError::InvalidGeneratedIdentity)
     }
 
+    /// Issues one opaque process-local native route token.
+    ///
+    /// The token contains no host path or hardware serial. Its digest binds a
+    /// kernel exchange while lease and generation checks remain the authority.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error only after the finite process sequence is exhausted or
+    /// if the generated token violates the domain contract.
+    pub fn native_route_token(&mut self) -> Result<NativeRouteToken, RuntimeIdentityError> {
+        let sequence = self.take_sequence()?;
+        let mut hasher = Sha256::new();
+        hasher.update(b"hyperflux-native-route-token-v1\0");
+        hasher.update(self.process_prefix.as_bytes());
+        hasher.update(sequence.to_be_bytes());
+        let digest = hasher.finalize();
+        let mut value = String::with_capacity(64);
+        for byte in digest {
+            use std::fmt::Write as _;
+            write!(value, "{byte:02x}")
+                .map_err(|_| RuntimeIdentityError::InvalidGeneratedIdentity)?;
+        }
+        NativeRouteToken::try_from(value)
+            .map_err(|_| RuntimeIdentityError::InvalidGeneratedIdentity)
+    }
+
     fn take_sequence(&mut self) -> Result<u64, RuntimeIdentityError> {
         let current = self.next_sequence;
         self.next_sequence = current
diff --git a/crates/hfx-bridge/src/session.rs b/crates/hfx-bridge/src/session.rs
index 1939729..54cccc1 100644
--- a/crates/hfx-bridge/src/session.rs
+++ b/crates/hfx-bridge/src/session.rs
@@ -311,11 +311,14 @@ fn validate_nested_request_id(request: &RpcRequest) -> Result<(), SessionError>
         RpcRequest::ReleaseLease(envelope) => Some(&envelope.params.request_id),
         RpcRequest::SubmitTransaction(envelope) => Some(&envelope.params.request_id),
         RpcRequest::TransactionOutcome(envelope) => Some(&envelope.params.request_id),
+        RpcRequest::NativeTransact(envelope) => Some(&envelope.params.request_id),
         RpcRequest::Negotiate(_)
         | RpcRequest::Snapshot(_)
         | RpcRequest::IntegrationView(_)
         | RpcRequest::Subscribe(_)
-        | RpcRequest::Diagnostics(_) => None,
+        | RpcRequest::Diagnostics(_)
+        | RpcRequest::NativeEnumerate(_)
+        | RpcRequest::NativeWatch(_) => None,
     };
     if nested.is_some_and(|request_id| request_id != request.request_id()) {
         return Err(SessionError::RequestIdMismatch);
@@ -323,6 +326,7 @@ fn validate_nested_request_id(request: &RpcRequest) -> Result<(), SessionError>
     Ok(())
 }
 
+#[allow(clippy::match_same_arms)]
 fn validate_client_id(request: &RpcRequest, expected: &ClientId) -> Result<(), SessionError> {
     let actual = match request {
         RpcRequest::AcquireLease(envelope) => Some(&envelope.params.client_id),
@@ -330,11 +334,15 @@ fn validate_client_id(request: &RpcRequest, expected: &ClientId) -> Result<(), S
         RpcRequest::ReleaseLease(envelope) => Some(&envelope.params.client_id),
         RpcRequest::SubmitTransaction(envelope) => Some(&envelope.params.client_id),
         RpcRequest::TransactionOutcome(envelope) => Some(&envelope.params.client_id),
-        RpcRequest::Subscribe(envelope) => Some(&envelope.params.client_id),
+        RpcRequest::Subscribe(envelope) | RpcRequest::NativeWatch(envelope) => {
+            Some(&envelope.params.client_id)
+        }
+        RpcRequest::NativeTransact(envelope) => Some(&envelope.params.client_id),
         RpcRequest::Negotiate(_)
         | RpcRequest::Snapshot(_)
         | RpcRequest::IntegrationView(_)
-        | RpcRequest::Diagnostics(_) => None,
+        | RpcRequest::Diagnostics(_)
+        | RpcRequest::NativeEnumerate(_) => None,
     };
     if actual.is_some_and(|client_id| client_id != expected) {
         return Err(SessionError::ClientIdMismatch);
diff --git a/crates/hfx-bridge/tests/core_backend.rs b/crates/hfx-bridge/tests/core_backend.rs
index 8021799..2c280c1 100644
--- a/crates/hfx-bridge/tests/core_backend.rs
+++ b/crates/hfx-bridge/tests/core_backend.rs
@@ -19,11 +19,11 @@ use hfx_domain::{
     ActivityState, ApplyOutcome, ClientId, ClientName, ColorChannel, ComponentVersion,
     ConnectionMode, DeliveredFrameCount, DeviceApplicationState, DeviceKind, EventBatchLimit,
     EventKind, EvidenceClaimId, EvidenceConfidence, FrameIndex, FreshnessState, GenerationId,
-    LeaseDurationMs, LogicalDeviceId, MonotonicMs, PairingState, PowerState, ProductId,
-    ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolVersion, QueueCapacity,
-    ReceiverId, RequestId, ResourceKind, RouteKind, RouteState, SequenceNumber, ServerInstanceId,
-    SideEffectCertainty, SleepState, StableLightingMode, StreamEpoch, StreamId, TransactionClass,
-    TransactionId, TransactionState, VendorId, WallClockUnixMs,
+    LeaseDurationMs, LogicalDeviceId, MonotonicMs, NativeRouteAccess, PairingState, PowerState,
+    ProductId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolVersion,
+    QueueCapacity, ReceiverId, RequestId, ResourceKind, RouteKind, RouteState, SequenceNumber,
+    ServerInstanceId, SideEffectCertainty, SleepState, StableLightingMode, StreamEpoch, StreamId,
+    TransactionClass, TransactionId, TransactionState, VendorId, WallClockUnixMs,
 };
 use hfx_protocol::{
     DeviceProfileBinding, EmptyRequest, EventCursor, LeaseRequest, LeaseResult, LightingFrame,
@@ -434,6 +434,37 @@ fn negotiate<R: RestorationRuntime>(
     envelope.result
 }
 
+fn negotiate_native<R: RestorationRuntime>(
+    dispatcher: &mut ConnectionDispatcher,
+    identities: &mut DeterministicIdentities,
+    sessions: &mut SessionRegistry,
+    backend: &mut TestBackend<R>,
+) -> hfx_protocol::ServerHello {
+    let response = dispatcher.dispatch(
+        RpcRequest::Negotiate(NegotiationRequestEnvelope {
+            request_id: text::<RequestId>("request-negotiate-native"),
+            params: hfx_protocol::ClientHello {
+                client_id: text::<ClientId>("client-1"),
+                client_name: text::<ClientName>("Core native backend test"),
+                minimum_version: ProtocolVersion::try_from(7_u16).expect("version is canonical"),
+                maximum_version: ProtocolVersion::try_from(7_u16).expect("version is canonical"),
+                required_features: vec![
+                    text::<ProtocolFeatureId>("native-receiver-tunnel"),
+                    text::<ProtocolFeatureId>("ownership-leases"),
+                ],
+                optional_features: Vec::new(),
+            },
+        }),
+        identities,
+        sessions,
+        backend,
+    );
+    let RpcResponse::NegotiateSuccess(envelope) = response else {
+        panic!("native negotiation must succeed: {response:?}");
+    };
+    envelope.result
+}
+
 fn resource(device_id: &str, generation_id: u64) -> ResourceKey {
     ResourceKey {
         receiver_id: text("receiver-1"),
@@ -507,6 +538,73 @@ fn assert_error(response: RpcResponse, finding: &str, kind: ProtocolErrorKind) {
     assert_eq!(envelope.error.kind, kind);
 }
 
+#[test]
+fn production_backend_enumerates_exact_candidates_without_granting_native_authority() {
+    let mut backend = backend();
+    let mut sessions = SessionRegistry::new(
+        QueueCapacity::try_from(4_u16).expect("session capacity is canonical"),
+    );
+    let mut dispatcher = new_dispatcher();
+    let mut identities = DeterministicIdentities(1);
+    let hello = negotiate_native(
+        &mut dispatcher,
+        &mut identities,
+        &mut sessions,
+        &mut backend,
+    );
+
+    let response = dispatcher.dispatch(
+        RpcRequest::NativeEnumerate(SessionRequestEnvelope {
+            request_id: text("request-native-enumerate"),
+            protocol_session_id: hello.protocol_session_id.clone(),
+            negotiation_token: hello.negotiation_token.clone(),
+            params: EmptyRequest {},
+        }),
+        &mut identities,
+        &mut sessions,
+        &mut backend,
+    );
+    let RpcResponse::NativeEnumerateSuccess(envelope) = response else {
+        panic!("native enumeration must succeed: {response:?}");
+    };
+    assert_eq!(envelope.result.routes.len(), 1);
+    let route = &envelope.result.routes[0];
+    assert_eq!(route.receiver_id.as_str(), "receiver-1");
+    assert_eq!(route.device_id.as_str(), "mouse");
+    assert_eq!(route.endpoint_id.as_str(), "mouse-hyperflux");
+    assert_eq!(route.vendor_id.get(), 0x1532);
+    assert_eq!(route.product_id.get(), 0x00cd);
+    assert_eq!(route.access, NativeRouteAccess::Candidate);
+    assert!(route.route_token.is_none());
+    assert!(route.resource.is_none());
+
+    let response = dispatcher.dispatch(
+        RpcRequest::AcquireLease(SessionRequestEnvelope {
+            request_id: text("request-native-lease"),
+            protocol_session_id: hello.protocol_session_id,
+            negotiation_token: hello.negotiation_token,
+            params: lease_request(
+                "request-native-lease",
+                ResourceKey {
+                    receiver_id: text("receiver-1"),
+                    generation_id: generation(1),
+                    device_id: text("mouse"),
+                    kind: ResourceKind::NativeControl,
+                },
+            ),
+        }),
+        &mut identities,
+        &mut sessions,
+        &mut backend,
+    );
+    assert_error(
+        response,
+        "HFX-PROFILE-001",
+        ProtocolErrorKind::UnsupportedFeature,
+    );
+    assert!(backend.transport().dispatches.is_empty());
+}
+
 #[test]
 fn effect_return_replay_reuses_live_owner_authority_and_disconnect_invalidates_it() {
     let mut backend = backend();
diff --git a/crates/hfx-bridge/tests/native_projection.rs b/crates/hfx-bridge/tests/native_projection.rs
new file mode 100644
index 0000000..33de043
--- /dev/null
+++ b/crates/hfx-bridge/tests/native_projection.rs
@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_bridge::{RuntimeProfileAuthority, project_native_routes};
+use hfx_core::{
+    ChildIdentity, EndpointIdentity, LifecycleLimits, ObservationStamp, ReceiverLifecycleMachine,
+    ReceiverLifecycleRegistry,
+};
+use hfx_domain::{
+    ConnectionMode, DeviceKind, EndpointId, EvidenceClaimId, EvidenceConfidence, GenerationId,
+    LogicalDeviceId, MonotonicMs, NativeRouteAccess, ProductId, RouteKind, RouteState,
+    SequenceNumber, SleepState, VendorId,
+};
+
+fn text<T>(value: &str) -> T
+where
+    T: TryFrom<String>,
+    T::Error: std::fmt::Debug,
+{
+    T::try_from(value.to_owned()).expect("test value is valid")
+}
+
+fn generation(value: u64) -> GenerationId {
+    GenerationId::try_from(value).expect("generation is valid")
+}
+
+fn stamp(sequence: u64) -> ObservationStamp {
+    ObservationStamp::new(
+        generation(1),
+        SequenceNumber::try_from(sequence).expect("sequence is valid"),
+        MonotonicMs::try_from(sequence).expect("timestamp is valid"),
+        EvidenceConfidence::Observed,
+        text::<EvidenceClaimId>(&format!("claim-{sequence}")),
+    )
+    .expect("stamp is valid")
+}
+
+fn register_child(
+    machine: &mut ReceiverLifecycleMachine,
+    id: &str,
+    kind: DeviceKind,
+    product_id: u16,
+    route: RouteKind,
+    sequence: u64,
+    available: bool,
+) {
+    let device_id: LogicalDeviceId = text(id);
+    machine
+        .register_device(
+            ChildIdentity::new(
+                device_id.clone(),
+                kind,
+                ProductId::try_from(product_id).expect("product is valid"),
+            )
+            .expect("identity is valid"),
+            stamp(sequence),
+        )
+        .expect("device registers");
+    let endpoint_id: EndpointId = text(&format!("{id}-endpoint"));
+    machine
+        .register_endpoint(
+            &device_id,
+            EndpointIdentity::new(
+                endpoint_id.clone(),
+                route,
+                match route {
+                    RouteKind::HyperfluxWireless => ConnectionMode::Hyperflux24ghz,
+                    RouteKind::DirectUsb => ConnectionMode::DirectUsb,
+                    RouteKind::Bluetooth => ConnectionMode::Bluetooth,
+                },
+            )
+            .expect("endpoint is valid"),
+            stamp(sequence + 1),
+        )
+        .expect("endpoint registers");
+    if available {
+        machine
+            .observe_route(
+                &device_id,
+                &endpoint_id,
+                RouteState::Available,
+                stamp(sequence + 2),
+            )
+            .expect("route becomes available");
+    } else {
+        machine
+            .observe_sleep(
+                &device_id,
+                &endpoint_id,
+                SleepState::Asleep,
+                stamp(sequence + 2),
+            )
+            .expect("sleep is observed");
+    }
+}
+
+#[test]
+fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candidates() {
+    let mut machine = ReceiverLifecycleMachine::new(text("receiver-1"), LifecycleLimits::default())
+        .expect("lifecycle starts");
+    machine.discover(stamp(1));
+    register_child(
+        &mut machine,
+        "known-mouse",
+        DeviceKind::Mouse,
+        0x00cd,
+        RouteKind::HyperfluxWireless,
+        2,
+        true,
+    );
+    register_child(
+        &mut machine,
+        "unknown-keyboard",
+        DeviceKind::Keyboard,
+        0x7777,
+        RouteKind::HyperfluxWireless,
+        10,
+        false,
+    );
+    register_child(
+        &mut machine,
+        "direct-only",
+        DeviceKind::Mouse,
+        0x00cd,
+        RouteKind::DirectUsb,
+        20,
+        true,
+    );
+    let mut receivers = ReceiverLifecycleRegistry::default();
+    receivers.register(machine).expect("receiver fits");
+    let mut profiles = RuntimeProfileAuthority::load(4).expect("profiles load");
+    profiles
+        .bind_receiver(
+            text("receiver-1"),
+            generation(1),
+            VendorId::try_from(0x1532_u16).expect("vendor is valid"),
+            ProductId::try_from(0x00cf_u16).expect("receiver product is valid"),
+        )
+        .expect("receiver binds");
+
+    let routes = project_native_routes(&receivers, &profiles).expect("routes project");
+    assert_eq!(routes.len(), 2);
+    assert_eq!(routes[0].device_id.as_str(), "known-mouse");
+    assert_eq!(routes[0].route_state, RouteState::Available);
+    assert_eq!(routes[0].access, NativeRouteAccess::Candidate);
+    assert_eq!(routes[0].vendor_id.get(), 0x1532);
+    assert_eq!(routes[0].product_id.get(), 0x00cd);
+    assert_eq!(
+        routes[0].protocol_family.as_str(),
+        "razer-feature-report-v1"
+    );
+    assert_eq!(routes[0].report_bytes.get(), 90);
+    assert!(routes[0].route_token.is_none());
+    assert!(routes[0].resource.is_none());
+
+    assert_eq!(routes[1].device_id.as_str(), "unknown-keyboard");
+    assert_eq!(routes[1].product_id.get(), 0x7777);
+    assert_eq!(routes[1].route_state, RouteState::Stale);
+    assert_eq!(routes[1].access, NativeRouteAccess::Candidate);
+}
diff --git a/crates/hfx-bridge/tests/rpc_framing.rs b/crates/hfx-bridge/tests/rpc_framing.rs
index 69a7f94..d1546fe 100644
--- a/crates/hfx-bridge/tests/rpc_framing.rs
+++ b/crates/hfx-bridge/tests/rpc_framing.rs
@@ -313,7 +313,7 @@ fn unsupported_response_version_emits_no_partial_frame() {
         write_rpc_response_for_version(
             &mut output,
             &negotiation_response(),
-            ProtocolVersion::try_from(7_u16).expect("version number is canonical"),
+            ProtocolVersion::try_from(8_u16).expect("version number is canonical"),
         ),
         Err(FrameError::InvalidResponse(
             hfx_protocol::ProtocolWireError::UnsupportedProtocolVersion
diff --git a/crates/hfx-core/src/lib.rs b/crates/hfx-core/src/lib.rs
index 9a78138..262d5bd 100644
--- a/crates/hfx-core/src/lib.rs
+++ b/crates/hfx-core/src/lib.rs
@@ -32,13 +32,15 @@ pub use lifecycle::{
     ReceiverGenerationLifecycle, ReceiverLifecycleMachine, ReturnEpoch, ReturnTransition,
 };
 pub use ports::{
-    Clock, DeviceStateAuthority, EventDelivery, EventSink, PersistedRestorePolicy,
-    PersistedStableEntry, PersistedStableIntent, PersistenceCasOutcome, PersistenceStore,
-    ProfileRegistry, QualifiedDeviceProfile, QualifiedReceiverProfile, ReceiverTransport,
-    RestoreAttempt, RestoreCompletion, RestoreDeferred, RestoreInvalidation, RestoreRecord,
-    RestoreRecordChange, RestoreRecordStatus, RestoreTrigger, SessionAuthority, StableIntentChange,
-    StableIntentTombstone, StableLighting, SubmissionBinding, TransportDispatch, TransportFailure,
-    TransportFailureFacts, TransportReceipt, TransportReconciliation, TransportTerminal, WallClock,
+    Clock, DeviceStateAuthority, EventDelivery, EventSink, NATIVE_REPORT_BYTES,
+    NATIVE_ROUTE_DIGEST_BYTES, NativeEndpointLane, NativeTransportDispatch, NativeTransportOutcome,
+    NativeTransportResult, PersistedRestorePolicy, PersistedStableEntry, PersistedStableIntent,
+    PersistenceCasOutcome, PersistenceStore, ProfileRegistry, QualifiedDeviceProfile,
+    QualifiedReceiverProfile, ReceiverTransport, RestoreAttempt, RestoreCompletion,
+    RestoreDeferred, RestoreInvalidation, RestoreRecord, RestoreRecordChange, RestoreRecordStatus,
+    RestoreTrigger, SessionAuthority, StableIntentChange, StableIntentTombstone, StableLighting,
+    SubmissionBinding, TransportDispatch, TransportFailure, TransportFailureFacts,
+    TransportReceipt, TransportReconciliation, TransportTerminal, WallClock,
 };
 pub use receiver_registry::{
     DEFAULT_MAX_RECEIVERS, ReceiverLifecycleRegistry, ReceiverRegistryError,
diff --git a/crates/hfx-core/src/ports.rs b/crates/hfx-core/src/ports.rs
index cbe325e..620efee 100644
--- a/crates/hfx-core/src/ports.rs
+++ b/crates/hfx-core/src/ports.rs
@@ -3,11 +3,11 @@
 use hfx_domain::{
     AuthorizationEpoch, DeliveredFrameCount, DeviceApplicationState, DeviceWriteReadiness,
     DispatchNonce, GenerationId, IntentDigest, IntentRevision, LedCount, LogicalDeviceId,
-    MonotonicMs, PersistenceRevision, PersistenceSchemaVersion, ProfileDigest, ProfileId,
-    ProtocolErrorKind, ReceiverId, RequestDigest, RestoreAttemptNumber, RestoreClaimId,
-    RestoreDeferReason, RestoreInvalidationReason, RestoreRecordState, RestoreTriggerId,
-    RestoreTriggerKind, SessionId, SideEffectCertainty, TransactionId, TransactionState,
-    WallClockUnixMs,
+    MonotonicMs, NativeExchangeTimeoutMs, PersistenceRevision, PersistenceSchemaVersion,
+    ProfileDigest, ProfileId, ProtocolErrorKind, ReceiverId, RequestDigest, RestoreAttemptNumber,
+    RestoreClaimId, RestoreDeferReason, RestoreInvalidationReason, RestoreRecordState,
+    RestoreTriggerId, RestoreTriggerKind, SessionId, SideEffectCertainty, TransactionId,
+    TransactionState, WallClockUnixMs,
 };
 use hfx_protocol::{
     BridgeEvent, DeviceProfileBinding, LeaseRequest, LightingFrame, ResourceKey, RgbColor,
@@ -52,6 +52,42 @@ pub struct TransportDispatch {
     pub frames: Vec<LightingFrame>,
 }
 
+pub const NATIVE_REPORT_BYTES: usize = 90;
+pub const NATIVE_ROUTE_DIGEST_BYTES: usize = 32;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeEndpointLane {
+    Pointer,
+    Keyboard,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeTransportDispatch {
+    pub session_id: SessionId,
+    pub authorization_epoch: AuthorizationEpoch,
+    pub dispatch_nonce: DispatchNonce,
+    pub receiver_id: ReceiverId,
+    pub generation_id: GenerationId,
+    pub endpoint: NativeEndpointLane,
+    pub route_token_digest: [u8; NATIVE_ROUTE_DIGEST_BYTES],
+    pub report: [u8; NATIVE_REPORT_BYTES],
+    pub timeout_ms: NativeExchangeTimeoutMs,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum NativeTransportResult {
+    NotSent { error_kind: ProtocolErrorKind },
+    MayHaveBeenSent { error_kind: ProtocolErrorKind },
+    MatchedResponse([u8; NATIVE_REPORT_BYTES]),
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeTransportOutcome {
+    pub dispatch_nonce: DispatchNonce,
+    pub route_token_digest: [u8; NATIVE_ROUTE_DIGEST_BYTES],
+    pub result: NativeTransportResult,
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
 #[serde(rename_all = "kebab-case")]
 pub enum TransportTerminal {
@@ -114,6 +150,20 @@ pub trait ReceiverTransport {
         self.current_generation(receiver_id) == Some(generation_id)
     }
 
+    /// Reports whether the additive opaque child-exchange backend is present
+    /// for one exact current receiver generation.
+    ///
+    /// Lighting write availability does not imply native exchange support.
+    /// Existing transports therefore remain fail-closed unless their adapter
+    /// explicitly overrides this capability probe.
+    fn native_exchange_available(
+        &self,
+        _receiver_id: &ReceiverId,
+        _generation_id: GenerationId,
+    ) -> bool {
+        false
+    }
+
     /// Reconciles one exact dispatch against the adapter's durable outcome log.
     ///
     /// The adapter must bind the lookup to session, authorization epoch,
@@ -132,6 +182,20 @@ pub trait ReceiverTransport {
     /// Returns the adapter's typed transport failure. Callers must preserve
     /// possible side effects and must not infer that retry is safe.
     fn dispatch(&mut self, dispatch: &TransportDispatch) -> Result<TransportReceipt, Self::Error>;
+
+    /// Delivers one opaque, generation-bound child feature-report exchange.
+    ///
+    /// Implementations that do not explicitly support this additive operation
+    /// remain fail-closed and report that no receiver side effect occurred.
+    fn native_exchange(&mut self, dispatch: &NativeTransportDispatch) -> NativeTransportOutcome {
+        NativeTransportOutcome {
+            dispatch_nonce: dispatch.dispatch_nonce,
+            route_token_digest: dispatch.route_token_digest,
+            result: NativeTransportResult::NotSent {
+                error_kind: ProtocolErrorKind::UnsupportedFeature,
+            },
+        }
+    }
 }
 
 /// Confirms that queued work still belongs to one live writer session.
diff --git a/crates/hfx-domain/src/generated.rs b/crates/hfx-domain/src/generated.rs
index 57fa22b..b843bcd 100644
--- a/crates/hfx-domain/src/generated.rs
+++ b/crates/hfx-domain/src/generated.rs
@@ -1405,6 +1405,86 @@ impl fmt::Display for EventBatchLimit {
     }
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(try_from = "u16", into = "u16")]
+pub struct NativeExchangeTimeoutMs(u16);
+
+impl NativeExchangeTimeoutMs {
+    pub const MIN: u16 = 1;
+    pub const MAX: u16 = 1_000;
+
+    #[must_use]
+    pub const fn get(self) -> u16 {
+        self.0
+    }
+}
+
+impl TryFrom<u16> for NativeExchangeTimeoutMs {
+    type Error = DomainValueError;
+
+    fn try_from(value: u16) -> Result<Self, Self::Error> {
+        if !(Self::MIN..=Self::MAX).contains(&value) {
+            return Err(DomainValueError::new(
+                "NativeExchangeTimeoutMs",
+                "outside the canonical range",
+            ));
+        }
+        Ok(Self(value))
+    }
+}
+
+impl From<NativeExchangeTimeoutMs> for u16 {
+    fn from(value: NativeExchangeTimeoutMs) -> Self {
+        value.0
+    }
+}
+
+impl fmt::Display for NativeExchangeTimeoutMs {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(try_from = "u16", into = "u16")]
+pub struct NativeReportByteCount(u16);
+
+impl NativeReportByteCount {
+    pub const MIN: u16 = 1;
+    pub const MAX: u16 = 4_096;
+
+    #[must_use]
+    pub const fn get(self) -> u16 {
+        self.0
+    }
+}
+
+impl TryFrom<u16> for NativeReportByteCount {
+    type Error = DomainValueError;
+
+    fn try_from(value: u16) -> Result<Self, Self::Error> {
+        if !(Self::MIN..=Self::MAX).contains(&value) {
+            return Err(DomainValueError::new(
+                "NativeReportByteCount",
+                "outside the canonical range",
+            ));
+        }
+        Ok(Self(value))
+    }
+}
+
+impl From<NativeReportByteCount> for u16 {
+    fn from(value: NativeReportByteCount) -> Self {
+        value.0
+    }
+}
+
+impl fmt::Display for NativeReportByteCount {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
 #[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 #[serde(try_from = "String", into = "String")]
 pub struct ReceiverId(String);
@@ -3133,6 +3213,150 @@ impl fmt::Display for RestoreTriggerId {
     }
 }
 
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct NativeRouteToken(String);
+
+impl NativeRouteToken {
+    pub const MIN_LENGTH: usize = 64;
+    pub const MAX_LENGTH: usize = 64;
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl TryFrom<String> for NativeRouteToken {
+    type Error = DomainValueError;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        if value.len() < Self::MIN_LENGTH || value.len() > Self::MAX_LENGTH {
+            return Err(DomainValueError::new(
+                "NativeRouteToken",
+                "outside the canonical length",
+            ));
+        }
+        Ok(Self(value))
+    }
+}
+
+impl TryFrom<&str> for NativeRouteToken {
+    type Error = DomainValueError;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Self::try_from(value.to_owned())
+    }
+}
+
+impl From<NativeRouteToken> for String {
+    fn from(value: NativeRouteToken) -> Self {
+        value.0
+    }
+}
+
+impl fmt::Display for NativeRouteToken {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct NativeReportHex(String);
+
+impl NativeReportHex {
+    pub const MIN_LENGTH: usize = 180;
+    pub const MAX_LENGTH: usize = 180;
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl TryFrom<String> for NativeReportHex {
+    type Error = DomainValueError;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        if value.len() < Self::MIN_LENGTH || value.len() > Self::MAX_LENGTH {
+            return Err(DomainValueError::new(
+                "NativeReportHex",
+                "outside the canonical length",
+            ));
+        }
+        Ok(Self(value))
+    }
+}
+
+impl TryFrom<&str> for NativeReportHex {
+    type Error = DomainValueError;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Self::try_from(value.to_owned())
+    }
+}
+
+impl From<NativeReportHex> for String {
+    fn from(value: NativeReportHex) -> Self {
+        value.0
+    }
+}
+
+impl fmt::Display for NativeReportHex {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct NativeProtocolFamily(String);
+
+impl NativeProtocolFamily {
+    pub const MIN_LENGTH: usize = 1;
+    pub const MAX_LENGTH: usize = 64;
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl TryFrom<String> for NativeProtocolFamily {
+    type Error = DomainValueError;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        if value.len() < Self::MIN_LENGTH || value.len() > Self::MAX_LENGTH {
+            return Err(DomainValueError::new(
+                "NativeProtocolFamily",
+                "outside the canonical length",
+            ));
+        }
+        Ok(Self(value))
+    }
+}
+
+impl TryFrom<&str> for NativeProtocolFamily {
+    type Error = DomainValueError;
+
+    fn try_from(value: &str) -> Result<Self, Self::Error> {
+        Self::try_from(value.to_owned())
+    }
+}
+
+impl From<NativeProtocolFamily> for String {
+    fn from(value: NativeProtocolFamily) -> Self {
+        value.0
+    }
+}
+
+impl fmt::Display for NativeProtocolFamily {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(formatter)
+    }
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum DeviceKind {
     #[serde(rename = "receiver")]
@@ -4213,6 +4437,8 @@ pub enum ResourceKind {
     Settings,
     #[serde(rename = "pairing")]
     Pairing,
+    #[serde(rename = "native-control")]
+    NativeControl,
 }
 
 impl ResourceKind {
@@ -4222,6 +4448,7 @@ impl ResourceKind {
             Self::Lighting => "lighting",
             Self::Settings => "settings",
             Self::Pairing => "pairing",
+            Self::NativeControl => "native-control",
         }
     }
 }
@@ -4234,6 +4461,7 @@ impl FromStr for ResourceKind {
             "lighting" => Ok(Self::Lighting),
             "settings" => Ok(Self::Settings),
             "pairing" => Ok(Self::Pairing),
+            "native-control" => Ok(Self::NativeControl),
             _ => Err(DomainValueError::unknown_wire("ResourceKind")),
         }
     }
@@ -5312,3 +5540,83 @@ impl fmt::Display for ErrorSeverity {
         formatter.write_str(self.as_str())
     }
 }
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum NativeRouteAccess {
+    #[serde(rename = "qualified")]
+    Qualified,
+    #[serde(rename = "candidate")]
+    Candidate,
+    #[serde(rename = "backend-required")]
+    BackendRequired,
+}
+
+impl NativeRouteAccess {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Qualified => "qualified",
+            Self::Candidate => "candidate",
+            Self::BackendRequired => "backend-required",
+        }
+    }
+}
+
+impl FromStr for NativeRouteAccess {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "qualified" => Ok(Self::Qualified),
+            "candidate" => Ok(Self::Candidate),
+            "backend-required" => Ok(Self::BackendRequired),
+            _ => Err(DomainValueError::unknown_wire("NativeRouteAccess")),
+        }
+    }
+}
+
+impl fmt::Display for NativeRouteAccess {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum NativeRouteEventKind {
+    #[serde(rename = "available")]
+    Available,
+    #[serde(rename = "unavailable")]
+    Unavailable,
+    #[serde(rename = "generation-replaced")]
+    GenerationReplaced,
+}
+
+impl NativeRouteEventKind {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Available => "available",
+            Self::Unavailable => "unavailable",
+            Self::GenerationReplaced => "generation-replaced",
+        }
+    }
+}
+
+impl FromStr for NativeRouteEventKind {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "available" => Ok(Self::Available),
+            "unavailable" => Ok(Self::Unavailable),
+            "generation-replaced" => Ok(Self::GenerationReplaced),
+            _ => Err(DomainValueError::unknown_wire("NativeRouteEventKind")),
+        }
+    }
+}
+
+impl fmt::Display for NativeRouteEventKind {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
diff --git a/crates/hfx-kernel-transport/README.md b/crates/hfx-kernel-transport/README.md
index fc02e4d..84dc366b 100644
--- a/crates/hfx-kernel-transport/README.md
+++ b/crates/hfx-kernel-transport/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Adapts the generated kernel UAPI into bounded Rust observation, routing, and envelope I/O.
+Adapts the generated kernel UAPI into bounded Rust observation, routing, envelope I/O, and qualified native exchanges.
 
 `implemented` | `runtime` | Atlas: `kernel-transport`
 
@@ -21,7 +21,7 @@ Adapts the generated kernel UAPI into bounded Rust observation, routing, and env
 **Does not own**
 - Qualification policy
 - Application identity
-- Unbounded raw reports
+- Unbounded or unqualified raw reports
 
 ## Change Here
 
diff --git a/crates/hfx-kernel-transport/src/error.rs b/crates/hfx-kernel-transport/src/error.rs
index fb2ecc2..961fc4a 100644
--- a/crates/hfx-kernel-transport/src/error.rs
+++ b/crates/hfx-kernel-transport/src/error.rs
@@ -15,11 +15,14 @@ pub enum KernelTransportErrorKind {
     InvalidSessionMaterial,
     SessionUnavailable,
     InvalidDispatch,
+    InvalidNativeExchange,
     Encoding,
     OutcomeRetainedFailure,
     OutcomeEvicted,
     OutcomeUnavailable,
     OutcomeConflict,
+    NativeOutcomeUnavailable,
+    NativeOutcomeConflict,
     KernelRejected,
 }
 
@@ -84,6 +87,7 @@ impl fmt::Display for KernelTransportError {
                 "kernel transport session is unavailable"
             }
             KernelTransportErrorKind::InvalidDispatch => "kernel transport dispatch is invalid",
+            KernelTransportErrorKind::InvalidNativeExchange => "kernel native exchange is invalid",
             KernelTransportErrorKind::Encoding => "kernel transport dispatch cannot be encoded",
             KernelTransportErrorKind::OutcomeRetainedFailure => {
                 "kernel transport retained a failed outcome"
@@ -95,6 +99,12 @@ impl fmt::Display for KernelTransportError {
             KernelTransportErrorKind::OutcomeConflict => {
                 "kernel transport outcome identity conflicts"
             }
+            KernelTransportErrorKind::NativeOutcomeUnavailable => {
+                "kernel native exchange outcome is unavailable"
+            }
+            KernelTransportErrorKind::NativeOutcomeConflict => {
+                "kernel native exchange outcome identity conflicts"
+            }
             KernelTransportErrorKind::KernelRejected => "kernel transport rejected the dispatch",
         })
     }
diff --git a/crates/hfx-kernel-transport/src/generated.rs b/crates/hfx-kernel-transport/src/generated.rs
index c6ce323..b2bc9f8 100644
--- a/crates/hfx-kernel-transport/src/generated.rs
+++ b/crates/hfx-kernel-transport/src/generated.rs
@@ -1,6 +1,8 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
 // UAPI source SHA-256: e93cdf3e8232d6178015125934b256b671e0560a2b934c193be29b250389e24f
+// UAPI registry SHA-256: 344fcd2b65d74efbaf133749260f64df127401777d06343c1b9dbd15bf0540df
+// UAPI native_exchange source native-exchange-v2.json SHA-256: bb9b3581815703a53346c5d9a1972ff84931c255103ca4a1ef224e9d3c5a61de
 
 #[repr(C, align(8))]
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
@@ -8,6 +10,7 @@ pub struct AlignedU64(pub u64);
 
 pub const HFX_UAPI_ABI_VERSION: u32 = 1;
 pub const HFX_UAPI_IOCTL_MAGIC: u8 = 0xb7;
+pub const HFX_UAPI_NATIVE_ABI_VERSION: u32 = 2;
 pub const HFX_UAPI_DIGEST_BYTES: usize = 32;
 pub const HFX_UAPI_NONCE_BYTES: usize = 32;
 pub const HFX_UAPI_MAX_SESSION_NS: u64 = 300_000_000_000;
@@ -16,6 +19,10 @@ pub const HFX_UAPI_MAX_FRAME_DELAY_US: u64 = 100_000;
 pub const HFX_UAPI_MAX_TRANSACTION_DELAY_US: u64 = 1_000_000;
 pub const HFX_UAPI_MAX_FRAMES: usize = 16;
 pub const HFX_UAPI_MAX_OBSERVATIONS: usize = 32;
+pub const HFX_UAPI_NATIVE_DIGEST_BYTES: usize = 32;
+pub const HFX_UAPI_NATIVE_REPORT_BYTES: usize = 90;
+pub const HFX_UAPI_NATIVE_MAX_RESULTS: u64 = 128;
+pub const HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS: u64 = 1_000_000_000;
 
 pub const HFX_UAPI_INFO_FLAG_DISCONNECTING: u32 = 1;
 pub const HFX_UAPI_INFO_FLAG_SUSPENDED: u32 = 2;
@@ -72,6 +79,10 @@ pub const HFX_UAPI_OBSERVATION_CONFIDENCE_EXACT: u32 = 3;
 
 pub const HFX_UAPI_OBSERVATION_BATCH_FLAG_CURSOR_GAP: u32 = 1;
 
+pub const HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT: u32 = 1;
+pub const HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT: u32 = 2;
+pub const HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE: u32 = 3;
+
 #[repr(C)]
 #[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
 pub struct HfxUapiInfo {
@@ -196,6 +207,82 @@ pub struct HfxUapiReadObservations {
     pub observations: [HfxUapiObservation; HFX_UAPI_MAX_OBSERVATIONS],
 }
 
+#[repr(C)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct HfxUapiNativeExchangeSubmit {
+    pub version: u32,
+    pub size: u32,
+    pub receiver_generation: AlignedU64,
+    pub authorization_epoch: AlignedU64,
+    pub dispatch_nonce: AlignedU64,
+    pub deadline_boottime_ns: AlignedU64,
+    pub endpoint_slot: u32,
+    pub report_length: u32,
+    pub route_token_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub request_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub report: [u8; HFX_UAPI_NATIVE_REPORT_BYTES],
+    pub kernel_sequence: AlignedU64,
+}
+
+impl Default for HfxUapiNativeExchangeSubmit {
+    fn default() -> Self {
+        Self {
+            version: 0,
+            size: 0,
+            receiver_generation: AlignedU64::default(),
+            authorization_epoch: AlignedU64::default(),
+            dispatch_nonce: AlignedU64::default(),
+            deadline_boottime_ns: AlignedU64::default(),
+            endpoint_slot: 0,
+            report_length: 0,
+            route_token_digest: [0; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            request_digest: [0; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            report: [0; HFX_UAPI_NATIVE_REPORT_BYTES],
+            kernel_sequence: AlignedU64::default(),
+        }
+    }
+}
+
+#[repr(C)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct HfxUapiNativeExchangeResult {
+    pub version: u32,
+    pub size: u32,
+    pub receiver_generation: AlignedU64,
+    pub authorization_epoch: AlignedU64,
+    pub kernel_sequence: AlignedU64,
+    pub dispatch_nonce: AlignedU64,
+    pub endpoint_slot: u32,
+    pub certainty: u32,
+    pub route_token_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub request_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub transport_errno: i32,
+    pub response_length: u32,
+    pub response: [u8; HFX_UAPI_NATIVE_REPORT_BYTES],
+    pub reserved: u16,
+}
+
+impl Default for HfxUapiNativeExchangeResult {
+    fn default() -> Self {
+        Self {
+            version: 0,
+            size: 0,
+            receiver_generation: AlignedU64::default(),
+            authorization_epoch: AlignedU64::default(),
+            kernel_sequence: AlignedU64::default(),
+            dispatch_nonce: AlignedU64::default(),
+            endpoint_slot: 0,
+            certainty: 0,
+            route_token_digest: [0; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            request_digest: [0; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            transport_errno: 0,
+            response_length: 0,
+            response: [0; HFX_UAPI_NATIVE_REPORT_BYTES],
+            reserved: 0,
+        }
+    }
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum IoctlDirection {
     Read,
@@ -245,3 +332,15 @@ pub const HFX_UAPI_IOCTL_READ_OBSERVATIONS: IoctlDescriptor = IoctlDescriptor {
     direction: IoctlDirection::ReadWrite,
     size: core::mem::size_of::<HfxUapiReadObservations>(),
 };
+
+pub const HFX_UAPI_IOCTL_SUBMIT_NATIVE_EXCHANGE: IoctlDescriptor = IoctlDescriptor {
+    number: 0x06,
+    direction: IoctlDirection::ReadWrite,
+    size: core::mem::size_of::<HfxUapiNativeExchangeSubmit>(),
+};
+
+pub const HFX_UAPI_IOCTL_GET_NATIVE_EXCHANGE_RESULT: IoctlDescriptor = IoctlDescriptor {
+    number: 0x07,
+    direction: IoctlDirection::ReadWrite,
+    size: core::mem::size_of::<HfxUapiNativeExchangeResult>(),
+};
diff --git a/crates/hfx-kernel-transport/src/io.rs b/crates/hfx-kernel-transport/src/io.rs
index d660f57..34cd40d 100644
--- a/crates/hfx-kernel-transport/src/io.rs
+++ b/crates/hfx-kernel-transport/src/io.rs
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{
-    HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo, HfxUapiReadObservations, HfxUapiSubmit,
-    HfxUapiTransactionResult, ioctl_sys,
+    HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo, HfxUapiNativeExchangeResult,
+    HfxUapiNativeExchangeSubmit, HfxUapiReadObservations, HfxUapiSubmit, HfxUapiTransactionResult,
+    ioctl_sys,
 };
 use rustix::fs::{Mode, OFlags, open};
 use rustix::time::{ClockId, clock_gettime};
@@ -85,6 +86,28 @@ pub trait KernelIo {
         &self,
         request: &mut HfxUapiTransactionResult,
     ) -> Result<(), KernelIoError>;
+    /// Submits one fixed-size native child feature-report exchange.
+    ///
+    /// The kernel sends the `SET_REPORT` at most once. An error can therefore
+    /// mean that the request may have reached the receiver; callers must
+    /// reconcile the exact result instead of repeating the submit.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error for validation, authorization, or transport failure.
+    fn submit_native_exchange(
+        &self,
+        request: &mut HfxUapiNativeExchangeSubmit,
+    ) -> Result<(), KernelIoError>;
+    /// Reconciles one exact native child exchange identity.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error when the result lookup cannot complete.
+    fn get_native_exchange_result(
+        &self,
+        request: &mut HfxUapiNativeExchangeResult,
+    ) -> Result<(), KernelIoError>;
     /// Reads the next bounded passive-observation batch.
     ///
     /// # Errors
@@ -166,6 +189,21 @@ impl KernelIo for LinuxKernelIo {
         ioctl_sys::get_transaction_result(&self.file, request).map_err(KernelIoError::from_rustix)
     }
 
+    fn submit_native_exchange(
+        &self,
+        request: &mut HfxUapiNativeExchangeSubmit,
+    ) -> Result<(), KernelIoError> {
+        ioctl_sys::submit_native_exchange(&self.file, request).map_err(KernelIoError::from_rustix)
+    }
+
+    fn get_native_exchange_result(
+        &self,
+        request: &mut HfxUapiNativeExchangeResult,
+    ) -> Result<(), KernelIoError> {
+        ioctl_sys::get_native_exchange_result(&self.file, request)
+            .map_err(KernelIoError::from_rustix)
+    }
+
     fn read_observations(
         &self,
         request: &mut HfxUapiReadObservations,
diff --git a/crates/hfx-kernel-transport/src/ioctl_sys.rs b/crates/hfx-kernel-transport/src/ioctl_sys.rs
index 09e00be..89df225 100644
--- a/crates/hfx-kernel-transport/src/ioctl_sys.rs
+++ b/crates/hfx-kernel-transport/src/ioctl_sys.rs
@@ -2,7 +2,8 @@
 
 use crate::{
     HFX_UAPI_IOCTL_MAGIC, HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo,
-    HfxUapiReadObservations, HfxUapiSubmit, HfxUapiTransactionResult,
+    HfxUapiNativeExchangeResult, HfxUapiNativeExchangeSubmit, HfxUapiReadObservations,
+    HfxUapiSubmit, HfxUapiTransactionResult,
 };
 use rustix::io;
 use rustix::ioctl::{Getter, Setter, Updater, ioctl, opcode};
@@ -19,6 +20,10 @@ const GET_TRANSACTION_RESULT: rustix::ioctl::Opcode =
     opcode::read_write::<HfxUapiTransactionResult>(HFX_UAPI_IOCTL_MAGIC, 0x04);
 const READ_OBSERVATIONS: rustix::ioctl::Opcode =
     opcode::read_write::<HfxUapiReadObservations>(HFX_UAPI_IOCTL_MAGIC, 0x05);
+const SUBMIT_NATIVE_EXCHANGE: rustix::ioctl::Opcode =
+    opcode::read_write::<HfxUapiNativeExchangeSubmit>(HFX_UAPI_IOCTL_MAGIC, 0x06);
+const GET_NATIVE_EXCHANGE_RESULT: rustix::ioctl::Opcode =
+    opcode::read_write::<HfxUapiNativeExchangeResult>(HFX_UAPI_IOCTL_MAGIC, 0x07);
 
 pub fn get_info(fd: impl AsFd) -> io::Result<HfxUapiInfo> {
     // SAFETY: the opcode is generated from the canonical UAPI type and the
@@ -68,3 +73,29 @@ pub fn read_observations(fd: impl AsFd, request: &mut HfxUapiReadObservations) -
         )
     }
 }
+
+pub fn submit_native_exchange(
+    fd: impl AsFd,
+    request: &mut HfxUapiNativeExchangeSubmit,
+) -> io::Result<()> {
+    // SAFETY: the read/write opcode and value type come from the same generated UAPI record.
+    unsafe {
+        ioctl(
+            fd,
+            Updater::<SUBMIT_NATIVE_EXCHANGE, HfxUapiNativeExchangeSubmit>::new(request),
+        )
+    }
+}
+
+pub fn get_native_exchange_result(
+    fd: impl AsFd,
+    request: &mut HfxUapiNativeExchangeResult,
+) -> io::Result<()> {
+    // SAFETY: the read/write opcode and value type come from the same generated UAPI record.
+    unsafe {
+        ioctl(
+            fd,
+            Updater::<GET_NATIVE_EXCHANGE_RESULT, HfxUapiNativeExchangeResult>::new(request),
+        )
+    }
+}
diff --git a/crates/hfx-kernel-transport/src/lib.rs b/crates/hfx-kernel-transport/src/lib.rs
index c4b7534..8904418 100644
--- a/crates/hfx-kernel-transport/src/lib.rs
+++ b/crates/hfx-kernel-transport/src/lib.rs
@@ -8,6 +8,7 @@ mod generated;
 mod io;
 #[allow(unsafe_code)]
 mod ioctl_sys;
+mod native;
 mod observation;
 mod reader;
 mod router;
@@ -17,6 +18,9 @@ pub use encoder::{EncodedTransaction, ReceiverFrameEncoderRegistry};
 pub use error::{KernelTransportError, KernelTransportErrorKind};
 pub use generated::*;
 pub use io::{KernelIo, KernelIoError, LinuxKernelIo};
+pub use native::{
+    NativeEndpointLane, NativeExchangeCertainty, NativeExchangeOutcome, NativeExchangeRequest,
+};
 pub use observation::{KernelObservationBatch, RawKernelObservation};
 pub use reader::{KernelEndpointFlags, KernelEndpointInfo, KernelObservationReader};
 pub use router::{KernelRouteError, KernelTransportRouter};
@@ -40,6 +44,8 @@ mod tests {
         assert_eq!(size_of::<HfxUapiTransactionResult>(), 104);
         assert_eq!(size_of::<HfxUapiObservation>(), 40);
         assert_eq!(size_of::<HfxUapiReadObservations>(), 1_328);
+        assert_eq!(size_of::<HfxUapiNativeExchangeSubmit>(), 216);
+        assert_eq!(size_of::<HfxUapiNativeExchangeResult>(), 216);
     }
 
     #[test]
@@ -51,6 +57,8 @@ mod tests {
             HFX_UAPI_IOCTL_SUBMIT,
             HFX_UAPI_IOCTL_GET_TRANSACTION_RESULT,
             HFX_UAPI_IOCTL_READ_OBSERVATIONS,
+            HFX_UAPI_IOCTL_SUBMIT_NATIVE_EXCHANGE,
+            HFX_UAPI_IOCTL_GET_NATIVE_EXCHANGE_RESULT,
         ];
         assert!(
             descriptors
@@ -59,5 +67,6 @@ mod tests {
         );
         assert_eq!(HFX_UAPI_IOCTL_MAGIC, 0xb7);
         assert_eq!(HFX_UAPI_ABI_VERSION, 1);
+        assert_eq!(HFX_UAPI_NATIVE_ABI_VERSION, 2);
     }
 }
diff --git a/crates/hfx-kernel-transport/src/native.rs b/crates/hfx-kernel-transport/src/native.rs
new file mode 100644
index 0000000..17317da
--- /dev/null
+++ b/crates/hfx-kernel-transport/src/native.rs
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::{
+    HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+    HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS, HFX_UAPI_NATIVE_DIGEST_BYTES,
+    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE,
+    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT, HFX_UAPI_NATIVE_REPORT_BYTES,
+    HfxUapiNativeExchangeResult,
+};
+use sha2::{Digest, Sha256};
+use std::time::Duration;
+
+const NATIVE_REQUEST_DIGEST_DOMAIN: &[u8] = b"hyperflux-native-exchange-request-v1\0";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeEndpointLane {
+    Pointer,
+    Keyboard,
+}
+
+impl NativeEndpointLane {
+    pub(crate) const fn as_uapi(self) -> u32 {
+        match self {
+            Self::Pointer => HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            Self::Keyboard => HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+        }
+    }
+
+    pub(crate) const fn from_uapi(value: u32) -> Option<Self> {
+        match value {
+            HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE => Some(Self::Pointer),
+            HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE => Some(Self::Keyboard),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeExchangeRequest {
+    pub dispatch_nonce: u64,
+    pub endpoint: NativeEndpointLane,
+    pub route_token_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub report: [u8; HFX_UAPI_NATIVE_REPORT_BYTES],
+    pub timeout: Duration,
+}
+
+impl NativeExchangeRequest {
+    pub(crate) fn validate(&self) -> bool {
+        let timeout_ns = self.timeout.as_nanos();
+        self.dispatch_nonce != 0
+            && self.route_token_digest.iter().any(|byte| *byte != 0)
+            && timeout_ns != 0
+            && timeout_ns <= u128::from(HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS)
+    }
+
+    pub(crate) fn request_digest(&self) -> [u8; HFX_UAPI_NATIVE_DIGEST_BYTES] {
+        let mut hasher = Sha256::new();
+        hasher.update(NATIVE_REQUEST_DIGEST_DOMAIN);
+        hasher.update(self.endpoint.as_uapi().to_le_bytes());
+        hasher.update(self.route_token_digest);
+        hasher.update(self.report);
+        hasher.finalize().into()
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeExchangeCertainty {
+    NotSent,
+    MayHaveBeenSent,
+    MatchedResponse,
+}
+
+impl NativeExchangeCertainty {
+    #[must_use]
+    pub const fn automatic_retry_safe(self) -> bool {
+        matches!(self, Self::NotSent)
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeExchangeOutcome {
+    pub authorization_epoch: u64,
+    pub kernel_sequence: u64,
+    pub dispatch_nonce: u64,
+    pub endpoint: NativeEndpointLane,
+    pub route_token_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub request_digest: [u8; HFX_UAPI_NATIVE_DIGEST_BYTES],
+    pub certainty: NativeExchangeCertainty,
+    pub transport_errno: i32,
+    pub response: Option<[u8; HFX_UAPI_NATIVE_REPORT_BYTES]>,
+}
+
+impl NativeExchangeOutcome {
+    pub(crate) fn decode(result: &HfxUapiNativeExchangeResult) -> Option<Self> {
+        let endpoint = NativeEndpointLane::from_uapi(result.endpoint_slot)?;
+        let (certainty, response) = match result.certainty {
+            HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT
+                if result.kernel_sequence.0 == 0 && result.response_length == 0 =>
+            {
+                (NativeExchangeCertainty::NotSent, None)
+            }
+            HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT
+                if result.response_length == 0 =>
+            {
+                (NativeExchangeCertainty::MayHaveBeenSent, None)
+            }
+            HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE
+                if result.kernel_sequence.0 != 0
+                    && result.transport_errno == 0
+                    && result.response_length
+                        == u32::try_from(HFX_UAPI_NATIVE_REPORT_BYTES).ok()? =>
+            {
+                (
+                    NativeExchangeCertainty::MatchedResponse,
+                    Some(result.response),
+                )
+            }
+            _ => return None,
+        };
+        Some(Self {
+            authorization_epoch: result.authorization_epoch.0,
+            kernel_sequence: result.kernel_sequence.0,
+            dispatch_nonce: result.dispatch_nonce.0,
+            endpoint,
+            route_token_digest: result.route_token_digest,
+            request_digest: result.request_digest,
+            certainty,
+            transport_errno: result.transport_errno,
+            response,
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::AlignedU64;
+
+    fn request() -> NativeExchangeRequest {
+        NativeExchangeRequest {
+            dispatch_nonce: 7,
+            endpoint: NativeEndpointLane::Pointer,
+            route_token_digest: [0x41; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            report: [0x72; HFX_UAPI_NATIVE_REPORT_BYTES],
+            timeout: Duration::from_millis(250),
+        }
+    }
+
+    #[test]
+    fn digest_is_domain_separated_and_bound_to_route_endpoint_and_report() {
+        let first = request();
+        let mut changed = first.clone();
+        changed.endpoint = NativeEndpointLane::Keyboard;
+        assert_ne!(first.request_digest(), changed.request_digest());
+        changed = first.clone();
+        changed.route_token_digest[0] ^= 1;
+        assert_ne!(first.request_digest(), changed.request_digest());
+        changed = first.clone();
+        changed.report[89] ^= 1;
+        assert_ne!(first.request_digest(), changed.request_digest());
+    }
+
+    #[test]
+    fn malformed_or_contradictory_outcome_fails_closed() {
+        let mut result = HfxUapiNativeExchangeResult {
+            authorization_epoch: AlignedU64(4),
+            kernel_sequence: AlignedU64(9),
+            dispatch_nonce: AlignedU64(7),
+            endpoint_slot: HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+            certainty: HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE,
+            route_token_digest: [0x41; HFX_UAPI_NATIVE_DIGEST_BYTES],
+            request_digest: request().request_digest(),
+            response_length: 90,
+            response: [0x72; HFX_UAPI_NATIVE_REPORT_BYTES],
+            ..HfxUapiNativeExchangeResult::default()
+        };
+        assert_eq!(
+            NativeExchangeOutcome::decode(&result)
+                .expect("valid outcome")
+                .certainty,
+            NativeExchangeCertainty::MatchedResponse
+        );
+        result.response_length = 0;
+        assert!(NativeExchangeOutcome::decode(&result).is_none());
+    }
+}
diff --git a/crates/hfx-kernel-transport/src/reader.rs b/crates/hfx-kernel-transport/src/reader.rs
index 3914a7b..09fb6ad 100644
--- a/crates/hfx-kernel-transport/src/reader.rs
+++ b/crates/hfx-kernel-transport/src/reader.rs
@@ -166,8 +166,8 @@ fn io_error(_: crate::KernelIoError) -> KernelTransportError {
 mod tests {
     use super::*;
     use crate::{
-        HfxUapiBeginSession, HfxUapiEndSession, HfxUapiSubmit, HfxUapiTransactionResult,
-        KernelIoError,
+        HfxUapiBeginSession, HfxUapiEndSession, HfxUapiNativeExchangeResult,
+        HfxUapiNativeExchangeSubmit, HfxUapiSubmit, HfxUapiTransactionResult, KernelIoError,
     };
     use std::cell::Cell;
 
@@ -219,6 +219,20 @@ mod tests {
             Err(KernelIoError::from_raw_os_error(1))
         }
 
+        fn submit_native_exchange(
+            &self,
+            _: &mut HfxUapiNativeExchangeSubmit,
+        ) -> Result<(), KernelIoError> {
+            Err(KernelIoError::from_raw_os_error(1))
+        }
+
+        fn get_native_exchange_result(
+            &self,
+            _: &mut HfxUapiNativeExchangeResult,
+        ) -> Result<(), KernelIoError> {
+            Err(KernelIoError::from_raw_os_error(1))
+        }
+
         fn read_observations(&self, _: &mut HfxUapiReadObservations) -> Result<(), KernelIoError> {
             Err(KernelIoError::from_raw_os_error(1))
         }
diff --git a/crates/hfx-kernel-transport/src/router.rs b/crates/hfx-kernel-transport/src/router.rs
index 44bc99a..5c59ff9 100644
--- a/crates/hfx-kernel-transport/src/router.rs
+++ b/crates/hfx-kernel-transport/src/router.rs
@@ -1,7 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{KernelTransportError, KernelTransportErrorKind};
-use hfx_core::{ReceiverTransport, TransportDispatch, TransportReceipt, TransportReconciliation};
+use hfx_core::{
+    NativeTransportDispatch, NativeTransportOutcome, NativeTransportResult, ReceiverTransport,
+    TransportDispatch, TransportReceipt, TransportReconciliation,
+};
 use hfx_domain::{GenerationId, QueueCapacity, ReceiverId};
 use std::collections::BTreeMap;
 use std::fmt;
@@ -178,6 +181,21 @@ where
         )
     }
 
+    fn native_exchange_available(
+        &self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> bool {
+        matches!(
+            self.routes.get(receiver_id),
+            Some(KernelRoute::Writable {
+                generation_id: active,
+                transport,
+            }) if *active == generation_id
+                && transport.native_exchange_available(receiver_id, generation_id)
+        )
+    }
+
     fn reconcile(&self, dispatch: &TransportDispatch) -> TransportReconciliation {
         match self.routes.get(&dispatch.receiver_id) {
             Some(KernelRoute::Writable {
@@ -199,6 +217,22 @@ where
             )),
         }
     }
+
+    fn native_exchange(&mut self, dispatch: &NativeTransportDispatch) -> NativeTransportOutcome {
+        match self.routes.get_mut(&dispatch.receiver_id) {
+            Some(KernelRoute::Writable {
+                generation_id,
+                transport,
+            }) if *generation_id == dispatch.generation_id => transport.native_exchange(dispatch),
+            _ => NativeTransportOutcome {
+                dispatch_nonce: dispatch.dispatch_nonce,
+                route_token_digest: dispatch.route_token_digest,
+                result: NativeTransportResult::NotSent {
+                    error_kind: hfx_domain::ProtocolErrorKind::StaleGeneration,
+                },
+            },
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/crates/hfx-kernel-transport/src/transport.rs b/crates/hfx-kernel-transport/src/transport.rs
index ec09e6f..6a9a005 100644
--- a/crates/hfx-kernel-transport/src/transport.rs
+++ b/crates/hfx-kernel-transport/src/transport.rs
@@ -4,6 +4,7 @@ use crate::observation::decode_observations;
 use crate::{
     AlignedU64, EncodedTransaction, HFX_UAPI_ABI_VERSION, HFX_UAPI_INFO_FLAG_DISCONNECTING,
     HFX_UAPI_INFO_FLAG_SESSION_ACTIVE, HFX_UAPI_INFO_FLAG_SUSPENDED, HFX_UAPI_MAX_SESSION_NS,
+    HFX_UAPI_NATIVE_ABI_VERSION, HFX_UAPI_NATIVE_REPORT_BYTES,
     HFX_UAPI_RESULT_FLAG_AUTOMATIC_RETRY_SAFE, HFX_UAPI_RESULT_FLAG_WRITE_STARTED,
     HFX_UAPI_REVOKE_REASON_EXPLICIT, HFX_UAPI_REVOKE_REASON_SERVICE_LOSS,
     HFX_UAPI_TRANSPORT_STATUS_CONFLICT, HFX_UAPI_TRANSPORT_STATUS_EVICTED,
@@ -11,17 +12,19 @@ use crate::{
     HFX_UAPI_TRANSPORT_STATUS_RESERVED, HFX_UAPI_TRANSPORT_STATUS_REVOKED,
     HFX_UAPI_TRANSPORT_STATUS_STARTED, HFX_UAPI_TRANSPORT_STATUS_SUCCEEDED,
     HFX_UAPI_TRANSPORT_STATUS_UNAVAILABLE, HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo,
-    HfxUapiReadObservations, HfxUapiSubmit, HfxUapiTransactionResult, KernelIo,
-    KernelObservationBatch, KernelTransportError, KernelTransportErrorKind, LinuxKernelIo,
-    ReceiverFrameEncoderRegistry,
+    HfxUapiNativeExchangeResult, HfxUapiNativeExchangeSubmit, HfxUapiReadObservations,
+    HfxUapiSubmit, HfxUapiTransactionResult, KernelIo, KernelObservationBatch,
+    KernelTransportError, KernelTransportErrorKind, LinuxKernelIo, NativeExchangeOutcome,
+    NativeExchangeRequest, ReceiverFrameEncoderRegistry,
 };
 use hfx_core::{
-    ReceiverTransport, TransportDispatch, TransportFailureFacts, TransportReceipt,
-    TransportReconciliation, TransportTerminal,
+    NativeEndpointLane as CoreNativeEndpointLane, NativeTransportDispatch, NativeTransportOutcome,
+    NativeTransportResult, ReceiverTransport, TransportDispatch, TransportFailureFacts,
+    TransportReceipt, TransportReconciliation, TransportTerminal,
 };
 use hfx_domain::{
     DeliveredFrameCount, DeviceApplicationState, GenerationId, ProfileDigest, ProfileId,
-    ProfileKind, ReceiverId, SideEffectCertainty,
+    ProfileKind, ProtocolErrorKind, ReceiverId, SideEffectCertainty,
 };
 use hfx_profiles::RuntimeProfileCatalog;
 use serde_json::to_vec;
@@ -201,6 +204,67 @@ impl<I: KernelIo> KernelReceiverTransport<I> {
         decode_observations(self.material.generation_id, after_sequence, &request)
     }
 
+    /// Reconciles an exact native child exchange without sending a report.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed error for invalid request material, forgotten or
+    /// contradictory nonce bindings, or a malformed kernel result.
+    pub fn reconcile_native_exchange(
+        &self,
+        request: &NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+        Self::validate_native_request(request)?;
+        let request_digest = request.request_digest();
+        let authorization_epoch =
+            match self.lookup_dispatch(request.dispatch_nonce, request_digest)? {
+                DispatchLookup::Known(epoch) | DispatchLookup::New(epoch) => epoch,
+                DispatchLookup::Forgotten => {
+                    return Err(KernelTransportError::uncertain(
+                        KernelTransportErrorKind::NativeOutcomeUnavailable,
+                    ));
+                }
+                DispatchLookup::Conflict => {
+                    return Err(KernelTransportError::uncertain(
+                        KernelTransportErrorKind::NativeOutcomeConflict,
+                    ));
+                }
+            };
+        self.query_native_exchange(request, request_digest, authorization_epoch, 0)
+    }
+
+    /// Performs one generation-bound native child feature-report exchange.
+    ///
+    /// The kernel submits `SET_REPORT` at most once for a new nonce. This method
+    /// always reconciles the exact retained result after the ioctl returns and
+    /// never repeats an uncertain submit.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed error for invalid request material, session loss,
+    /// contradictory nonce reuse, or an unavailable/malformed retained result.
+    pub fn native_exchange(
+        &mut self,
+        request: &NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+        Self::validate_native_request(request)?;
+        let request_digest = request.request_digest();
+        match self.lookup_dispatch(request.dispatch_nonce, request_digest)? {
+            DispatchLookup::Known(epoch) => {
+                self.query_native_exchange(request, request_digest, epoch, 0)
+            }
+            DispatchLookup::New(epoch) => {
+                self.submit_native_exchange(request, request_digest, epoch)
+            }
+            DispatchLookup::Forgotten => Err(KernelTransportError::uncertain(
+                KernelTransportErrorKind::NativeOutcomeUnavailable,
+            )),
+            DispatchLookup::Conflict => Err(KernelTransportError::uncertain(
+                KernelTransportErrorKind::NativeOutcomeConflict,
+            )),
+        }
+    }
+
     /// Ends the current kernel authorization session explicitly.
     ///
     /// # Errors
@@ -347,6 +411,104 @@ impl<I: KernelIo> KernelReceiverTransport<I> {
         Ok((encoded, fingerprint))
     }
 
+    fn validate_native_request(
+        request: &NativeExchangeRequest,
+    ) -> Result<(), KernelTransportError> {
+        if request.validate() {
+            Ok(())
+        } else {
+            Err(KernelTransportError::safe(
+                KernelTransportErrorKind::InvalidNativeExchange,
+            ))
+        }
+    }
+
+    fn query_native_exchange(
+        &self,
+        request: &NativeExchangeRequest,
+        request_digest: [u8; 32],
+        authorization_epoch: u64,
+        kernel_sequence: u64,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+        let mut query = HfxUapiNativeExchangeResult {
+            version: HFX_UAPI_NATIVE_ABI_VERSION,
+            size: uapi_size::<HfxUapiNativeExchangeResult>()?,
+            receiver_generation: AlignedU64(self.material.generation_id.get()),
+            authorization_epoch: AlignedU64(authorization_epoch),
+            kernel_sequence: AlignedU64(kernel_sequence),
+            dispatch_nonce: AlignedU64(request.dispatch_nonce),
+            endpoint_slot: request.endpoint.as_uapi(),
+            route_token_digest: request.route_token_digest,
+            request_digest,
+            ..HfxUapiNativeExchangeResult::default()
+        };
+        self.io
+            .get_native_exchange_result(&mut query)
+            .map_err(|_| {
+                KernelTransportError::uncertain(KernelTransportErrorKind::NativeOutcomeUnavailable)
+            })?;
+        if query.version != HFX_UAPI_NATIVE_ABI_VERSION
+            || usize::try_from(query.size).ok() != Some(size_of::<HfxUapiNativeExchangeResult>())
+            || query.receiver_generation.0 != self.material.generation_id.get()
+            || query.authorization_epoch.0 != authorization_epoch
+            || query.dispatch_nonce.0 != request.dispatch_nonce
+            || query.endpoint_slot != request.endpoint.as_uapi()
+            || query.route_token_digest != request.route_token_digest
+            || query.request_digest != request_digest
+            || query.reserved != 0
+        {
+            return Err(KernelTransportError::uncertain(
+                KernelTransportErrorKind::NativeOutcomeConflict,
+            ));
+        }
+        NativeExchangeOutcome::decode(&query).ok_or_else(|| {
+            KernelTransportError::uncertain(KernelTransportErrorKind::NativeOutcomeConflict)
+        })
+    }
+
+    fn submit_native_exchange(
+        &self,
+        request: &NativeExchangeRequest,
+        request_digest: [u8; 32],
+        authorization_epoch: u64,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+        self.remember_dispatch(request.dispatch_nonce, request_digest, authorization_epoch)?;
+        let timeout_ns = u64::try_from(request.timeout.as_nanos()).map_err(|_| {
+            KernelTransportError::safe(KernelTransportErrorKind::InvalidNativeExchange)
+        })?;
+        let now = self.io.boottime_ns().map_err(io_error)?;
+        let deadline = now.checked_add(timeout_ns).ok_or_else(|| {
+            KernelTransportError::safe(KernelTransportErrorKind::InvalidNativeExchange)
+        })?;
+        let mut submit = HfxUapiNativeExchangeSubmit {
+            version: HFX_UAPI_NATIVE_ABI_VERSION,
+            size: uapi_size::<HfxUapiNativeExchangeSubmit>()?,
+            receiver_generation: AlignedU64(self.material.generation_id.get()),
+            authorization_epoch: AlignedU64(authorization_epoch),
+            dispatch_nonce: AlignedU64(request.dispatch_nonce),
+            deadline_boottime_ns: AlignedU64(deadline),
+            endpoint_slot: request.endpoint.as_uapi(),
+            report_length: u32::try_from(HFX_UAPI_NATIVE_REPORT_BYTES).map_err(|_| {
+                KernelTransportError::safe(KernelTransportErrorKind::InvalidNativeExchange)
+            })?,
+            route_token_digest: request.route_token_digest,
+            request_digest,
+            report: request.report,
+            kernel_sequence: AlignedU64(0),
+        };
+        let submit_result = self.io.submit_native_exchange(&mut submit);
+        match self.query_native_exchange(
+            request,
+            request_digest,
+            authorization_epoch,
+            submit.kernel_sequence.0,
+        ) {
+            Ok(outcome) => Ok(outcome),
+            Err(error) if submit_result.is_err() => Err(error),
+            Err(error) => Err(error),
+        }
+    }
+
     fn lookup_dispatch(
         &self,
         nonce: u64,
@@ -520,6 +682,20 @@ impl<I: KernelIo> ReceiverTransport for KernelReceiverTransport<I> {
         Some(self.material.generation_id)
     }
 
+    fn native_exchange_available(
+        &self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> bool {
+        receiver_id == &self.material.receiver_id
+            && generation_id == self.material.generation_id
+            && self
+                .io
+                .get_info()
+                .ok()
+                .is_some_and(|info| self.validate_writable_info(&info).is_ok())
+    }
+
     fn reconcile(&self, dispatch: &TransportDispatch) -> TransportReconciliation {
         let Ok((encoded, fingerprint)) = self.encode_and_fingerprint(dispatch) else {
             return TransportReconciliation::Conflict;
@@ -549,6 +725,62 @@ impl<I: KernelIo> ReceiverTransport for KernelReceiverTransport<I> {
             )),
         }
     }
+
+    fn native_exchange(&mut self, dispatch: &NativeTransportDispatch) -> NativeTransportOutcome {
+        if dispatch.receiver_id != self.material.receiver_id
+            || dispatch.generation_id != self.material.generation_id
+        {
+            return core_native_failure(dispatch, ProtocolErrorKind::StaleGeneration, true);
+        }
+        let request = NativeExchangeRequest {
+            dispatch_nonce: dispatch.dispatch_nonce.get(),
+            endpoint: match dispatch.endpoint {
+                CoreNativeEndpointLane::Pointer => crate::NativeEndpointLane::Pointer,
+                CoreNativeEndpointLane::Keyboard => crate::NativeEndpointLane::Keyboard,
+            },
+            route_token_digest: dispatch.route_token_digest,
+            report: dispatch.report,
+            timeout: Duration::from_millis(u64::from(dispatch.timeout_ms.get())),
+        };
+        match KernelReceiverTransport::native_exchange(self, &request) {
+            Ok(outcome)
+                if outcome.dispatch_nonce == dispatch.dispatch_nonce.get()
+                    && outcome.route_token_digest == dispatch.route_token_digest =>
+            {
+                let result = match outcome.certainty {
+                    crate::NativeExchangeCertainty::NotSent => NativeTransportResult::NotSent {
+                        error_kind: native_transport_error_kind(outcome.transport_errno),
+                    },
+                    crate::NativeExchangeCertainty::MayHaveBeenSent => {
+                        NativeTransportResult::MayHaveBeenSent {
+                            error_kind: native_transport_error_kind(outcome.transport_errno),
+                        }
+                    }
+                    crate::NativeExchangeCertainty::MatchedResponse => {
+                        let Some(response) = outcome.response else {
+                            return core_native_failure(
+                                dispatch,
+                                ProtocolErrorKind::OutcomeUnknown,
+                                false,
+                            );
+                        };
+                        NativeTransportResult::MatchedResponse(response)
+                    }
+                };
+                NativeTransportOutcome {
+                    dispatch_nonce: dispatch.dispatch_nonce,
+                    route_token_digest: dispatch.route_token_digest,
+                    result,
+                }
+            }
+            Ok(_) => core_native_failure(dispatch, ProtocolErrorKind::OutcomeUnknown, false),
+            Err(error) => core_native_failure(
+                dispatch,
+                kernel_native_error_kind(error.kind()),
+                error.failure_facts().automatic_retry_safe,
+            ),
+        }
+    }
 }
 
 impl<I: KernelIo> Drop for KernelReceiverTransport<I> {
@@ -557,6 +789,53 @@ impl<I: KernelIo> Drop for KernelReceiverTransport<I> {
     }
 }
 
+fn core_native_failure(
+    dispatch: &NativeTransportDispatch,
+    error_kind: ProtocolErrorKind,
+    retry_safe: bool,
+) -> NativeTransportOutcome {
+    NativeTransportOutcome {
+        dispatch_nonce: dispatch.dispatch_nonce,
+        route_token_digest: dispatch.route_token_digest,
+        result: if retry_safe {
+            NativeTransportResult::NotSent { error_kind }
+        } else {
+            NativeTransportResult::MayHaveBeenSent { error_kind }
+        },
+    }
+}
+
+fn native_transport_error_kind(transport_errno: i32) -> ProtocolErrorKind {
+    if transport_errno == 0 {
+        ProtocolErrorKind::OutcomeUnknown
+    } else {
+        ProtocolErrorKind::TransportFailure
+    }
+}
+
+const fn kernel_native_error_kind(kind: KernelTransportErrorKind) -> ProtocolErrorKind {
+    match kind {
+        KernelTransportErrorKind::InvalidNativeExchange
+        | KernelTransportErrorKind::InvalidDispatch
+        | KernelTransportErrorKind::Encoding => ProtocolErrorKind::InvalidRequest,
+        KernelTransportErrorKind::GenerationMismatch
+        | KernelTransportErrorKind::ReceiverMismatch => ProtocolErrorKind::StaleGeneration,
+        KernelTransportErrorKind::OutcomeEvicted => ProtocolErrorKind::OutcomeEvicted,
+        KernelTransportErrorKind::NativeOutcomeUnavailable
+        | KernelTransportErrorKind::NativeOutcomeConflict
+        | KernelTransportErrorKind::OutcomeUnavailable
+        | KernelTransportErrorKind::OutcomeConflict => ProtocolErrorKind::OutcomeUnknown,
+        KernelTransportErrorKind::Io
+        | KernelTransportErrorKind::AbiMismatch
+        | KernelTransportErrorKind::ProfileMismatch
+        | KernelTransportErrorKind::UnsupportedBackend
+        | KernelTransportErrorKind::InvalidSessionMaterial
+        | KernelTransportErrorKind::SessionUnavailable
+        | KernelTransportErrorKind::OutcomeRetainedFailure
+        | KernelTransportErrorKind::KernelRejected => ProtocolErrorKind::TransportFailure,
+    }
+}
+
 fn validate_result_key(
     dispatch: &TransportDispatch,
     fingerprint: [u8; 32],
diff --git a/crates/hfx-kernel-transport/tests/adapter.rs b/crates/hfx-kernel-transport/tests/adapter.rs
index dc02395..ce91c28 100644
--- a/crates/hfx-kernel-transport/tests/adapter.rs
+++ b/crates/hfx-kernel-transport/tests/adapter.rs
@@ -9,13 +9,17 @@ use hfx_domain::{
 use hfx_kernel_transport::{
     AlignedU64, HFX_UAPI_ABI_VERSION, HFX_UAPI_INFO_FLAG_SESSION_ACTIVE,
     HFX_UAPI_INFO_FLAG_SUSPENDED, HFX_UAPI_INFO_FLAG_WRITER_OPEN, HFX_UAPI_MAX_OBSERVATIONS,
+    HFX_UAPI_NATIVE_ABI_VERSION, HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE,
+    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT, HFX_UAPI_NATIVE_REPORT_BYTES,
     HFX_UAPI_RESULT_FLAG_AUTOMATIC_RETRY_SAFE, HFX_UAPI_RESULT_FLAG_WRITE_STARTED,
     HFX_UAPI_TRANSPORT_STATUS_FAILED, HFX_UAPI_TRANSPORT_STATUS_NOT_OBSERVED,
     HFX_UAPI_TRANSPORT_STATUS_SUCCEEDED, HFX_UAPI_TRANSPORT_STATUS_UNAVAILABLE,
-    HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo, HfxUapiObservation,
-    HfxUapiReadObservations, HfxUapiSubmit, HfxUapiTransactionResult, KernelIo, KernelIoError,
-    KernelReceiverTransport, KernelSessionMaterial, KernelTransportErrorKind,
-    ReceiverFrameEncoderRegistry,
+    HfxUapiBeginSession, HfxUapiEndSession, HfxUapiInfo, HfxUapiNativeExchangeResult,
+    HfxUapiNativeExchangeSubmit, HfxUapiObservation, HfxUapiReadObservations, HfxUapiSubmit,
+    HfxUapiTransactionResult, KernelIo, KernelIoError, KernelReceiverTransport,
+    KernelSessionMaterial, KernelTransportErrorKind, NativeEndpointLane, NativeExchangeCertainty,
+    NativeExchangeRequest, ReceiverFrameEncoderRegistry,
 };
 use hfx_profiles::RuntimeProfileCatalog;
 use hfx_protocol::{DeviceProfileBinding, LightingFrame, RgbColor};
@@ -56,6 +60,10 @@ struct FakeKernelState {
     last_submit: Option<HfxUapiSubmit>,
     results: BTreeMap<(u64, u64), HfxUapiTransactionResult>,
     failure_plan: Option<FailurePlan>,
+    native_submit_calls: usize,
+    last_native_submit: Option<HfxUapiNativeExchangeSubmit>,
+    native_results: BTreeMap<(u64, u64), HfxUapiNativeExchangeResult>,
+    native_failure_errno: Option<i32>,
     observations: Vec<HfxUapiObservation>,
 }
 
@@ -77,6 +85,10 @@ impl FakeKernel {
                 last_submit: None,
                 results: BTreeMap::new(),
                 failure_plan: None,
+                native_submit_calls: 0,
+                last_native_submit: None,
+                native_results: BTreeMap::new(),
+                native_failure_errno: None,
                 observations: Vec::new(),
             })),
         }
@@ -96,6 +108,13 @@ impl FakeKernel {
             .failure_plan = Some(plan);
     }
 
+    fn fail_next_native_after_set(&self, transport_errno: i32) {
+        self.state
+            .lock()
+            .expect("fake kernel lock is healthy")
+            .native_failure_errno = Some(transport_errno);
+    }
+
     fn advance_to_renewal_window(&self) {
         let mut state = self.state.lock().expect("fake kernel lock is healthy");
         state.now_ns = state.expires_ns.saturating_sub(4_000_000_000);
@@ -288,6 +307,121 @@ impl KernelIo for FakeKernel {
         Ok(())
     }
 
+    fn submit_native_exchange(
+        &self,
+        request: &mut HfxUapiNativeExchangeSubmit,
+    ) -> Result<(), KernelIoError> {
+        let mut state = self.state.lock().map_err(lock_error)?;
+        if let Some(result) = state
+            .native_results
+            .values()
+            .find(|result| {
+                result.receiver_generation == request.receiver_generation
+                    && result.dispatch_nonce == request.dispatch_nonce
+                    && result.endpoint_slot == request.endpoint_slot
+                    && result.route_token_digest == request.route_token_digest
+                    && result.request_digest == request.request_digest
+            })
+            .copied()
+        {
+            request.kernel_sequence = result.kernel_sequence;
+            return if result.certainty == HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE {
+                Ok(())
+            } else {
+                Err(fake_error())
+            };
+        }
+        if !state.session_active
+            || request.authorization_epoch.0 != state.authorization_epoch
+            || request.receiver_generation.0 != state.generation
+            || request.dispatch_nonce.0 <= state.maximum_nonce
+        {
+            return Err(fake_error());
+        }
+        state.maximum_nonce = request.dispatch_nonce.0;
+        state.next_sequence = state.next_sequence.saturating_add(1);
+        state.native_submit_calls += 1;
+        request.kernel_sequence = AlignedU64(state.next_sequence);
+        state.last_native_submit = Some(*request);
+        let failure = state.native_failure_errno.take();
+        let matched = failure.is_none();
+        let result = HfxUapiNativeExchangeResult {
+            version: HFX_UAPI_NATIVE_ABI_VERSION,
+            size: u32::try_from(size_of::<HfxUapiNativeExchangeResult>())
+                .map_err(|_| fake_error())?,
+            receiver_generation: request.receiver_generation,
+            authorization_epoch: request.authorization_epoch,
+            kernel_sequence: request.kernel_sequence,
+            dispatch_nonce: request.dispatch_nonce,
+            endpoint_slot: request.endpoint_slot,
+            certainty: if matched {
+                HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE
+            } else {
+                HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT
+            },
+            route_token_digest: request.route_token_digest,
+            request_digest: request.request_digest,
+            transport_errno: failure.unwrap_or(0),
+            response_length: if matched {
+                u32::try_from(HFX_UAPI_NATIVE_REPORT_BYTES).map_err(|_| fake_error())?
+            } else {
+                0
+            },
+            response: if matched {
+                request.report
+            } else {
+                [0; HFX_UAPI_NATIVE_REPORT_BYTES]
+            },
+            reserved: 0,
+        };
+        state.native_results.insert(
+            (request.authorization_epoch.0, request.dispatch_nonce.0),
+            result,
+        );
+        if matched { Ok(()) } else { Err(fake_error()) }
+    }
+
+    fn get_native_exchange_result(
+        &self,
+        request: &mut HfxUapiNativeExchangeResult,
+    ) -> Result<(), KernelIoError> {
+        let state = self.state.lock().map_err(lock_error)?;
+        if let Some(result) = state.native_results.values().find(|result| {
+            result.receiver_generation == request.receiver_generation
+                && result.dispatch_nonce == request.dispatch_nonce
+                && result.endpoint_slot == request.endpoint_slot
+                && result.route_token_digest == request.route_token_digest
+                && result.request_digest == request.request_digest
+        }) {
+            *request = *result;
+            return Ok(());
+        }
+        if let Some(result) = state
+            .native_results
+            .get(&(request.authorization_epoch.0, request.dispatch_nonce.0))
+        {
+            request.kernel_sequence = result.kernel_sequence;
+            request.certainty = HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT;
+            request.transport_errno = -17;
+            request.response_length = 0;
+            request.response = [0; HFX_UAPI_NATIVE_REPORT_BYTES];
+            return Ok(());
+        }
+        request.kernel_sequence = AlignedU64(0);
+        request.certainty = if state.session_active
+            && request.authorization_epoch.0 == state.authorization_epoch
+            && request.dispatch_nonce.0 > state.maximum_nonce
+        {
+            HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT
+        } else {
+            HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT
+        };
+        request.transport_errno = -61;
+        request.response_length = 0;
+        request.response = [0; HFX_UAPI_NATIVE_REPORT_BYTES];
+        Ok(())
+    }
+
     fn read_observations(
         &self,
         request: &mut HfxUapiReadObservations,
@@ -413,6 +547,91 @@ fn adapter_reconciles_exact_success_without_a_second_submit() {
     );
 }
 
+#[test]
+fn native_exchange_reconciles_before_and_after_one_set() {
+    let fake = FakeKernel::new();
+    let mut transport = transport(fake.clone());
+    let request = native_request(1, NativeEndpointLane::Pointer);
+
+    let before = transport
+        .reconcile_native_exchange(&request)
+        .expect("new nonce is provably not sent");
+    assert_eq!(before.certainty, NativeExchangeCertainty::NotSent);
+    assert!(before.certainty.automatic_retry_safe());
+
+    let outcome = transport
+        .native_exchange(&request)
+        .expect("native exchange succeeds");
+    assert_eq!(outcome.certainty, NativeExchangeCertainty::MatchedResponse);
+    assert_eq!(outcome.response, Some(request.report));
+    assert!(!outcome.certainty.automatic_retry_safe());
+
+    assert_eq!(
+        transport.native_exchange(&request),
+        Ok(outcome.clone()),
+        "an exact replay returns the retained response"
+    );
+    let state = fake.snapshot();
+    assert_eq!(state.native_submit_calls, 1);
+    assert_eq!(
+        state
+            .last_native_submit
+            .expect("native submit was captured")
+            .report,
+        request.report
+    );
+}
+
+#[test]
+fn uncertain_native_set_is_retained_and_never_resubmitted() {
+    let fake = FakeKernel::new();
+    fake.fail_next_native_after_set(-110);
+    let mut transport = transport(fake.clone());
+    let request = native_request(1, NativeEndpointLane::Keyboard);
+
+    let outcome = transport
+        .native_exchange(&request)
+        .expect("uncertain delivery remains a typed outcome");
+    assert_eq!(outcome.certainty, NativeExchangeCertainty::MayHaveBeenSent);
+    assert_eq!(outcome.transport_errno, -110);
+    assert_eq!(outcome.response, None);
+    assert!(!outcome.certainty.automatic_retry_safe());
+    assert_eq!(transport.native_exchange(&request), Ok(outcome));
+
+    let mut contradiction = request.clone();
+    contradiction.report[12] ^= 1;
+    assert_eq!(
+        transport
+            .native_exchange(&contradiction)
+            .expect_err("one nonce cannot identify two native requests")
+            .kind(),
+        KernelTransportErrorKind::NativeOutcomeConflict
+    );
+    assert_eq!(fake.snapshot().native_submit_calls, 1);
+}
+
+#[test]
+fn native_and_lighting_submissions_share_one_monotonic_nonce_ledger() {
+    let fake = FakeKernel::new();
+    let mut transport = transport(fake.clone());
+    let catalog = RuntimeProfileCatalog::load().expect("catalog is valid");
+
+    transport
+        .dispatch(&dispatch(&catalog, 1, true, false))
+        .expect("lighting nonce one succeeds");
+    transport
+        .native_exchange(&native_request(2, NativeEndpointLane::Pointer))
+        .expect("native nonce two succeeds");
+    transport
+        .dispatch(&dispatch(&catalog, 3, false, true))
+        .expect("lighting nonce three succeeds");
+
+    let state = fake.snapshot();
+    assert_eq!(state.submit_calls, 2);
+    assert_eq!(state.native_submit_calls, 1);
+    assert_eq!(state.maximum_nonce, 3);
+}
+
 #[test]
 fn retained_result_survives_writer_session_rotation() {
     let fake = FakeKernel::new();
@@ -513,14 +732,15 @@ fn suspended_receiver_retains_generation_identity_but_rejects_writes() {
     let fake = FakeKernel::new();
     let mut transport = transport(fake.clone());
     let receiver_id = ReceiverId::try_from("receiver-1").expect("receiver id is valid");
+    let generation = GenerationId::try_from(GENERATION).expect("generation is valid");
     let catalog = RuntimeProfileCatalog::load().expect("catalog is valid");
 
+    assert!(transport.native_exchange_available(&receiver_id, generation));
+
     fake.set_suspended(true);
 
-    assert_eq!(
-        transport.current_generation(&receiver_id),
-        Some(GenerationId::try_from(GENERATION).expect("generation is valid"))
-    );
+    assert_eq!(transport.current_generation(&receiver_id), Some(generation));
+    assert!(!transport.native_exchange_available(&receiver_id, generation));
     let error = transport
         .dispatch(&dispatch(&catalog, 1, true, true))
         .expect_err("suspended receiver cannot admit a write");
@@ -688,6 +908,23 @@ fn keyboard_colors() -> Vec<RgbColor> {
         .collect()
 }
 
+fn native_request(dispatch_nonce: u64, endpoint: NativeEndpointLane) -> NativeExchangeRequest {
+    let mut report = [0_u8; HFX_UAPI_NATIVE_REPORT_BYTES];
+    report[0] = 0x1f;
+    report[6] = 0x00;
+    report[7] = 0x87;
+    report[88] = report[2..88]
+        .iter()
+        .fold(0_u8, |checksum, byte| checksum ^ byte);
+    NativeExchangeRequest {
+        dispatch_nonce,
+        endpoint,
+        route_token_digest: [0x5a; 32],
+        report,
+        timeout: Duration::from_millis(250),
+    }
+}
+
 fn color(red: u8, green: u8, blue: u8) -> RgbColor {
     RgbColor {
         red: ColorChannel::try_from(red).expect("red is valid"),
diff --git a/crates/hfx-profiles/src/catalog.rs b/crates/hfx-profiles/src/catalog.rs
index 51b831b..ebd0dfd 100644
--- a/crates/hfx-profiles/src/catalog.rs
+++ b/crates/hfx-profiles/src/catalog.rs
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{
-    LifecyclePolicyRecord, LightingTopology, PROFILES, PassiveTelemetryRecord, PresentationRecord,
-    ProfileRecord, QualificationMigrationRecord, ReturnEvidenceSource,
+    LifecyclePolicyRecord, LightingTopology, NativeExchangeRecord, PROFILES,
+    PassiveTelemetryRecord, PresentationRecord, ProfileRecord, QualificationMigrationRecord,
+    ReturnEvidenceSource,
 };
 use hfx_domain::{
     CapabilityId, CarrierIndex, DeviceKind, DomainValueError, LedCount, ProductId, ProfileDigest,
@@ -126,6 +127,7 @@ pub struct RuntimeProfile {
     pub required_sibling_kinds: &'static [DeviceKind],
     pub exact_child_combinations: bool,
     pub capabilities: Vec<RuntimeCapability>,
+    pub native_exchange: Option<NativeExchangeRecord>,
     pub lighting: Option<RuntimeLightingTopology>,
     pub passive: Option<PassiveTelemetryRecord>,
     pub lifecycle: Option<LifecyclePolicyRecord>,
@@ -280,6 +282,7 @@ fn convert_profile(record: &ProfileRecord) -> Result<RuntimeProfile, ProfileCata
                 })
             })
             .collect::<Result<Vec<_>, ProfileCatalogError>>()?,
+        native_exchange: record.native_exchange,
         lighting: record.lighting.map(convert_lighting).transpose()?,
         passive: record.passive,
         lifecycle: record.lifecycle,
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index fc9f282..728f54d 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac
+// Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -112,6 +112,24 @@ pub struct PresentationRecord {
     pub transport_variant: &'static str,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeMatchRangeRecord {
+    pub offset: u16,
+    pub length: u16,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeExchangeRecord {
+    pub protocol_family: &'static str,
+    pub report_bytes: u16,
+    pub set_report_index: u8,
+    pub response_report_index: u8,
+    pub initial_response_delay_us: u32,
+    pub response_retry_delay_us: u32,
+    pub max_response_attempts: u8,
+    pub match_ranges: &'static [NativeMatchRangeRecord],
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct ProfileRecord {
     pub id: &'static str,
@@ -130,6 +148,7 @@ pub struct ProfileRecord {
     pub required_sibling_kinds: &'static [DeviceKind],
     pub exact_child_combinations: bool,
     pub capabilities: &'static [CapabilityRecord],
+    pub native_exchange: Option<NativeExchangeRecord>,
     pub lighting: Option<LightingTopology>,
     pub passive: Option<PassiveTelemetryRecord>,
     pub lifecycle: Option<LifecyclePolicyRecord>,
@@ -138,7 +157,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac";
+    "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
@@ -392,6 +411,17 @@ const CAPABILITIES_2: &[CapabilityRecord] = &[
     },
 ];
 
+const NATIVE_MATCH_RANGES_2: &[NativeMatchRangeRecord] = &[
+    NativeMatchRangeRecord {
+        offset: 2,
+        length: 2,
+    },
+    NativeMatchRangeRecord {
+        offset: 6,
+        length: 2,
+    },
+];
+
 const QUALIFICATION_MIGRATIONS_2: &[QualificationMigrationRecord] = &[];
 
 const CAPABILITIES_3: &[CapabilityRecord] = &[
@@ -427,6 +457,7 @@ pub const PROFILES: &[ProfileRecord] = &[
         required_sibling_kinds: &[],
         exact_child_combinations: false,
         capabilities: CAPABILITIES_0,
+        native_exchange: None,
         lighting: Some(LightingTopology {
             physical_led_count: 13,
             application_slot_count: 13,
@@ -482,6 +513,7 @@ pub const PROFILES: &[ProfileRecord] = &[
         required_sibling_kinds: &[],
         exact_child_combinations: false,
         capabilities: CAPABILITIES_1,
+        native_exchange: None,
         lighting: Some(LightingTopology {
             physical_led_count: 84,
             application_slot_count: 102,
@@ -526,7 +558,7 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "receiver.razer.hyperflux-v2.1532-00cf",
-        runtime_sha256: "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6",
+        runtime_sha256: "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2",
         revision: 2,
         profile_kind: ProfileKind::Receiver,
         device_kind: DeviceKind::Receiver,
@@ -541,6 +573,16 @@ pub const PROFILES: &[ProfileRecord] = &[
         required_sibling_kinds: &[],
         exact_child_combinations: false,
         capabilities: CAPABILITIES_2,
+        native_exchange: Some(NativeExchangeRecord {
+            protocol_family: "razer-feature-report-v1",
+            report_bytes: 90,
+            set_report_index: 0,
+            response_report_index: 0,
+            initial_response_delay_us: 8000,
+            response_retry_delay_us: 10000,
+            max_response_attempts: 5,
+            match_ranges: NATIVE_MATCH_RANGES_2,
+        }),
         lighting: None,
         passive: None,
         lifecycle: None,
@@ -564,6 +606,7 @@ pub const PROFILES: &[ProfileRecord] = &[
         required_sibling_kinds: &[],
         exact_child_combinations: false,
         capabilities: CAPABILITIES_3,
+        native_exchange: None,
         lighting: None,
         passive: None,
         lifecycle: None,
diff --git a/crates/hfx-protocol/src/generated.rs b/crates/hfx-protocol/src/generated.rs
index d347176..8963465 100644
--- a/crates/hfx-protocol/src/generated.rs
+++ b/crates/hfx-protocol/src/generated.rs
@@ -8,19 +8,21 @@ use hfx_domain::{
     ErrorSeverity, EventBatchLimit, EventKind, EvidenceClaimId, EvidenceConfidence, FindingId,
     FrameCount, FrameIndex, FreshnessState, GenerationId, HumanMessage, InventoryAvailability,
     LeaseDurationMs, LeaseId, LeaseState, LedCount, LogicalDeviceId, ModelName, MonotonicMs,
-    NegotiationToken, PairingState, PowerState, PresenceState, PresentationKey, PrivacyClass,
-    ProductId, ProfileDigest, ProfileId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId,
-    ProtocolSessionId, ProtocolVersion, QueueAdmission, QueueCapacity, ReceiverId,
-    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreDeliveryState,
-    RestoreState, ReturnEvidence, ReturnPhase, RouteKind, RouteState, SequenceNumber,
-    ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision, StableLightingMode,
-    StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability, TransactionClass,
-    TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
+    NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, NegotiationToken, PairingState,
+    PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId, ProfileDigest, ProfileId,
+    ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolSessionId, ProtocolVersion,
+    QueueAdmission, QueueCapacity, ReceiverId, ReceiverLifecycleState, RequestDigest, RequestId,
+    ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence, ReturnPhase, RouteKind,
+    RouteState, SequenceNumber, ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision,
+    StableLightingMode, StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability,
+    TransactionClass, TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
+    VendorId,
 };
 use serde::{Deserialize, Serialize};
 
-pub const MINIMUM_PROTOCOL_VERSION: u16 = 6;
-pub const MAXIMUM_PROTOCOL_VERSION: u16 = 6;
+pub const MINIMUM_PROTOCOL_VERSION: u16 = 7;
+pub const MAXIMUM_PROTOCOL_VERSION: u16 = 7;
 pub const MAX_WIRE_MESSAGE_BYTES: usize = 1_048_576;
 pub const MAX_JSON_DEPTH: usize = 128;
 pub const SUPPORTED_FEATURES: &[&str] = &[
@@ -33,6 +35,7 @@ pub const SUPPORTED_FEATURES: &[&str] = &[
     "event-subscriptions",
     "structured-diagnostics",
     "return-lifecycle-projection",
+    "native-receiver-tunnel",
 ];
 
 /// A method request with no method-specific fields.
@@ -777,6 +780,140 @@ pub struct IntegrationView {
     pub receivers: Vec<IntegrationReceiverView>,
 }
 
+/// One generation-bound receiver child route without a host device path.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRoute {
+    /// Receiver that owns this route.
+    pub receiver_id: ReceiverId,
+    /// Exact receiver generation binding.
+    pub generation_id: GenerationId,
+    /// Logical child device identity.
+    pub device_id: LogicalDeviceId,
+    /// Exact receiver child endpoint.
+    pub endpoint_id: EndpointId,
+    /// Observed child device category.
+    pub device_kind: DeviceKind,
+    /// Observed child USB vendor identifier.
+    pub vendor_id: VendorId,
+    /// Observed child USB product identifier.
+    pub product_id: ProductId,
+    /// Current receiver route evidence.
+    pub route_state: RouteState,
+    /// Evidence-backed tunnel access level.
+    pub access: NativeRouteAccess,
+    /// Opaque feature-report protocol family.
+    pub protocol_family: NativeProtocolFamily,
+    /// Exact native report size.
+    pub report_bytes: NativeReportByteCount,
+    /// Opaque writable route token when qualified and available.
+    pub route_token: Option<NativeRouteToken>,
+    /// Native-control lease resource when writable.
+    pub resource: Option<ResourceKey>,
+}
+
+/// Bounded sequence-consistent native route inventory.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteInventory {
+    /// Complete event position reflected by this inventory.
+    pub cursor: EventCursor,
+    /// Known routes in canonical identity order.
+    pub routes: Vec<NativeRoute>,
+}
+
+/// One idempotent lease-bound native child feature-report exchange.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeRequest {
+    /// Client idempotency identity.
+    pub request_id: RequestId,
+    /// Owning application client.
+    pub client_id: ClientId,
+    /// Exact native-control ownership lease.
+    pub lease_id: LeaseId,
+    /// Generation-bound opaque route token.
+    pub route_token: NativeRouteToken,
+    /// Exact lowercase hexadecimal native report.
+    pub report: NativeReportHex,
+    /// Bounded complete exchange deadline.
+    pub timeout_ms: NativeExchangeTimeoutMs,
+}
+
+/// The native request provably did not reach the receiver.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeNotSent {
+    /// Stable retry-safe failure category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central diagnostic reference.
+    pub finding_id: FindingId,
+}
+
+/// The SET report may have reached the receiver and must not be repeated automatically.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeUncertain {
+    /// Stable uncertain failure category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central diagnostic reference.
+    pub finding_id: FindingId,
+}
+
+/// A response matching the exact native request identity was retained.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeMatchedResponse {
+    /// Exact lowercase hexadecimal native response.
+    pub response: NativeReportHex,
+}
+
+/// Idempotent native exchange identity and contradiction-free result.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeOutcome {
+    /// Original client request identity.
+    pub request_id: RequestId,
+    /// Exact route token used for the exchange.
+    pub route_token: NativeRouteToken,
+    /// Retained native transport result.
+    pub result: NativeExchangeResult,
+}
+
+/// One sequence-bound complete native route change.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteEvent {
+    /// Strictly increasing route event sequence.
+    pub sequence: SequenceNumber,
+    /// Typed route transition.
+    pub kind: NativeRouteEventKind,
+    /// Complete route state after the transition.
+    pub route: NativeRoute,
+}
+
+/// Bounded native route changes with explicit cursor-gap state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteEventBatch {
+    /// Native route subscription identity.
+    pub subscription_id: SubscriptionId,
+    /// Cursor for the next native route batch.
+    pub next_cursor: EventCursor,
+    /// Native route events after the requested cursor.
+    pub events: Vec<NativeRouteEvent>,
+    /// Oldest retained sequence.
+    pub oldest_available: SequenceNumber,
+    /// Newest retained sequence.
+    pub latest_available: SequenceNumber,
+    /// Events evicted during this stream epoch.
+    pub dropped_events: DroppedEventCount,
+    /// Whether the client must enumerate routes again.
+    pub cursor_gap: bool,
+    /// Whether another retained native route event follows.
+    pub has_more: bool,
+}
+
 /// Stable structured request failure.
 #[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -836,6 +973,21 @@ pub enum ControllerOwnership {
     OwnedByOther(OtherOwnedController),
 }
 
+/// Contradiction-free native transport certainty and response.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "certainty", content = "detail")]
+pub enum NativeExchangeResult {
+    /// The request is safe to retry with a new identity.
+    #[serde(rename = "not-sent")]
+    NotSent(NativeExchangeNotSent),
+    /// Automatic retry is forbidden because SET delivery is uncertain.
+    #[serde(rename = "may-have-been-sent")]
+    MayHaveBeenSent(NativeExchangeUncertain),
+    /// The exact matching response was retained.
+    #[serde(rename = "matched-response")]
+    MatchedResponse(NativeExchangeMatchedResponse),
+}
+
 /// Unnegotiated request envelope used only for the handshake.
 #[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -878,6 +1030,12 @@ pub enum RpcRequest {
     Subscribe(SessionRequestEnvelope<SubscriptionRequest>),
     #[serde(rename = "diagnostics")]
     Diagnostics(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "native-enumerate")]
+    NativeEnumerate(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "native-transact")]
+    NativeTransact(SessionRequestEnvelope<NativeExchangeRequest>),
+    #[serde(rename = "native-watch")]
+    NativeWatch(SessionRequestEnvelope<SubscriptionRequest>),
 }
 
 /// Successful method response bound to the serving bridge instance.
@@ -922,6 +1080,12 @@ pub enum RpcResponse {
     SubscribeSuccess(SuccessEnvelope<EventBatch>),
     #[serde(rename = "diagnostics-success")]
     DiagnosticsSuccess(SuccessEnvelope<DiagnosticSnapshot>),
+    #[serde(rename = "native-enumerate-success")]
+    NativeEnumerateSuccess(SuccessEnvelope<NativeRouteInventory>),
+    #[serde(rename = "native-transact-success")]
+    NativeTransactSuccess(SuccessEnvelope<NativeExchangeOutcome>),
+    #[serde(rename = "native-watch-success")]
+    NativeWatchSuccess(SuccessEnvelope<NativeRouteEventBatch>),
     #[serde(rename = "error")]
     Error(ErrorEnvelope),
 }
@@ -995,6 +1159,24 @@ pub const METHODS: &[MethodDescriptor] = &[
         response: "DiagnosticSnapshot",
         required_feature: Some("structured-diagnostics"),
     },
+    MethodDescriptor {
+        name: "native-enumerate",
+        request: "EmptyRequest",
+        response: "NativeRouteInventory",
+        required_feature: Some("native-receiver-tunnel"),
+    },
+    MethodDescriptor {
+        name: "native-transact",
+        request: "NativeExchangeRequest",
+        response: "NativeExchangeOutcome",
+        required_feature: Some("native-receiver-tunnel"),
+    },
+    MethodDescriptor {
+        name: "native-watch",
+        request: "SubscriptionRequest",
+        response: "NativeRouteEventBatch",
+        required_feature: Some("native-receiver-tunnel"),
+    },
 ];
 
 impl RpcRequest {
@@ -1005,13 +1187,15 @@ impl RpcRequest {
             Self::Negotiate(envelope) => &envelope.request_id,
             Self::Snapshot(envelope)
             | Self::IntegrationView(envelope)
-            | Self::Diagnostics(envelope) => &envelope.request_id,
+            | Self::Diagnostics(envelope)
+            | Self::NativeEnumerate(envelope) => &envelope.request_id,
             Self::AcquireLease(envelope) => &envelope.request_id,
             Self::RenewLease(envelope) => &envelope.request_id,
             Self::ReleaseLease(envelope) => &envelope.request_id,
             Self::SubmitTransaction(envelope) => &envelope.request_id,
             Self::TransactionOutcome(envelope) => &envelope.request_id,
-            Self::Subscribe(envelope) => &envelope.request_id,
+            Self::Subscribe(envelope) | Self::NativeWatch(envelope) => &envelope.request_id,
+            Self::NativeTransact(envelope) => &envelope.request_id,
         }
     }
 
@@ -1029,6 +1213,9 @@ impl RpcRequest {
             Self::TransactionOutcome(_) => &METHODS[7],
             Self::Subscribe(_) => &METHODS[8],
             Self::Diagnostics(_) => &METHODS[9],
+            Self::NativeEnumerate(_) => &METHODS[10],
+            Self::NativeTransact(_) => &METHODS[11],
+            Self::NativeWatch(_) => &METHODS[12],
         }
     }
 
@@ -1039,7 +1226,8 @@ impl RpcRequest {
             Self::Negotiate(_) => None,
             Self::Snapshot(envelope)
             | Self::IntegrationView(envelope)
-            | Self::Diagnostics(envelope) => {
+            | Self::Diagnostics(envelope)
+            | Self::NativeEnumerate(envelope) => {
                 Some((&envelope.protocol_session_id, &envelope.negotiation_token))
             }
             Self::AcquireLease(envelope) => {
@@ -1057,7 +1245,10 @@ impl RpcRequest {
             Self::TransactionOutcome(envelope) => {
                 Some((&envelope.protocol_session_id, &envelope.negotiation_token))
             }
-            Self::Subscribe(envelope) => {
+            Self::Subscribe(envelope) | Self::NativeWatch(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::NativeTransact(envelope) => {
                 Some((&envelope.protocol_session_id, &envelope.negotiation_token))
             }
         }
@@ -1079,6 +1270,9 @@ impl RpcResponse {
             | Self::TransactionOutcomeSuccess(envelope) => Some(&envelope.request_id),
             Self::SubscribeSuccess(envelope) => Some(&envelope.request_id),
             Self::DiagnosticsSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeEnumerateSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeTransactSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeWatchSuccess(envelope) => Some(&envelope.request_id),
             Self::Error(envelope) => envelope.request_id.as_ref(),
         }
     }
@@ -1097,6 +1291,9 @@ impl RpcResponse {
             | Self::TransactionOutcomeSuccess(envelope) => &envelope.server_instance_id,
             Self::SubscribeSuccess(envelope) => &envelope.server_instance_id,
             Self::DiagnosticsSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeEnumerateSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeTransactSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeWatchSuccess(envelope) => &envelope.server_instance_id,
             Self::Error(envelope) => &envelope.server_instance_id,
         }
     }
diff --git a/crates/hfx-protocol/src/generated_v7.rs b/crates/hfx-protocol/src/generated_v7.rs
new file mode 100644
index 0000000..8963465
--- /dev/null
+++ b/crates/hfx-protocol/src/generated_v7.rs
@@ -0,0 +1,1300 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_domain::{
+    ActivityState, BatteryPercent, CapabilityId, ClientId, ClientName, ColorChannel,
+    ComponentVersion, ConnectionMode, ContactState, ControllerAvailability, DeliveredFrameCount,
+    DeviceApplicationState, DeviceKind, DocumentationPath, DroppedEventCount, EndpointId,
+    ErrorSeverity, EventBatchLimit, EventKind, EvidenceClaimId, EvidenceConfidence, FindingId,
+    FrameCount, FrameIndex, FreshnessState, GenerationId, HumanMessage, InventoryAvailability,
+    LeaseDurationMs, LeaseId, LeaseState, LedCount, LogicalDeviceId, ModelName, MonotonicMs,
+    NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, NegotiationToken, PairingState,
+    PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId, ProfileDigest, ProfileId,
+    ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolSessionId, ProtocolVersion,
+    QueueAdmission, QueueCapacity, ReceiverId, ReceiverLifecycleState, RequestDigest, RequestId,
+    ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence, ReturnPhase, RouteKind,
+    RouteState, SequenceNumber, ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision,
+    StableLightingMode, StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability,
+    TransactionClass, TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
+    VendorId,
+};
+use serde::{Deserialize, Serialize};
+
+pub const MINIMUM_PROTOCOL_VERSION: u16 = 7;
+pub const MAXIMUM_PROTOCOL_VERSION: u16 = 7;
+pub const MAX_WIRE_MESSAGE_BYTES: usize = 1_048_576;
+pub const MAX_JSON_DEPTH: usize = 128;
+pub const SUPPORTED_FEATURES: &[&str] = &[
+    "ownership-leases",
+    "atomic-transactions",
+    "profile-bound-transactions",
+    "semantic-stable-lighting",
+    "snapshot-profile-bindings",
+    "integration-view-projection",
+    "event-subscriptions",
+    "structured-diagnostics",
+    "return-lifecycle-projection",
+    "native-receiver-tunnel",
+];
+
+/// A method request with no method-specific fields.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EmptyRequest {}
+
+/// One canonical eight-bit RGB color.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RgbColor {
+    /// Red channel.
+    pub red: ColorChannel,
+    /// Green channel.
+    pub green: ColorChannel,
+    /// Blue channel.
+    pub blue: ColorChannel,
+}
+
+/// Bounded client protocol and feature offer.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ClientHello {
+    /// Process-scoped client identity.
+    pub client_id: ClientId,
+    /// User-facing application name.
+    pub client_name: ClientName,
+    /// Oldest protocol accepted by the client.
+    pub minimum_version: ProtocolVersion,
+    /// Newest protocol accepted by the client.
+    pub maximum_version: ProtocolVersion,
+    /// Features without which this client cannot operate.
+    pub required_features: Vec<ProtocolFeatureId>,
+    /// Features the client can use when available.
+    pub optional_features: Vec<ProtocolFeatureId>,
+}
+
+/// Negotiated protocol version and bridge feature set.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ServerHello {
+    /// Mutually supported protocol version.
+    pub selected_version: ProtocolVersion,
+    /// Changes whenever the bridge process identity changes.
+    pub server_instance_id: ServerInstanceId,
+    /// Server-issued connection ownership identity.
+    pub protocol_session_id: ProtocolSessionId,
+    /// Binds subsequent requests to this negotiated selection.
+    pub negotiation_token: NegotiationToken,
+    /// Bridge component version.
+    pub bridge_version: ComponentVersion,
+    /// Protocol features enabled for this connection.
+    pub enabled_features: Vec<ProtocolFeatureId>,
+    /// Maximum retained event count.
+    pub event_buffer_capacity: QueueCapacity,
+}
+
+/// One device-scoped writable resource.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ResourceKey {
+    /// Receiver that owns the route.
+    pub receiver_id: ReceiverId,
+    /// Receiver generation to which ownership is bound.
+    pub generation_id: GenerationId,
+    /// Logical resource owner.
+    pub device_id: LogicalDeviceId,
+    /// Generic resource domain.
+    pub kind: ResourceKind,
+}
+
+/// Atomic request for one or more writable resources.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Requesting client.
+    pub client_id: ClientId,
+    /// Complete atomic resource set.
+    pub resources: Vec<ResourceKey>,
+    /// Renewable lease duration.
+    pub duration_ms: LeaseDurationMs,
+}
+
+/// Granted ownership lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseGrant {
+    /// Lease identity.
+    pub lease_id: LeaseId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Atomically owned resources.
+    pub resources: Vec<ResourceKey>,
+    /// Exclusive monotonic expiry.
+    pub expires_at_ms: MonotonicMs,
+    /// Current lease state.
+    pub state: LeaseState,
+}
+
+/// Deterministic first conflict from an otherwise atomic lease request.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseConflict {
+    /// Current owner.
+    pub conflicting_client: ClientId,
+    /// First conflict in canonical resource order.
+    pub conflicting_resource: ResourceKey,
+}
+
+/// Structured lease rejection unrelated to another owner.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LeaseRejection {
+    /// Stable rejection category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central error catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Idempotent renewal of one existing lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RenewLeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Lease to renew.
+    pub lease_id: LeaseId,
+    /// New bounded duration.
+    pub duration_ms: LeaseDurationMs,
+}
+
+/// Idempotent release of one existing lease.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReleaseLeaseRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Owning client.
+    pub client_id: ClientId,
+    /// Lease to release.
+    pub lease_id: LeaseId,
+}
+
+/// Complete resumable position in one event stream projection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EventCursor {
+    /// Bridge event-stream identity.
+    pub stream_id: StreamId,
+    /// Changes whenever the event stream restarts.
+    pub stream_epoch: StreamEpoch,
+    /// Snapshot and event projection contract revision.
+    pub projection_revision: ProjectionRevision,
+    /// Last event reflected by this cursor.
+    pub sequence: SequenceNumber,
+}
+
+/// Generation-bound endpoint return state without claiming physical lighting application.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReturnEpoch {
+    /// Receiver generation that owns the epoch.
+    pub generation_id: GenerationId,
+    /// Logical child whose endpoint is returning.
+    pub device_id: LogicalDeviceId,
+    /// Exact endpoint whose return is tracked.
+    pub endpoint_id: EndpointId,
+    /// Opening evidence sequence for stale-event rejection.
+    pub epoch_sequence: SequenceNumber,
+    /// Bridge-local monotonic epoch opening time.
+    pub opened_at_ms: MonotonicMs,
+    /// Typed passive evidence that opened the epoch.
+    pub opening_evidence: ReturnEvidence,
+    /// Current endpoint return phase.
+    pub phase: ReturnPhase,
+    /// Strongest known replay-delivery fact.
+    pub delivery_state: RestoreDeliveryState,
+}
+
+/// Independent route, power, sleep, activity, contact, and freshness facts.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EndpointSnapshot {
+    /// Stable logical route identity.
+    pub endpoint_id: EndpointId,
+    /// Transport route category.
+    pub route_kind: RouteKind,
+    /// Current route evidence.
+    pub route_state: RouteState,
+    /// User-facing connection mode.
+    pub connection_mode: ConnectionMode,
+    /// Explicit power evidence, independent of route.
+    pub power_state: PowerState,
+    /// Explicit sleep evidence.
+    pub sleep_state: SleepState,
+    /// Recent activity evidence.
+    pub activity_state: ActivityState,
+    /// Mat-contact evidence where applicable.
+    pub contact_state: ContactState,
+    /// Freshness of the route projection.
+    pub freshness: FreshnessState,
+    /// How directly the state was established.
+    pub confidence: EvidenceConfidence,
+    /// Privacy-safe evidence provenance when available.
+    pub evidence_claim_id: Option<EvidenceClaimId>,
+    /// Bridge-local observation instant.
+    pub observed_at_ms: Option<MonotonicMs>,
+    /// Optional versioned return projection; receiver delivery alone never means child application.
+    pub return_epoch: Option<ReturnEpoch>,
+}
+
+/// Battery availability and value without collapsing unknown and unavailable.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BatteryObservation {
+    /// Whether a current value exists.
+    pub availability: TelemetryAvailability,
+    /// Reported value only when availability is reported.
+    pub percentage: Option<BatteryPercent>,
+    /// Freshness of the battery observation.
+    pub freshness: FreshnessState,
+    /// How directly the value was established.
+    pub confidence: EvidenceConfidence,
+    /// Bridge-local observation instant.
+    pub observed_at_ms: Option<MonotonicMs>,
+}
+
+/// Current bounded application ownership for one generation-scoped resource.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ResourceOwnershipSnapshot {
+    /// Owned resource.
+    pub resource: ResourceKey,
+    /// Current owning client.
+    pub client_id: ClientId,
+    /// Authorizing lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Application-neutral logical controller state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LogicalDeviceSnapshot {
+    /// Logical identity.
+    pub device_id: LogicalDeviceId,
+    /// Device category.
+    pub device_kind: DeviceKind,
+    /// Observed product id.
+    pub product_id: ProductId,
+    /// Qualified profile when available.
+    pub profile_id: Option<ProfileId>,
+    /// Immutable qualified child profile digest when available.
+    pub profile_digest: Option<ProfileDigest>,
+    /// Receiver inventory state independent of route.
+    pub pairing: PairingState,
+    /// Derived controller presence.
+    pub presence: PresenceState,
+    /// Evidence-backed support level.
+    pub support_level: SupportLevel,
+    /// Independent known routes in canonical endpoint order.
+    pub endpoints: Vec<EndpointSnapshot>,
+    /// Current battery projection.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+}
+
+/// Generation-bound receiver and child inventory.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ReceiverSnapshot {
+    /// Logical receiver identity.
+    pub receiver_id: ReceiverId,
+    /// Current receiver generation.
+    pub generation_id: GenerationId,
+    /// Exact qualified receiver profile when available.
+    pub profile_id: Option<ProfileId>,
+    /// Immutable qualified receiver profile digest when available.
+    pub profile_digest: Option<ProfileDigest>,
+    /// Receiver lifecycle state.
+    pub lifecycle: ReceiverLifecycleState,
+    /// Independent logical children.
+    pub devices: Vec<LogicalDeviceSnapshot>,
+    /// Current generation-scoped write ownership.
+    pub ownership: Vec<ResourceOwnershipSnapshot>,
+    /// Whether stable state restoration is enabled.
+    pub stable_restore_enabled: bool,
+    /// Current restoration state.
+    pub restore_state: RestoreState,
+}
+
+/// Sequence-bound complete bridge snapshot.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BridgeSnapshot {
+    /// Complete event position reflected by this snapshot.
+    pub cursor: EventCursor,
+    /// Exactly one current generation per receiver in canonical order.
+    pub receivers: Vec<ReceiverSnapshot>,
+}
+
+/// One logical-device direct-mode frame.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LightingFrame {
+    /// Frame target.
+    pub device_id: LogicalDeviceId,
+    /// Transaction-local frame order.
+    pub frame_index: FrameIndex,
+    /// Logical LED colors before carrier translation.
+    pub colors: Vec<RgbColor>,
+}
+
+/// Exact profile and lighting dimensions bound to one transaction target.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceProfileBinding {
+    /// Logical transaction target.
+    pub device_id: LogicalDeviceId,
+    /// Qualified child profile selected at admission.
+    pub profile_id: ProfileId,
+    /// Immutable profile-catalog digest selected at admission.
+    pub profile_digest: ProfileDigest,
+    /// Exact logical color count required by this profile.
+    pub application_slot_count: LedCount,
+}
+
+/// Explicit semantic stable-lighting intent for one frame target.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct StableLightingIntent {
+    /// Logical stable-lighting target.
+    pub device_id: LogicalDeviceId,
+    /// Stable Static or Off meaning independent of RGB payload values.
+    pub mode: StableLightingMode,
+}
+
+/// Atomic generation- and ownership-bound operation.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionRequest {
+    /// Idempotency identity.
+    pub request_id: RequestId,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Submitting client.
+    pub client_id: ClientId,
+    /// Atomic ownership proof.
+    pub lease_id: LeaseId,
+    /// Receiver target.
+    pub receiver_id: ReceiverId,
+    /// Generation binding.
+    pub generation_id: GenerationId,
+    /// Exact qualified receiver profile selected at admission.
+    pub receiver_profile_id: ProfileId,
+    /// Immutable receiver profile-catalog digest selected at admission.
+    pub receiver_profile_digest: ProfileDigest,
+    /// Complete canonical profile binding for every frame target.
+    pub device_profiles: Vec<DeviceProfileBinding>,
+    /// Ordering and coalescing class.
+    pub transaction_class: TransactionClass,
+    /// Canonical per-target semantic intent for static-lighting; empty for every other transaction class.
+    pub stable_intents: Vec<StableLightingIntent>,
+    /// Absolute monotonic deadline.
+    pub deadline_ms: MonotonicMs,
+    /// Complete ownership set.
+    pub resources: Vec<ResourceKey>,
+    /// Complete atomic frame batch.
+    pub frames: Vec<LightingFrame>,
+}
+
+/// Nonterminal generation-bound transaction projection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionProgress {
+    /// Original idempotency identity.
+    pub request_id: RequestId,
+    /// Canonical request digest used for exact replay.
+    pub request_digest: RequestDigest,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Bound receiver.
+    pub receiver_id: ReceiverId,
+    /// Bound receiver generation.
+    pub generation_id: GenerationId,
+    /// Current nonterminal state.
+    pub state: TransactionState,
+    /// Bounded queue decision.
+    pub admission: QueueAdmission,
+    /// Frames promised by the transaction.
+    pub declared_frames: FrameCount,
+    /// Frames terminally accepted so far.
+    pub delivered_frames: DeliveredFrameCount,
+    /// Current transport side-effect knowledge.
+    pub side_effect_certainty: SideEffectCertainty,
+    /// Whether transport has begun a hardware write.
+    pub live_write_executed: bool,
+}
+
+/// Immutable terminal transaction outcome retained for bounded lookup.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionTerminal {
+    /// Original idempotency identity.
+    pub request_id: RequestId,
+    /// Canonical request digest used for exact replay.
+    pub request_digest: RequestDigest,
+    /// Transaction identity.
+    pub transaction_id: TransactionId,
+    /// Bound receiver.
+    pub receiver_id: ReceiverId,
+    /// Bound receiver generation.
+    pub generation_id: GenerationId,
+    /// Terminal succeeded, failed, revoked, or superseded state.
+    pub state: TransactionState,
+    /// Frames promised by the transaction.
+    pub declared_frames: FrameCount,
+    /// Frames terminally accepted by transport.
+    pub delivered_frames: DeliveredFrameCount,
+    /// Terminal transport side-effect knowledge.
+    pub side_effect_certainty: SideEffectCertainty,
+    /// Whether transport began a hardware write.
+    pub live_write_executed: bool,
+    /// Whether exact automatic replay is safe; false after possible transport.
+    pub automatic_retry: bool,
+    /// Separate child-application evidence.
+    pub device_application: DeviceApplicationState,
+    /// Immutable completion event sequence.
+    pub terminal_sequence: SequenceNumber,
+    /// Structured failure category.
+    pub error_kind: Option<ProtocolErrorKind>,
+    /// Newer unsent effect transaction that replaced this one.
+    pub superseded_by: Option<TransactionId>,
+}
+
+/// Outcome lookup cannot return a retained transaction record.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionUnavailable {
+    /// Requested transaction identity.
+    pub transaction_id: TransactionId,
+    /// Unknown or evicted outcome category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central error catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Idempotent lookup of one previously submitted transaction.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct TransactionLookup {
+    /// Lookup request identity.
+    pub request_id: RequestId,
+    /// Original transaction owner.
+    pub client_id: ClientId,
+    /// Transaction to inspect.
+    pub transaction_id: TransactionId,
+}
+
+/// Bounded event subscription cursor.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SubscriptionRequest {
+    /// Subscribing client.
+    pub client_id: ClientId,
+    /// Server-issued subscription identity when continuing.
+    pub subscription_id: Option<SubscriptionId>,
+    /// Previously observed complete event cursor.
+    pub expected_cursor: Option<EventCursor>,
+    /// Maximum events requested in this batch.
+    pub max_events: EventBatchLimit,
+}
+
+/// Sequence-bound typed event with snapshot references.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct BridgeEvent {
+    /// Strictly increasing sequence.
+    pub sequence: SequenceNumber,
+    /// Typed event category.
+    pub kind: EventKind,
+    /// Affected receiver when applicable.
+    pub receiver_id: Option<ReceiverId>,
+    /// Affected generation when applicable.
+    pub generation_id: Option<GenerationId>,
+    /// Affected logical device when applicable.
+    pub device_id: Option<LogicalDeviceId>,
+    /// Affected lease when applicable.
+    pub lease_id: Option<LeaseId>,
+    /// Affected transaction when applicable.
+    pub transaction_id: Option<TransactionId>,
+    /// Affected finding when applicable.
+    pub finding_id: Option<FindingId>,
+}
+
+/// Bounded event result with explicit cursor-gap state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct EventBatch {
+    /// Subscription identity.
+    pub subscription_id: SubscriptionId,
+    /// Cursor to supply for the next batch.
+    pub next_cursor: EventCursor,
+    /// Events after the requested cursor.
+    pub events: Vec<BridgeEvent>,
+    /// Oldest retained sequence.
+    pub oldest_available: SequenceNumber,
+    /// Newest retained sequence.
+    pub latest_available: SequenceNumber,
+    /// Events evicted since this stream epoch began.
+    pub dropped_events: DroppedEventCount,
+    /// Whether the client must refresh its snapshot.
+    pub cursor_gap: bool,
+    /// Whether another retained event follows this batch.
+    pub has_more: bool,
+}
+
+/// One privacy-classified actionable finding.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DiagnosticFinding {
+    /// Stable finding code.
+    pub finding_id: FindingId,
+    /// User-facing severity.
+    pub severity: ErrorSeverity,
+    /// Bounded technical cause.
+    pub cause: HumanMessage,
+    /// Plain user explanation.
+    pub explanation: HumanMessage,
+    /// One safe remediation.
+    pub safe_action: HumanMessage,
+    /// Support-output privacy class.
+    pub privacy: PrivacyClass,
+    /// Stable documentation path.
+    pub documentation: DocumentationPath,
+}
+
+/// Bounded bridge findings and queue health.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DiagnosticSnapshot {
+    /// Latest reflected event sequence.
+    pub sequence: SequenceNumber,
+    /// Active actionable findings.
+    pub findings: Vec<DiagnosticFinding>,
+    /// Configured event bound.
+    pub event_buffer_capacity: QueueCapacity,
+    /// Configured transaction bound.
+    pub transaction_queue_capacity: QueueCapacity,
+}
+
+/// Exact immutable profile authority exposed to integrations.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ProfileBindingView {
+    /// Qualified profile identity.
+    pub profile_id: ProfileId,
+    /// Immutable runtime profile digest.
+    pub profile_digest: ProfileDigest,
+}
+
+/// Truthful paired-device inventory independent of application controller registration.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct DeviceInventoryView {
+    /// Logical device identity.
+    pub device_id: LogicalDeviceId,
+    /// Device category.
+    pub device_kind: DeviceKind,
+    /// Observed product id.
+    pub product_id: ProductId,
+    /// Exact qualified child profile when available.
+    pub profile: Option<ProfileBindingView>,
+    /// Qualified model name when available.
+    pub model_name: Option<ModelName>,
+    /// Receiver pairing truth.
+    pub pairing: PairingState,
+    /// Derived device presence.
+    pub presence: PresenceState,
+    /// Inventory-facing availability with receiver and pairing context.
+    pub availability: InventoryAvailability,
+    /// Evidence-backed support level.
+    pub support_level: SupportLevel,
+    /// Independent known routes.
+    pub endpoints: Vec<EndpointSnapshot>,
+    /// Battery truth without collapsing unavailable states.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+}
+
+/// Pinned upstream presentation authority without hardware transport policy.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct PresentationView {
+    /// Pinned upstream catalog identity.
+    pub upstream_id: UpstreamId,
+    /// Upstream project responsible for presentation.
+    pub owner: UpstreamOwner,
+    /// Pinned upstream project version.
+    pub project_version: ComponentVersion,
+    /// Pinned upstream source revision.
+    pub source_revision: SourceRevision,
+    /// Upstream model registry key.
+    pub model_key: PresentationKey,
+    /// Upstream layout registry key when applicable.
+    pub layout_key: Option<PresentationKey>,
+    /// Presentation variant for this route.
+    pub transport_variant: TransportVariant,
+}
+
+/// Application-facing lighting dimensions without receiver carrier mapping.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct LightingTopologyView {
+    /// Physically illuminated LED count.
+    pub physical_led_count: LedCount,
+    /// Exact application color count.
+    pub application_slot_count: LedCount,
+    /// Application layout row count.
+    pub rows: LedCount,
+    /// Application layout column count.
+    pub columns: LedCount,
+}
+
+/// Writable controller currently has no application owner.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct UnownedController {}
+
+/// Writable controller is owned by the requesting client.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ViewerOwnedController {
+    /// Current ownership lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock lease expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Writable controller is owned by another application client.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct OtherOwnedController {
+    /// Current owning client.
+    pub client_id: ClientId,
+    /// Current ownership lease.
+    pub lease_id: LeaseId,
+    /// Exclusive bridge-clock lease expiry.
+    pub expires_at_ms: MonotonicMs,
+}
+
+/// Viewer-specific actions derived from availability and ownership.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControllerActions {
+    /// Viewer may atomically acquire this resource.
+    pub can_acquire: bool,
+    /// Viewer may release its current lease.
+    pub can_release: bool,
+    /// Viewer owns a currently writable route.
+    pub can_submit_now: bool,
+}
+
+/// Exact qualified receiver-backed application controller.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ControllerView {
+    /// Owning receiver.
+    pub receiver_id: ReceiverId,
+    /// Generation binding.
+    pub generation_id: GenerationId,
+    /// Logical controller identity.
+    pub device_id: LogicalDeviceId,
+    /// Exact usable receiver endpoint.
+    pub endpoint_id: EndpointId,
+    /// Controller category.
+    pub device_kind: DeviceKind,
+    /// Qualified product id.
+    pub product_id: ProductId,
+    /// Exact receiver profile authority.
+    pub receiver_profile: ProfileBindingView,
+    /// Exact child profile authority.
+    pub device_profile: ProfileBindingView,
+    /// Qualified model name.
+    pub model_name: ModelName,
+    /// Pinned application presentation authority.
+    pub presentation: PresentationView,
+    /// Ready or sleeping controller state.
+    pub availability: ControllerAvailability,
+    /// Current battery projection.
+    pub battery: BatteryObservation,
+    /// Qualified semantic capabilities.
+    pub capabilities: Vec<CapabilityId>,
+    /// Application-facing lighting dimensions.
+    pub lighting: LightingTopologyView,
+    /// Generation-scoped lighting ownership resource.
+    pub resource: ResourceKey,
+    /// Viewer-specific ownership state.
+    pub ownership: ControllerOwnership,
+    /// Viewer-specific safe actions.
+    pub actions: ControllerActions,
+}
+
+/// One receiver generation with complete inventory and qualified controllers.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct IntegrationReceiverView {
+    /// Logical receiver identity.
+    pub receiver_id: ReceiverId,
+    /// Current receiver generation.
+    pub generation_id: GenerationId,
+    /// Exact receiver profile when qualified.
+    pub profile: Option<ProfileBindingView>,
+    /// Qualified receiver model name.
+    pub model_name: Option<ModelName>,
+    /// Current receiver lifecycle.
+    pub lifecycle: ReceiverLifecycleState,
+    /// Stable lighting restore policy.
+    pub stable_restore_enabled: bool,
+    /// Current restoration state.
+    pub restore_state: RestoreState,
+    /// Complete paired and observed inventory.
+    pub inventory: Vec<DeviceInventoryView>,
+    /// Exact qualified application controllers.
+    pub controllers: Vec<ControllerView>,
+}
+
+/// Client-specific application view projected once by bridge policy.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct IntegrationView {
+    /// Complete event position reflected by the projection.
+    pub cursor: EventCursor,
+    /// Current receiver integration projections.
+    pub receivers: Vec<IntegrationReceiverView>,
+}
+
+/// One generation-bound receiver child route without a host device path.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRoute {
+    /// Receiver that owns this route.
+    pub receiver_id: ReceiverId,
+    /// Exact receiver generation binding.
+    pub generation_id: GenerationId,
+    /// Logical child device identity.
+    pub device_id: LogicalDeviceId,
+    /// Exact receiver child endpoint.
+    pub endpoint_id: EndpointId,
+    /// Observed child device category.
+    pub device_kind: DeviceKind,
+    /// Observed child USB vendor identifier.
+    pub vendor_id: VendorId,
+    /// Observed child USB product identifier.
+    pub product_id: ProductId,
+    /// Current receiver route evidence.
+    pub route_state: RouteState,
+    /// Evidence-backed tunnel access level.
+    pub access: NativeRouteAccess,
+    /// Opaque feature-report protocol family.
+    pub protocol_family: NativeProtocolFamily,
+    /// Exact native report size.
+    pub report_bytes: NativeReportByteCount,
+    /// Opaque writable route token when qualified and available.
+    pub route_token: Option<NativeRouteToken>,
+    /// Native-control lease resource when writable.
+    pub resource: Option<ResourceKey>,
+}
+
+/// Bounded sequence-consistent native route inventory.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteInventory {
+    /// Complete event position reflected by this inventory.
+    pub cursor: EventCursor,
+    /// Known routes in canonical identity order.
+    pub routes: Vec<NativeRoute>,
+}
+
+/// One idempotent lease-bound native child feature-report exchange.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeRequest {
+    /// Client idempotency identity.
+    pub request_id: RequestId,
+    /// Owning application client.
+    pub client_id: ClientId,
+    /// Exact native-control ownership lease.
+    pub lease_id: LeaseId,
+    /// Generation-bound opaque route token.
+    pub route_token: NativeRouteToken,
+    /// Exact lowercase hexadecimal native report.
+    pub report: NativeReportHex,
+    /// Bounded complete exchange deadline.
+    pub timeout_ms: NativeExchangeTimeoutMs,
+}
+
+/// The native request provably did not reach the receiver.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeNotSent {
+    /// Stable retry-safe failure category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central diagnostic reference.
+    pub finding_id: FindingId,
+}
+
+/// The SET report may have reached the receiver and must not be repeated automatically.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeUncertain {
+    /// Stable uncertain failure category.
+    pub error_kind: ProtocolErrorKind,
+    /// Central diagnostic reference.
+    pub finding_id: FindingId,
+}
+
+/// A response matching the exact native request identity was retained.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeMatchedResponse {
+    /// Exact lowercase hexadecimal native response.
+    pub response: NativeReportHex,
+}
+
+/// Idempotent native exchange identity and contradiction-free result.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeExchangeOutcome {
+    /// Original client request identity.
+    pub request_id: RequestId,
+    /// Exact route token used for the exchange.
+    pub route_token: NativeRouteToken,
+    /// Retained native transport result.
+    pub result: NativeExchangeResult,
+}
+
+/// One sequence-bound complete native route change.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteEvent {
+    /// Strictly increasing route event sequence.
+    pub sequence: SequenceNumber,
+    /// Typed route transition.
+    pub kind: NativeRouteEventKind,
+    /// Complete route state after the transition.
+    pub route: NativeRoute,
+}
+
+/// Bounded native route changes with explicit cursor-gap state.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NativeRouteEventBatch {
+    /// Native route subscription identity.
+    pub subscription_id: SubscriptionId,
+    /// Cursor for the next native route batch.
+    pub next_cursor: EventCursor,
+    /// Native route events after the requested cursor.
+    pub events: Vec<NativeRouteEvent>,
+    /// Oldest retained sequence.
+    pub oldest_available: SequenceNumber,
+    /// Newest retained sequence.
+    pub latest_available: SequenceNumber,
+    /// Events evicted during this stream epoch.
+    pub dropped_events: DroppedEventCount,
+    /// Whether the client must enumerate routes again.
+    pub cursor_gap: bool,
+    /// Whether another retained native route event follows.
+    pub has_more: bool,
+}
+
+/// Stable structured request failure.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RpcError {
+    /// Related request when parsing reached it.
+    pub request_id: Option<RequestId>,
+    /// Machine-readable failure class.
+    pub kind: ProtocolErrorKind,
+    /// Bounded user-safe explanation.
+    pub message: HumanMessage,
+    /// Diagnostic catalog reference.
+    pub finding_id: FindingId,
+}
+
+/// Contradiction-free atomic lease outcome.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "outcome", content = "detail")]
+pub enum LeaseResult {
+    /// Every requested resource was granted.
+    #[serde(rename = "granted")]
+    Granted(LeaseGrant),
+    /// Another client owns at least one requested resource; none were granted.
+    #[serde(rename = "conflict")]
+    Conflict(LeaseConflict),
+    /// The request failed without granting any resource.
+    #[serde(rename = "rejected")]
+    Rejected(LeaseRejection),
+}
+
+/// Contradiction-free current, terminal, or unavailable transaction outcome.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "outcome", content = "detail")]
+pub enum TransactionResult {
+    /// The transaction has not reached a terminal state.
+    #[serde(rename = "progress")]
+    Progress(TransactionProgress),
+    /// The immutable terminal outcome is retained.
+    #[serde(rename = "terminal")]
+    Terminal(TransactionTerminal),
+    /// No retained outcome can answer this lookup.
+    #[serde(rename = "unavailable")]
+    Unavailable(TransactionUnavailable),
+}
+
+/// Contradiction-free viewer-specific controller ownership.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "state", content = "detail")]
+pub enum ControllerOwnership {
+    /// No application currently owns the controller.
+    #[serde(rename = "unowned")]
+    Unowned(UnownedController),
+    /// The requesting client owns the controller.
+    #[serde(rename = "owned-by-viewer")]
+    OwnedByViewer(ViewerOwnedController),
+    /// Another application client owns the controller.
+    #[serde(rename = "owned-by-other")]
+    OwnedByOther(OtherOwnedController),
+}
+
+/// Contradiction-free native transport certainty and response.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "certainty", content = "detail")]
+pub enum NativeExchangeResult {
+    /// The request is safe to retry with a new identity.
+    #[serde(rename = "not-sent")]
+    NotSent(NativeExchangeNotSent),
+    /// Automatic retry is forbidden because SET delivery is uncertain.
+    #[serde(rename = "may-have-been-sent")]
+    MayHaveBeenSent(NativeExchangeUncertain),
+    /// The exact matching response was retained.
+    #[serde(rename = "matched-response")]
+    MatchedResponse(NativeExchangeMatchedResponse),
+}
+
+/// Unnegotiated request envelope used only for the handshake.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct NegotiationRequestEnvelope {
+    pub request_id: RequestId,
+    pub params: ClientHello,
+}
+
+/// Request envelope bound to one negotiated bridge connection.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SessionRequestEnvelope<T> {
+    pub request_id: RequestId,
+    pub protocol_session_id: ProtocolSessionId,
+    pub negotiation_token: NegotiationToken,
+    pub params: T,
+}
+
+/// Typed request envelope; arbitrary method strings or parameters are impossible.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "method", content = "request")]
+pub enum RpcRequest {
+    #[serde(rename = "negotiate")]
+    Negotiate(NegotiationRequestEnvelope),
+    #[serde(rename = "snapshot")]
+    Snapshot(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "integration-view")]
+    IntegrationView(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "acquire-lease")]
+    AcquireLease(SessionRequestEnvelope<LeaseRequest>),
+    #[serde(rename = "renew-lease")]
+    RenewLease(SessionRequestEnvelope<RenewLeaseRequest>),
+    #[serde(rename = "release-lease")]
+    ReleaseLease(SessionRequestEnvelope<ReleaseLeaseRequest>),
+    #[serde(rename = "submit-transaction")]
+    SubmitTransaction(SessionRequestEnvelope<TransactionRequest>),
+    #[serde(rename = "transaction-outcome")]
+    TransactionOutcome(SessionRequestEnvelope<TransactionLookup>),
+    #[serde(rename = "subscribe")]
+    Subscribe(SessionRequestEnvelope<SubscriptionRequest>),
+    #[serde(rename = "diagnostics")]
+    Diagnostics(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "native-enumerate")]
+    NativeEnumerate(SessionRequestEnvelope<EmptyRequest>),
+    #[serde(rename = "native-transact")]
+    NativeTransact(SessionRequestEnvelope<NativeExchangeRequest>),
+    #[serde(rename = "native-watch")]
+    NativeWatch(SessionRequestEnvelope<SubscriptionRequest>),
+}
+
+/// Successful method response bound to the serving bridge instance.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct SuccessEnvelope<T> {
+    pub request_id: RequestId,
+    pub server_instance_id: ServerInstanceId,
+    pub result: T,
+}
+
+/// Structured error response bound to the serving bridge instance.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct ErrorEnvelope {
+    pub request_id: Option<RequestId>,
+    pub server_instance_id: ServerInstanceId,
+    pub error: RpcError,
+}
+
+/// Typed success-or-error response envelope.
+#[derive(Clone, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+#[serde(tag = "type", content = "response")]
+pub enum RpcResponse {
+    #[serde(rename = "negotiate-success")]
+    NegotiateSuccess(SuccessEnvelope<ServerHello>),
+    #[serde(rename = "snapshot-success")]
+    SnapshotSuccess(SuccessEnvelope<BridgeSnapshot>),
+    #[serde(rename = "integration-view-success")]
+    IntegrationViewSuccess(SuccessEnvelope<IntegrationView>),
+    #[serde(rename = "acquire-lease-success")]
+    AcquireLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "renew-lease-success")]
+    RenewLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "release-lease-success")]
+    ReleaseLeaseSuccess(SuccessEnvelope<LeaseResult>),
+    #[serde(rename = "submit-transaction-success")]
+    SubmitTransactionSuccess(SuccessEnvelope<TransactionResult>),
+    #[serde(rename = "transaction-outcome-success")]
+    TransactionOutcomeSuccess(SuccessEnvelope<TransactionResult>),
+    #[serde(rename = "subscribe-success")]
+    SubscribeSuccess(SuccessEnvelope<EventBatch>),
+    #[serde(rename = "diagnostics-success")]
+    DiagnosticsSuccess(SuccessEnvelope<DiagnosticSnapshot>),
+    #[serde(rename = "native-enumerate-success")]
+    NativeEnumerateSuccess(SuccessEnvelope<NativeRouteInventory>),
+    #[serde(rename = "native-transact-success")]
+    NativeTransactSuccess(SuccessEnvelope<NativeExchangeOutcome>),
+    #[serde(rename = "native-watch-success")]
+    NativeWatchSuccess(SuccessEnvelope<NativeRouteEventBatch>),
+    #[serde(rename = "error")]
+    Error(ErrorEnvelope),
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct MethodDescriptor {
+    pub name: &'static str,
+    pub request: &'static str,
+    pub response: &'static str,
+    pub required_feature: Option<&'static str>,
+}
+
+pub const METHODS: &[MethodDescriptor] = &[
+    MethodDescriptor {
+        name: "negotiate",
+        request: "ClientHello",
+        response: "ServerHello",
+        required_feature: None,
+    },
+    MethodDescriptor {
+        name: "snapshot",
+        request: "EmptyRequest",
+        response: "BridgeSnapshot",
+        required_feature: None,
+    },
+    MethodDescriptor {
+        name: "integration-view",
+        request: "EmptyRequest",
+        response: "IntegrationView",
+        required_feature: Some("integration-view-projection"),
+    },
+    MethodDescriptor {
+        name: "acquire-lease",
+        request: "LeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "renew-lease",
+        request: "RenewLeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "release-lease",
+        request: "ReleaseLeaseRequest",
+        response: "LeaseResult",
+        required_feature: Some("ownership-leases"),
+    },
+    MethodDescriptor {
+        name: "submit-transaction",
+        request: "TransactionRequest",
+        response: "TransactionResult",
+        required_feature: Some("atomic-transactions"),
+    },
+    MethodDescriptor {
+        name: "transaction-outcome",
+        request: "TransactionLookup",
+        response: "TransactionResult",
+        required_feature: Some("atomic-transactions"),
+    },
+    MethodDescriptor {
+        name: "subscribe",
+        request: "SubscriptionRequest",
+        response: "EventBatch",
+        required_feature: Some("event-subscriptions"),
+    },
+    MethodDescriptor {
+        name: "diagnostics",
+        request: "EmptyRequest",
+        response: "DiagnosticSnapshot",
+        required_feature: Some("structured-diagnostics"),
+    },
+    MethodDescriptor {
+        name: "native-enumerate",
+        request: "EmptyRequest",
+        response: "NativeRouteInventory",
+        required_feature: Some("native-receiver-tunnel"),
+    },
+    MethodDescriptor {
+        name: "native-transact",
+        request: "NativeExchangeRequest",
+        response: "NativeExchangeOutcome",
+        required_feature: Some("native-receiver-tunnel"),
+    },
+    MethodDescriptor {
+        name: "native-watch",
+        request: "SubscriptionRequest",
+        response: "NativeRouteEventBatch",
+        required_feature: Some("native-receiver-tunnel"),
+    },
+];
+
+impl RpcRequest {
+    /// Returns the request identity carried by every method envelope.
+    #[must_use]
+    pub fn request_id(&self) -> &RequestId {
+        match self {
+            Self::Negotiate(envelope) => &envelope.request_id,
+            Self::Snapshot(envelope)
+            | Self::IntegrationView(envelope)
+            | Self::Diagnostics(envelope)
+            | Self::NativeEnumerate(envelope) => &envelope.request_id,
+            Self::AcquireLease(envelope) => &envelope.request_id,
+            Self::RenewLease(envelope) => &envelope.request_id,
+            Self::ReleaseLease(envelope) => &envelope.request_id,
+            Self::SubmitTransaction(envelope) => &envelope.request_id,
+            Self::TransactionOutcome(envelope) => &envelope.request_id,
+            Self::Subscribe(envelope) | Self::NativeWatch(envelope) => &envelope.request_id,
+            Self::NativeTransact(envelope) => &envelope.request_id,
+        }
+    }
+
+    /// Returns the generated descriptor for this request variant.
+    #[must_use]
+    pub const fn method_descriptor(&self) -> &'static MethodDescriptor {
+        match self {
+            Self::Negotiate(_) => &METHODS[0],
+            Self::Snapshot(_) => &METHODS[1],
+            Self::IntegrationView(_) => &METHODS[2],
+            Self::AcquireLease(_) => &METHODS[3],
+            Self::RenewLease(_) => &METHODS[4],
+            Self::ReleaseLease(_) => &METHODS[5],
+            Self::SubmitTransaction(_) => &METHODS[6],
+            Self::TransactionOutcome(_) => &METHODS[7],
+            Self::Subscribe(_) => &METHODS[8],
+            Self::Diagnostics(_) => &METHODS[9],
+            Self::NativeEnumerate(_) => &METHODS[10],
+            Self::NativeTransact(_) => &METHODS[11],
+            Self::NativeWatch(_) => &METHODS[12],
+        }
+    }
+
+    /// Returns negotiated connection credentials for session-bound methods.
+    #[must_use]
+    pub fn session_credentials(&self) -> Option<(&ProtocolSessionId, &NegotiationToken)> {
+        match self {
+            Self::Negotiate(_) => None,
+            Self::Snapshot(envelope)
+            | Self::IntegrationView(envelope)
+            | Self::Diagnostics(envelope)
+            | Self::NativeEnumerate(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::AcquireLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::RenewLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::ReleaseLease(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::SubmitTransaction(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::TransactionOutcome(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::Subscribe(envelope) | Self::NativeWatch(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+            Self::NativeTransact(envelope) => {
+                Some((&envelope.protocol_session_id, &envelope.negotiation_token))
+            }
+        }
+    }
+}
+
+impl RpcResponse {
+    /// Returns the request identity carried by the response envelope.
+    #[must_use]
+    pub fn request_id(&self) -> Option<&RequestId> {
+        match self {
+            Self::NegotiateSuccess(envelope) => Some(&envelope.request_id),
+            Self::SnapshotSuccess(envelope) => Some(&envelope.request_id),
+            Self::IntegrationViewSuccess(envelope) => Some(&envelope.request_id),
+            Self::AcquireLeaseSuccess(envelope)
+            | Self::RenewLeaseSuccess(envelope)
+            | Self::ReleaseLeaseSuccess(envelope) => Some(&envelope.request_id),
+            Self::SubmitTransactionSuccess(envelope)
+            | Self::TransactionOutcomeSuccess(envelope) => Some(&envelope.request_id),
+            Self::SubscribeSuccess(envelope) => Some(&envelope.request_id),
+            Self::DiagnosticsSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeEnumerateSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeTransactSuccess(envelope) => Some(&envelope.request_id),
+            Self::NativeWatchSuccess(envelope) => Some(&envelope.request_id),
+            Self::Error(envelope) => envelope.request_id.as_ref(),
+        }
+    }
+
+    /// Returns the bridge process identity carried by the response envelope.
+    #[must_use]
+    pub fn server_instance_id(&self) -> &ServerInstanceId {
+        match self {
+            Self::NegotiateSuccess(envelope) => &envelope.server_instance_id,
+            Self::SnapshotSuccess(envelope) => &envelope.server_instance_id,
+            Self::IntegrationViewSuccess(envelope) => &envelope.server_instance_id,
+            Self::AcquireLeaseSuccess(envelope)
+            | Self::RenewLeaseSuccess(envelope)
+            | Self::ReleaseLeaseSuccess(envelope) => &envelope.server_instance_id,
+            Self::SubmitTransactionSuccess(envelope)
+            | Self::TransactionOutcomeSuccess(envelope) => &envelope.server_instance_id,
+            Self::SubscribeSuccess(envelope) => &envelope.server_instance_id,
+            Self::DiagnosticsSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeEnumerateSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeTransactSuccess(envelope) => &envelope.server_instance_id,
+            Self::NativeWatchSuccess(envelope) => &envelope.server_instance_id,
+            Self::Error(envelope) => &envelope.server_instance_id,
+        }
+    }
+}
diff --git a/crates/hfx-protocol/src/generated_versions.rs b/crates/hfx-protocol/src/generated_versions.rs
index 5c016b4..5a48be4 100644
--- a/crates/hfx-protocol/src/generated_versions.rs
+++ b/crates/hfx-protocol/src/generated_versions.rs
@@ -13,6 +13,8 @@ pub mod v4;
 pub mod v5;
 #[path = "generated_v6.rs"]
 pub mod v6;
+#[path = "generated_v7.rs"]
+pub mod v7;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct ProtocolVersionDescriptor {
@@ -22,7 +24,7 @@ pub struct ProtocolVersionDescriptor {
     pub served_features: &'static [&'static str],
 }
 
-pub const CURRENT_PROTOCOL_VERSION: u16 = 6;
+pub const CURRENT_PROTOCOL_VERSION: u16 = 7;
 pub const GENERATED_PROTOCOL_VERSIONS: &[ProtocolVersionDescriptor] = &[
     ProtocolVersionDescriptor {
         version: 1,
@@ -104,4 +106,21 @@ pub const GENERATED_PROTOCOL_VERSIONS: &[ProtocolVersionDescriptor] = &[
             "structured-diagnostics",
         ],
     },
+    ProtocolVersionDescriptor {
+        version: 7,
+        catalog_sha256: "39443b1babed1e7f94824dcb3379f9572563263592841fda21378c14aff3bd34",
+        catalog_features: v7::SUPPORTED_FEATURES,
+        served_features: &[
+            "atomic-transactions",
+            "event-subscriptions",
+            "integration-view-projection",
+            "native-receiver-tunnel",
+            "ownership-leases",
+            "profile-bound-transactions",
+            "return-lifecycle-projection",
+            "semantic-stable-lighting",
+            "snapshot-profile-bindings",
+            "structured-diagnostics",
+        ],
+    },
 ];
diff --git a/crates/hfx-protocol/src/wire.rs b/crates/hfx-protocol/src/wire.rs
index f3e1018..e11e84f 100644
--- a/crates/hfx-protocol/src/wire.rs
+++ b/crates/hfx-protocol/src/wire.rs
@@ -3,16 +3,18 @@
 use crate::{
     CURRENT_PROTOCOL_VERSION, ControllerOwnership, ControllerView, DeviceInventoryView,
     DiagnosticSnapshot, EndpointSnapshot, EventBatch, IntegrationReceiverView, IntegrationView,
-    LeaseResult, MAX_WIRE_MESSAGE_BYTES, ProtocolValidationError, RpcRequest, RpcResponse,
-    SnapshotValidationError, StableLightingIntent, TransactionResult, TransactionTerminal,
-    TransactionUnavailable, v1, v2, v3, v4, v5, v6, validate_bridge_snapshot,
-    validate_lease_request, validate_transaction,
+    LeaseResult, MAX_WIRE_MESSAGE_BYTES, NativeExchangeOutcome, NativeExchangeRequest,
+    NativeExchangeResult, NativeRoute, NativeRouteEventBatch, NativeRouteInventory,
+    ProtocolValidationError, RpcRequest, RpcResponse, SnapshotValidationError,
+    StableLightingIntent, TransactionResult, TransactionTerminal, TransactionUnavailable, v1, v2,
+    v3, v4, v5, v6, v7, validate_bridge_snapshot, validate_lease_request, validate_transaction,
 };
 use hfx_domain::{
-    ConnectionMode, ControllerAvailability, FreshnessState, InventoryAvailability, PairingState,
-    PowerState, PresenceState, ProtocolErrorKind, ProtocolVersion, ReceiverLifecycleState,
-    ResourceKind, RouteKind, RouteState, SideEffectCertainty, SleepState, StableLightingMode,
-    TransactionClass, TransactionState,
+    ConnectionMode, ControllerAvailability, FreshnessState, InventoryAvailability,
+    NativeRouteAccess, NativeRouteEventKind, PairingState, PowerState, PresenceState,
+    ProtocolErrorKind, ProtocolVersion, ReceiverLifecycleState, ResourceKind, RouteKind,
+    RouteState, SideEffectCertainty, SleepState, StableLightingMode, TransactionClass,
+    TransactionState,
 };
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::Value;
@@ -212,6 +214,194 @@ fn strictly_ordered<T: Ord>(values: &[T]) -> bool {
     values.windows(2).all(|pair| pair[0] < pair[1])
 }
 
+fn native_report_is_canonical(value: &str) -> bool {
+    value
+        .bytes()
+        .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte))
+}
+
+fn native_route_identity_precedes(left: &NativeRoute, right: &NativeRoute) -> bool {
+    (
+        &left.receiver_id,
+        left.generation_id,
+        &left.device_id,
+        &left.endpoint_id,
+    ) < (
+        &right.receiver_id,
+        right.generation_id,
+        &right.device_id,
+        &right.endpoint_id,
+    )
+}
+
+fn validate_native_route(route: &NativeRoute) -> Result<(), ProtocolWireError> {
+    let writable =
+        route.access == NativeRouteAccess::Qualified && route.route_state == RouteState::Available;
+    if writable != route.route_token.is_some() || writable != route.resource.is_some() {
+        return Err(ProtocolWireError::InvalidResponse(
+            "native route authority contradicts access or availability",
+        ));
+    }
+    if !writable {
+        return Ok(());
+    }
+
+    let Some(resource) = &route.resource else {
+        return Err(ProtocolWireError::InvalidResponse(
+            "writable native route lacks its ownership resource",
+        ));
+    };
+    if resource.receiver_id != route.receiver_id
+        || resource.generation_id != route.generation_id
+        || resource.device_id != route.device_id
+        || resource.kind != ResourceKind::NativeControl
+        || usize::from(route.report_bytes.get()).saturating_mul(2)
+            != hfx_domain::NativeReportHex::MIN_LENGTH
+    {
+        return Err(ProtocolWireError::InvalidResponse(
+            "writable native route contradicts identity, resource, or report shape",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_native_route_inventory(
+    inventory: &NativeRouteInventory,
+) -> Result<(), ProtocolWireError> {
+    if inventory.routes.len() > 32
+        || !inventory
+            .routes
+            .windows(2)
+            .all(|pair| native_route_identity_precedes(&pair[0], &pair[1]))
+    {
+        return Err(ProtocolWireError::InvalidResponse(
+            "native routes are oversized, duplicated, or unordered",
+        ));
+    }
+    for route in &inventory.routes {
+        validate_native_route(route)?;
+    }
+    Ok(())
+}
+
+fn validate_native_exchange_request(
+    envelope_request_id: &hfx_domain::RequestId,
+    request: &NativeExchangeRequest,
+) -> Result<(), ProtocolWireError> {
+    if envelope_request_id != &request.request_id {
+        return Err(ProtocolWireError::RequestNotCanonical);
+    }
+    if !native_report_is_canonical(request.report.as_str()) {
+        return Err(ProtocolWireError::RequestNotCanonical);
+    }
+    Ok(())
+}
+
+fn validate_native_exchange_outcome(
+    outcome: &NativeExchangeOutcome,
+) -> Result<(), ProtocolWireError> {
+    if let NativeExchangeResult::MatchedResponse(response) = &outcome.result
+        && !native_report_is_canonical(response.response.as_str())
+    {
+        return Err(ProtocolWireError::InvalidResponse(
+            "native response report is not canonical lowercase hexadecimal",
+        ));
+    }
+    Ok(())
+}
+
+fn validate_native_route_event_batch(
+    batch: &NativeRouteEventBatch,
+) -> Result<(), ProtocolWireError> {
+    if batch.events.len() > 256
+        || batch.oldest_available > batch.latest_available
+        || !batch
+            .events
+            .windows(2)
+            .all(|pair| pair[0].sequence < pair[1].sequence)
+        || batch.events.iter().any(|event| {
+            event.sequence < batch.oldest_available
+                || event.sequence > batch.latest_available
+                || matches!(event.kind, NativeRouteEventKind::Available)
+                    != (event.route.route_state == RouteState::Available)
+        })
+        || batch
+            .events
+            .last()
+            .is_some_and(|event| event.sequence != batch.next_cursor.sequence)
+        || (batch.cursor_gap && (!batch.events.is_empty() || batch.has_more))
+        || (batch.has_more && batch.next_cursor.sequence >= batch.latest_available)
+    {
+        return Err(ProtocolWireError::InvalidResponse(
+            "native route event cursor, sequence, or transition facts contradict",
+        ));
+    }
+    for event in &batch.events {
+        validate_native_route(&event.route)?;
+    }
+    Ok(())
+}
+
+fn request_requires_v7(request: &RpcRequest) -> bool {
+    match request {
+        RpcRequest::NativeEnumerate(_)
+        | RpcRequest::NativeTransact(_)
+        | RpcRequest::NativeWatch(_) => true,
+        RpcRequest::AcquireLease(envelope) => envelope
+            .params
+            .resources
+            .iter()
+            .any(|resource| resource.kind == ResourceKind::NativeControl),
+        RpcRequest::SubmitTransaction(envelope) => envelope
+            .params
+            .resources
+            .iter()
+            .any(|resource| resource.kind == ResourceKind::NativeControl),
+        RpcRequest::Negotiate(_)
+        | RpcRequest::Snapshot(_)
+        | RpcRequest::IntegrationView(_)
+        | RpcRequest::RenewLease(_)
+        | RpcRequest::ReleaseLease(_)
+        | RpcRequest::TransactionOutcome(_)
+        | RpcRequest::Subscribe(_)
+        | RpcRequest::Diagnostics(_) => false,
+    }
+}
+
+fn lease_result_uses_native_control(result: &LeaseResult) -> bool {
+    match result {
+        LeaseResult::Granted(grant) => grant
+            .resources
+            .iter()
+            .any(|resource| resource.kind == ResourceKind::NativeControl),
+        LeaseResult::Conflict(conflict) => {
+            conflict.conflicting_resource.kind == ResourceKind::NativeControl
+        }
+        LeaseResult::Rejected(_) => false,
+    }
+}
+
+fn response_requires_v7(response: &RpcResponse) -> bool {
+    match response {
+        RpcResponse::NativeEnumerateSuccess(_)
+        | RpcResponse::NativeTransactSuccess(_)
+        | RpcResponse::NativeWatchSuccess(_) => true,
+        RpcResponse::AcquireLeaseSuccess(envelope)
+        | RpcResponse::RenewLeaseSuccess(envelope)
+        | RpcResponse::ReleaseLeaseSuccess(envelope) => {
+            lease_result_uses_native_control(&envelope.result)
+        }
+        RpcResponse::NegotiateSuccess(_)
+        | RpcResponse::SnapshotSuccess(_)
+        | RpcResponse::IntegrationViewSuccess(_)
+        | RpcResponse::SubmitTransactionSuccess(_)
+        | RpcResponse::TransactionOutcomeSuccess(_)
+        | RpcResponse::SubscribeSuccess(_)
+        | RpcResponse::DiagnosticsSuccess(_)
+        | RpcResponse::Error(_) => false,
+    }
+}
+
 /// Validates method-specific request bounds after bounded decoding.
 ///
 /// # Errors
@@ -241,13 +431,18 @@ pub fn validate_rpc_request(request: &RpcRequest) -> Result<(), ProtocolWireErro
         RpcRequest::SubmitTransaction(envelope) => {
             validate_transaction(&envelope.params).map_err(ProtocolWireError::InvalidRequest)
         }
+        RpcRequest::NativeTransact(envelope) => {
+            validate_native_exchange_request(&envelope.request_id, &envelope.params)
+        }
         RpcRequest::Snapshot(_)
         | RpcRequest::IntegrationView(_)
         | RpcRequest::RenewLease(_)
         | RpcRequest::ReleaseLease(_)
         | RpcRequest::TransactionOutcome(_)
         | RpcRequest::Subscribe(_)
-        | RpcRequest::Diagnostics(_) => Ok(()),
+        | RpcRequest::Diagnostics(_)
+        | RpcRequest::NativeEnumerate(_)
+        | RpcRequest::NativeWatch(_) => Ok(()),
     }
 }
 
@@ -626,6 +821,15 @@ pub fn validate_rpc_response(response: &RpcResponse) -> Result<(), ProtocolWireE
         }
         RpcResponse::SubscribeSuccess(envelope) => validate_event_batch(&envelope.result),
         RpcResponse::DiagnosticsSuccess(envelope) => validate_diagnostics(&envelope.result),
+        RpcResponse::NativeEnumerateSuccess(envelope) => {
+            validate_native_route_inventory(&envelope.result)
+        }
+        RpcResponse::NativeTransactSuccess(envelope) => {
+            validate_native_exchange_outcome(&envelope.result)
+        }
+        RpcResponse::NativeWatchSuccess(envelope) => {
+            validate_native_route_event_batch(&envelope.result)
+        }
         RpcResponse::Error(_) => Ok(()),
     }
 }
@@ -671,6 +875,9 @@ fn encode_rpc_request_version(
     version: u16,
 ) -> Result<Vec<u8>, ProtocolWireError> {
     validate_rpc_request(request)?;
+    if version < 7 && request_requires_v7(request) {
+        return Err(ProtocolWireError::UnsupportedVersionMethod);
+    }
     if version < 5 && matches!(request, RpcRequest::IntegrationView(_)) {
         return Err(ProtocolWireError::UnsupportedVersionMethod);
     }
@@ -701,6 +908,7 @@ fn encode_rpc_request_version(
         4 => frozen_encoding::<v4::RpcRequest>(value),
         5 => frozen_encoding::<v5::RpcRequest>(value),
         6 => frozen_encoding::<v6::RpcRequest>(value),
+        7 => frozen_encoding::<v7::RpcRequest>(value),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
@@ -722,15 +930,20 @@ pub fn decode_rpc_request_for_version(
 }
 
 fn decode_rpc_request_version(bytes: &[u8], version: u16) -> Result<RpcRequest, ProtocolWireError> {
-    match version {
+    let request = match version {
         1 => normalize_v1_request(decode::<v1::RpcRequest>(bytes)?),
         2 => normalize_v2_request(decode::<v2::RpcRequest>(bytes)?),
         3 => transcode_request(decode::<v3::RpcRequest>(bytes)?),
         4 => transcode_request(decode::<v4::RpcRequest>(bytes)?),
         5 => transcode_request(decode::<v5::RpcRequest>(bytes)?),
         6 => transcode_request(decode::<v6::RpcRequest>(bytes)?),
+        7 => transcode_request(decode::<v7::RpcRequest>(bytes)?),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
+    }?;
+    if version < 7 && request_requires_v7(&request) {
+        return Err(ProtocolWireError::UnsupportedVersionMethod);
     }
+    Ok(request)
 }
 
 /// Decodes one bounded typed response and enforces projection invariants.
@@ -761,15 +974,20 @@ fn decode_rpc_response_version(
     bytes: &[u8],
     version: u16,
 ) -> Result<RpcResponse, ProtocolWireError> {
-    match version {
+    let response = match version {
         1 => transcode_response(decode::<v1::RpcResponse>(bytes)?),
         2 => transcode_response(decode::<v2::RpcResponse>(bytes)?),
         3 => transcode_response(decode::<v3::RpcResponse>(bytes)?),
         4 => transcode_response(decode::<v4::RpcResponse>(bytes)?),
         5 => transcode_response(decode::<v5::RpcResponse>(bytes)?),
         6 => transcode_response(decode::<v6::RpcResponse>(bytes)?),
+        7 => transcode_response(decode::<v7::RpcResponse>(bytes)?),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
+    }?;
+    if version < 7 && response_requires_v7(&response) {
+        return Err(ProtocolWireError::UnsupportedVersionMethod);
     }
+    Ok(response)
 }
 
 /// Encodes one current response after enforcing response invariants.
@@ -800,6 +1018,9 @@ fn encode_rpc_response_version(
     version: u16,
 ) -> Result<Vec<u8>, ProtocolWireError> {
     validate_rpc_response(response)?;
+    if version < 7 && response_requires_v7(response) {
+        return Err(ProtocolWireError::UnsupportedVersionMethod);
+    }
     if version < 5 && matches!(response, RpcResponse::IntegrationViewSuccess(_)) {
         return Err(ProtocolWireError::UnsupportedVersionMethod);
     }
@@ -808,6 +1029,9 @@ fn encode_rpc_response_version(
     if version < 6 {
         remove_return_epochs(response, &mut value)?;
     }
+    if version < 7 {
+        remove_native_control_snapshot_ownership(response, &mut value)?;
+    }
     match version {
         1 => {
             remove_snapshot_profile_bindings(response, &mut value)?;
@@ -824,10 +1048,46 @@ fn encode_rpc_response_version(
         4 => frozen_encoding::<v4::RpcResponse>(value),
         5 => frozen_encoding::<v5::RpcResponse>(value),
         6 => frozen_encoding::<v6::RpcResponse>(value),
+        7 => frozen_encoding::<v7::RpcResponse>(value),
         _ => Err(ProtocolWireError::UnsupportedProtocolVersion),
     }
 }
 
+fn remove_native_control_snapshot_ownership(
+    response: &RpcResponse,
+    value: &mut Value,
+) -> Result<(), ProtocolWireError> {
+    if !matches!(response, RpcResponse::SnapshotSuccess(_)) {
+        return Ok(());
+    }
+    let receivers = value
+        .as_object_mut()
+        .and_then(|root| root.get_mut("response"))
+        .and_then(Value::as_object_mut)
+        .and_then(|response| response.get_mut("result"))
+        .and_then(Value::as_object_mut)
+        .and_then(|result| result.get_mut("receivers"))
+        .and_then(Value::as_array_mut)
+        .ok_or(ProtocolWireError::VersionTranslation)?;
+    for receiver in receivers {
+        let ownership = receiver
+            .as_object_mut()
+            .and_then(|receiver| receiver.get_mut("ownership"))
+            .and_then(Value::as_array_mut)
+            .ok_or(ProtocolWireError::VersionTranslation)?;
+        ownership.retain(|entry| {
+            entry
+                .as_object()
+                .and_then(|entry| entry.get("resource"))
+                .and_then(Value::as_object)
+                .and_then(|resource| resource.get("kind"))
+                .and_then(Value::as_str)
+                != Some("native-control")
+        });
+    }
+    Ok(())
+}
+
 fn remove_return_epochs(
     response: &RpcResponse,
     value: &mut Value,
diff --git a/crates/hfx-protocol/tests/protocol.rs b/crates/hfx-protocol/tests/protocol.rs
index a3c7b5d..2e7c97d 100644
--- a/crates/hfx-protocol/tests/protocol.rs
+++ b/crates/hfx-protocol/tests/protocol.rs
@@ -160,13 +160,27 @@ fn feature_negotiation_selects_intersection_and_rejects_incompatible_versions()
             .contains(&value("integration-view-projection"))
     );
 
-    let incompatible = ClientHello {
+    let v7 = ClientHello {
         minimum_version: number(7),
         maximum_version: number(7),
+        required_features: vec![value("native-receiver-tunnel")],
         ..v5
     };
+    let response = negotiate(&v7, context("protocol-session-7")).expect("v7 overlaps");
+    assert_eq!(response.selected_version.get(), 7);
+    assert!(
+        response
+            .enabled_features
+            .contains(&value("native-receiver-tunnel"))
+    );
+
+    let incompatible = ClientHello {
+        minimum_version: number(8),
+        maximum_version: number(8),
+        ..v7
+    };
     assert_eq!(
-        negotiate(&incompatible, context("protocol-session-7")),
+        negotiate(&incompatible, context("protocol-session-8")),
         Err(NegotiationError::IncompatibleVersion)
     );
 }
diff --git a/crates/hfx-protocol/tests/wire_and_snapshot.rs b/crates/hfx-protocol/tests/wire_and_snapshot.rs
index 14c602e..9afa2fa 100644
--- a/crates/hfx-protocol/tests/wire_and_snapshot.rs
+++ b/crates/hfx-protocol/tests/wire_and_snapshot.rs
@@ -3,22 +3,27 @@
 use hfx_domain::{
     ActivityState, BatteryPercent, ClientId, ClientName, ColorChannel, ConnectionMode,
     ContactState, ControllerAvailability, DeviceKind, EvidenceConfidence, FreshnessState,
-    GenerationId, InventoryAvailability, LedCount, ModelName, MonotonicMs, PairingState,
-    PowerState, PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
+    GenerationId, InventoryAvailability, LeaseDurationMs, LedCount, ModelName, MonotonicMs,
+    NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, PairingState, PowerState,
+    PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
     ReceiverLifecycleState, ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence,
     ReturnPhase, RouteKind, RouteState, SequenceNumber, SleepState, StableLightingMode,
-    StreamEpoch, SupportLevel, TelemetryAvailability, TransactionClass,
+    StreamEpoch, SupportLevel, TelemetryAvailability, TransactionClass, VendorId,
 };
 use hfx_protocol::{
     BatteryObservation, BridgeSnapshot, ClientHello, ControllerActions, ControllerOwnership,
     ControllerView, DeviceInventoryView, EmptyRequest, EndpointSnapshot, EventCursor,
-    IntegrationReceiverView, IntegrationView, LightingTopologyView, LogicalDeviceSnapshot,
-    MAX_WIRE_MESSAGE_BYTES, NegotiationRequestEnvelope, PresentationView, ProfileBindingView,
-    ProtocolWireError, ReceiverSnapshot, ResourceKey, ReturnEpoch, RpcRequest, RpcResponse,
-    SessionRequestEnvelope, SnapshotValidationError, SuccessEnvelope, UnownedController,
-    decode_rpc_request, decode_rpc_request_for_version, decode_rpc_response,
-    decode_rpc_response_for_version, encode_rpc_request_for_version,
-    encode_rpc_response_for_version, validate_bridge_snapshot, validate_rpc_response_for_version,
+    IntegrationReceiverView, IntegrationView, LeaseRequest, LightingTopologyView,
+    LogicalDeviceSnapshot, MAX_WIRE_MESSAGE_BYTES, NativeExchangeMatchedResponse,
+    NativeExchangeOutcome, NativeExchangeRequest, NativeExchangeResult, NativeRoute,
+    NativeRouteEvent, NativeRouteEventBatch, NativeRouteInventory, NegotiationRequestEnvelope,
+    PresentationView, ProfileBindingView, ProtocolWireError, ReceiverSnapshot, ResourceKey,
+    ResourceOwnershipSnapshot, ReturnEpoch, RpcRequest, RpcResponse, SessionRequestEnvelope,
+    SnapshotValidationError, SuccessEnvelope, UnownedController, decode_rpc_request,
+    decode_rpc_request_for_version, decode_rpc_response, decode_rpc_response_for_version,
+    encode_rpc_request_for_version, encode_rpc_response_for_version, validate_bridge_snapshot,
+    validate_rpc_response_for_version,
 };
 use serde_json::{Value, json};
 
@@ -46,6 +51,46 @@ fn cursor() -> EventCursor {
     }
 }
 
+fn native_route(access: NativeRouteAccess, route_state: RouteState) -> NativeRoute {
+    let writable = access == NativeRouteAccess::Qualified && route_state == RouteState::Available;
+    NativeRoute {
+        receiver_id: text("receiver-1"),
+        generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
+        device_id: text("mouse-1"),
+        endpoint_id: text("endpoint-hyperflux"),
+        device_kind: DeviceKind::Mouse,
+        vendor_id: VendorId::try_from(0x1532_u16).expect("vendor id is valid"),
+        product_id: ProductId::try_from(0x00cd_u16).expect("product id is valid"),
+        route_state,
+        access,
+        protocol_family: text::<NativeProtocolFamily>("razer-feature-report-v1"),
+        report_bytes: number::<NativeReportByteCount>(90),
+        route_token: writable.then(|| text::<NativeRouteToken>(&"a".repeat(64))),
+        resource: writable.then(|| ResourceKey {
+            receiver_id: text("receiver-1"),
+            generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
+            device_id: text("mouse-1"),
+            kind: ResourceKind::NativeControl,
+        }),
+    }
+}
+
+fn native_exchange_request(report: &str) -> RpcRequest {
+    RpcRequest::NativeTransact(SessionRequestEnvelope {
+        request_id: text("native-request-1"),
+        protocol_session_id: text("protocol-session-1"),
+        negotiation_token: text("negotiation-1"),
+        params: NativeExchangeRequest {
+            request_id: text("native-request-1"),
+            client_id: text("client-1"),
+            lease_id: text("native-lease-1"),
+            route_token: text::<NativeRouteToken>(&"a".repeat(64)),
+            report: text::<NativeReportHex>(report),
+            timeout_ms: number::<NativeExchangeTimeoutMs>(100),
+        },
+    })
+}
+
 fn endpoint() -> EndpointSnapshot {
     EndpointSnapshot {
         endpoint_id: text("endpoint-hyperflux"),
@@ -458,10 +503,14 @@ fn versioned_decoders_reject_changed_or_unknown_wire_shapes_instead_of_guessing(
     );
     assert_eq!(
         decode_rpc_request_for_version(&v3, number(6)),
-        Ok(normalized)
+        Ok(normalized.clone())
     );
     assert_eq!(
         decode_rpc_request_for_version(&v3, number(7)),
+        Ok(normalized)
+    );
+    assert_eq!(
+        decode_rpc_request_for_version(&v3, number(8)),
         Err(ProtocolWireError::UnsupportedProtocolVersion)
     );
 }
@@ -547,7 +596,7 @@ fn responses_are_checked_against_the_exact_negotiated_schema() {
                 server_instance_id: text("bridge-instance-1"),
                 result: snapshot(battery(TelemetryAvailability::Reported, Some(73))),
             }),
-            number(7)
+            number(8)
         ),
         Err(ProtocolWireError::UnsupportedProtocolVersion)
     );
@@ -609,3 +658,203 @@ fn return_epoch_projection_rejects_cross_record_or_false_synchronization_claims(
         Err(SnapshotValidationError::ReturnEpochContradiction)
     );
 }
+
+#[test]
+fn v7_native_exchange_round_trips_and_cannot_downgrade() {
+    let report = "00".repeat(90);
+    let request = native_exchange_request(&report);
+    let encoded = encode_rpc_request_for_version(&request, number(7))
+        .expect("canonical native request encodes in v7");
+    assert_eq!(
+        decode_rpc_request_for_version(&encoded, number(7)),
+        Ok(request.clone())
+    );
+    for version in 1_u16..=6 {
+        assert_eq!(
+            encode_rpc_request_for_version(&request, number(version)),
+            Err(ProtocolWireError::UnsupportedVersionMethod)
+        );
+    }
+
+    let response = RpcResponse::NativeTransactSuccess(SuccessEnvelope {
+        request_id: text("native-request-1"),
+        server_instance_id: text("bridge-instance-1"),
+        result: NativeExchangeOutcome {
+            request_id: text("native-request-1"),
+            route_token: text::<NativeRouteToken>(&"a".repeat(64)),
+            result: NativeExchangeResult::MatchedResponse(NativeExchangeMatchedResponse {
+                response: text::<NativeReportHex>(&"01".repeat(90)),
+            }),
+        },
+    });
+    let encoded = encode_rpc_response_for_version(&response, number(7))
+        .expect("canonical native response encodes in v7");
+    assert_eq!(
+        decode_rpc_response_for_version(&encoded, number(7)),
+        Ok(response.clone())
+    );
+    for version in 1_u16..=6 {
+        assert_eq!(
+            encode_rpc_response_for_version(&response, number(version)),
+            Err(ProtocolWireError::UnsupportedVersionMethod)
+        );
+    }
+}
+
+#[test]
+fn native_exchange_rejects_noncanonical_reports_and_request_identity_conflicts() {
+    let uppercase = native_exchange_request(&"AA".repeat(90));
+    assert_eq!(
+        encode_rpc_request_for_version(&uppercase, number(7)),
+        Err(ProtocolWireError::RequestNotCanonical)
+    );
+
+    let mut mismatched = native_exchange_request(&"00".repeat(90));
+    let RpcRequest::NativeTransact(envelope) = &mut mismatched else {
+        panic!("native request expected")
+    };
+    envelope.params.request_id = text("different-request");
+    assert_eq!(
+        encode_rpc_request_for_version(&mismatched, number(7)),
+        Err(ProtocolWireError::RequestNotCanonical)
+    );
+}
+
+#[test]
+fn native_inventory_fails_closed_on_authority_or_identity_contradictions() {
+    let valid = RpcResponse::NativeEnumerateSuccess(SuccessEnvelope {
+        request_id: text("native-enumerate-1"),
+        server_instance_id: text("bridge-instance-1"),
+        result: NativeRouteInventory {
+            cursor: cursor(),
+            routes: vec![native_route(
+                NativeRouteAccess::Qualified,
+                RouteState::Available,
+            )],
+        },
+    });
+    encode_rpc_response_for_version(&valid, number(7)).expect("qualified route is canonical");
+
+    let mut candidate_with_authority = valid.clone();
+    let RpcResponse::NativeEnumerateSuccess(envelope) = &mut candidate_with_authority else {
+        panic!("native inventory expected")
+    };
+    envelope.result.routes[0].access = NativeRouteAccess::Candidate;
+    assert!(matches!(
+        encode_rpc_response_for_version(&candidate_with_authority, number(7)),
+        Err(ProtocolWireError::InvalidResponse(_))
+    ));
+
+    let mut duplicate_identity = valid;
+    let RpcResponse::NativeEnumerateSuccess(envelope) = &mut duplicate_identity else {
+        panic!("native inventory expected")
+    };
+    envelope.result.routes.push(native_route(
+        NativeRouteAccess::Qualified,
+        RouteState::Unavailable,
+    ));
+    assert!(matches!(
+        encode_rpc_response_for_version(&duplicate_identity, number(7)),
+        Err(ProtocolWireError::InvalidResponse(_))
+    ));
+}
+
+#[test]
+fn native_route_events_require_consistent_transitions_and_cursors() {
+    let response = RpcResponse::NativeWatchSuccess(SuccessEnvelope {
+        request_id: text("native-watch-1"),
+        server_instance_id: text("bridge-instance-1"),
+        result: NativeRouteEventBatch {
+            subscription_id: text("native-subscription-1"),
+            next_cursor: EventCursor {
+                sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+                ..cursor()
+            },
+            events: vec![NativeRouteEvent {
+                sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+                kind: NativeRouteEventKind::Available,
+                route: native_route(NativeRouteAccess::Qualified, RouteState::Available),
+            }],
+            oldest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+            latest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+            dropped_events: hfx_domain::DroppedEventCount::try_from(0_u64)
+                .expect("dropped count is valid"),
+            cursor_gap: false,
+            has_more: false,
+        },
+    });
+    encode_rpc_response_for_version(&response, number(7)).expect("native event batch is valid");
+
+    let mut contradictory = response;
+    let RpcResponse::NativeWatchSuccess(envelope) = &mut contradictory else {
+        panic!("native event response expected")
+    };
+    envelope.result.events[0].kind = NativeRouteEventKind::Unavailable;
+    assert!(matches!(
+        encode_rpc_response_for_version(&contradictory, number(7)),
+        Err(ProtocolWireError::InvalidResponse(_))
+    ));
+}
+
+#[test]
+fn legacy_versions_reject_native_leases_and_hide_native_snapshot_ownership() {
+    let native_resource = ResourceKey {
+        receiver_id: text("receiver-1"),
+        generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
+        device_id: text("mouse-1"),
+        kind: ResourceKind::NativeControl,
+    };
+    let request = RpcRequest::AcquireLease(SessionRequestEnvelope {
+        request_id: text("native-lease-request"),
+        protocol_session_id: text("protocol-session-1"),
+        negotiation_token: text("negotiation-1"),
+        params: LeaseRequest {
+            request_id: text("native-lease-request"),
+            client_id: text("client-1"),
+            resources: vec![native_resource.clone()],
+            duration_ms: LeaseDurationMs::try_from(10_000_u32).expect("duration is valid"),
+        },
+    });
+    encode_rpc_request_for_version(&request, number(7)).expect("v7 native lease request is valid");
+    assert_eq!(
+        encode_rpc_request_for_version(&request, number(6)),
+        Err(ProtocolWireError::UnsupportedVersionMethod)
+    );
+    let wire = serde_json::to_vec(&request).expect("request serializes");
+    assert_eq!(
+        decode_rpc_request_for_version(&wire, number(6)),
+        Err(ProtocolWireError::UnsupportedVersionMethod)
+    );
+
+    let mut current = snapshot(battery(TelemetryAvailability::Reported, Some(73)));
+    current.receivers[0]
+        .ownership
+        .push(ResourceOwnershipSnapshot {
+            resource: native_resource,
+            client_id: text("native-client"),
+            lease_id: text("native-lease-1"),
+            expires_at_ms: MonotonicMs::try_from(100_u64).expect("time is valid"),
+        });
+    let response = RpcResponse::SnapshotSuccess(SuccessEnvelope {
+        request_id: text("snapshot-with-native-ownership"),
+        server_instance_id: text("bridge-instance-1"),
+        result: current,
+    });
+    let v7 = encode_rpc_response_for_version(&response, number(7))
+        .expect("v7 preserves native ownership");
+    let RpcResponse::SnapshotSuccess(v7) =
+        decode_rpc_response_for_version(&v7, number(7)).expect("v7 snapshot decodes")
+    else {
+        panic!("snapshot response expected")
+    };
+    assert_eq!(v7.result.receivers[0].ownership.len(), 1);
+
+    let v6 = encode_rpc_response_for_version(&response, number(6))
+        .expect("v6 snapshot safely omits native ownership");
+    let RpcResponse::SnapshotSuccess(v6) =
+        decode_rpc_response_for_version(&v6, number(6)).expect("v6 snapshot decodes")
+    else {
+        panic!("snapshot response expected")
+    };
+    assert!(v6.result.receivers[0].ownership.is_empty());
+}
diff --git a/crates/hfx-sdk/src/client.rs b/crates/hfx-sdk/src/client.rs
index e5c137d..d86451e 100644
--- a/crates/hfx-sdk/src/client.rs
+++ b/crates/hfx-sdk/src/client.rs
@@ -3,12 +3,13 @@
 use crate::{FramedIoChannel, RequestIdentitySource, SdkError, SdkMethod};
 use hfx_domain::{
     ClientId, ClientName, EventBatchLimit, GenerationId, LeaseDurationMs, LeaseId, MonotonicMs,
-    ProfileDigest, ProfileId, ProtocolFeatureId, ProtocolVersion, ReceiverId, RequestId,
-    TransactionClass, TransactionId,
+    NativeExchangeTimeoutMs, NativeReportHex, NativeRouteToken, ProfileDigest, ProfileId,
+    ProtocolFeatureId, ProtocolVersion, ReceiverId, RequestId, TransactionClass, TransactionId,
 };
 use hfx_protocol::{
     BridgeSnapshot, ClientHello, DeviceProfileBinding, DiagnosticSnapshot, EmptyRequest,
     EventBatch, EventCursor, IntegrationView, LeaseRequest, LeaseResult, LightingFrame,
+    NativeExchangeOutcome, NativeExchangeRequest, NativeRouteEventBatch, NativeRouteInventory,
     NegotiationRequestEnvelope, ReleaseLeaseRequest, RenewLeaseRequest, RpcRequest, RpcResponse,
     ServerHello, SessionRequestEnvelope, StableLightingIntent, SubscriptionRequest,
     TransactionLookup, TransactionRequest, TransactionResult,
@@ -48,6 +49,20 @@ pub struct TransactionSubmission {
     pub frames: Vec<LightingFrame>,
 }
 
+/// Exact replayable identity and payload for one native receiver exchange.
+///
+/// Keep this value unchanged until the bridge returns an outcome. Reusing it
+/// cannot issue a second receiver SET; changing any field requires a newly
+/// prepared request identity.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeExchangeSubmission {
+    pub request_id: RequestId,
+    pub lease_id: LeaseId,
+    pub route_token: NativeRouteToken,
+    pub report: NativeReportHex,
+    pub timeout_ms: NativeExchangeTimeoutMs,
+}
+
 #[derive(Debug)]
 pub struct HyperFluxClient<S, I> {
     channel: FramedIoChannel<S>,
@@ -350,6 +365,105 @@ where
         }
     }
 
+    /// Enumerates receiver-backed child routes without exposing host paths.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed local or server error. Protocol v7 and the
+    /// `native-receiver-tunnel` feature are required.
+    pub fn native_enumerate(&mut self) -> Result<NativeRouteInventory, SdkError> {
+        let request_id = self.next_request_id()?;
+        let response = self.exchange(
+            &RpcRequest::NativeEnumerate(self.envelope(request_id.clone(), EmptyRequest {})),
+            &request_id,
+        )?;
+        match response {
+            RpcResponse::NativeEnumerateSuccess(envelope) => Ok(envelope.result),
+            _ => Err(SdkError::UnexpectedResponse {
+                expected: SdkMethod::NativeEnumerate,
+            }),
+        }
+    }
+
+    /// Allocates one process-unique idempotency identity for a native exchange.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed request-identity failure without sending bytes.
+    pub fn prepare_native_exchange(
+        &mut self,
+        lease_id: LeaseId,
+        route_token: NativeRouteToken,
+        report: NativeReportHex,
+        timeout_ms: NativeExchangeTimeoutMs,
+    ) -> Result<NativeExchangeSubmission, SdkError> {
+        Ok(NativeExchangeSubmission {
+            request_id: self.next_request_id()?,
+            lease_id,
+            route_token,
+            report,
+            timeout_ms,
+        })
+    }
+
+    /// Performs one exact native exchange or returns its retained outcome.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed local or server error. The caller must reuse the exact
+    /// prepared submission after an ambiguous local I/O failure.
+    pub fn native_transact(
+        &mut self,
+        submission: &NativeExchangeSubmission,
+    ) -> Result<NativeExchangeOutcome, SdkError> {
+        let params = NativeExchangeRequest {
+            request_id: submission.request_id.clone(),
+            client_id: self.client_id.clone(),
+            lease_id: submission.lease_id.clone(),
+            route_token: submission.route_token.clone(),
+            report: submission.report.clone(),
+            timeout_ms: submission.timeout_ms,
+        };
+        let response = self.exchange(
+            &RpcRequest::NativeTransact(self.envelope(submission.request_id.clone(), params)),
+            &submission.request_id,
+        )?;
+        match response {
+            RpcResponse::NativeTransactSuccess(envelope) => Ok(envelope.result),
+            _ => Err(SdkError::UnexpectedResponse {
+                expected: SdkMethod::NativeTransact,
+            }),
+        }
+    }
+
+    /// Reads bounded native-route lifecycle transitions.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed local or server error.
+    pub fn native_watch(
+        &mut self,
+        subscription: EventSubscription,
+    ) -> Result<NativeRouteEventBatch, SdkError> {
+        let request_id = self.next_request_id()?;
+        let params = SubscriptionRequest {
+            client_id: self.client_id.clone(),
+            subscription_id: subscription.subscription_id,
+            expected_cursor: subscription.expected_cursor,
+            max_events: subscription.max_events,
+        };
+        let response = self.exchange(
+            &RpcRequest::NativeWatch(self.envelope(request_id.clone(), params)),
+            &request_id,
+        )?;
+        match response {
+            RpcResponse::NativeWatchSuccess(envelope) => Ok(envelope.result),
+            _ => Err(SdkError::UnexpectedResponse {
+                expected: SdkMethod::NativeWatch,
+            }),
+        }
+    }
+
     fn next_request_id(&mut self) -> Result<RequestId, SdkError> {
         self.identities.next_request_id().map_err(SdkError::from)
     }
diff --git a/crates/hfx-sdk/src/error.rs b/crates/hfx-sdk/src/error.rs
index 6dde399..92e92ea 100644
--- a/crates/hfx-sdk/src/error.rs
+++ b/crates/hfx-sdk/src/error.rs
@@ -16,6 +16,9 @@ pub enum SdkMethod {
     TransactionOutcome,
     Subscribe,
     Diagnostics,
+    NativeEnumerate,
+    NativeTransact,
+    NativeWatch,
 }
 
 impl SdkMethod {
@@ -31,6 +34,9 @@ impl SdkMethod {
             Self::TransactionOutcome => "transaction outcome",
             Self::Subscribe => "subscribe",
             Self::Diagnostics => "diagnostics",
+            Self::NativeEnumerate => "native route enumeration",
+            Self::NativeTransact => "native receiver exchange",
+            Self::NativeWatch => "native route watch",
         }
     }
 }
diff --git a/crates/hfx-sdk/src/lib.rs b/crates/hfx-sdk/src/lib.rs
index d26f03d..7979f5c 100644
--- a/crates/hfx-sdk/src/lib.rs
+++ b/crates/hfx-sdk/src/lib.rs
@@ -8,6 +8,9 @@ mod error;
 mod identity;
 
 pub use channel::FramedIoChannel;
-pub use client::{EventSubscription, HyperFluxClient, SdkClientConfig, TransactionSubmission};
+pub use client::{
+    EventSubscription, HyperFluxClient, NativeExchangeSubmission, SdkClientConfig,
+    TransactionSubmission,
+};
 pub use error::{SdkError, SdkMethod};
 pub use identity::{KernelRequestIdentitySource, RequestIdentityError, RequestIdentitySource};
diff --git a/crates/hfx-sdk/tests/sdk_contract.rs b/crates/hfx-sdk/tests/sdk_contract.rs
index 39c4219..71c611b 100644
--- a/crates/hfx-sdk/tests/sdk_contract.rs
+++ b/crates/hfx-sdk/tests/sdk_contract.rs
@@ -5,16 +5,19 @@ use hfx_bridge::{
     SessionIdentityError, SessionIdentitySource, SessionRegistry, serve_connection,
 };
 use hfx_domain::{
-    ClientId, ClientName, ColorChannel, ComponentVersion, ProjectionRevision, ProtocolFeatureId,
-    ProtocolVersion, QueueCapacity, RequestId, SequenceNumber, ServerInstanceId,
-    StableLightingMode, StreamEpoch, StreamId,
+    ClientId, ClientName, ColorChannel, ComponentVersion, DroppedEventCount, LeaseId,
+    NativeExchangeTimeoutMs, NativeReportHex, NativeRouteToken, ProjectionRevision,
+    ProtocolFeatureId, ProtocolVersion, QueueCapacity, RequestId, SequenceNumber, ServerInstanceId,
+    StableLightingMode, StreamEpoch, StreamId, SubscriptionId,
 };
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, EventBatch, EventCursor, FrameError, IntegrationView,
-    LeaseRequest, LeaseResult, ProtocolWireError, ReleaseLeaseRequest, RenewLeaseRequest,
-    RpcRequest, RpcResponse, ServerHello, SubscriptionRequest, SuccessEnvelope, TransactionLookup,
-    TransactionRequest, TransactionResult, decode_rpc_request_for_version, read_rpc_request,
-    read_rpc_request_for_version, write_rpc_response, write_rpc_response_for_version,
+    LeaseRequest, LeaseResult, NativeExchangeNotSent, NativeExchangeOutcome, NativeExchangeRequest,
+    NativeExchangeResult, NativeRouteEventBatch, NativeRouteInventory, ProtocolWireError,
+    ReleaseLeaseRequest, RenewLeaseRequest, RpcRequest, RpcResponse, ServerHello,
+    SubscriptionRequest, SuccessEnvelope, TransactionLookup, TransactionRequest, TransactionResult,
+    decode_rpc_request_for_version, read_rpc_request, read_rpc_request_for_version,
+    write_rpc_response, write_rpc_response_for_version,
 };
 use hfx_sdk::{
     FramedIoChannel, HyperFluxClient, RequestIdentityError, RequestIdentitySource, SdkClientConfig,
@@ -66,6 +69,9 @@ struct SnapshotBackend {
     integration_view_calls: usize,
     disconnect_calls: usize,
     observed_client: Option<ClientId>,
+    native_enumerate_calls: usize,
+    native_transact_calls: usize,
+    native_watch_calls: usize,
 }
 
 impl BridgeRpcBackend for SnapshotBackend {
@@ -142,6 +148,52 @@ impl BridgeRpcBackend for SnapshotBackend {
         Err(RpcFailure::internal())
     }
 
+    fn native_enumerate(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+    ) -> Result<NativeRouteInventory, RpcFailure> {
+        self.native_enumerate_calls += 1;
+        Ok(NativeRouteInventory {
+            cursor: empty_snapshot().cursor,
+            routes: Vec::new(),
+        })
+    }
+
+    fn native_transact(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+        request: NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        self.native_transact_calls += 1;
+        Ok(NativeExchangeOutcome {
+            request_id: request.request_id,
+            route_token: request.route_token,
+            result: NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                error_kind: hfx_domain::ProtocolErrorKind::TransportFailure,
+                finding_id: id("HFX-TRANSPORT-001"),
+            }),
+        })
+    }
+
+    fn native_watch(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+        _request: SubscriptionRequest,
+    ) -> Result<NativeRouteEventBatch, RpcFailure> {
+        self.native_watch_calls += 1;
+        let cursor = empty_snapshot().cursor;
+        Ok(NativeRouteEventBatch {
+            subscription_id: id::<SubscriptionId>("native-subscription-1"),
+            next_cursor: cursor.clone(),
+            events: Vec::new(),
+            oldest_available: cursor.sequence,
+            latest_available: cursor.sequence,
+            dropped_events: DroppedEventCount::try_from(0_u64).expect("zero drops are valid"),
+            cursor_gap: false,
+            has_more: false,
+        })
+    }
+
     fn disconnect(&mut self, _session: &AuthorizedSession) -> Result<(), RpcFailure> {
         self.disconnect_calls += 1;
         Ok(())
@@ -178,6 +230,20 @@ fn integration_client_config() -> SdkClientConfig {
     }
 }
 
+fn native_client_config() -> SdkClientConfig {
+    SdkClientConfig {
+        client_id: id::<ClientId>("sdk-native-client-test"),
+        client_name: id::<ClientName>("SDK native tunnel test"),
+        minimum_version: ProtocolVersion::try_from(7_u16).expect("v7 is valid"),
+        maximum_version: ProtocolVersion::try_from(7_u16).expect("v7 is valid"),
+        required_features: vec![
+            id::<ProtocolFeatureId>("native-receiver-tunnel"),
+            id::<ProtocolFeatureId>("ownership-leases"),
+        ],
+        optional_features: Vec::new(),
+    }
+}
+
 fn bridge_config() -> BridgeSessionConfig {
     BridgeSessionConfig {
         server_instance_id: id::<ServerInstanceId>("sdk-server-test"),
@@ -334,6 +400,79 @@ fn sdk_requests_the_v5_view_over_the_real_bridge_runtime() {
     assert_eq!(remaining_sessions, 0);
 }
 
+#[test]
+fn sdk_v7_exposes_replayable_native_enumerate_transact_and_watch() {
+    let (client_stream, mut server_stream) = configured_pair();
+    let server = thread::spawn(move || {
+        let mut identities = DeterministicSessionIdentities::new();
+        let mut sessions =
+            SessionRegistry::new(QueueCapacity::try_from(4).expect("capacity is valid"));
+        let mut backend = SnapshotBackend::default();
+        let result = serve_connection(
+            &mut server_stream,
+            bridge_config(),
+            &mut identities,
+            &mut sessions,
+            &mut backend,
+        );
+        (result, backend, sessions.len())
+    });
+
+    let mut client = HyperFluxClient::connect(
+        client_stream,
+        native_client_config(),
+        DeterministicRequestIdentities::default(),
+    )
+    .expect("SDK v7 negotiation succeeds");
+    assert_eq!(client.server_hello().selected_version.get(), 7);
+    assert!(
+        client
+            .native_enumerate()
+            .expect("routes enumerate")
+            .routes
+            .is_empty()
+    );
+
+    let prepared = client
+        .prepare_native_exchange(
+            id::<LeaseId>("native-lease-1"),
+            id::<NativeRouteToken>(&"a".repeat(64)),
+            id::<NativeReportHex>(&"0".repeat(180)),
+            NativeExchangeTimeoutMs::try_from(100_u16).expect("timeout is valid"),
+        )
+        .expect("native request identity is prepared");
+    let first = client
+        .native_transact(&prepared)
+        .expect("native outcome is returned");
+    let repeated = client
+        .native_transact(&prepared)
+        .expect("exact prepared identity is replayable");
+    assert_eq!(first, repeated);
+    assert_eq!(first.request_id, prepared.request_id);
+
+    let watched = client
+        .native_watch(hfx_sdk::EventSubscription {
+            subscription_id: None,
+            expected_cursor: None,
+            max_events: hfx_domain::EventBatchLimit::try_from(8_u16).expect("batch limit is valid"),
+        })
+        .expect("native routes are watchable");
+    assert!(watched.events.is_empty());
+
+    client
+        .into_inner()
+        .shutdown(std::net::Shutdown::Write)
+        .expect("client closes its write side");
+    let (result, backend, remaining_sessions) = server.join().expect("server thread joins");
+    let report = result.expect("bridge connection exits cleanly");
+    assert_eq!(report.requests_served, 5);
+    assert_eq!(backend.native_enumerate_calls, 1);
+    assert_eq!(backend.native_transact_calls, 2);
+    assert_eq!(backend.native_watch_calls, 1);
+    assert_eq!(backend.disconnect_calls, 1);
+    assert_eq!(remaining_sessions, 0);
+}
+
 #[test]
 fn clean_eof_and_malformed_server_responses_are_distinct() {
     let (client_stream, mut server_stream) = configured_pair();
diff --git a/docs/generated/bridge-protocol-v7.md b/docs/generated/bridge-protocol-v7.md
new file mode 100644
index 0000000..b021eff
--- /dev/null
+++ b/docs/generated/bridge-protocol-v7.md
@@ -0,0 +1,744 @@
+# Bridge Protocol V7
+
+> Generated by `./hfx generate`. Do not edit manually.
+
+Supported protocol versions: **7 through 7**.
+
+Maximum encoded message: **1048576 bytes**. Maximum JSON nesting: **128 levels**.
+
+## Clock And Ordering Semantics
+
+`MonotonicMs` values belong to the serving bridge process monotonic clock. They are comparable only while `server_instance_id` remains unchanged; they are never wall-clock timestamps and must not be retained across bridge restart.
+
+Lease expiries and transaction deadlines are exclusive absolute instants in that clock domain. Transaction `frame_index` values are contiguous, zero-based, and ordered within one atomic request. Terminal outcomes are immutable; a client looks them up instead of replaying a request after uncertain transport.
+
+## Negotiated Features
+
+- `ownership-leases`
+- `atomic-transactions`
+- `profile-bound-transactions`
+- `semantic-stable-lighting`
+- `snapshot-profile-bindings`
+- `integration-view-projection`
+- `event-subscriptions`
+- `structured-diagnostics`
+- `return-lifecycle-projection`
+- `native-receiver-tunnel`
+
+## Methods
+
+| Method | Request | Response | Feature |
+| --- | --- | --- | --- |
+| `negotiate` | `ClientHello` | `ServerHello` | base |
+| `snapshot` | `EmptyRequest` | `BridgeSnapshot` | base |
+| `integration-view` | `EmptyRequest` | `IntegrationView` | `integration-view-projection` |
+| `acquire-lease` | `LeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `renew-lease` | `RenewLeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `release-lease` | `ReleaseLeaseRequest` | `LeaseResult` | `ownership-leases` |
+| `submit-transaction` | `TransactionRequest` | `TransactionResult` | `atomic-transactions` |
+| `transaction-outcome` | `TransactionLookup` | `TransactionResult` | `atomic-transactions` |
+| `subscribe` | `SubscriptionRequest` | `EventBatch` | `event-subscriptions` |
+| `diagnostics` | `EmptyRequest` | `DiagnosticSnapshot` | `structured-diagnostics` |
+| `native-enumerate` | `EmptyRequest` | `NativeRouteInventory` | `native-receiver-tunnel` |
+| `native-transact` | `NativeExchangeRequest` | `NativeExchangeOutcome` | `native-receiver-tunnel` |
+| `native-watch` | `SubscriptionRequest` | `NativeRouteEventBatch` | `native-receiver-tunnel` |
+
+## Records
+
+### EmptyRequest
+
+A method request with no method-specific fields.
+
+This record has no fields.
+
+### RgbColor
+
+One canonical eight-bit RGB color.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `red` | `ColorChannel` | `true` | scalar |
+| `green` | `ColorChannel` | `true` | scalar |
+| `blue` | `ColorChannel` | `true` | scalar |
+
+### ClientHello
+
+Bounded client protocol and feature offer.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `client_name` | `ClientName` | `true` | scalar |
+| `minimum_version` | `ProtocolVersion` | `true` | scalar |
+| `maximum_version` | `ProtocolVersion` | `true` | scalar |
+| `required_features` | `ProtocolFeatureId` | `true` | max 64 |
+| `optional_features` | `ProtocolFeatureId` | `true` | max 64 |
+
+### ServerHello
+
+Negotiated protocol version and bridge feature set.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `selected_version` | `ProtocolVersion` | `true` | scalar |
+| `server_instance_id` | `ServerInstanceId` | `true` | scalar |
+| `protocol_session_id` | `ProtocolSessionId` | `true` | scalar |
+| `negotiation_token` | `NegotiationToken` | `true` | scalar |
+| `bridge_version` | `ComponentVersion` | `true` | scalar |
+| `enabled_features` | `ProtocolFeatureId` | `true` | max 64 |
+| `event_buffer_capacity` | `QueueCapacity` | `true` | scalar |
+
+### ResourceKey
+
+One device-scoped writable resource.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `kind` | `ResourceKind` | `true` | scalar |
+
+### LeaseRequest
+
+Atomic request for one or more writable resources.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `duration_ms` | `LeaseDurationMs` | `true` | scalar |
+
+### LeaseGrant
+
+Granted ownership lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+| `state` | `LeaseState` | `true` | scalar |
+
+### LeaseConflict
+
+Deterministic first conflict from an otherwise atomic lease request.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `conflicting_client` | `ClientId` | `true` | scalar |
+| `conflicting_resource` | `ResourceKey` | `true` | scalar |
+
+### LeaseRejection
+
+Structured lease rejection unrelated to another owner.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### RenewLeaseRequest
+
+Idempotent renewal of one existing lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `duration_ms` | `LeaseDurationMs` | `true` | scalar |
+
+### ReleaseLeaseRequest
+
+Idempotent release of one existing lease.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+
+### EventCursor
+
+Complete resumable position in one event stream projection.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `stream_id` | `StreamId` | `true` | scalar |
+| `stream_epoch` | `StreamEpoch` | `true` | scalar |
+| `projection_revision` | `ProjectionRevision` | `true` | scalar |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+
+### ReturnEpoch
+
+Generation-bound endpoint return state without claiming physical lighting application.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `epoch_sequence` | `SequenceNumber` | `true` | scalar |
+| `opened_at_ms` | `MonotonicMs` | `true` | scalar |
+| `opening_evidence` | `ReturnEvidence` | `true` | scalar |
+| `phase` | `ReturnPhase` | `true` | scalar |
+| `delivery_state` | `RestoreDeliveryState` | `true` | scalar |
+
+### EndpointSnapshot
+
+Independent route, power, sleep, activity, contact, and freshness facts.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `route_kind` | `RouteKind` | `true` | scalar |
+| `route_state` | `RouteState` | `true` | scalar |
+| `connection_mode` | `ConnectionMode` | `true` | scalar |
+| `power_state` | `PowerState` | `true` | scalar |
+| `sleep_state` | `SleepState` | `true` | scalar |
+| `activity_state` | `ActivityState` | `true` | scalar |
+| `contact_state` | `ContactState` | `true` | scalar |
+| `freshness` | `FreshnessState` | `true` | scalar |
+| `confidence` | `EvidenceConfidence` | `true` | scalar |
+| `evidence_claim_id` | `EvidenceClaimId` | `false` | scalar |
+| `observed_at_ms` | `MonotonicMs` | `false` | scalar |
+| `return_epoch` | `ReturnEpoch` | `false` | scalar |
+
+### BatteryObservation
+
+Battery availability and value without collapsing unknown and unavailable.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `availability` | `TelemetryAvailability` | `true` | scalar |
+| `percentage` | `BatteryPercent` | `false` | scalar |
+| `freshness` | `FreshnessState` | `true` | scalar |
+| `confidence` | `EvidenceConfidence` | `true` | scalar |
+| `observed_at_ms` | `MonotonicMs` | `false` | scalar |
+
+### ResourceOwnershipSnapshot
+
+Current bounded application ownership for one generation-scoped resource.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `resource` | `ResourceKey` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### LogicalDeviceSnapshot
+
+Application-neutral logical controller state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `false` | scalar |
+| `profile_digest` | `ProfileDigest` | `false` | scalar |
+| `pairing` | `PairingState` | `true` | scalar |
+| `presence` | `PresenceState` | `true` | scalar |
+| `support_level` | `SupportLevel` | `true` | scalar |
+| `endpoints` | `EndpointSnapshot` | `true` | max 8 |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+
+### ReceiverSnapshot
+
+Generation-bound receiver and child inventory.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `false` | scalar |
+| `profile_digest` | `ProfileDigest` | `false` | scalar |
+| `lifecycle` | `ReceiverLifecycleState` | `true` | scalar |
+| `devices` | `LogicalDeviceSnapshot` | `true` | max 32 |
+| `ownership` | `ResourceOwnershipSnapshot` | `true` | max 96 |
+| `stable_restore_enabled` | `Boolean` | `true` | scalar |
+| `restore_state` | `RestoreState` | `true` | scalar |
+
+### BridgeSnapshot
+
+Sequence-bound complete bridge snapshot.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `receivers` | `ReceiverSnapshot` | `true` | max 16 |
+
+### LightingFrame
+
+One logical-device direct-mode frame.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `frame_index` | `FrameIndex` | `true` | scalar |
+| `colors` | `RgbColor` | `true` | max 4096 |
+
+### DeviceProfileBinding
+
+Exact profile and lighting dimensions bound to one transaction target.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `profile_id` | `ProfileId` | `true` | scalar |
+| `profile_digest` | `ProfileDigest` | `true` | scalar |
+| `application_slot_count` | `LedCount` | `true` | scalar |
+
+### StableLightingIntent
+
+Explicit semantic stable-lighting intent for one frame target.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `mode` | `StableLightingMode` | `true` | scalar |
+
+### TransactionRequest
+
+Atomic generation- and ownership-bound operation.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `receiver_profile_id` | `ProfileId` | `true` | scalar |
+| `receiver_profile_digest` | `ProfileDigest` | `true` | scalar |
+| `device_profiles` | `DeviceProfileBinding` | `true` | max 32 |
+| `transaction_class` | `TransactionClass` | `true` | scalar |
+| `stable_intents` | `StableLightingIntent` | `true` | max 32 |
+| `deadline_ms` | `MonotonicMs` | `true` | scalar |
+| `resources` | `ResourceKey` | `true` | max 32 |
+| `frames` | `LightingFrame` | `true` | max 32 |
+
+### TransactionProgress
+
+Nonterminal generation-bound transaction projection.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `request_digest` | `RequestDigest` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `state` | `TransactionState` | `true` | scalar |
+| `admission` | `QueueAdmission` | `true` | scalar |
+| `declared_frames` | `FrameCount` | `true` | scalar |
+| `delivered_frames` | `DeliveredFrameCount` | `true` | scalar |
+| `side_effect_certainty` | `SideEffectCertainty` | `true` | scalar |
+| `live_write_executed` | `Boolean` | `true` | scalar |
+
+### TransactionTerminal
+
+Immutable terminal transaction outcome retained for bounded lookup.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `request_digest` | `RequestDigest` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `state` | `TransactionState` | `true` | scalar |
+| `declared_frames` | `FrameCount` | `true` | scalar |
+| `delivered_frames` | `DeliveredFrameCount` | `true` | scalar |
+| `side_effect_certainty` | `SideEffectCertainty` | `true` | scalar |
+| `live_write_executed` | `Boolean` | `true` | scalar |
+| `automatic_retry` | `Boolean` | `true` | scalar |
+| `device_application` | `DeviceApplicationState` | `true` | scalar |
+| `terminal_sequence` | `SequenceNumber` | `true` | scalar |
+| `error_kind` | `ProtocolErrorKind` | `false` | scalar |
+| `superseded_by` | `TransactionId` | `false` | scalar |
+
+### TransactionUnavailable
+
+Outcome lookup cannot return a retained transaction record.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### TransactionLookup
+
+Idempotent lookup of one previously submitted transaction.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `transaction_id` | `TransactionId` | `true` | scalar |
+
+### SubscriptionRequest
+
+Bounded event subscription cursor.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `subscription_id` | `SubscriptionId` | `false` | scalar |
+| `expected_cursor` | `EventCursor` | `false` | scalar |
+| `max_events` | `EventBatchLimit` | `true` | scalar |
+
+### BridgeEvent
+
+Sequence-bound typed event with snapshot references.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `kind` | `EventKind` | `true` | scalar |
+| `receiver_id` | `ReceiverId` | `false` | scalar |
+| `generation_id` | `GenerationId` | `false` | scalar |
+| `device_id` | `LogicalDeviceId` | `false` | scalar |
+| `lease_id` | `LeaseId` | `false` | scalar |
+| `transaction_id` | `TransactionId` | `false` | scalar |
+| `finding_id` | `FindingId` | `false` | scalar |
+
+### EventBatch
+
+Bounded event result with explicit cursor-gap state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `subscription_id` | `SubscriptionId` | `true` | scalar |
+| `next_cursor` | `EventCursor` | `true` | scalar |
+| `events` | `BridgeEvent` | `true` | max 256 |
+| `oldest_available` | `SequenceNumber` | `true` | scalar |
+| `latest_available` | `SequenceNumber` | `true` | scalar |
+| `dropped_events` | `DroppedEventCount` | `true` | scalar |
+| `cursor_gap` | `Boolean` | `true` | scalar |
+| `has_more` | `Boolean` | `true` | scalar |
+
+### DiagnosticFinding
+
+One privacy-classified actionable finding.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `finding_id` | `FindingId` | `true` | scalar |
+| `severity` | `ErrorSeverity` | `true` | scalar |
+| `cause` | `HumanMessage` | `true` | scalar |
+| `explanation` | `HumanMessage` | `true` | scalar |
+| `safe_action` | `HumanMessage` | `true` | scalar |
+| `privacy` | `PrivacyClass` | `true` | scalar |
+| `documentation` | `DocumentationPath` | `true` | scalar |
+
+### DiagnosticSnapshot
+
+Bounded bridge findings and queue health.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `findings` | `DiagnosticFinding` | `true` | max 128 |
+| `event_buffer_capacity` | `QueueCapacity` | `true` | scalar |
+| `transaction_queue_capacity` | `QueueCapacity` | `true` | scalar |
+
+### ProfileBindingView
+
+Exact immutable profile authority exposed to integrations.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `profile_id` | `ProfileId` | `true` | scalar |
+| `profile_digest` | `ProfileDigest` | `true` | scalar |
+
+### DeviceInventoryView
+
+Truthful paired-device inventory independent of application controller registration.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `profile` | `ProfileBindingView` | `false` | scalar |
+| `model_name` | `ModelName` | `false` | scalar |
+| `pairing` | `PairingState` | `true` | scalar |
+| `presence` | `PresenceState` | `true` | scalar |
+| `availability` | `InventoryAvailability` | `true` | scalar |
+| `support_level` | `SupportLevel` | `true` | scalar |
+| `endpoints` | `EndpointSnapshot` | `true` | max 8 |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+
+### PresentationView
+
+Pinned upstream presentation authority without hardware transport policy.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `upstream_id` | `UpstreamId` | `true` | scalar |
+| `owner` | `UpstreamOwner` | `true` | scalar |
+| `project_version` | `ComponentVersion` | `true` | scalar |
+| `source_revision` | `SourceRevision` | `true` | scalar |
+| `model_key` | `PresentationKey` | `true` | scalar |
+| `layout_key` | `PresentationKey` | `false` | scalar |
+| `transport_variant` | `TransportVariant` | `true` | scalar |
+
+### LightingTopologyView
+
+Application-facing lighting dimensions without receiver carrier mapping.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `physical_led_count` | `LedCount` | `true` | scalar |
+| `application_slot_count` | `LedCount` | `true` | scalar |
+| `rows` | `LedCount` | `true` | scalar |
+| `columns` | `LedCount` | `true` | scalar |
+
+### UnownedController
+
+Writable controller currently has no application owner.
+
+This record has no fields.
+
+### ViewerOwnedController
+
+Writable controller is owned by the requesting client.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### OtherOwnedController
+
+Writable controller is owned by another application client.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `expires_at_ms` | `MonotonicMs` | `true` | scalar |
+
+### ControllerActions
+
+Viewer-specific actions derived from availability and ownership.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `can_acquire` | `Boolean` | `true` | scalar |
+| `can_release` | `Boolean` | `true` | scalar |
+| `can_submit_now` | `Boolean` | `true` | scalar |
+
+### ControllerView
+
+Exact qualified receiver-backed application controller.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `receiver_profile` | `ProfileBindingView` | `true` | scalar |
+| `device_profile` | `ProfileBindingView` | `true` | scalar |
+| `model_name` | `ModelName` | `true` | scalar |
+| `presentation` | `PresentationView` | `true` | scalar |
+| `availability` | `ControllerAvailability` | `true` | scalar |
+| `battery` | `BatteryObservation` | `true` | scalar |
+| `capabilities` | `CapabilityId` | `true` | max 128 |
+| `lighting` | `LightingTopologyView` | `true` | scalar |
+| `resource` | `ResourceKey` | `true` | scalar |
+| `ownership` | `ControllerOwnership` | `true` | scalar |
+| `actions` | `ControllerActions` | `true` | scalar |
+
+### IntegrationReceiverView
+
+One receiver generation with complete inventory and qualified controllers.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `profile` | `ProfileBindingView` | `false` | scalar |
+| `model_name` | `ModelName` | `false` | scalar |
+| `lifecycle` | `ReceiverLifecycleState` | `true` | scalar |
+| `stable_restore_enabled` | `Boolean` | `true` | scalar |
+| `restore_state` | `RestoreState` | `true` | scalar |
+| `inventory` | `DeviceInventoryView` | `true` | max 32 |
+| `controllers` | `ControllerView` | `true` | max 32 |
+
+### IntegrationView
+
+Client-specific application view projected once by bridge policy.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `receivers` | `IntegrationReceiverView` | `true` | max 16 |
+
+### NativeRoute
+
+One generation-bound receiver child route without a host device path.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `vendor_id` | `VendorId` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `route_state` | `RouteState` | `true` | scalar |
+| `access` | `NativeRouteAccess` | `true` | scalar |
+| `protocol_family` | `NativeProtocolFamily` | `true` | scalar |
+| `report_bytes` | `NativeReportByteCount` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `false` | scalar |
+| `resource` | `ResourceKey` | `false` | scalar |
+
+### NativeRouteInventory
+
+Bounded sequence-consistent native route inventory.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `routes` | `NativeRoute` | `true` | max 32 |
+
+### NativeExchangeRequest
+
+One idempotent lease-bound native child feature-report exchange.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `true` | scalar |
+| `report` | `NativeReportHex` | `true` | scalar |
+| `timeout_ms` | `NativeExchangeTimeoutMs` | `true` | scalar |
+
+### NativeExchangeNotSent
+
+The native request provably did not reach the receiver.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### NativeExchangeUncertain
+
+The SET report may have reached the receiver and must not be repeated automatically.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### NativeExchangeMatchedResponse
+
+A response matching the exact native request identity was retained.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `response` | `NativeReportHex` | `true` | scalar |
+
+### NativeExchangeOutcome
+
+Idempotent native exchange identity and contradiction-free result.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `true` | scalar |
+| `result` | `NativeExchangeResult` | `true` | scalar |
+
+### NativeRouteEvent
+
+One sequence-bound complete native route change.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `kind` | `NativeRouteEventKind` | `true` | scalar |
+| `route` | `NativeRoute` | `true` | scalar |
+
+### NativeRouteEventBatch
+
+Bounded native route changes with explicit cursor-gap state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `subscription_id` | `SubscriptionId` | `true` | scalar |
+| `next_cursor` | `EventCursor` | `true` | scalar |
+| `events` | `NativeRouteEvent` | `true` | max 256 |
+| `oldest_available` | `SequenceNumber` | `true` | scalar |
+| `latest_available` | `SequenceNumber` | `true` | scalar |
+| `dropped_events` | `DroppedEventCount` | `true` | scalar |
+| `cursor_gap` | `Boolean` | `true` | scalar |
+| `has_more` | `Boolean` | `true` | scalar |
+
+### RpcError
+
+Stable structured request failure.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `false` | scalar |
+| `kind` | `ProtocolErrorKind` | `true` | scalar |
+| `message` | `HumanMessage` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+## Tagged Unions
+
+### LeaseResult
+
+Contradiction-free atomic lease outcome.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `granted` | `Granted` | `LeaseGrant` |
+| `conflict` | `Conflict` | `LeaseConflict` |
+| `rejected` | `Rejected` | `LeaseRejection` |
+
+### TransactionResult
+
+Contradiction-free current, terminal, or unavailable transaction outcome.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `progress` | `Progress` | `TransactionProgress` |
+| `terminal` | `Terminal` | `TransactionTerminal` |
+| `unavailable` | `Unavailable` | `TransactionUnavailable` |
+
+### ControllerOwnership
+
+Contradiction-free viewer-specific controller ownership.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `unowned` | `Unowned` | `UnownedController` |
+| `owned-by-viewer` | `OwnedByViewer` | `ViewerOwnedController` |
+| `owned-by-other` | `OwnedByOther` | `OtherOwnedController` |
+
+### NativeExchangeResult
+
+Contradiction-free native transport certainty and response.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `not-sent` | `NotSent` | `NativeExchangeNotSent` |
+| `may-have-been-sent` | `MayHaveBeenSent` | `NativeExchangeUncertain` |
+| `matched-response` | `MatchedResponse` | `NativeExchangeMatchedResponse` |
diff --git a/docs/generated/bridge-protocol.md b/docs/generated/bridge-protocol.md
index 8c8140f..3ae460a 100644
--- a/docs/generated/bridge-protocol.md
+++ b/docs/generated/bridge-protocol.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Supported protocol versions: **6 through 6**.
+Supported protocol versions: **7 through 7**.
 
 Maximum encoded message: **1048576 bytes**. Maximum JSON nesting: **128 levels**.
 
@@ -23,6 +23,7 @@ Lease expiries and transaction deadlines are exclusive absolute instants in that
 - `event-subscriptions`
 - `structured-diagnostics`
 - `return-lifecycle-projection`
+- `native-receiver-tunnel`
 
 ## Methods
 
@@ -38,6 +39,9 @@ Lease expiries and transaction deadlines are exclusive absolute instants in that
 | `transaction-outcome` | `TransactionLookup` | `TransactionResult` | `atomic-transactions` |
 | `subscribe` | `SubscriptionRequest` | `EventBatch` | `event-subscriptions` |
 | `diagnostics` | `EmptyRequest` | `DiagnosticSnapshot` | `structured-diagnostics` |
+| `native-enumerate` | `EmptyRequest` | `NativeRouteInventory` | `native-receiver-tunnel` |
+| `native-transact` | `NativeExchangeRequest` | `NativeExchangeOutcome` | `native-receiver-tunnel` |
+| `native-watch` | `SubscriptionRequest` | `NativeRouteEventBatch` | `native-receiver-tunnel` |
 
 ## Records
 
@@ -583,6 +587,109 @@ Client-specific application view projected once by bridge policy.
 | `cursor` | `EventCursor` | `true` | scalar |
 | `receivers` | `IntegrationReceiverView` | `true` | max 16 |
 
+### NativeRoute
+
+One generation-bound receiver child route without a host device path.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `receiver_id` | `ReceiverId` | `true` | scalar |
+| `generation_id` | `GenerationId` | `true` | scalar |
+| `device_id` | `LogicalDeviceId` | `true` | scalar |
+| `endpoint_id` | `EndpointId` | `true` | scalar |
+| `device_kind` | `DeviceKind` | `true` | scalar |
+| `vendor_id` | `VendorId` | `true` | scalar |
+| `product_id` | `ProductId` | `true` | scalar |
+| `route_state` | `RouteState` | `true` | scalar |
+| `access` | `NativeRouteAccess` | `true` | scalar |
+| `protocol_family` | `NativeProtocolFamily` | `true` | scalar |
+| `report_bytes` | `NativeReportByteCount` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `false` | scalar |
+| `resource` | `ResourceKey` | `false` | scalar |
+
+### NativeRouteInventory
+
+Bounded sequence-consistent native route inventory.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `cursor` | `EventCursor` | `true` | scalar |
+| `routes` | `NativeRoute` | `true` | max 32 |
+
+### NativeExchangeRequest
+
+One idempotent lease-bound native child feature-report exchange.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `client_id` | `ClientId` | `true` | scalar |
+| `lease_id` | `LeaseId` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `true` | scalar |
+| `report` | `NativeReportHex` | `true` | scalar |
+| `timeout_ms` | `NativeExchangeTimeoutMs` | `true` | scalar |
+
+### NativeExchangeNotSent
+
+The native request provably did not reach the receiver.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### NativeExchangeUncertain
+
+The SET report may have reached the receiver and must not be repeated automatically.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `error_kind` | `ProtocolErrorKind` | `true` | scalar |
+| `finding_id` | `FindingId` | `true` | scalar |
+
+### NativeExchangeMatchedResponse
+
+A response matching the exact native request identity was retained.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `response` | `NativeReportHex` | `true` | scalar |
+
+### NativeExchangeOutcome
+
+Idempotent native exchange identity and contradiction-free result.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `request_id` | `RequestId` | `true` | scalar |
+| `route_token` | `NativeRouteToken` | `true` | scalar |
+| `result` | `NativeExchangeResult` | `true` | scalar |
+
+### NativeRouteEvent
+
+One sequence-bound complete native route change.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `sequence` | `SequenceNumber` | `true` | scalar |
+| `kind` | `NativeRouteEventKind` | `true` | scalar |
+| `route` | `NativeRoute` | `true` | scalar |
+
+### NativeRouteEventBatch
+
+Bounded native route changes with explicit cursor-gap state.
+
+| Field | Type | Required | Bound |
+| --- | --- | --- | --- |
+| `subscription_id` | `SubscriptionId` | `true` | scalar |
+| `next_cursor` | `EventCursor` | `true` | scalar |
+| `events` | `NativeRouteEvent` | `true` | max 256 |
+| `oldest_available` | `SequenceNumber` | `true` | scalar |
+| `latest_available` | `SequenceNumber` | `true` | scalar |
+| `dropped_events` | `DroppedEventCount` | `true` | scalar |
+| `cursor_gap` | `Boolean` | `true` | scalar |
+| `has_more` | `Boolean` | `true` | scalar |
+
 ### RpcError
 
 Stable structured request failure.
@@ -625,3 +732,13 @@ Contradiction-free viewer-specific controller ownership.
 | `unowned` | `Unowned` | `UnownedController` |
 | `owned-by-viewer` | `OwnedByViewer` | `ViewerOwnedController` |
 | `owned-by-other` | `OwnedByOther` | `OtherOwnedController` |
+
+### NativeExchangeResult
+
+Contradiction-free native transport certainty and response.
+
+| Tag | Variant | Payload |
+| --- | --- | --- |
+| `not-sent` | `NotSent` | `NativeExchangeNotSent` |
+| `may-have-been-sent` | `MayHaveBeenSent` | `NativeExchangeUncertain` |
+| `matched-response` | `MatchedResponse` | `NativeExchangeMatchedResponse` |
diff --git a/docs/generated/domain-types.md b/docs/generated/domain-types.md
index a3e1d68..964eb77 100644
--- a/docs/generated/domain-types.md
+++ b/docs/generated/domain-types.md
@@ -38,6 +38,8 @@ These types prevent semantically different values from being passed interchangea
 | `DispatchNonce` | `dispatch_nonce` | 1 to 18446744073709551615 | `decimal-string` |
 | `WallClockUnixMs` | `wall_clock_unix_ms` | 0 to 18446744073709551615 | `decimal-string` |
 | `EventBatchLimit` | `event_batch_limit` | 1 to 256 | `number` |
+| `NativeExchangeTimeoutMs` | `native_exchange_timeout_ms` | 1 to 1000 | `number` |
+| `NativeReportByteCount` | `native_report_byte_count` | 1 to 4096 | `number` |
 
 ## Opaque String Types
 
@@ -79,6 +81,9 @@ These types prevent semantically different values from being passed interchangea
 | `PresentationKey` | `presentation_key` | 1 to 160 bytes |
 | `TransportVariant` | `transport_variant` | 1 to 64 bytes |
 | `RestoreTriggerId` | `restore_trigger_id` | 1 to 128 bytes |
+| `NativeRouteToken` | `native_route_token` | 64 to 64 bytes |
+| `NativeReportHex` | `native_report_hex` | 180 to 180 bytes |
+| `NativeProtocolFamily` | `native_protocol_family` | 1 to 64 bytes |
 
 ## Enumerations
 
@@ -105,7 +110,7 @@ These types prevent semantically different values from being passed interchangea
 - `ReceiverState`: `absent`, `discovered-read-only`, `observed`, `profile-qualified`, `session-authorized`, `degraded-read-only`
 - `TransactionState`: `created`, `validated`, `ownership-bound`, `generation-bound`, `queued`, `sent`, `health-pending`, `succeeded`, `failed`, `revoked`, `superseded`
 - `LeaseState`: `requested`, `granted`, `renewed`, `released`, `expired`, `revoked`
-- `ResourceKind`: `lighting`, `settings`, `pairing`
+- `ResourceKind`: `lighting`, `settings`, `pairing`, `native-control`
 - `TransactionClass`: `effect-frame`, `static-lighting`, `device-setting`, `restore`, `pairing`
 - `StableLightingMode`: `static`, `off`
 - `QueueAdmission`: `enqueued`, `coalesced`, `rejected-full`, `rejected-deadline`, `rejected-invalid`
@@ -127,3 +132,5 @@ These types prevent semantically different values from being passed interchangea
 - `TelemetryAvailability`: `unknown`, `unavailable`, `reported`
 - `LeaseOutcome`: `granted`, `conflict`, `rejected`
 - `ErrorSeverity`: `info`, `warning`, `error`, `critical`
+- `NativeRouteAccess`: `qualified`, `candidate`, `backend-required`
+- `NativeRouteEventKind`: `available`, `unavailable`, `generation-replaced`
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index b5c1418..e8090db 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,11 +33,11 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `161` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `167` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
-| `kernel-source` | 14 | `-` |
+| `kernel-source` | 15 | `-` |
 | `dkms-configuration` | 1 | `-` |
 | `bridge-service` | 1 | `-` |
 | `activation-service` | 1 | `-` |
@@ -47,14 +47,14 @@ The expanded source payload contains `161` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 54 | `-` |
+| `schemas` | 56 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
 | `integration-authority` | 6 | `-` |
-| `cpp-sdk-headers` | 28 | `-` |
-| `documentation` | 38 | `-` |
+| `cpp-sdk-headers` | 30 | `-` |
+| `documentation` | 39 | `-` |
 | `readme` | 1 | `-` |
 | `security-policy` | 1 | `-` |
 | `license` | 1 | `-` |
diff --git a/docs/generated/kernel-uapi.md b/docs/generated/kernel-uapi.md
index 931e238..4482ceb 100644
--- a/docs/generated/kernel-uapi.md
+++ b/docs/generated/kernel-uapi.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-ABI version: `1`.
+ABI catalogs: `1` (baseline), `2` (native_exchange).
 
 The UAPI contains fixed-width values, no pointers, and no application or product presentation.
 
@@ -10,14 +10,16 @@ The UAPI contains fixed-width values, no pointers, and no application or product
 
 | Structure | Size | Purpose boundary |
 | --- | ---: | --- |
-| `hfx_uapi_info` | 40 | `get_info` |
-| `hfx_uapi_begin_session` | 128 | `begin_session` |
-| `hfx_uapi_end_session` | 32 | `end_session` |
-| `hfx_uapi_frame` | 112 | `nested payload` |
-| `hfx_uapi_submit` | 1872 | `submit` |
-| `hfx_uapi_transaction_result` | 104 | `get_transaction_result` |
-| `hfx_uapi_observation` | 40 | `nested payload` |
-| `hfx_uapi_read_observations` | 1328 | `read_observations` |
+| `hfx_uapi_info` | 40 | `get_info` (baseline) |
+| `hfx_uapi_begin_session` | 128 | `begin_session` (baseline) |
+| `hfx_uapi_end_session` | 32 | `end_session` (baseline) |
+| `hfx_uapi_frame` | 112 | `nested payload` (baseline) |
+| `hfx_uapi_submit` | 1872 | `submit` (baseline) |
+| `hfx_uapi_transaction_result` | 104 | `get_transaction_result` (baseline) |
+| `hfx_uapi_observation` | 40 | `nested payload` (baseline) |
+| `hfx_uapi_read_observations` | 1328 | `read_observations` (baseline) |
+| `hfx_uapi_native_exchange_submit` | 216 | `submit_native_exchange` (native_exchange) |
+| `hfx_uapi_native_exchange_result` | 216 | `get_native_exchange_result` (native_exchange) |
 
 ## Ioctls
 
@@ -29,6 +31,8 @@ The UAPI contains fixed-width values, no pointers, and no application or product
 | `submit` | `0x03` | `read_write` | `hfx_uapi_submit` |
 | `get_transaction_result` | `0x04` | `read_write` | `hfx_uapi_transaction_result` |
 | `read_observations` | `0x05` | `read_write` | `hfx_uapi_read_observations` |
+| `submit_native_exchange` | `0x06` | `read_write` | `hfx_uapi_native_exchange_submit` |
+| `get_native_exchange_result` | `0x07` | `read_write` | `hfx_uapi_native_exchange_result` |
 
 ## Ownership
 
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index f2bcf6b..b1e4781 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -232,7 +232,7 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 
 **Used by:** [Assurance and release evidence](#assurance), [Kernel driver contract](#driver-contract), [Error catalog](#errors), [Application integration catalog](#integrations), [Composable hardware profiles](#profiles), [Versioned bridge protocol](#protocol), [Linux runtime authority](#runtime-config), [Rust workspace](#rust-workspace), [Repository tooling](#tooling)
 
-**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`, `schemas/lifecycle-policy-catalog.schema.json`.
+**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`, `schemas/lifecycle-policy-catalog.schema.json`, `schemas/kernel-uapi-registry.schema.json`, `schemas/kernel-uapi-native-exchange.schema.json`.
 
 **Generated projections:** `schemas/README.md`, `docs/generated/domain-types.md`.
 
@@ -612,11 +612,11 @@ Provides the typed Rust client contract used by production integrations and inte
 
 `crates/hfx-kernel-transport` · `runtime` · `implemented`
 
-Adapts the generated kernel UAPI into bounded Rust observation, routing, and envelope I/O.
+Adapts the generated kernel UAPI into bounded Rust observation, routing, envelope I/O, and qualified native exchanges.
 
 **Owns:** Kernel device I/O; UAPI encoding; Receiver route adaptation.
 
-**Must never own:** Qualification policy; Application identity; Unbounded raw reports.
+**Must never own:** Qualification policy; Application identity; Unbounded or unqualified raw reports.
 
 **Depends on:** [Rust workspace](#rust-workspace), [Kernel driver contract](#driver-contract), [Versioned bridge protocol](#protocol)
 
@@ -664,7 +664,7 @@ Exercises generations, failures, persistence, restoration, replay, and migration
 
 `driver` · `runtime` · `implemented`
 
-Defines the generated userspace ABI and the strict boundary around the in-kernel receiver transport.
+Defines additive generated userspace ABIs and the strict boundary around the in-kernel receiver transport.
 
 **Owns:** Kernel UAPI authority; Driver source boundary; Session-device contract.
 
@@ -674,7 +674,7 @@ Defines the generated userspace ABI and the strict boundary around the in-kernel
 
 **Used by:** [Linux HID kernel module](#kernel-module), [Kernel transport adapter](#kernel-transport)
 
-**Canonical sources:** `uapi/kernel-uapi.json`.
+**Canonical sources:** `uapi/registry.json`, `uapi/kernel-uapi.json`, `uapi/native-exchange-v2.json`.
 
 **Generated projections:** `driver/README.md`, `driver/kernel/uapi/hyperflux_next.h`, `docs/generated/kernel-uapi.md`.
 
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index ad16ec6..a87f297 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `2874becb4636df0d25308c3cdd27b18585424476379ec3ea74ea87a781344253`
+- Authority SHA-256: `92006b9561017382240993dd195de5c217e9e6fcc2e3614e6061698fd16b201d`
 
 ## License Policy
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index de51eca..b96ab98 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac`
+Profile source: `5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -12,7 +12,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `62f114182069` | 7 | 7 |
 | **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `46703d44d594` | 6 | 7 |
-| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `ff258c7eb0ff` | 4 | 2 |
+| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `4f469c2f3f70` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
 ## Composition Contract
diff --git a/driver/README.md b/driver/README.md
index 371f6fc..0fedb35 100644
--- a/driver/README.md
+++ b/driver/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Defines the generated userspace ABI and the strict boundary around the in-kernel receiver transport.
+Defines additive generated userspace ABIs and the strict boundary around the in-kernel receiver transport.
 
 `implemented` | `runtime` | Atlas: `driver-contract`
 
@@ -25,7 +25,9 @@ Defines the generated userspace ABI and the strict boundary around the in-kernel
 
 ## Change Here
 
+- [`uapi/registry.json`](../uapi/registry.json)
 - [`uapi/kernel-uapi.json`](../uapi/kernel-uapi.json)
+- [`uapi/native-exchange-v2.json`](../uapi/native-exchange-v2.json)
 
 ## Verification
 
diff --git a/driver/kernel/Makefile b/driver/kernel/Makefile
index 133d50e..66e16cb 100644
--- a/driver/kernel/Makefile
+++ b/driver/kernel/Makefile
@@ -5,6 +5,7 @@ hid-hyperflux-next-y := \
 	hyperflux-next-observation.o \
 	hyperflux-next-profile.o \
 	hyperflux-next-session.o \
+	hyperflux-next-native.o \
 	hyperflux-next-transport.o
 
 KDIR ?= /lib/modules/$(shell uname -r)/build
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index d553bdc..4de15d1 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,11 +1,24 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac */
+/* Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
 #endif
 
-HFX_RECEIVER_PROFILE(0x1532, 0x00cf, 1, HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1)
+HFX_RECEIVER_PROFILE(
+	0x1532, 0x00cf,
+	1,
+	.pairing_inventory_kind = HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1,
+	.native_exchange_kind = HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1,
+	.native_report_bytes = 90,
+	.native_set_report_index = 0,
+	.native_response_report_index = 0,
+	.native_initial_response_delay_us = 8000,
+	.native_response_retry_delay_us = 10000,
+	.native_max_response_attempts = 5,
+	.native_match_range_count = 2,
+	.native_match_ranges = { { .offset = 2, .length = 2 }, { .offset = 6, .length = 2 } }
+)
 
 #undef HFX_RECEIVER_PROFILE
diff --git a/driver/kernel/hyperflux-next-core.c b/driver/kernel/hyperflux-next-core.c
index 6c0e582..1d04f91 100644
--- a/driver/kernel/hyperflux-next-core.c
+++ b/driver/kernel/hyperflux-next-core.c
@@ -67,10 +67,15 @@ void hfx_receiver_release(struct kref *refcount)
 		container_of(refcount, struct hfx_receiver, refcount);
 
 	hfx_transport_free_journal(receiver);
+	hfx_native_exchange_free_journal(receiver);
 	memzero_explicit(receiver->result_tombstones,
 			 sizeof(*receiver->result_tombstones) *
 				 HFX_TOMBSTONE_CAPACITY);
 	kfree(receiver->result_tombstones);
+	memzero_explicit(receiver->native_result_tombstones,
+			 sizeof(*receiver->native_result_tombstones) *
+				 HFX_UAPI_NATIVE_MAX_RESULTS);
+	kfree(receiver->native_result_tombstones);
 	kfree(receiver->observation_ring);
 	usb_put_dev(receiver->udev);
 	kfree(receiver->session_name);
@@ -96,9 +101,15 @@ hfx_receiver_candidate(struct usb_device *udev,
 			sizeof(*candidate->result_tombstones), GFP_KERNEL);
 	if (!candidate->result_tombstones)
 		goto err_observations;
+	candidate->native_result_tombstones =
+		kcalloc(HFX_UAPI_NATIVE_MAX_RESULTS,
+			sizeof(*candidate->native_result_tombstones), GFP_KERNEL);
+	if (!candidate->native_result_tombstones)
+		goto err_result_tombstones;
 
 	INIT_LIST_HEAD(&candidate->node);
 	INIT_LIST_HEAD(&candidate->result_records);
+	INIT_LIST_HEAD(&candidate->native_result_records);
 	mutex_init(&candidate->state_lock);
 	mutex_init(&candidate->transport_lock);
 	spin_lock_init(&candidate->authorization_lock);
@@ -106,10 +117,13 @@ hfx_receiver_candidate(struct usb_device *udev,
 	kref_init(&candidate->refcount);
 	candidate->udev = usb_get_dev(udev);
 	candidate->backend_id = profile->backend_id;
+	candidate->profile = profile;
 	candidate->next_observation_sequence = 0;
 	candidate->next_kernel_sequence = 0;
 	return candidate;
 
+err_result_tombstones:
+	kfree(candidate->result_tombstones);
 err_observations:
 	kfree(candidate->observation_ring);
 err_candidate:
@@ -431,7 +445,7 @@ static int hfx_resume(struct hid_device *hdev)
 }
 
 static const struct hid_device_id hfx_devices[] = {
-#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, ...) \
 	{ HID_USB_DEVICE((vendor), (product)), .driver_data = (backend) },
 #include "generated/hyperflux_receiver_profiles.inc"
 #undef HFX_RECEIVER_PROFILE
diff --git a/driver/kernel/hyperflux-next-internal.h b/driver/kernel/hyperflux-next-internal.h
index 9c5a170..be5df26 100644
--- a/driver/kernel/hyperflux-next-internal.h
+++ b/driver/kernel/hyperflux-next-internal.h
@@ -37,6 +37,18 @@ struct hfx_result_tombstone {
 	u8 request_digest[HFX_UAPI_DIGEST_BYTES];
 };
 
+struct hfx_native_result_record {
+	struct list_head node;
+	struct hfx_uapi_native_exchange_result result;
+	u8 request[HFX_UAPI_NATIVE_REPORT_BYTES];
+};
+
+struct hfx_native_result_tombstone {
+	bool valid;
+	struct hfx_uapi_native_exchange_result result;
+	u8 request[HFX_UAPI_NATIVE_REPORT_BYTES];
+};
+
 struct hfx_receiver {
 	struct list_head node;
 	struct usb_device *udev;
@@ -49,6 +61,7 @@ struct hfx_receiver {
 	char *session_name;
 	u64 generation;
 	u32 backend_id;
+	const struct hfx_receiver_profile *profile;
 	DECLARE_BITMAP(bound_interface_numbers, HFX_USB_INTERFACE_LIMIT);
 	unsigned int bound_interfaces;
 	unsigned int suspended_interfaces;
@@ -77,6 +90,11 @@ struct hfx_receiver {
 	struct hfx_result_tombstone *result_tombstones;
 	u32 tombstone_head;
 	u32 tombstone_count;
+	struct list_head native_result_records;
+	u32 native_result_count;
+	struct hfx_native_result_tombstone *native_result_tombstones;
+	u32 native_tombstone_head;
+	u32 native_tombstone_count;
 };
 
 struct hfx_interface {
@@ -128,4 +146,12 @@ long hfx_transport_get_result(struct hfx_receiver *receiver,
 			      void __user *user_arg);
 void hfx_transport_free_journal(struct hfx_receiver *receiver);
 
+long hfx_native_exchange_submit(struct hfx_receiver *receiver,
+				struct hfx_file_context *context,
+				void __user *user_arg);
+long hfx_native_exchange_get_result(struct hfx_receiver *receiver,
+				    struct hfx_file_context *context,
+				    void __user *user_arg);
+void hfx_native_exchange_free_journal(struct hfx_receiver *receiver);
+
 #endif
diff --git a/driver/kernel/hyperflux-next-native.c b/driver/kernel/hyperflux-next-native.c
new file mode 100644
index 0000000..85bdf9b
--- /dev/null
+++ b/driver/kernel/hyperflux-next-native.c
@@ -0,0 +1,685 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include "hyperflux-next-internal.h"
+
+#define HFX_NATIVE_SET_REQUEST_TYPE 0x21
+#define HFX_NATIVE_SET_REQUEST 0x09
+#define HFX_NATIVE_GET_REQUEST_TYPE 0xa1
+#define HFX_NATIVE_GET_REQUEST 0x01
+#define HFX_NATIVE_REPORT_VALUE 0x0300
+#define HFX_NATIVE_TIMEOUT_MS \
+	DIV_ROUND_UP_ULL(HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS, NSEC_PER_MSEC)
+
+static bool hfx_native_profile_valid(const struct hfx_receiver_profile *profile)
+{
+	u16 previous_end = 0;
+	u16 index;
+
+	if (!profile ||
+	    profile->native_exchange_kind !=
+		    HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 ||
+	    profile->native_report_bytes != HFX_UAPI_NATIVE_REPORT_BYTES ||
+	    !profile->native_max_response_attempts ||
+	    profile->native_max_response_attempts > 16U ||
+	    !profile->native_match_range_count ||
+	    profile->native_match_range_count > HFX_NATIVE_MATCH_RANGE_CAPACITY)
+		return false;
+
+	for (index = 0; index < profile->native_match_range_count; index++) {
+		const struct hfx_native_match_range *range =
+			&profile->native_match_ranges[index];
+
+		if (!range->length || range->offset < previous_end ||
+		    range->offset + range->length > profile->native_report_bytes)
+			return false;
+		previous_end = range->offset + range->length;
+	}
+	return true;
+}
+
+static int hfx_native_submit_validate(
+	const struct hfx_receiver *receiver,
+	const struct hfx_uapi_native_exchange_submit *submit)
+{
+	u64 now_ns = ktime_get_boottime_ns();
+
+	if (submit->version != HFX_UAPI_NATIVE_ABI_VERSION ||
+	    submit->size != sizeof(*submit))
+		return -EPROTO;
+	if (!hfx_native_profile_valid(receiver->profile))
+		return -EOPNOTSUPP;
+	if (!submit->dispatch_nonce ||
+	    !memchr_inv(submit->route_token_digest, 0,
+			sizeof(submit->route_token_digest)) ||
+	    !memchr_inv(submit->request_digest, 0,
+			sizeof(submit->request_digest)))
+		return -EINVAL;
+	if (submit->endpoint_slot != HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE &&
+	    submit->endpoint_slot != HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE)
+		return -EINVAL;
+	if (submit->report_length != HFX_UAPI_NATIVE_REPORT_BYTES ||
+	    submit->kernel_sequence)
+		return -EINVAL;
+	if (submit->deadline_boottime_ns <= now_ns ||
+	    submit->deadline_boottime_ns - now_ns >
+		    HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS)
+		return -ETIME;
+	return 0;
+}
+
+static bool hfx_native_key_matches(
+	const struct hfx_uapi_native_exchange_result *result,
+	u64 generation, u64 epoch, u64 nonce)
+{
+	return result->receiver_generation == generation &&
+		result->authorization_epoch == epoch &&
+		result->dispatch_nonce == nonce;
+}
+
+static bool hfx_native_exact_matches(
+	const struct hfx_uapi_native_exchange_result *result,
+	u64 generation, u64 nonce, u32 endpoint_slot,
+	const u8 *route_token_digest, const u8 *request_digest)
+{
+	return result->receiver_generation == generation &&
+		result->dispatch_nonce == nonce &&
+		result->endpoint_slot == endpoint_slot &&
+		!memcmp(result->route_token_digest, route_token_digest,
+			sizeof(result->route_token_digest)) &&
+		!memcmp(result->request_digest, request_digest,
+			sizeof(result->request_digest));
+}
+
+static struct hfx_native_result_record *
+hfx_native_record_find(struct hfx_receiver *receiver, u64 generation,
+		       u64 epoch, u64 nonce)
+{
+	struct hfx_native_result_record *record;
+
+	list_for_each_entry(record, &receiver->native_result_records, node) {
+		if (hfx_native_key_matches(&record->result, generation, epoch,
+					   nonce))
+			return record;
+	}
+	return NULL;
+}
+
+static struct hfx_native_result_record *
+hfx_native_record_find_exact(struct hfx_receiver *receiver, u64 generation,
+			     u64 nonce, u32 endpoint_slot,
+			     const u8 *route_token_digest,
+			     const u8 *request_digest)
+{
+	struct hfx_native_result_record *record;
+
+	list_for_each_entry(record, &receiver->native_result_records, node) {
+		if (hfx_native_exact_matches(&record->result, generation, nonce,
+					     endpoint_slot, route_token_digest,
+					     request_digest))
+			return record;
+	}
+	return NULL;
+}
+
+static struct hfx_native_result_tombstone *
+hfx_native_tombstone_find(struct hfx_receiver *receiver, u64 generation,
+			  u64 epoch, u64 nonce)
+{
+	u32 index;
+
+	for (index = 0; index < HFX_UAPI_NATIVE_MAX_RESULTS; index++) {
+		struct hfx_native_result_tombstone *tombstone =
+			&receiver->native_result_tombstones[index];
+
+		if (tombstone->valid &&
+		    hfx_native_key_matches(&tombstone->result, generation, epoch,
+					   nonce))
+			return tombstone;
+	}
+	return NULL;
+}
+
+static struct hfx_native_result_tombstone *
+hfx_native_tombstone_find_exact(struct hfx_receiver *receiver,
+				u64 generation, u64 nonce,
+				u32 endpoint_slot,
+				const u8 *route_token_digest,
+				const u8 *request_digest)
+{
+	u32 index;
+
+	for (index = 0; index < HFX_UAPI_NATIVE_MAX_RESULTS; index++) {
+		struct hfx_native_result_tombstone *tombstone =
+			&receiver->native_result_tombstones[index];
+
+		if (tombstone->valid &&
+		    hfx_native_exact_matches(&tombstone->result, generation, nonce,
+					     endpoint_slot, route_token_digest,
+					     request_digest))
+			return tombstone;
+	}
+	return NULL;
+}
+
+static bool hfx_native_record_matches_submit(
+	const struct hfx_native_result_record *record,
+	const struct hfx_uapi_native_exchange_submit *submit)
+{
+	return !memcmp(record->request, submit->report, sizeof(record->request));
+}
+
+static bool hfx_native_tombstone_matches_submit(
+	const struct hfx_native_result_tombstone *tombstone,
+	const struct hfx_uapi_native_exchange_submit *submit)
+{
+	return !memcmp(tombstone->request, submit->report,
+		       sizeof(tombstone->request));
+}
+
+static void hfx_native_remember_tombstone(
+	struct hfx_receiver *receiver,
+	const struct hfx_native_result_record *record)
+{
+	struct hfx_native_result_tombstone *tombstone =
+		&receiver->native_result_tombstones[
+			receiver->native_tombstone_head];
+
+	memzero_explicit(tombstone, sizeof(*tombstone));
+	tombstone->valid = true;
+	tombstone->result = record->result;
+	memcpy(tombstone->request, record->request,
+	       sizeof(tombstone->request));
+	receiver->native_tombstone_head =
+		(receiver->native_tombstone_head + 1U) %
+		HFX_UAPI_NATIVE_MAX_RESULTS;
+	if (receiver->native_tombstone_count < HFX_UAPI_NATIVE_MAX_RESULTS)
+		receiver->native_tombstone_count++;
+}
+
+static int hfx_native_ensure_result_capacity(struct hfx_receiver *receiver)
+{
+	struct hfx_native_result_record *record;
+
+	if (receiver->native_result_count < HFX_UAPI_NATIVE_MAX_RESULTS)
+		return 0;
+	record = list_first_entry_or_null(&receiver->native_result_records,
+					  struct hfx_native_result_record,
+					  node);
+	if (!record)
+		return -EBUSY;
+	hfx_native_remember_tombstone(receiver, record);
+	list_del(&record->node);
+	receiver->native_result_count--;
+	memzero_explicit(record, sizeof(*record));
+	kfree(record);
+	return 0;
+}
+
+static int hfx_native_result_return_code(
+	const struct hfx_uapi_native_exchange_result *result)
+{
+	if (result->certainty ==
+	    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE)
+		return 0;
+	if (result->transport_errno)
+		return result->transport_errno;
+	return -EIO;
+}
+
+static int hfx_native_delay(u32 delay_us, u64 deadline_ns)
+{
+	u64 now_ns;
+	u64 remaining_us;
+
+	if (!delay_us)
+		return 0;
+	now_ns = ktime_get_boottime_ns();
+	if (now_ns >= deadline_ns)
+		return -ETIME;
+	remaining_us = div_u64(deadline_ns - now_ns, NSEC_PER_USEC);
+	if (remaining_us < delay_us)
+		return -ETIME;
+	if (delay_us >= 20000U)
+		msleep(DIV_ROUND_UP(delay_us, 1000U));
+	else
+		usleep_range(delay_us,
+			     delay_us + min(delay_us / 10U + 1U, 1000U));
+	return ktime_get_boottime_ns() < deadline_ns ? 0 : -ETIME;
+}
+
+static bool hfx_native_response_matches(
+	const struct hfx_receiver_profile *profile,
+	const u8 *request, const u8 *response)
+{
+	u16 index;
+
+	for (index = 0; index < profile->native_match_range_count; index++) {
+		const struct hfx_native_match_range *range =
+			&profile->native_match_ranges[index];
+
+		if (memcmp(&request[range->offset], &response[range->offset],
+			   range->length))
+			return false;
+	}
+	return true;
+}
+
+static int hfx_native_usb_set(struct hfx_receiver *receiver,
+			      const struct hfx_receiver_profile *profile,
+			      u8 *request)
+{
+	int ret;
+
+	ret = usb_control_msg(receiver->udev,
+			      usb_sndctrlpipe(receiver->udev, 0),
+			      HFX_NATIVE_SET_REQUEST,
+			      HFX_NATIVE_SET_REQUEST_TYPE,
+			      HFX_NATIVE_REPORT_VALUE,
+			      profile->native_set_report_index,
+			      request, profile->native_report_bytes,
+			      HFX_NATIVE_TIMEOUT_MS);
+	if (ret < 0)
+		return ret;
+	return ret == profile->native_report_bytes ? 0 : -EIO;
+}
+
+static int hfx_native_usb_get(struct hfx_receiver *receiver,
+			      const struct hfx_receiver_profile *profile,
+			      u8 *response)
+{
+	int ret;
+
+	ret = usb_control_msg(receiver->udev,
+			      usb_rcvctrlpipe(receiver->udev, 0),
+			      HFX_NATIVE_GET_REQUEST,
+			      HFX_NATIVE_GET_REQUEST_TYPE,
+			      HFX_NATIVE_REPORT_VALUE,
+			      profile->native_response_report_index,
+			      response, profile->native_report_bytes,
+			      HFX_NATIVE_TIMEOUT_MS);
+	if (ret < 0)
+		return ret;
+	return ret == profile->native_report_bytes ? 0 : -EIO;
+}
+
+static int hfx_native_record_dispatch(
+	struct hfx_receiver *receiver, struct hfx_file_context *context,
+	struct hfx_native_result_record *record, u64 deadline_ns)
+{
+	const struct hfx_receiver_profile *profile = receiver->profile;
+	struct usb_interface *control_interface;
+	u8 *request;
+	u8 *response;
+	u16 attempt;
+	int ret;
+
+	request = kmemdup(record->request, sizeof(record->request), GFP_KERNEL);
+	if (!request) {
+		ret = -ENOMEM;
+		goto not_sent;
+	}
+	response = kzalloc(HFX_UAPI_NATIVE_REPORT_BYTES, GFP_KERNEL);
+	if (!response) {
+		ret = -ENOMEM;
+		goto free_request;
+	}
+	control_interface = usb_ifnum_to_if(
+		receiver->udev, profile->native_set_report_index);
+	if (!control_interface) {
+		ret = -ENODEV;
+		goto free_buffers;
+	}
+	ret = usb_autopm_get_interface(control_interface);
+	if (ret)
+		goto free_buffers;
+	ret = hfx_session_check(receiver, context,
+				record->result.receiver_generation,
+				record->result.authorization_epoch);
+	if (ret)
+		goto put_interface;
+	if (ktime_get_boottime_ns() >= deadline_ns) {
+		ret = -ETIME;
+		goto put_interface;
+	}
+
+	record->result.certainty =
+		HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT;
+	ret = hfx_native_usb_set(receiver, profile, request);
+	if (ret)
+		goto uncertain;
+	ret = hfx_native_delay(profile->native_initial_response_delay_us,
+			       deadline_ns);
+	if (ret)
+		goto uncertain;
+
+	for (attempt = 0; attempt < profile->native_max_response_attempts;
+	     attempt++) {
+		ret = hfx_session_check(receiver, context,
+					record->result.receiver_generation,
+					record->result.authorization_epoch);
+		if (ret)
+			goto uncertain;
+		if (ktime_get_boottime_ns() >= deadline_ns) {
+			ret = -ETIME;
+			goto uncertain;
+		}
+		memzero_explicit(response, HFX_UAPI_NATIVE_REPORT_BYTES);
+		ret = hfx_native_usb_get(receiver, profile, response);
+		if (!ret && hfx_native_response_matches(
+				    profile, request, response)) {
+			record->result.certainty =
+				HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE;
+			record->result.transport_errno = 0;
+			record->result.response_length =
+				HFX_UAPI_NATIVE_REPORT_BYTES;
+			memcpy(record->result.response, response,
+			       sizeof(record->result.response));
+			ret = 0;
+			goto put_interface;
+		}
+		if (!ret)
+			ret = -ENOMSG;
+		if (attempt + 1U < profile->native_max_response_attempts) {
+			int delay_ret = hfx_native_delay(
+				profile->native_response_retry_delay_us,
+				deadline_ns);
+
+			if (delay_ret) {
+				ret = delay_ret;
+				goto uncertain;
+			}
+		}
+	}
+
+uncertain:
+	record->result.transport_errno = ret;
+put_interface:
+	usb_mark_last_busy(receiver->udev);
+	usb_autopm_put_interface(control_interface);
+free_buffers:
+	memzero_explicit(response, HFX_UAPI_NATIVE_REPORT_BYTES);
+	kfree(response);
+free_request:
+	memzero_explicit(request, HFX_UAPI_NATIVE_REPORT_BYTES);
+	kfree(request);
+not_sent:
+	if (record->result.certainty ==
+	    HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT)
+		record->result.transport_errno = ret;
+	return ret;
+}
+
+static int hfx_native_reserve(
+	struct hfx_receiver *receiver, struct hfx_file_context *context,
+	const struct hfx_uapi_native_exchange_submit *submit,
+	struct hfx_native_result_record *record)
+{
+	unsigned long flags;
+	int ret;
+
+	ret = hfx_native_ensure_result_capacity(receiver);
+	if (ret)
+		return ret;
+	spin_lock_irqsave(&receiver->authorization_lock, flags);
+	if (receiver->writer_context != context || !receiver->session_active ||
+	    receiver->authorization_epoch != submit->authorization_epoch ||
+	    receiver->generation != submit->receiver_generation) {
+		ret = -EKEYREVOKED;
+	} else if (submit->dispatch_nonce <=
+		   receiver->session_max_dispatch_nonce) {
+		ret = -ENODATA;
+	} else if (receiver->next_kernel_sequence == U64_MAX) {
+		ret = -EOVERFLOW;
+	} else {
+		receiver->session_max_dispatch_nonce = submit->dispatch_nonce;
+		receiver->next_kernel_sequence++;
+		record->result.kernel_sequence = receiver->next_kernel_sequence;
+		ret = 0;
+	}
+	spin_unlock_irqrestore(&receiver->authorization_lock, flags);
+	if (ret)
+		return ret;
+
+	record->result.version = HFX_UAPI_NATIVE_ABI_VERSION;
+	record->result.size = sizeof(record->result);
+	record->result.receiver_generation = submit->receiver_generation;
+	record->result.authorization_epoch = submit->authorization_epoch;
+	record->result.dispatch_nonce = submit->dispatch_nonce;
+	record->result.endpoint_slot = submit->endpoint_slot;
+	record->result.certainty =
+		HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT;
+	memcpy(record->result.route_token_digest,
+	       submit->route_token_digest,
+	       sizeof(record->result.route_token_digest));
+	memcpy(record->result.request_digest, submit->request_digest,
+	       sizeof(record->result.request_digest));
+	memcpy(record->request, submit->report, sizeof(record->request));
+	list_add_tail(&record->node, &receiver->native_result_records);
+	receiver->native_result_count++;
+	return 0;
+}
+
+long hfx_native_exchange_submit(struct hfx_receiver *receiver,
+				struct hfx_file_context *context,
+				void __user *user_arg)
+{
+	struct hfx_uapi_native_exchange_submit *submit;
+	struct hfx_native_result_record *record;
+	struct hfx_native_result_tombstone *tombstone;
+	long ret;
+
+	if (!context->writer)
+		return -EACCES;
+	submit = kmalloc(sizeof(*submit), GFP_KERNEL);
+	if (!submit)
+		return -ENOMEM;
+	if (copy_from_user(submit, user_arg, sizeof(*submit))) {
+		ret = -EFAULT;
+		goto out_submit;
+	}
+	ret = hfx_native_submit_validate(receiver, submit);
+	if (ret)
+		goto out_submit;
+	if (submit->receiver_generation != receiver->generation) {
+		ret = -ESTALE;
+		goto out_submit;
+	}
+
+	mutex_lock(&receiver->transport_lock);
+	ret = hfx_session_check(receiver, context,
+				submit->receiver_generation,
+				submit->authorization_epoch);
+	if (ret)
+		goto out_unlock;
+	record = hfx_native_record_find_exact(
+		receiver, submit->receiver_generation, submit->dispatch_nonce,
+		submit->endpoint_slot, submit->route_token_digest,
+		submit->request_digest);
+	if (record) {
+		if (!hfx_native_record_matches_submit(record, submit)) {
+			hfx_session_revoke(
+				receiver, HFX_UAPI_REVOKE_REASON_SERVICE_LOSS);
+			ret = -EEXIST;
+			goto out_unlock;
+		}
+		submit->kernel_sequence = record->result.kernel_sequence;
+		ret = hfx_native_result_return_code(&record->result);
+		goto out_copy;
+	}
+	tombstone = hfx_native_tombstone_find_exact(
+		receiver, submit->receiver_generation, submit->dispatch_nonce,
+		submit->endpoint_slot, submit->route_token_digest,
+		submit->request_digest);
+	if (tombstone) {
+		if (!hfx_native_tombstone_matches_submit(tombstone, submit)) {
+			hfx_session_revoke(
+				receiver, HFX_UAPI_REVOKE_REASON_SERVICE_LOSS);
+			ret = -EEXIST;
+			goto out_unlock;
+		}
+		submit->kernel_sequence = tombstone->result.kernel_sequence;
+		ret = hfx_native_result_return_code(&tombstone->result);
+		goto out_copy;
+	}
+	if (hfx_native_record_find(receiver, submit->receiver_generation,
+				   submit->authorization_epoch,
+				   submit->dispatch_nonce) ||
+	    hfx_native_tombstone_find(receiver, submit->receiver_generation,
+				      submit->authorization_epoch,
+				      submit->dispatch_nonce)) {
+		hfx_session_revoke(receiver,
+				   HFX_UAPI_REVOKE_REASON_SERVICE_LOSS);
+		ret = -EEXIST;
+		goto out_unlock;
+	}
+
+	record = kzalloc(sizeof(*record), GFP_KERNEL);
+	if (!record) {
+		ret = -ENOMEM;
+		goto out_unlock;
+	}
+	INIT_LIST_HEAD(&record->node);
+	ret = hfx_native_reserve(receiver, context, submit, record);
+	if (ret) {
+		memzero_explicit(record, sizeof(*record));
+		kfree(record);
+		goto out_unlock;
+	}
+	submit->kernel_sequence = record->result.kernel_sequence;
+	ret = hfx_native_record_dispatch(receiver, context, record,
+					 submit->deadline_boottime_ns);
+out_copy:
+	if (copy_to_user(user_arg, submit, sizeof(*submit))) {
+		hfx_session_revoke(receiver,
+				   HFX_UAPI_REVOKE_REASON_SERVICE_LOSS);
+		ret = -EFAULT;
+	}
+out_unlock:
+	mutex_unlock(&receiver->transport_lock);
+out_submit:
+	memzero_explicit(submit, sizeof(*submit));
+	kfree(submit);
+	return ret;
+}
+
+static void hfx_native_synthetic(
+	struct hfx_uapi_native_exchange_result *result,
+	u32 certainty, int transport_errno)
+{
+	result->kernel_sequence = 0;
+	result->certainty = certainty;
+	result->transport_errno = transport_errno;
+	result->response_length = 0;
+	memzero_explicit(result->response, sizeof(result->response));
+	result->reserved = 0;
+}
+
+long hfx_native_exchange_get_result(struct hfx_receiver *receiver,
+				    struct hfx_file_context *context,
+				    void __user *user_arg)
+{
+	struct hfx_uapi_native_exchange_result query;
+	struct hfx_native_result_record *record;
+	struct hfx_native_result_tombstone *tombstone;
+	bool not_observed;
+	long ret = 0;
+
+	if (!context->writer)
+		return -EACCES;
+	if (copy_from_user(&query, user_arg, sizeof(query)))
+		return -EFAULT;
+	if (query.version != HFX_UAPI_NATIVE_ABI_VERSION ||
+	    query.size != sizeof(query))
+		return -EPROTO;
+	if (query.receiver_generation != receiver->generation)
+		return -ESTALE;
+	if (!query.dispatch_nonce ||
+	    (query.endpoint_slot != HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE &&
+	     query.endpoint_slot != HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE) ||
+	    !memchr_inv(query.route_token_digest, 0,
+			sizeof(query.route_token_digest)) ||
+	    !memchr_inv(query.request_digest, 0,
+			sizeof(query.request_digest)) ||
+	    query.certainty || query.transport_errno || query.response_length ||
+	    memchr_inv(query.response, 0, sizeof(query.response)) ||
+	    query.reserved)
+		return -EINVAL;
+
+	mutex_lock(&receiver->transport_lock);
+	record = hfx_native_record_find_exact(
+		receiver, query.receiver_generation, query.dispatch_nonce,
+		query.endpoint_slot, query.route_token_digest,
+		query.request_digest);
+	if (record) {
+		if (query.kernel_sequence &&
+		    query.kernel_sequence != record->result.kernel_sequence) {
+			hfx_native_synthetic(
+				&query,
+				HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+				-EEXIST);
+		} else {
+			query = record->result;
+		}
+		goto out_copy;
+	}
+	tombstone = hfx_native_tombstone_find_exact(
+		receiver, query.receiver_generation, query.dispatch_nonce,
+		query.endpoint_slot, query.route_token_digest,
+		query.request_digest);
+	if (tombstone) {
+		if (query.kernel_sequence &&
+		    query.kernel_sequence != tombstone->result.kernel_sequence) {
+			hfx_native_synthetic(
+				&query,
+				HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+				-EEXIST);
+		} else {
+			query = tombstone->result;
+		}
+		goto out_copy;
+	}
+	if (hfx_native_record_find(receiver, query.receiver_generation,
+				   query.authorization_epoch,
+				   query.dispatch_nonce) ||
+	    hfx_native_tombstone_find(receiver, query.receiver_generation,
+				      query.authorization_epoch,
+				      query.dispatch_nonce)) {
+		hfx_native_synthetic(
+			&query,
+			HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+			-EEXIST);
+		goto out_copy;
+	}
+	not_observed = hfx_session_nonce_not_observed(
+		receiver, context, query.authorization_epoch,
+		query.dispatch_nonce);
+	hfx_native_synthetic(
+		&query,
+		not_observed ? HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT :
+			       HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT,
+		-ENODATA);
+out_copy:
+	if (copy_to_user(user_arg, &query, sizeof(query)))
+		ret = -EFAULT;
+	mutex_unlock(&receiver->transport_lock);
+	memzero_explicit(&query, sizeof(query));
+	return ret;
+}
+
+void hfx_native_exchange_free_journal(struct hfx_receiver *receiver)
+{
+	struct hfx_native_result_record *record;
+	struct hfx_native_result_record *next;
+
+	list_for_each_entry_safe(record, next,
+				 &receiver->native_result_records, node) {
+		list_del(&record->node);
+		memzero_explicit(record, sizeof(*record));
+		kfree(record);
+	}
+	receiver->native_result_count = 0;
+}
diff --git a/driver/kernel/hyperflux-next-profile.c b/driver/kernel/hyperflux-next-profile.c
index 624e605..cca1af9 100644
--- a/driver/kernel/hyperflux-next-profile.c
+++ b/driver/kernel/hyperflux-next-profile.c
@@ -4,9 +4,9 @@
 
 #include "hyperflux-next-profile.h"
 
-#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
-	{ .vendor_id = (vendor), .product_id = (product), .backend_id = (backend), \
-	  .pairing_inventory_kind = (inventory) },
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, ...) \
+	{ .vendor_id = (vendor), .product_id = (product), \
+	  .backend_id = (backend), __VA_ARGS__ },
 
 static const struct hfx_receiver_profile hfx_receiver_profiles[] = {
 #include "generated/hyperflux_receiver_profiles.inc"
diff --git a/driver/kernel/hyperflux-next-profile.h b/driver/kernel/hyperflux-next-profile.h
index e7bf178..ba82ce7 100644
--- a/driver/kernel/hyperflux-next-profile.h
+++ b/driver/kernel/hyperflux-next-profile.h
@@ -9,11 +9,33 @@ enum hfx_pairing_inventory_kind {
 	HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1 = 1,
 };
 
+enum hfx_native_exchange_kind {
+	HFX_NATIVE_EXCHANGE_NONE = 0,
+	HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 = 1,
+};
+
+#define HFX_NATIVE_MATCH_RANGE_CAPACITY 4U
+
+struct hfx_native_match_range {
+	u16 offset;
+	u16 length;
+};
+
 struct hfx_receiver_profile {
 	u16 vendor_id;
 	u16 product_id;
 	u32 backend_id;
 	u32 pairing_inventory_kind;
+	u32 native_exchange_kind;
+	u16 native_report_bytes;
+	u16 native_set_report_index;
+	u16 native_response_report_index;
+	u16 native_max_response_attempts;
+	u16 native_match_range_count;
+	u32 native_initial_response_delay_us;
+	u32 native_response_retry_delay_us;
+	struct hfx_native_match_range
+		native_match_ranges[HFX_NATIVE_MATCH_RANGE_CAPACITY];
 };
 
 const struct hfx_receiver_profile *hfx_receiver_profile_find(u16 vendor_id,
diff --git a/driver/kernel/hyperflux-next-session.c b/driver/kernel/hyperflux-next-session.c
index dad938e..c971e91 100644
--- a/driver/kernel/hyperflux-next-session.c
+++ b/driver/kernel/hyperflux-next-session.c
@@ -353,6 +353,10 @@ static long hfx_session_ioctl(struct file *file, unsigned int command,
 		return hfx_transport_get_result(receiver, context, user_arg);
 	case HFX_UAPI_IOCTL_READ_OBSERVATIONS:
 		return hfx_observation_read(receiver, user_arg);
+	case HFX_UAPI_IOCTL_SUBMIT_NATIVE_EXCHANGE:
+		return hfx_native_exchange_submit(receiver, context, user_arg);
+	case HFX_UAPI_IOCTL_GET_NATIVE_EXCHANGE_RESULT:
+		return hfx_native_exchange_get_result(receiver, context, user_arg);
 	default:
 		return -ENOTTY;
 	}
diff --git a/driver/kernel/uapi/hyperflux_next.h b/driver/kernel/uapi/hyperflux_next.h
index e4882bd..493d5fd 100644
--- a/driver/kernel/uapi/hyperflux_next.h
+++ b/driver/kernel/uapi/hyperflux_next.h
@@ -1,6 +1,8 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /* UAPI source SHA-256: e93cdf3e8232d6178015125934b256b671e0560a2b934c193be29b250389e24f */
+/* UAPI registry SHA-256: 344fcd2b65d74efbaf133749260f64df127401777d06343c1b9dbd15bf0540df */
+/* UAPI native_exchange source native-exchange-v2.json SHA-256: bb9b3581815703a53346c5d9a1972ff84931c255103ca4a1ef224e9d3c5a61de */
 
 #ifndef _UAPI_HYPERFLUX_NEXT_H
 #define _UAPI_HYPERFLUX_NEXT_H
@@ -10,6 +12,7 @@
 
 #define HFX_UAPI_ABI_VERSION 1U
 #define HFX_UAPI_IOCTL_MAGIC 0xb7
+#define HFX_UAPI_NATIVE_ABI_VERSION 2U
 #define HFX_UAPI_DIGEST_BYTES 32U
 #define HFX_UAPI_NONCE_BYTES 32U
 #define HFX_UAPI_MAX_SESSION_NS 300000000000ULL
@@ -18,6 +21,10 @@
 #define HFX_UAPI_MAX_TRANSACTION_DELAY_US 1000000U
 #define HFX_UAPI_MAX_FRAMES 16U
 #define HFX_UAPI_MAX_OBSERVATIONS 32U
+#define HFX_UAPI_NATIVE_DIGEST_BYTES 32U
+#define HFX_UAPI_NATIVE_REPORT_BYTES 90U
+#define HFX_UAPI_NATIVE_MAX_RESULTS 128U
+#define HFX_UAPI_NATIVE_CONTROL_TIMEOUT_NS 1000000000U
 
 #define HFX_UAPI_INFO_FLAG_DISCONNECTING 1U
 #define HFX_UAPI_INFO_FLAG_SUSPENDED 2U
@@ -74,6 +81,10 @@
 
 #define HFX_UAPI_OBSERVATION_BATCH_FLAG_CURSOR_GAP 1U
 
+#define HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_NOT_SENT 1U
+#define HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MAY_HAVE_BEEN_SENT 2U
+#define HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE 3U
+
 struct hfx_uapi_info {
 	__u32 version;
 	__u32 size;
@@ -169,6 +180,38 @@ struct hfx_uapi_read_observations {
 	struct hfx_uapi_observation observations[HFX_UAPI_MAX_OBSERVATIONS];
 };
 
+struct hfx_uapi_native_exchange_submit {
+	__u32 version;
+	__u32 size;
+	__aligned_u64 receiver_generation;
+	__aligned_u64 authorization_epoch;
+	__aligned_u64 dispatch_nonce;
+	__aligned_u64 deadline_boottime_ns;
+	__u32 endpoint_slot;
+	__u32 report_length;
+	__u8 route_token_digest[HFX_UAPI_NATIVE_DIGEST_BYTES];
+	__u8 request_digest[HFX_UAPI_NATIVE_DIGEST_BYTES];
+	__u8 report[HFX_UAPI_NATIVE_REPORT_BYTES];
+	__aligned_u64 kernel_sequence;
+};
+
+struct hfx_uapi_native_exchange_result {
+	__u32 version;
+	__u32 size;
+	__aligned_u64 receiver_generation;
+	__aligned_u64 authorization_epoch;
+	__aligned_u64 kernel_sequence;
+	__aligned_u64 dispatch_nonce;
+	__u32 endpoint_slot;
+	__u32 certainty;
+	__u8 route_token_digest[HFX_UAPI_NATIVE_DIGEST_BYTES];
+	__u8 request_digest[HFX_UAPI_NATIVE_DIGEST_BYTES];
+	__s32 transport_errno;
+	__u32 response_length;
+	__u8 response[HFX_UAPI_NATIVE_REPORT_BYTES];
+	__u16 reserved;
+};
+
 #define HFX_UAPI_IOCTL_GET_INFO \
 	_IOR(HFX_UAPI_IOCTL_MAGIC, 0x00, \
 		struct hfx_uapi_info)
@@ -187,5 +230,11 @@ struct hfx_uapi_read_observations {
 #define HFX_UAPI_IOCTL_READ_OBSERVATIONS \
 	_IOWR(HFX_UAPI_IOCTL_MAGIC, 0x05, \
 		struct hfx_uapi_read_observations)
+#define HFX_UAPI_IOCTL_SUBMIT_NATIVE_EXCHANGE \
+	_IOWR(HFX_UAPI_IOCTL_MAGIC, 0x06, \
+		struct hfx_uapi_native_exchange_submit)
+#define HFX_UAPI_IOCTL_GET_NATIVE_EXCHANGE_RESULT \
+	_IOWR(HFX_UAPI_IOCTL_MAGIC, 0x07, \
+		struct hfx_uapi_native_exchange_result)
 
 #endif
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 819740b..61bb91c 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "287f279c6bb36b725cf056a20ad01a0bf68e9a28d9243e2ab7d69ff1a2ce5c72",
+  "source_sha256": "fba23260a420dc6bdc3de6795e840757436ef051132787579a23be3a5436d020",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index 5b25845..cd4dc2b 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1442,7 +1442,7 @@
         "The receiver and mat do not appear as addressable RGB controllers."
       ],
       "revision": 2,
-      "runtime_sha256": "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6",
+      "runtime_sha256": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/receivers/razer-hyperflux-v2-1532-00cf.json",
       "transport": {
@@ -1451,6 +1451,25 @@
         "backend_id": 1,
         "generation_bound": true,
         "maximum_targets": 115,
+        "native_exchange": {
+          "initial_response_delay_us": 8000,
+          "match_ranges": [
+            {
+              "length": 2,
+              "offset": 2
+            },
+            {
+              "length": 2,
+              "offset": 6
+            }
+          ],
+          "max_response_attempts": 5,
+          "protocol_family": "razer-feature-report-v1",
+          "report_bytes": 90,
+          "response_report_index": 0,
+          "response_retry_delay_us": 10000,
+          "set_report_index": 0
+        },
         "pairing_inventory": {
           "decoder": "razer-hyperflux-v2-feature-01-v1"
         }
@@ -1505,5 +1524,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
+  "source_sha256": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
 }
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 79ba571..3a9933d 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -102,6 +102,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "kernel-source",
+      "source": "driver/kernel/hyperflux-next-native.c",
+      "destination": "/usr/src/hid-hyperflux-next-0.0.0_dev.1/hyperflux-next-native.c",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "kernel-source",
       "source": "driver/kernel/hyperflux-next-observation.c",
@@ -396,6 +403,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/kernel-uapi-native-exchange.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/kernel-uapi-native-exchange.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/kernel-uapi-registry.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/kernel-uapi-registry.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/kernel-uapi.schema.json",
@@ -844,6 +865,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp",
+      "destination": "/usr/include/hyperflux/generated/protocol_v7_json.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp",
+      "destination": "/usr/include/hyperflux/generated/protocol_v7_types.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/sdk.hpp",
@@ -1019,6 +1054,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "documentation",
+      "source": "docs/generated/bridge-protocol-v7.md",
+      "destination": "/usr/share/doc/hyperflux-next/generated/bridge-protocol-v7.md",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "documentation",
       "source": "docs/generated/bridge-protocol.md",
diff --git a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
index 4b1588c..7d0d990 100644
--- a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
+++ b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
@@ -7,7 +7,27 @@
   "device_kind": "receiver",
   "identity": {"manufacturer": "Razer", "model_name": "Razer HyperFlux V2 Receiver", "authority": "usb", "vendor_id": 5426, "product_id": 207},
   "compatibility": {"protocol_family": "razer-hyperflux-v2", "supported_child_kinds": ["keyboard", "mouse"], "exact_child_combinations": false},
-  "transport": {"backend": "structured-feature-set-report-v1", "backend_id": 1, "maximum_targets": 115, "generation_bound": true, "application_raw_frames": false, "pairing_inventory": {"decoder": "razer-hyperflux-v2-feature-01-v1"}},
+  "transport": {
+    "backend": "structured-feature-set-report-v1",
+    "backend_id": 1,
+    "maximum_targets": 115,
+    "generation_bound": true,
+    "application_raw_frames": false,
+    "pairing_inventory": {"decoder": "razer-hyperflux-v2-feature-01-v1"},
+    "native_exchange": {
+      "protocol_family": "razer-feature-report-v1",
+      "report_bytes": 90,
+      "set_report_index": 0,
+      "response_report_index": 0,
+      "initial_response_delay_us": 8000,
+      "response_retry_delay_us": 10000,
+      "max_response_attempts": 5,
+      "match_ranges": [
+        {"offset": 2, "length": 2},
+        {"offset": 6, "length": 2}
+      ]
+    }
+  },
   "capabilities": [
     {"id": "identity.model", "support_level": "identified", "evidence_claims": ["claim.receiver.1532-00cf.generation-session"]},
     {"id": "identity.paired-product-id", "support_level": "read-only", "evidence_claims": ["claim.receiver.1532-00cf.generation-session"]},
diff --git a/protocol/registry.json b/protocol/registry.json
index 35af89a..b044af3 100644
--- a/protocol/registry.json
+++ b/protocol/registry.json
@@ -1,7 +1,7 @@
 {
   "$schema": "../schemas/protocol-registry.schema.json",
   "schema": "hyperflux-protocol-registry-v1",
-  "current_version": 6,
+  "current_version": 7,
   "versions": [
     {
       "version": 1,
@@ -38,6 +38,12 @@
       "catalog": "v6/catalog.json",
       "sha256": "6b7b16aeae887979de5f75fb82959450c55179dbed3142450939fd7ee8f8ce54",
       "served_features": ["atomic-transactions", "event-subscriptions", "integration-view-projection", "ownership-leases", "profile-bound-transactions", "return-lifecycle-projection", "semantic-stable-lighting", "snapshot-profile-bindings", "structured-diagnostics"]
+    },
+    {
+      "version": 7,
+      "catalog": "v7/catalog.json",
+      "sha256": "39443b1babed1e7f94824dcb3379f9572563263592841fda21378c14aff3bd34",
+      "served_features": ["atomic-transactions", "event-subscriptions", "integration-view-projection", "native-receiver-tunnel", "ownership-leases", "profile-bound-transactions", "return-lifecycle-projection", "semantic-stable-lighting", "snapshot-profile-bindings", "structured-diagnostics"]
     }
   ]
 }
diff --git a/protocol/v7/catalog.json b/protocol/v7/catalog.json
new file mode 100644
index 0000000..833feb5
--- /dev/null
+++ b/protocol/v7/catalog.json
@@ -0,0 +1,677 @@
+{
+  "$schema": "../../schemas/protocol-catalog.schema.json",
+  "schema": "hyperflux-protocol-catalog-v1",
+  "minimum_version": 7,
+  "maximum_version": 7,
+  "limits": {
+    "max_message_bytes": 1048576,
+    "max_json_depth": 128
+  },
+  "features": ["ownership-leases", "atomic-transactions", "profile-bound-transactions", "semantic-stable-lighting", "snapshot-profile-bindings", "integration-view-projection", "event-subscriptions", "structured-diagnostics", "return-lifecycle-projection", "native-receiver-tunnel"],
+  "records": [
+    {
+      "name": "EmptyRequest",
+      "description": "A method request with no method-specific fields.",
+      "fields": []
+    },
+    {
+      "name": "RgbColor",
+      "description": "One canonical eight-bit RGB color.",
+      "fields": [
+        {"name": "red", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Red channel."},
+        {"name": "green", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Green channel."},
+        {"name": "blue", "type": "ColorChannel", "required": true, "many": false, "max_items": null, "description": "Blue channel."}
+      ]
+    },
+    {
+      "name": "ClientHello",
+      "description": "Bounded client protocol and feature offer.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Process-scoped client identity."},
+        {"name": "client_name", "type": "ClientName", "required": true, "many": false, "max_items": null, "description": "User-facing application name."},
+        {"name": "minimum_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Oldest protocol accepted by the client."},
+        {"name": "maximum_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Newest protocol accepted by the client."},
+        {"name": "required_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Features without which this client cannot operate."},
+        {"name": "optional_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Features the client can use when available."}
+      ]
+    },
+    {
+      "name": "ServerHello",
+      "description": "Negotiated protocol version and bridge feature set.",
+      "fields": [
+        {"name": "selected_version", "type": "ProtocolVersion", "required": true, "many": false, "max_items": null, "description": "Mutually supported protocol version."},
+        {"name": "server_instance_id", "type": "ServerInstanceId", "required": true, "many": false, "max_items": null, "description": "Changes whenever the bridge process identity changes."},
+        {"name": "protocol_session_id", "type": "ProtocolSessionId", "required": true, "many": false, "max_items": null, "description": "Server-issued connection ownership identity."},
+        {"name": "negotiation_token", "type": "NegotiationToken", "required": true, "many": false, "max_items": null, "description": "Binds subsequent requests to this negotiated selection."},
+        {"name": "bridge_version", "type": "ComponentVersion", "required": true, "many": false, "max_items": null, "description": "Bridge component version."},
+        {"name": "enabled_features", "type": "ProtocolFeatureId", "required": true, "many": true, "max_items": 64, "description": "Protocol features enabled for this connection."},
+        {"name": "event_buffer_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Maximum retained event count."}
+      ]
+    },
+    {
+      "name": "ResourceKey",
+      "description": "One device-scoped writable resource.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Receiver that owns the route."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Receiver generation to which ownership is bound."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical resource owner."},
+        {"name": "kind", "type": "ResourceKind", "required": true, "many": false, "max_items": null, "description": "Generic resource domain."}
+      ]
+    },
+    {
+      "name": "LeaseRequest",
+      "description": "Atomic request for one or more writable resources.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Requesting client."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Complete atomic resource set."},
+        {"name": "duration_ms", "type": "LeaseDurationMs", "required": true, "many": false, "max_items": null, "description": "Renewable lease duration."}
+      ]
+    },
+    {
+      "name": "LeaseGrant",
+      "description": "Granted ownership lease.",
+      "fields": [
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Atomically owned resources."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive monotonic expiry."},
+        {"name": "state", "type": "LeaseState", "required": true, "many": false, "max_items": null, "description": "Current lease state."}
+      ]
+    },
+    {
+      "name": "LeaseConflict",
+      "description": "Deterministic first conflict from an otherwise atomic lease request.",
+      "fields": [
+        {"name": "conflicting_client", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owner."},
+        {"name": "conflicting_resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "First conflict in canonical resource order."}
+      ]
+    },
+    {
+      "name": "LeaseRejection",
+      "description": "Structured lease rejection unrelated to another owner.",
+      "fields": [
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Stable rejection category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central error catalog reference."}
+      ]
+    },
+    {
+      "name": "RenewLeaseRequest",
+      "description": "Idempotent renewal of one existing lease.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease to renew."},
+        {"name": "duration_ms", "type": "LeaseDurationMs", "required": true, "many": false, "max_items": null, "description": "New bounded duration."}
+      ]
+    },
+    {
+      "name": "ReleaseLeaseRequest",
+      "description": "Idempotent release of one existing lease.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Lease to release."}
+      ]
+    },
+    {
+      "name": "EventCursor",
+      "description": "Complete resumable position in one event stream projection.",
+      "fields": [
+        {"name": "stream_id", "type": "StreamId", "required": true, "many": false, "max_items": null, "description": "Bridge event-stream identity."},
+        {"name": "stream_epoch", "type": "StreamEpoch", "required": true, "many": false, "max_items": null, "description": "Changes whenever the event stream restarts."},
+        {"name": "projection_revision", "type": "ProjectionRevision", "required": true, "many": false, "max_items": null, "description": "Snapshot and event projection contract revision."},
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Last event reflected by this cursor."}
+      ]
+    },
+    {
+      "name": "ReturnEpoch",
+      "description": "Generation-bound endpoint return state without claiming physical lighting application.",
+      "fields": [
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Receiver generation that owns the epoch."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical child whose endpoint is returning."},
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Exact endpoint whose return is tracked."},
+        {"name": "epoch_sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Opening evidence sequence for stale-event rejection."},
+        {"name": "opened_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Bridge-local monotonic epoch opening time."},
+        {"name": "opening_evidence", "type": "ReturnEvidence", "required": true, "many": false, "max_items": null, "description": "Typed passive evidence that opened the epoch."},
+        {"name": "phase", "type": "ReturnPhase", "required": true, "many": false, "max_items": null, "description": "Current endpoint return phase."},
+        {"name": "delivery_state", "type": "RestoreDeliveryState", "required": true, "many": false, "max_items": null, "description": "Strongest known replay-delivery fact."}
+      ]
+    },
+    {
+      "name": "EndpointSnapshot",
+      "description": "Independent route, power, sleep, activity, contact, and freshness facts.",
+      "fields": [
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Stable logical route identity."},
+        {"name": "route_kind", "type": "RouteKind", "required": true, "many": false, "max_items": null, "description": "Transport route category."},
+        {"name": "route_state", "type": "RouteState", "required": true, "many": false, "max_items": null, "description": "Current route evidence."},
+        {"name": "connection_mode", "type": "ConnectionMode", "required": true, "many": false, "max_items": null, "description": "User-facing connection mode."},
+        {"name": "power_state", "type": "PowerState", "required": true, "many": false, "max_items": null, "description": "Explicit power evidence, independent of route."},
+        {"name": "sleep_state", "type": "SleepState", "required": true, "many": false, "max_items": null, "description": "Explicit sleep evidence."},
+        {"name": "activity_state", "type": "ActivityState", "required": true, "many": false, "max_items": null, "description": "Recent activity evidence."},
+        {"name": "contact_state", "type": "ContactState", "required": true, "many": false, "max_items": null, "description": "Mat-contact evidence where applicable."},
+        {"name": "freshness", "type": "FreshnessState", "required": true, "many": false, "max_items": null, "description": "Freshness of the route projection."},
+        {"name": "confidence", "type": "EvidenceConfidence", "required": true, "many": false, "max_items": null, "description": "How directly the state was established."},
+        {"name": "evidence_claim_id", "type": "EvidenceClaimId", "required": false, "many": false, "max_items": null, "description": "Privacy-safe evidence provenance when available."},
+        {"name": "observed_at_ms", "type": "MonotonicMs", "required": false, "many": false, "max_items": null, "description": "Bridge-local observation instant."},
+        {"name": "return_epoch", "type": "ReturnEpoch", "required": false, "many": false, "max_items": null, "description": "Optional versioned return projection; receiver delivery alone never means child application."}
+      ]
+    },
+    {
+      "name": "BatteryObservation",
+      "description": "Battery availability and value without collapsing unknown and unavailable.",
+      "fields": [
+        {"name": "availability", "type": "TelemetryAvailability", "required": true, "many": false, "max_items": null, "description": "Whether a current value exists."},
+        {"name": "percentage", "type": "BatteryPercent", "required": false, "many": false, "max_items": null, "description": "Reported value only when availability is reported."},
+        {"name": "freshness", "type": "FreshnessState", "required": true, "many": false, "max_items": null, "description": "Freshness of the battery observation."},
+        {"name": "confidence", "type": "EvidenceConfidence", "required": true, "many": false, "max_items": null, "description": "How directly the value was established."},
+        {"name": "observed_at_ms", "type": "MonotonicMs", "required": false, "many": false, "max_items": null, "description": "Bridge-local observation instant."}
+      ]
+    },
+    {
+      "name": "ResourceOwnershipSnapshot",
+      "description": "Current bounded application ownership for one generation-scoped resource.",
+      "fields": [
+        {"name": "resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "Owned resource."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Authorizing lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock expiry."}
+      ]
+    },
+    {
+      "name": "LogicalDeviceSnapshot",
+      "description": "Application-neutral logical controller state.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical identity."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Device category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed product id."},
+        {"name": "profile_id", "type": "ProfileId", "required": false, "many": false, "max_items": null, "description": "Qualified profile when available."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": false, "many": false, "max_items": null, "description": "Immutable qualified child profile digest when available."},
+        {"name": "pairing", "type": "PairingState", "required": true, "many": false, "max_items": null, "description": "Receiver inventory state independent of route."},
+        {"name": "presence", "type": "PresenceState", "required": true, "many": false, "max_items": null, "description": "Derived controller presence."},
+        {"name": "support_level", "type": "SupportLevel", "required": true, "many": false, "max_items": null, "description": "Evidence-backed support level."},
+        {"name": "endpoints", "type": "EndpointSnapshot", "required": true, "many": true, "max_items": 8, "description": "Independent known routes in canonical endpoint order."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Current battery projection."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."}
+      ]
+    },
+    {
+      "name": "ReceiverSnapshot",
+      "description": "Generation-bound receiver and child inventory.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Logical receiver identity."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Current receiver generation."},
+        {"name": "profile_id", "type": "ProfileId", "required": false, "many": false, "max_items": null, "description": "Exact qualified receiver profile when available."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": false, "many": false, "max_items": null, "description": "Immutable qualified receiver profile digest when available."},
+        {"name": "lifecycle", "type": "ReceiverLifecycleState", "required": true, "many": false, "max_items": null, "description": "Receiver lifecycle state."},
+        {"name": "devices", "type": "LogicalDeviceSnapshot", "required": true, "many": true, "max_items": 32, "description": "Independent logical children."},
+        {"name": "ownership", "type": "ResourceOwnershipSnapshot", "required": true, "many": true, "max_items": 96, "description": "Current generation-scoped write ownership."},
+        {"name": "stable_restore_enabled", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether stable state restoration is enabled."},
+        {"name": "restore_state", "type": "RestoreState", "required": true, "many": false, "max_items": null, "description": "Current restoration state."}
+      ]
+    },
+    {
+      "name": "BridgeSnapshot",
+      "description": "Sequence-bound complete bridge snapshot.",
+      "fields": [
+        {"name": "cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Complete event position reflected by this snapshot."},
+        {"name": "receivers", "type": "ReceiverSnapshot", "required": true, "many": true, "max_items": 16, "description": "Exactly one current generation per receiver in canonical order."}
+      ]
+    },
+    {
+      "name": "LightingFrame",
+      "description": "One logical-device direct-mode frame.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Frame target."},
+        {"name": "frame_index", "type": "FrameIndex", "required": true, "many": false, "max_items": null, "description": "Transaction-local frame order."},
+        {"name": "colors", "type": "RgbColor", "required": true, "many": true, "max_items": 4096, "description": "Logical LED colors before carrier translation."}
+      ]
+    },
+    {
+      "name": "DeviceProfileBinding",
+      "description": "Exact profile and lighting dimensions bound to one transaction target.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical transaction target."},
+        {"name": "profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Qualified child profile selected at admission."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable profile-catalog digest selected at admission."},
+        {"name": "application_slot_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Exact logical color count required by this profile."}
+      ]
+    },
+    {
+      "name": "StableLightingIntent",
+      "description": "Explicit semantic stable-lighting intent for one frame target.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical stable-lighting target."},
+        {"name": "mode", "type": "StableLightingMode", "required": true, "many": false, "max_items": null, "description": "Stable Static or Off meaning independent of RGB payload values."}
+      ]
+    },
+    {
+      "name": "TransactionRequest",
+      "description": "Atomic generation- and ownership-bound operation.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Idempotency identity."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Submitting client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Atomic ownership proof."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Receiver target."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Generation binding."},
+        {"name": "receiver_profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Exact qualified receiver profile selected at admission."},
+        {"name": "receiver_profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable receiver profile-catalog digest selected at admission."},
+        {"name": "device_profiles", "type": "DeviceProfileBinding", "required": true, "many": true, "max_items": 32, "description": "Complete canonical profile binding for every frame target."},
+        {"name": "transaction_class", "type": "TransactionClass", "required": true, "many": false, "max_items": null, "description": "Ordering and coalescing class."},
+        {"name": "stable_intents", "type": "StableLightingIntent", "required": true, "many": true, "max_items": 32, "description": "Canonical per-target semantic intent for static-lighting; empty for every other transaction class."},
+        {"name": "deadline_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Absolute monotonic deadline."},
+        {"name": "resources", "type": "ResourceKey", "required": true, "many": true, "max_items": 32, "description": "Complete ownership set."},
+        {"name": "frames", "type": "LightingFrame", "required": true, "many": true, "max_items": 32, "description": "Complete atomic frame batch."}
+      ]
+    },
+    {
+      "name": "TransactionProgress",
+      "description": "Nonterminal generation-bound transaction projection.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Original idempotency identity."},
+        {"name": "request_digest", "type": "RequestDigest", "required": true, "many": false, "max_items": null, "description": "Canonical request digest used for exact replay."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Bound receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Bound receiver generation."},
+        {"name": "state", "type": "TransactionState", "required": true, "many": false, "max_items": null, "description": "Current nonterminal state."},
+        {"name": "admission", "type": "QueueAdmission", "required": true, "many": false, "max_items": null, "description": "Bounded queue decision."},
+        {"name": "declared_frames", "type": "FrameCount", "required": true, "many": false, "max_items": null, "description": "Frames promised by the transaction."},
+        {"name": "delivered_frames", "type": "DeliveredFrameCount", "required": true, "many": false, "max_items": null, "description": "Frames terminally accepted so far."},
+        {"name": "side_effect_certainty", "type": "SideEffectCertainty", "required": true, "many": false, "max_items": null, "description": "Current transport side-effect knowledge."},
+        {"name": "live_write_executed", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether transport has begun a hardware write."}
+      ]
+    },
+    {
+      "name": "TransactionTerminal",
+      "description": "Immutable terminal transaction outcome retained for bounded lookup.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Original idempotency identity."},
+        {"name": "request_digest", "type": "RequestDigest", "required": true, "many": false, "max_items": null, "description": "Canonical request digest used for exact replay."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction identity."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Bound receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Bound receiver generation."},
+        {"name": "state", "type": "TransactionState", "required": true, "many": false, "max_items": null, "description": "Terminal succeeded, failed, revoked, or superseded state."},
+        {"name": "declared_frames", "type": "FrameCount", "required": true, "many": false, "max_items": null, "description": "Frames promised by the transaction."},
+        {"name": "delivered_frames", "type": "DeliveredFrameCount", "required": true, "many": false, "max_items": null, "description": "Frames terminally accepted by transport."},
+        {"name": "side_effect_certainty", "type": "SideEffectCertainty", "required": true, "many": false, "max_items": null, "description": "Terminal transport side-effect knowledge."},
+        {"name": "live_write_executed", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether transport began a hardware write."},
+        {"name": "automatic_retry", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether exact automatic replay is safe; false after possible transport."},
+        {"name": "device_application", "type": "DeviceApplicationState", "required": true, "many": false, "max_items": null, "description": "Separate child-application evidence."},
+        {"name": "terminal_sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Immutable completion event sequence."},
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": false, "many": false, "max_items": null, "description": "Structured failure category."},
+        {"name": "superseded_by", "type": "TransactionId", "required": false, "many": false, "max_items": null, "description": "Newer unsent effect transaction that replaced this one."}
+      ]
+    },
+    {
+      "name": "TransactionUnavailable",
+      "description": "Outcome lookup cannot return a retained transaction record.",
+      "fields": [
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Requested transaction identity."},
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Unknown or evicted outcome category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central error catalog reference."}
+      ]
+    },
+    {
+      "name": "TransactionLookup",
+      "description": "Idempotent lookup of one previously submitted transaction.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Lookup request identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Original transaction owner."},
+        {"name": "transaction_id", "type": "TransactionId", "required": true, "many": false, "max_items": null, "description": "Transaction to inspect."}
+      ]
+    },
+    {
+      "name": "SubscriptionRequest",
+      "description": "Bounded event subscription cursor.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Subscribing client."},
+        {"name": "subscription_id", "type": "SubscriptionId", "required": false, "many": false, "max_items": null, "description": "Server-issued subscription identity when continuing."},
+        {"name": "expected_cursor", "type": "EventCursor", "required": false, "many": false, "max_items": null, "description": "Previously observed complete event cursor."},
+        {"name": "max_events", "type": "EventBatchLimit", "required": true, "many": false, "max_items": null, "description": "Maximum events requested in this batch."}
+      ]
+    },
+    {
+      "name": "BridgeEvent",
+      "description": "Sequence-bound typed event with snapshot references.",
+      "fields": [
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Strictly increasing sequence."},
+        {"name": "kind", "type": "EventKind", "required": true, "many": false, "max_items": null, "description": "Typed event category."},
+        {"name": "receiver_id", "type": "ReceiverId", "required": false, "many": false, "max_items": null, "description": "Affected receiver when applicable."},
+        {"name": "generation_id", "type": "GenerationId", "required": false, "many": false, "max_items": null, "description": "Affected generation when applicable."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": false, "many": false, "max_items": null, "description": "Affected logical device when applicable."},
+        {"name": "lease_id", "type": "LeaseId", "required": false, "many": false, "max_items": null, "description": "Affected lease when applicable."},
+        {"name": "transaction_id", "type": "TransactionId", "required": false, "many": false, "max_items": null, "description": "Affected transaction when applicable."},
+        {"name": "finding_id", "type": "FindingId", "required": false, "many": false, "max_items": null, "description": "Affected finding when applicable."}
+      ]
+    },
+    {
+      "name": "EventBatch",
+      "description": "Bounded event result with explicit cursor-gap state.",
+      "fields": [
+        {"name": "subscription_id", "type": "SubscriptionId", "required": true, "many": false, "max_items": null, "description": "Subscription identity."},
+        {"name": "next_cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Cursor to supply for the next batch."},
+        {"name": "events", "type": "BridgeEvent", "required": true, "many": true, "max_items": 256, "description": "Events after the requested cursor."},
+        {"name": "oldest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Oldest retained sequence."},
+        {"name": "latest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Newest retained sequence."},
+        {"name": "dropped_events", "type": "DroppedEventCount", "required": true, "many": false, "max_items": null, "description": "Events evicted since this stream epoch began."},
+        {"name": "cursor_gap", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether the client must refresh its snapshot."},
+        {"name": "has_more", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether another retained event follows this batch."}
+      ]
+    },
+    {
+      "name": "DiagnosticFinding",
+      "description": "One privacy-classified actionable finding.",
+      "fields": [
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Stable finding code."},
+        {"name": "severity", "type": "ErrorSeverity", "required": true, "many": false, "max_items": null, "description": "User-facing severity."},
+        {"name": "cause", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Bounded technical cause."},
+        {"name": "explanation", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Plain user explanation."},
+        {"name": "safe_action", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "One safe remediation."},
+        {"name": "privacy", "type": "PrivacyClass", "required": true, "many": false, "max_items": null, "description": "Support-output privacy class."},
+        {"name": "documentation", "type": "DocumentationPath", "required": true, "many": false, "max_items": null, "description": "Stable documentation path."}
+      ]
+    },
+    {
+      "name": "DiagnosticSnapshot",
+      "description": "Bounded bridge findings and queue health.",
+      "fields": [
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Latest reflected event sequence."},
+        {"name": "findings", "type": "DiagnosticFinding", "required": true, "many": true, "max_items": 128, "description": "Active actionable findings."},
+        {"name": "event_buffer_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Configured event bound."},
+        {"name": "transaction_queue_capacity", "type": "QueueCapacity", "required": true, "many": false, "max_items": null, "description": "Configured transaction bound."}
+      ]
+    },
+    {
+      "name": "ProfileBindingView",
+      "description": "Exact immutable profile authority exposed to integrations.",
+      "fields": [
+        {"name": "profile_id", "type": "ProfileId", "required": true, "many": false, "max_items": null, "description": "Qualified profile identity."},
+        {"name": "profile_digest", "type": "ProfileDigest", "required": true, "many": false, "max_items": null, "description": "Immutable runtime profile digest."}
+      ]
+    },
+    {
+      "name": "DeviceInventoryView",
+      "description": "Truthful paired-device inventory independent of application controller registration.",
+      "fields": [
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical device identity."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Device category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed product id."},
+        {"name": "profile", "type": "ProfileBindingView", "required": false, "many": false, "max_items": null, "description": "Exact qualified child profile when available."},
+        {"name": "model_name", "type": "ModelName", "required": false, "many": false, "max_items": null, "description": "Qualified model name when available."},
+        {"name": "pairing", "type": "PairingState", "required": true, "many": false, "max_items": null, "description": "Receiver pairing truth."},
+        {"name": "presence", "type": "PresenceState", "required": true, "many": false, "max_items": null, "description": "Derived device presence."},
+        {"name": "availability", "type": "InventoryAvailability", "required": true, "many": false, "max_items": null, "description": "Inventory-facing availability with receiver and pairing context."},
+        {"name": "support_level", "type": "SupportLevel", "required": true, "many": false, "max_items": null, "description": "Evidence-backed support level."},
+        {"name": "endpoints", "type": "EndpointSnapshot", "required": true, "many": true, "max_items": 8, "description": "Independent known routes."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Battery truth without collapsing unavailable states."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."}
+      ]
+    },
+    {
+      "name": "PresentationView",
+      "description": "Pinned upstream presentation authority without hardware transport policy.",
+      "fields": [
+        {"name": "upstream_id", "type": "UpstreamId", "required": true, "many": false, "max_items": null, "description": "Pinned upstream catalog identity."},
+        {"name": "owner", "type": "UpstreamOwner", "required": true, "many": false, "max_items": null, "description": "Upstream project responsible for presentation."},
+        {"name": "project_version", "type": "ComponentVersion", "required": true, "many": false, "max_items": null, "description": "Pinned upstream project version."},
+        {"name": "source_revision", "type": "SourceRevision", "required": true, "many": false, "max_items": null, "description": "Pinned upstream source revision."},
+        {"name": "model_key", "type": "PresentationKey", "required": true, "many": false, "max_items": null, "description": "Upstream model registry key."},
+        {"name": "layout_key", "type": "PresentationKey", "required": false, "many": false, "max_items": null, "description": "Upstream layout registry key when applicable."},
+        {"name": "transport_variant", "type": "TransportVariant", "required": true, "many": false, "max_items": null, "description": "Presentation variant for this route."}
+      ]
+    },
+    {
+      "name": "LightingTopologyView",
+      "description": "Application-facing lighting dimensions without receiver carrier mapping.",
+      "fields": [
+        {"name": "physical_led_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Physically illuminated LED count."},
+        {"name": "application_slot_count", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Exact application color count."},
+        {"name": "rows", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Application layout row count."},
+        {"name": "columns", "type": "LedCount", "required": true, "many": false, "max_items": null, "description": "Application layout column count."}
+      ]
+    },
+    {
+      "name": "UnownedController",
+      "description": "Writable controller currently has no application owner.",
+      "fields": []
+    },
+    {
+      "name": "ViewerOwnedController",
+      "description": "Writable controller is owned by the requesting client.",
+      "fields": [
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Current ownership lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock lease expiry."}
+      ]
+    },
+    {
+      "name": "OtherOwnedController",
+      "description": "Writable controller is owned by another application client.",
+      "fields": [
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Current owning client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Current ownership lease."},
+        {"name": "expires_at_ms", "type": "MonotonicMs", "required": true, "many": false, "max_items": null, "description": "Exclusive bridge-clock lease expiry."}
+      ]
+    },
+    {
+      "name": "ControllerActions",
+      "description": "Viewer-specific actions derived from availability and ownership.",
+      "fields": [
+        {"name": "can_acquire", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer may atomically acquire this resource."},
+        {"name": "can_release", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer may release its current lease."},
+        {"name": "can_submit_now", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Viewer owns a currently writable route."}
+      ]
+    },
+    {
+      "name": "ControllerView",
+      "description": "Exact qualified receiver-backed application controller.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Owning receiver."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Generation binding."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical controller identity."},
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Exact usable receiver endpoint."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Controller category."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Qualified product id."},
+        {"name": "receiver_profile", "type": "ProfileBindingView", "required": true, "many": false, "max_items": null, "description": "Exact receiver profile authority."},
+        {"name": "device_profile", "type": "ProfileBindingView", "required": true, "many": false, "max_items": null, "description": "Exact child profile authority."},
+        {"name": "model_name", "type": "ModelName", "required": true, "many": false, "max_items": null, "description": "Qualified model name."},
+        {"name": "presentation", "type": "PresentationView", "required": true, "many": false, "max_items": null, "description": "Pinned application presentation authority."},
+        {"name": "availability", "type": "ControllerAvailability", "required": true, "many": false, "max_items": null, "description": "Ready or sleeping controller state."},
+        {"name": "battery", "type": "BatteryObservation", "required": true, "many": false, "max_items": null, "description": "Current battery projection."},
+        {"name": "capabilities", "type": "CapabilityId", "required": true, "many": true, "max_items": 128, "description": "Qualified semantic capabilities."},
+        {"name": "lighting", "type": "LightingTopologyView", "required": true, "many": false, "max_items": null, "description": "Application-facing lighting dimensions."},
+        {"name": "resource", "type": "ResourceKey", "required": true, "many": false, "max_items": null, "description": "Generation-scoped lighting ownership resource."},
+        {"name": "ownership", "type": "ControllerOwnership", "required": true, "many": false, "max_items": null, "description": "Viewer-specific ownership state."},
+        {"name": "actions", "type": "ControllerActions", "required": true, "many": false, "max_items": null, "description": "Viewer-specific safe actions."}
+      ]
+    },
+    {
+      "name": "IntegrationReceiverView",
+      "description": "One receiver generation with complete inventory and qualified controllers.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Logical receiver identity."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Current receiver generation."},
+        {"name": "profile", "type": "ProfileBindingView", "required": false, "many": false, "max_items": null, "description": "Exact receiver profile when qualified."},
+        {"name": "model_name", "type": "ModelName", "required": false, "many": false, "max_items": null, "description": "Qualified receiver model name."},
+        {"name": "lifecycle", "type": "ReceiverLifecycleState", "required": true, "many": false, "max_items": null, "description": "Current receiver lifecycle."},
+        {"name": "stable_restore_enabled", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Stable lighting restore policy."},
+        {"name": "restore_state", "type": "RestoreState", "required": true, "many": false, "max_items": null, "description": "Current restoration state."},
+        {"name": "inventory", "type": "DeviceInventoryView", "required": true, "many": true, "max_items": 32, "description": "Complete paired and observed inventory."},
+        {"name": "controllers", "type": "ControllerView", "required": true, "many": true, "max_items": 32, "description": "Exact qualified application controllers."}
+      ]
+    },
+    {
+      "name": "IntegrationView",
+      "description": "Client-specific application view projected once by bridge policy.",
+      "fields": [
+        {"name": "cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Complete event position reflected by the projection."},
+        {"name": "receivers", "type": "IntegrationReceiverView", "required": true, "many": true, "max_items": 16, "description": "Current receiver integration projections."}
+      ]
+    },
+    {
+      "name": "NativeRoute",
+      "description": "One generation-bound receiver child route without a host device path.",
+      "fields": [
+        {"name": "receiver_id", "type": "ReceiverId", "required": true, "many": false, "max_items": null, "description": "Receiver that owns this route."},
+        {"name": "generation_id", "type": "GenerationId", "required": true, "many": false, "max_items": null, "description": "Exact receiver generation binding."},
+        {"name": "device_id", "type": "LogicalDeviceId", "required": true, "many": false, "max_items": null, "description": "Logical child device identity."},
+        {"name": "endpoint_id", "type": "EndpointId", "required": true, "many": false, "max_items": null, "description": "Exact receiver child endpoint."},
+        {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Observed child device category."},
+        {"name": "vendor_id", "type": "VendorId", "required": true, "many": false, "max_items": null, "description": "Observed child USB vendor identifier."},
+        {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed child USB product identifier."},
+        {"name": "route_state", "type": "RouteState", "required": true, "many": false, "max_items": null, "description": "Current receiver route evidence."},
+        {"name": "access", "type": "NativeRouteAccess", "required": true, "many": false, "max_items": null, "description": "Evidence-backed tunnel access level."},
+        {"name": "protocol_family", "type": "NativeProtocolFamily", "required": true, "many": false, "max_items": null, "description": "Opaque feature-report protocol family."},
+        {"name": "report_bytes", "type": "NativeReportByteCount", "required": true, "many": false, "max_items": null, "description": "Exact native report size."},
+        {"name": "route_token", "type": "NativeRouteToken", "required": false, "many": false, "max_items": null, "description": "Opaque writable route token when qualified and available."},
+        {"name": "resource", "type": "ResourceKey", "required": false, "many": false, "max_items": null, "description": "Native-control lease resource when writable."}
+      ]
+    },
+    {
+      "name": "NativeRouteInventory",
+      "description": "Bounded sequence-consistent native route inventory.",
+      "fields": [
+        {"name": "cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Complete event position reflected by this inventory."},
+        {"name": "routes", "type": "NativeRoute", "required": true, "many": true, "max_items": 32, "description": "Known routes in canonical identity order."}
+      ]
+    },
+    {
+      "name": "NativeExchangeRequest",
+      "description": "One idempotent lease-bound native child feature-report exchange.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Client idempotency identity."},
+        {"name": "client_id", "type": "ClientId", "required": true, "many": false, "max_items": null, "description": "Owning application client."},
+        {"name": "lease_id", "type": "LeaseId", "required": true, "many": false, "max_items": null, "description": "Exact native-control ownership lease."},
+        {"name": "route_token", "type": "NativeRouteToken", "required": true, "many": false, "max_items": null, "description": "Generation-bound opaque route token."},
+        {"name": "report", "type": "NativeReportHex", "required": true, "many": false, "max_items": null, "description": "Exact lowercase hexadecimal native report."},
+        {"name": "timeout_ms", "type": "NativeExchangeTimeoutMs", "required": true, "many": false, "max_items": null, "description": "Bounded complete exchange deadline."}
+      ]
+    },
+    {
+      "name": "NativeExchangeNotSent",
+      "description": "The native request provably did not reach the receiver.",
+      "fields": [
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Stable retry-safe failure category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central diagnostic reference."}
+      ]
+    },
+    {
+      "name": "NativeExchangeUncertain",
+      "description": "The SET report may have reached the receiver and must not be repeated automatically.",
+      "fields": [
+        {"name": "error_kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Stable uncertain failure category."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Central diagnostic reference."}
+      ]
+    },
+    {
+      "name": "NativeExchangeMatchedResponse",
+      "description": "A response matching the exact native request identity was retained.",
+      "fields": [
+        {"name": "response", "type": "NativeReportHex", "required": true, "many": false, "max_items": null, "description": "Exact lowercase hexadecimal native response."}
+      ]
+    },
+    {
+      "name": "NativeExchangeOutcome",
+      "description": "Idempotent native exchange identity and contradiction-free result.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": true, "many": false, "max_items": null, "description": "Original client request identity."},
+        {"name": "route_token", "type": "NativeRouteToken", "required": true, "many": false, "max_items": null, "description": "Exact route token used for the exchange."},
+        {"name": "result", "type": "NativeExchangeResult", "required": true, "many": false, "max_items": null, "description": "Retained native transport result."}
+      ]
+    },
+    {
+      "name": "NativeRouteEvent",
+      "description": "One sequence-bound complete native route change.",
+      "fields": [
+        {"name": "sequence", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Strictly increasing route event sequence."},
+        {"name": "kind", "type": "NativeRouteEventKind", "required": true, "many": false, "max_items": null, "description": "Typed route transition."},
+        {"name": "route", "type": "NativeRoute", "required": true, "many": false, "max_items": null, "description": "Complete route state after the transition."}
+      ]
+    },
+    {
+      "name": "NativeRouteEventBatch",
+      "description": "Bounded native route changes with explicit cursor-gap state.",
+      "fields": [
+        {"name": "subscription_id", "type": "SubscriptionId", "required": true, "many": false, "max_items": null, "description": "Native route subscription identity."},
+        {"name": "next_cursor", "type": "EventCursor", "required": true, "many": false, "max_items": null, "description": "Cursor for the next native route batch."},
+        {"name": "events", "type": "NativeRouteEvent", "required": true, "many": true, "max_items": 256, "description": "Native route events after the requested cursor."},
+        {"name": "oldest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Oldest retained sequence."},
+        {"name": "latest_available", "type": "SequenceNumber", "required": true, "many": false, "max_items": null, "description": "Newest retained sequence."},
+        {"name": "dropped_events", "type": "DroppedEventCount", "required": true, "many": false, "max_items": null, "description": "Events evicted during this stream epoch."},
+        {"name": "cursor_gap", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether the client must enumerate routes again."},
+        {"name": "has_more", "type": "Boolean", "required": true, "many": false, "max_items": null, "description": "Whether another retained native route event follows."}
+      ]
+    },
+    {
+      "name": "RpcError",
+      "description": "Stable structured request failure.",
+      "fields": [
+        {"name": "request_id", "type": "RequestId", "required": false, "many": false, "max_items": null, "description": "Related request when parsing reached it."},
+        {"name": "kind", "type": "ProtocolErrorKind", "required": true, "many": false, "max_items": null, "description": "Machine-readable failure class."},
+        {"name": "message", "type": "HumanMessage", "required": true, "many": false, "max_items": null, "description": "Bounded user-safe explanation."},
+        {"name": "finding_id", "type": "FindingId", "required": true, "many": false, "max_items": null, "description": "Diagnostic catalog reference."}
+      ]
+    }
+  ],
+  "unions": [
+    {
+      "name": "LeaseResult",
+      "description": "Contradiction-free atomic lease outcome.",
+      "tag": "outcome",
+      "content": "detail",
+      "variants": [
+        {"name": "Granted", "wire": "granted", "type": "LeaseGrant", "description": "Every requested resource was granted."},
+        {"name": "Conflict", "wire": "conflict", "type": "LeaseConflict", "description": "Another client owns at least one requested resource; none were granted."},
+        {"name": "Rejected", "wire": "rejected", "type": "LeaseRejection", "description": "The request failed without granting any resource."}
+      ]
+    },
+    {
+      "name": "TransactionResult",
+      "description": "Contradiction-free current, terminal, or unavailable transaction outcome.",
+      "tag": "outcome",
+      "content": "detail",
+      "variants": [
+        {"name": "Progress", "wire": "progress", "type": "TransactionProgress", "description": "The transaction has not reached a terminal state."},
+        {"name": "Terminal", "wire": "terminal", "type": "TransactionTerminal", "description": "The immutable terminal outcome is retained."},
+        {"name": "Unavailable", "wire": "unavailable", "type": "TransactionUnavailable", "description": "No retained outcome can answer this lookup."}
+      ]
+    },
+    {
+      "name": "ControllerOwnership",
+      "description": "Contradiction-free viewer-specific controller ownership.",
+      "tag": "state",
+      "content": "detail",
+      "variants": [
+        {"name": "Unowned", "wire": "unowned", "type": "UnownedController", "description": "No application currently owns the controller."},
+        {"name": "OwnedByViewer", "wire": "owned-by-viewer", "type": "ViewerOwnedController", "description": "The requesting client owns the controller."},
+        {"name": "OwnedByOther", "wire": "owned-by-other", "type": "OtherOwnedController", "description": "Another application client owns the controller."}
+      ]
+    },
+    {
+      "name": "NativeExchangeResult",
+      "description": "Contradiction-free native transport certainty and response.",
+      "tag": "certainty",
+      "content": "detail",
+      "variants": [
+        {"name": "NotSent", "wire": "not-sent", "type": "NativeExchangeNotSent", "description": "The request is safe to retry with a new identity."},
+        {"name": "MayHaveBeenSent", "wire": "may-have-been-sent", "type": "NativeExchangeUncertain", "description": "Automatic retry is forbidden because SET delivery is uncertain."},
+        {"name": "MatchedResponse", "wire": "matched-response", "type": "NativeExchangeMatchedResponse", "description": "The exact matching response was retained."}
+      ]
+    }
+  ],
+  "methods": [
+    {"name": "negotiate", "request": "ClientHello", "response": "ServerHello", "required_feature": null, "description": "Select one compatible protocol version and optional feature set."},
+    {"name": "snapshot", "request": "EmptyRequest", "response": "BridgeSnapshot", "required_feature": null, "description": "Read one sequence-bound complete logical-device snapshot."},
+    {"name": "integration-view", "request": "EmptyRequest", "response": "IntegrationView", "required_feature": "integration-view-projection", "description": "Read one canonical client-specific inventory and controller projection."},
+    {"name": "acquire-lease", "request": "LeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Acquire a complete resource set atomically."},
+    {"name": "renew-lease", "request": "RenewLeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Renew one owned lease."},
+    {"name": "release-lease", "request": "ReleaseLeaseRequest", "response": "LeaseResult", "required_feature": "ownership-leases", "description": "Release one owned lease without forced takeover."},
+    {"name": "submit-transaction", "request": "TransactionRequest", "response": "TransactionResult", "required_feature": "atomic-transactions", "description": "Submit one complete generation-bound transaction."},
+    {"name": "transaction-outcome", "request": "TransactionLookup", "response": "TransactionResult", "required_feature": "atomic-transactions", "description": "Resolve a prior result without resubmitting transport."},
+    {"name": "subscribe", "request": "SubscriptionRequest", "response": "EventBatch", "required_feature": "event-subscriptions", "description": "Read bounded typed events after a sequence cursor."},
+    {"name": "diagnostics", "request": "EmptyRequest", "response": "DiagnosticSnapshot", "required_feature": "structured-diagnostics", "description": "Read privacy-classified diagnostics and queue health."},
+    {"name": "native-enumerate", "request": "EmptyRequest", "response": "NativeRouteInventory", "required_feature": "native-receiver-tunnel", "description": "Enumerate generation-bound receiver child routes without host paths."},
+    {"name": "native-transact", "request": "NativeExchangeRequest", "response": "NativeExchangeOutcome", "required_feature": "native-receiver-tunnel", "description": "Perform one lease-bound idempotent native feature-report exchange."},
+    {"name": "native-watch", "request": "SubscriptionRequest", "response": "NativeRouteEventBatch", "required_feature": "native-receiver-tunnel", "description": "Read bounded native route availability changes after a cursor."}
+  ]
+}
diff --git a/schemas/README.md b/schemas/README.md
index b680ed5..2bdcda7 100644
--- a/schemas/README.md
+++ b/schemas/README.md
@@ -33,6 +33,8 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 - [`schemas/local-snapshot.schema.json`](local-snapshot.schema.json)
 - [`schemas/licensing-policy.schema.json`](licensing-policy.schema.json)
 - [`schemas/lifecycle-policy-catalog.schema.json`](lifecycle-policy-catalog.schema.json)
+- [`schemas/kernel-uapi-registry.schema.json`](kernel-uapi-registry.schema.json)
+- [`schemas/kernel-uapi-native-exchange.schema.json`](kernel-uapi-native-exchange.schema.json)
 
 ## Verification
 
diff --git a/schemas/domain-catalog.json b/schemas/domain-catalog.json
index ad55d89..aa95e5b 100644
--- a/schemas/domain-catalog.json
+++ b/schemas/domain-catalog.json
@@ -31,7 +31,9 @@
     {"name": "AuthorizationEpoch", "wire": "authorization_epoch", "rust": "u64", "cpp": "std::uint64_t", "json_encoding": "decimal-string", "python_min": 1, "minimum": "1", "maximum": "18446744073709551615"},
     {"name": "DispatchNonce", "wire": "dispatch_nonce", "rust": "u64", "cpp": "std::uint64_t", "json_encoding": "decimal-string", "python_min": 1, "minimum": "1", "maximum": "18446744073709551615"},
     {"name": "WallClockUnixMs", "wire": "wall_clock_unix_ms", "rust": "u64", "cpp": "std::uint64_t", "json_encoding": "decimal-string", "python_min": 0, "minimum": "0", "maximum": "18446744073709551615"},
-    {"name": "EventBatchLimit", "wire": "event_batch_limit", "rust": "u16", "cpp": "std::uint16_t", "json_encoding": "number", "python_min": 1, "minimum": 1, "maximum": 256}
+    {"name": "EventBatchLimit", "wire": "event_batch_limit", "rust": "u16", "cpp": "std::uint16_t", "json_encoding": "number", "python_min": 1, "minimum": 1, "maximum": 256},
+    {"name": "NativeExchangeTimeoutMs", "wire": "native_exchange_timeout_ms", "rust": "u16", "cpp": "std::uint16_t", "json_encoding": "number", "python_min": 1, "minimum": 1, "maximum": 1000},
+    {"name": "NativeReportByteCount", "wire": "native_report_byte_count", "rust": "u16", "cpp": "std::uint16_t", "json_encoding": "number", "python_min": 1, "minimum": 1, "maximum": 4096}
   ],
   "string_types": [
     {"name": "ReceiverId", "wire": "receiver_id", "minimum_length": 1, "maximum_length": 128},
@@ -69,7 +71,10 @@
     {"name": "SourceRevision", "wire": "source_revision", "minimum_length": 1, "maximum_length": 64},
     {"name": "PresentationKey", "wire": "presentation_key", "minimum_length": 1, "maximum_length": 160},
     {"name": "TransportVariant", "wire": "transport_variant", "minimum_length": 1, "maximum_length": 64},
-    {"name": "RestoreTriggerId", "wire": "restore_trigger_id", "minimum_length": 1, "maximum_length": 128}
+    {"name": "RestoreTriggerId", "wire": "restore_trigger_id", "minimum_length": 1, "maximum_length": 128},
+    {"name": "NativeRouteToken", "wire": "native_route_token", "minimum_length": 64, "maximum_length": 64},
+    {"name": "NativeReportHex", "wire": "native_report_hex", "minimum_length": 180, "maximum_length": 180},
+    {"name": "NativeProtocolFamily", "wire": "native_protocol_family", "minimum_length": 1, "maximum_length": 64}
   ],
   "enums": [
     {"name": "DeviceKind", "values": ["receiver", "mat", "mouse", "keyboard", "unknown"]},
@@ -95,7 +100,7 @@
     {"name": "ReceiverState", "values": ["absent", "discovered-read-only", "observed", "profile-qualified", "session-authorized", "degraded-read-only"]},
     {"name": "TransactionState", "values": ["created", "validated", "ownership-bound", "generation-bound", "queued", "sent", "health-pending", "succeeded", "failed", "revoked", "superseded"]},
     {"name": "LeaseState", "values": ["requested", "granted", "renewed", "released", "expired", "revoked"]},
-    {"name": "ResourceKind", "values": ["lighting", "settings", "pairing"]},
+    {"name": "ResourceKind", "values": ["lighting", "settings", "pairing", "native-control"]},
     {"name": "TransactionClass", "values": ["effect-frame", "static-lighting", "device-setting", "restore", "pairing"]},
     {"name": "StableLightingMode", "values": ["static", "off"]},
     {"name": "QueueAdmission", "values": ["enqueued", "coalesced", "rejected-full", "rejected-deadline", "rejected-invalid"]},
@@ -116,6 +121,8 @@
     {"name": "DeviceApplicationState", "values": ["unverified", "confirmed", "rejected"]},
     {"name": "TelemetryAvailability", "values": ["unknown", "unavailable", "reported"]},
     {"name": "LeaseOutcome", "values": ["granted", "conflict", "rejected"]},
-    {"name": "ErrorSeverity", "values": ["info", "warning", "error", "critical"]}
+    {"name": "ErrorSeverity", "values": ["info", "warning", "error", "critical"]},
+    {"name": "NativeRouteAccess", "values": ["qualified", "candidate", "backend-required"]},
+    {"name": "NativeRouteEventKind", "values": ["available", "unavailable", "generation-replaced"]}
   ]
 }
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index 78c9cff..c9aafe7 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -78,6 +78,7 @@
         "generation_bound": {"type": "boolean"},
         "application_raw_frames": {"type": "boolean"},
         "pairing_inventory": {"$ref": "#/$defs/pairing-inventory"},
+        "native_exchange": {"$ref": "#/$defs/native-exchange"},
         "lighting": {"$ref": "#/$defs/lighting"},
         "passive": {"$ref": "#/$defs/passive"},
         "lifecycle": {"$ref": "#/$defs/lifecycle-policy"}
@@ -91,6 +92,34 @@
         "decoder": {"enum": ["razer-hyperflux-v2-feature-01-v1"]}
       }
     },
+    "native-exchange": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["protocol_family", "report_bytes", "set_report_index", "response_report_index", "initial_response_delay_us", "response_retry_delay_us", "max_response_attempts", "match_ranges"],
+      "properties": {
+        "protocol_family": {"const": "razer-feature-report-v1"},
+        "report_bytes": {"const": 90},
+        "set_report_index": {"type": "integer", "minimum": 0, "maximum": 255},
+        "response_report_index": {"type": "integer", "minimum": 0, "maximum": 255},
+        "initial_response_delay_us": {"type": "integer", "minimum": 0, "maximum": 100000},
+        "response_retry_delay_us": {"type": "integer", "minimum": 1, "maximum": 100000},
+        "max_response_attempts": {"type": "integer", "minimum": 1, "maximum": 16},
+        "match_ranges": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 4,
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["offset", "length"],
+            "properties": {
+              "offset": {"type": "integer", "minimum": 0, "maximum": 89},
+              "length": {"type": "integer", "minimum": 1, "maximum": 90}
+            }
+          }
+        }
+      }
+    },
     "lighting": {
       "type": "object",
       "additionalProperties": false,
diff --git a/schemas/kernel-uapi-native-exchange.schema.json b/schemas/kernel-uapi-native-exchange.schema.json
new file mode 100644
index 0000000..d457180
--- /dev/null
+++ b/schemas/kernel-uapi-native-exchange.schema.json
@@ -0,0 +1,90 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/kernel-uapi-native-exchange-v2.json",
+  "title": "HyperFlux native exchange kernel UAPI catalog",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "abi_version", "ioctl_magic", "limits", "enums", "structs", "ioctls"],
+  "properties": {
+    "$schema": {"const": "../schemas/kernel-uapi-native-exchange.schema.json"},
+    "schema": {"const": "hyperflux-kernel-uapi-native-exchange-v2"},
+    "abi_version": {"const": 2},
+    "ioctl_magic": {"type": "integer", "minimum": 1, "maximum": 255},
+    "limits": {
+      "type": "object",
+      "minProperties": 1,
+      "additionalProperties": {"type": "integer", "minimum": 1, "maximum": 18446744073709551615}
+    },
+    "enums": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "values"],
+        "properties": {
+          "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+          "values": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["name", "value"],
+              "properties": {
+                "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+                "value": {"type": "integer", "minimum": 0, "maximum": 4294967295}
+              }
+            }
+          }
+        }
+      }
+    },
+    "structs": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "fields"],
+        "properties": {
+          "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+          "fields": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["name", "type"],
+              "properties": {
+                "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+                "type": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+                "count": {
+                  "oneOf": [
+                    {"type": "integer", "minimum": 1, "maximum": 4096},
+                    {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"}
+                  ]
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "ioctls": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["name", "number", "direction", "struct"],
+        "properties": {
+          "name": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+          "number": {"type": "integer", "minimum": 0, "maximum": 255},
+          "direction": {"enum": ["read", "write", "read_write"]},
+          "struct": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/kernel-uapi-registry.schema.json b/schemas/kernel-uapi-registry.schema.json
new file mode 100644
index 0000000..40be1e7
--- /dev/null
+++ b/schemas/kernel-uapi-registry.schema.json
@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/kernel-uapi-registry-v1.json",
+  "title": "HyperFlux kernel UAPI registry",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "entries"],
+  "properties": {
+    "$schema": {"const": "../schemas/kernel-uapi-registry.schema.json"},
+    "schema": {"const": "hyperflux-kernel-uapi-registry-v1"},
+    "entries": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["abi_version", "catalog", "schema", "schema_ref", "version_macro", "role"],
+        "properties": {
+          "abi_version": {"type": "integer", "minimum": 1, "maximum": 4294967295},
+          "catalog": {"type": "string", "pattern": "^[a-z][a-z0-9_-]*\\.json$"},
+          "schema": {"type": "string", "pattern": "^hyperflux-kernel-uapi-[a-z0-9-]+$"},
+          "schema_ref": {"type": "string", "pattern": "^\\.\\./schemas/[a-z][a-z0-9_-]*\\.schema\\.json$"},
+          "version_macro": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"},
+          "role": {"type": "string", "pattern": "^[a-z][a-z0-9_]*$"}
+        }
+      }
+    }
+  }
+}
diff --git a/sdk/cpp/include/hyperflux/generated/domain_json.hpp b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
index a2541b6..918dff9 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
@@ -569,6 +569,30 @@ template<>
     return encode_numeric<EventBatchLimit>(value);
 }
 
+template<>
+[[nodiscard]] inline NativeExchangeTimeoutMs decode<NativeExchangeTimeoutMs>(const Json& value)
+{
+    return decode_numeric<NativeExchangeTimeoutMs>(value);
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeExchangeTimeoutMs>(const NativeExchangeTimeoutMs& value)
+{
+    return encode_numeric<NativeExchangeTimeoutMs>(value);
+}
+
+template<>
+[[nodiscard]] inline NativeReportByteCount decode<NativeReportByteCount>(const Json& value)
+{
+    return decode_numeric<NativeReportByteCount>(value);
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeReportByteCount>(const NativeReportByteCount& value)
+{
+    return encode_numeric<NativeReportByteCount>(value);
+}
+
 template<>
 [[nodiscard]] inline ReceiverId decode<ReceiverId>(const Json& value)
 {
@@ -1001,6 +1025,42 @@ template<>
     return encode_string<RestoreTriggerId>(value);
 }
 
+template<>
+[[nodiscard]] inline NativeRouteToken decode<NativeRouteToken>(const Json& value)
+{
+    return decode_string<NativeRouteToken>(value);
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeRouteToken>(const NativeRouteToken& value)
+{
+    return encode_string<NativeRouteToken>(value);
+}
+
+template<>
+[[nodiscard]] inline NativeReportHex decode<NativeReportHex>(const Json& value)
+{
+    return decode_string<NativeReportHex>(value);
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeReportHex>(const NativeReportHex& value)
+{
+    return encode_string<NativeReportHex>(value);
+}
+
+template<>
+[[nodiscard]] inline NativeProtocolFamily decode<NativeProtocolFamily>(const Json& value)
+{
+    return decode_string<NativeProtocolFamily>(value);
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeProtocolFamily>(const NativeProtocolFamily& value)
+{
+    return encode_string<NativeProtocolFamily>(value);
+}
+
 template<>
 [[nodiscard]] inline DeviceKind decode<DeviceKind>(const Json& value)
 {
@@ -1840,6 +1900,10 @@ template<>
     {
         return ResourceKind::Pairing;
     }
+    if(wire == "native-control")
+    {
+        return ResourceKind::NativeControl;
+    }
     throw CodecError("unknown ResourceKind wire value");
 }
 
@@ -2686,4 +2750,62 @@ template<>
     return Json(std::string(to_string(value)));
 }
 
+template<>
+[[nodiscard]] inline NativeRouteAccess decode<NativeRouteAccess>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected NativeRouteAccess wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "qualified")
+    {
+        return NativeRouteAccess::Qualified;
+    }
+    if(wire == "candidate")
+    {
+        return NativeRouteAccess::Candidate;
+    }
+    if(wire == "backend-required")
+    {
+        return NativeRouteAccess::BackendRequired;
+    }
+    throw CodecError("unknown NativeRouteAccess wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeRouteAccess>(const NativeRouteAccess& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
+template<>
+[[nodiscard]] inline NativeRouteEventKind decode<NativeRouteEventKind>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected NativeRouteEventKind wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "available")
+    {
+        return NativeRouteEventKind::Available;
+    }
+    if(wire == "unavailable")
+    {
+        return NativeRouteEventKind::Unavailable;
+    }
+    if(wire == "generation-replaced")
+    {
+        return NativeRouteEventKind::GenerationReplaced;
+    }
+    throw CodecError("unknown NativeRouteEventKind wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeRouteEventKind>(const NativeRouteEventKind& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
 } // namespace hyperflux::json_codec
diff --git a/sdk/cpp/include/hyperflux/generated/domain_types.hpp b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
index cbe3868..65e6ae9 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
@@ -727,6 +727,56 @@ class EventBatchLimit
     value_type value_;
 };
 
+class NativeExchangeTimeoutMs
+{
+public:
+    using value_type = std::uint16_t;
+    static constexpr value_type minimum = 1;
+    static constexpr value_type maximum = 1000;
+    static constexpr bool wire_as_decimal_string = false;
+
+    [[nodiscard]] static constexpr std::optional<NativeExchangeTimeoutMs> from(value_type value)
+    {
+        if(value < minimum || value > maximum)
+        {
+            return std::nullopt;
+        }
+        return NativeExchangeTimeoutMs(value);
+    }
+
+    [[nodiscard]] constexpr value_type value() const { return value_; }
+    friend constexpr bool operator==(const NativeExchangeTimeoutMs&, const NativeExchangeTimeoutMs&) = default;
+
+private:
+    explicit constexpr NativeExchangeTimeoutMs(value_type value) : value_(value) {}
+    value_type value_;
+};
+
+class NativeReportByteCount
+{
+public:
+    using value_type = std::uint16_t;
+    static constexpr value_type minimum = 1;
+    static constexpr value_type maximum = 4096;
+    static constexpr bool wire_as_decimal_string = false;
+
+    [[nodiscard]] static constexpr std::optional<NativeReportByteCount> from(value_type value)
+    {
+        if(value < minimum || value > maximum)
+        {
+            return std::nullopt;
+        }
+        return NativeReportByteCount(value);
+    }
+
+    [[nodiscard]] constexpr value_type value() const { return value_; }
+    friend constexpr bool operator==(const NativeReportByteCount&, const NativeReportByteCount&) = default;
+
+private:
+    explicit constexpr NativeReportByteCount(value_type value) : value_(value) {}
+    value_type value_;
+};
+
 class ReceiverId
 {
 public:
@@ -1555,6 +1605,75 @@ class RestoreTriggerId
     std::string value_;
 };
 
+class NativeRouteToken
+{
+public:
+    static constexpr std::size_t minimum_length = 64;
+    static constexpr std::size_t maximum_length = 64;
+
+    [[nodiscard]] static std::optional<NativeRouteToken> from(std::string_view value)
+    {
+        if(value.size() < minimum_length || value.size() > maximum_length)
+        {
+            return std::nullopt;
+        }
+        return NativeRouteToken(std::string(value));
+    }
+
+    [[nodiscard]] std::string_view value() const { return value_; }
+    friend bool operator==(const NativeRouteToken&, const NativeRouteToken&) = default;
+
+private:
+    explicit NativeRouteToken(std::string value) : value_(std::move(value)) {}
+    std::string value_;
+};
+
+class NativeReportHex
+{
+public:
+    static constexpr std::size_t minimum_length = 180;
+    static constexpr std::size_t maximum_length = 180;
+
+    [[nodiscard]] static std::optional<NativeReportHex> from(std::string_view value)
+    {
+        if(value.size() < minimum_length || value.size() > maximum_length)
+        {
+            return std::nullopt;
+        }
+        return NativeReportHex(std::string(value));
+    }
+
+    [[nodiscard]] std::string_view value() const { return value_; }
+    friend bool operator==(const NativeReportHex&, const NativeReportHex&) = default;
+
+private:
+    explicit NativeReportHex(std::string value) : value_(std::move(value)) {}
+    std::string value_;
+};
+
+class NativeProtocolFamily
+{
+public:
+    static constexpr std::size_t minimum_length = 1;
+    static constexpr std::size_t maximum_length = 64;
+
+    [[nodiscard]] static std::optional<NativeProtocolFamily> from(std::string_view value)
+    {
+        if(value.size() < minimum_length || value.size() > maximum_length)
+        {
+            return std::nullopt;
+        }
+        return NativeProtocolFamily(std::string(value));
+    }
+
+    [[nodiscard]] std::string_view value() const { return value_; }
+    friend bool operator==(const NativeProtocolFamily&, const NativeProtocolFamily&) = default;
+
+private:
+    explicit NativeProtocolFamily(std::string value) : value_(std::move(value)) {}
+    std::string value_;
+};
+
 enum class DeviceKind
 {
     Receiver,
@@ -2050,6 +2169,7 @@ enum class ResourceKind
     Lighting,
     Settings,
     Pairing,
+    NativeControl,
 };
 
 [[nodiscard]] constexpr std::string_view to_string(ResourceKind value)
@@ -2059,6 +2179,7 @@ enum class ResourceKind
         case ResourceKind::Lighting: return "lighting";
         case ResourceKind::Settings: return "settings";
         case ResourceKind::Pairing: return "pairing";
+        case ResourceKind::NativeControl: return "native-control";
     }
     return "unknown";
 }
@@ -2555,4 +2676,40 @@ enum class ErrorSeverity
     return "unknown";
 }
 
+enum class NativeRouteAccess
+{
+    Qualified,
+    Candidate,
+    BackendRequired,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(NativeRouteAccess value)
+{
+    switch(value)
+    {
+        case NativeRouteAccess::Qualified: return "qualified";
+        case NativeRouteAccess::Candidate: return "candidate";
+        case NativeRouteAccess::BackendRequired: return "backend-required";
+    }
+    return "unknown";
+}
+
+enum class NativeRouteEventKind
+{
+    Available,
+    Unavailable,
+    GenerationReplaced,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(NativeRouteEventKind value)
+{
+    switch(value)
+    {
+        case NativeRouteEventKind::Available: return "available";
+        case NativeRouteEventKind::Unavailable: return "unavailable";
+        case NativeRouteEventKind::GenerationReplaced: return "generation-replaced";
+    }
+    return "unknown";
+}
+
 } // namespace hyperflux
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 532f2dc..17633c4 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac
+// Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac";
+inline constexpr std::string_view profile_source_sha256 = "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
@@ -238,7 +238,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf", 3, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &lifecycle_0, &presentation_0},
     {"child.razer.deathstalker-v2-pro-tkl.0296", "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63", 6, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &lifecycle_1, &presentation_1},
-    {"receiver.razer.hyperflux-v2.1532-00cf", "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
+    {"receiver.razer.hyperflux-v2.1532-00cf", "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr, nullptr},
 }};
 
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
index a249719..9e51edb 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
@@ -272,6 +272,60 @@ template<>
 template<>
 [[nodiscard]] Json encode<::hyperflux::IntegrationView>(const ::hyperflux::IntegrationView& value);
 
+template<>
+[[nodiscard]] ::hyperflux::NativeRoute decode<::hyperflux::NativeRoute>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeRoute>(const ::hyperflux::NativeRoute& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeRouteInventory decode<::hyperflux::NativeRouteInventory>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeRouteInventory>(const ::hyperflux::NativeRouteInventory& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeRequest decode<::hyperflux::NativeExchangeRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeRequest>(const ::hyperflux::NativeExchangeRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeNotSent decode<::hyperflux::NativeExchangeNotSent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeNotSent>(const ::hyperflux::NativeExchangeNotSent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeUncertain decode<::hyperflux::NativeExchangeUncertain>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeUncertain>(const ::hyperflux::NativeExchangeUncertain& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeMatchedResponse decode<::hyperflux::NativeExchangeMatchedResponse>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeMatchedResponse>(const ::hyperflux::NativeExchangeMatchedResponse& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeOutcome decode<::hyperflux::NativeExchangeOutcome>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeOutcome>(const ::hyperflux::NativeExchangeOutcome& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeRouteEvent decode<::hyperflux::NativeRouteEvent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeRouteEvent>(const ::hyperflux::NativeRouteEvent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::NativeRouteEventBatch decode<::hyperflux::NativeRouteEventBatch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeRouteEventBatch>(const ::hyperflux::NativeRouteEventBatch& value);
+
 template<>
 [[nodiscard]] ::hyperflux::RpcError decode<::hyperflux::RpcError>(const Json& value);
 
@@ -296,6 +350,12 @@ template<>
 template<>
 [[nodiscard]] Json encode<::hyperflux::ControllerOwnership>(const ::hyperflux::ControllerOwnership& value);
 
+template<>
+[[nodiscard]] ::hyperflux::NativeExchangeResult decode<::hyperflux::NativeExchangeResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::NativeExchangeResult>(const ::hyperflux::NativeExchangeResult& value);
+
 template<>
 [[nodiscard]] ::hyperflux::NegotiationRequestEnvelope decode<::hyperflux::NegotiationRequestEnvelope>(const Json& value);
 
@@ -1451,6 +1511,221 @@ template<>
     return result;
 }
 
+template<>
+[[nodiscard]] inline ::hyperflux::NativeRoute decode<::hyperflux::NativeRoute>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "endpoint_id", "device_kind", "vendor_id", "product_id", "route_state", "access", "protocol_family", "report_bytes", "route_token", "resource"});
+    return ::hyperflux::NativeRoute {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::VendorId>(required_field(value, "vendor_id")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::NativeRouteAccess>(required_field(value, "access")),
+        decode<::hyperflux::NativeProtocolFamily>(required_field(value, "protocol_family")),
+        decode<::hyperflux::NativeReportByteCount>(required_field(value, "report_bytes")),
+        decode_optional_field<::hyperflux::NativeRouteToken>(value, "route_token"),
+        decode_optional_field<::hyperflux::ResourceKey>(value, "resource"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeRoute>(const ::hyperflux::NativeRoute& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["vendor_id"] = encode(value.vendor_id);
+    result["product_id"] = encode(value.product_id);
+    result["route_state"] = encode(value.route_state);
+    result["access"] = encode(value.access);
+    result["protocol_family"] = encode(value.protocol_family);
+    result["report_bytes"] = encode(value.report_bytes);
+    result["route_token"] = value.route_token.has_value() ? encode(*value.route_token) : Json(nullptr);
+    result["resource"] = value.resource.has_value() ? encode(*value.resource) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeRouteInventory decode<::hyperflux::NativeRouteInventory>(const Json& value)
+{
+    require_object(value, {"cursor", "routes"});
+    return ::hyperflux::NativeRouteInventory {
+        decode<::hyperflux::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::NativeRoute>(required_field(value, "routes"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeRouteInventory>(const ::hyperflux::NativeRouteInventory& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["routes"] = encode_vector(value.routes);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeRequest decode<::hyperflux::NativeExchangeRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id", "route_token", "report", "timeout_ms"});
+    return ::hyperflux::NativeExchangeRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::NativeRouteToken>(required_field(value, "route_token")),
+        decode<::hyperflux::NativeReportHex>(required_field(value, "report")),
+        decode<::hyperflux::NativeExchangeTimeoutMs>(required_field(value, "timeout_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeRequest>(const ::hyperflux::NativeExchangeRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["route_token"] = encode(value.route_token);
+    result["report"] = encode(value.report);
+    result["timeout_ms"] = encode(value.timeout_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeNotSent decode<::hyperflux::NativeExchangeNotSent>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::NativeExchangeNotSent {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeNotSent>(const ::hyperflux::NativeExchangeNotSent& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeUncertain decode<::hyperflux::NativeExchangeUncertain>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::NativeExchangeUncertain {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeUncertain>(const ::hyperflux::NativeExchangeUncertain& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeMatchedResponse decode<::hyperflux::NativeExchangeMatchedResponse>(const Json& value)
+{
+    require_object(value, {"response"});
+    return ::hyperflux::NativeExchangeMatchedResponse {
+        decode<::hyperflux::NativeReportHex>(required_field(value, "response")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeMatchedResponse>(const ::hyperflux::NativeExchangeMatchedResponse& value)
+{
+    Json result = Json::object();
+    result["response"] = encode(value.response);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeOutcome decode<::hyperflux::NativeExchangeOutcome>(const Json& value)
+{
+    require_object(value, {"request_id", "route_token", "result"});
+    return ::hyperflux::NativeExchangeOutcome {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::NativeRouteToken>(required_field(value, "route_token")),
+        decode<::hyperflux::NativeExchangeResult>(required_field(value, "result")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeOutcome>(const ::hyperflux::NativeExchangeOutcome& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["route_token"] = encode(value.route_token);
+    result["result"] = encode(value.result);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeRouteEvent decode<::hyperflux::NativeRouteEvent>(const Json& value)
+{
+    require_object(value, {"sequence", "kind", "route"});
+    return ::hyperflux::NativeRouteEvent {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode<::hyperflux::NativeRouteEventKind>(required_field(value, "kind")),
+        decode<::hyperflux::NativeRoute>(required_field(value, "route")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeRouteEvent>(const ::hyperflux::NativeRouteEvent& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["kind"] = encode(value.kind);
+    result["route"] = encode(value.route);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::NativeRouteEventBatch decode<::hyperflux::NativeRouteEventBatch>(const Json& value)
+{
+    require_object(value, {"subscription_id", "next_cursor", "events", "oldest_available", "latest_available", "dropped_events", "cursor_gap", "has_more"});
+    return ::hyperflux::NativeRouteEventBatch {
+        decode<::hyperflux::SubscriptionId>(required_field(value, "subscription_id")),
+        decode<::hyperflux::EventCursor>(required_field(value, "next_cursor")),
+        decode_vector<::hyperflux::NativeRouteEvent>(required_field(value, "events"), 256),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "oldest_available")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "latest_available")),
+        decode<::hyperflux::DroppedEventCount>(required_field(value, "dropped_events")),
+        decode<bool>(required_field(value, "cursor_gap")),
+        decode<bool>(required_field(value, "has_more")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeRouteEventBatch>(const ::hyperflux::NativeRouteEventBatch& value)
+{
+    Json result = Json::object();
+    result["subscription_id"] = encode(value.subscription_id);
+    result["next_cursor"] = encode(value.next_cursor);
+    result["events"] = encode_vector(value.events);
+    result["oldest_available"] = encode(value.oldest_available);
+    result["latest_available"] = encode(value.latest_available);
+    result["dropped_events"] = encode(value.dropped_events);
+    result["cursor_gap"] = encode(value.cursor_gap);
+    result["has_more"] = encode(value.has_more);
+    return result;
+}
+
 template<>
 [[nodiscard]] inline ::hyperflux::RpcError decode<::hyperflux::RpcError>(const Json& value)
 {
@@ -1609,6 +1884,51 @@ template<>
         value);
 }
 
+template<>
+[[nodiscard]] inline ::hyperflux::NativeExchangeResult decode<::hyperflux::NativeExchangeResult>(const Json& value)
+{
+    require_object(value, {"certainty", "detail"});
+    const auto& tag_value = required_field(value, "certainty");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("NativeExchangeResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "not-sent")
+    {
+        return ::hyperflux::NativeExchangeResult {::hyperflux::NativeExchangeResultNotSent {
+            decode<::hyperflux::NativeExchangeNotSent>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "may-have-been-sent")
+    {
+        return ::hyperflux::NativeExchangeResult {::hyperflux::NativeExchangeResultMayHaveBeenSent {
+            decode<::hyperflux::NativeExchangeUncertain>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "matched-response")
+    {
+        return ::hyperflux::NativeExchangeResult {::hyperflux::NativeExchangeResultMatchedResponse {
+            decode<::hyperflux::NativeExchangeMatchedResponse>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown NativeExchangeResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::NativeExchangeResult>(const ::hyperflux::NativeExchangeResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"certainty", std::string(Alternative::certainty)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
 template<>
 [[nodiscard]] inline ::hyperflux::NegotiationRequestEnvelope decode<::hyperflux::NegotiationRequestEnvelope>(const Json& value)
 {
@@ -1747,6 +2067,18 @@ template<>
     {
         return ::hyperflux::RpcRequest {::hyperflux::RpcRequestDiagnostics {decode_session_request<::hyperflux::EmptyRequest>(envelope)}};
     }
+    if(method == "native-enumerate")
+    {
+        return ::hyperflux::RpcRequest {::hyperflux::RpcRequestNativeEnumerate {decode_session_request<::hyperflux::EmptyRequest>(envelope)}};
+    }
+    if(method == "native-transact")
+    {
+        return ::hyperflux::RpcRequest {::hyperflux::RpcRequestNativeTransact {decode_session_request<::hyperflux::NativeExchangeRequest>(envelope)}};
+    }
+    if(method == "native-watch")
+    {
+        return ::hyperflux::RpcRequest {::hyperflux::RpcRequestNativeWatch {decode_session_request<::hyperflux::SubscriptionRequest>(envelope)}};
+    }
     throw CodecError("unknown RPC request method");
 }
 
@@ -1844,6 +2176,24 @@ template<>
             decode_success<::hyperflux::DiagnosticSnapshot>(envelope)
         }};
     }
+    if(type == "native-enumerate-success")
+    {
+        return ::hyperflux::RpcResponse {::hyperflux::RpcResponseNativeEnumerateSuccess {
+            decode_success<::hyperflux::NativeRouteInventory>(envelope)
+        }};
+    }
+    if(type == "native-transact-success")
+    {
+        return ::hyperflux::RpcResponse {::hyperflux::RpcResponseNativeTransactSuccess {
+            decode_success<::hyperflux::NativeExchangeOutcome>(envelope)
+        }};
+    }
+    if(type == "native-watch-success")
+    {
+        return ::hyperflux::RpcResponse {::hyperflux::RpcResponseNativeWatchSuccess {
+            decode_success<::hyperflux::NativeRouteEventBatch>(envelope)
+        }};
+    }
     if(type == "error")
     {
         return ::hyperflux::RpcResponse {decode<::hyperflux::ErrorEnvelope>(envelope)};
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
index 61c0161..2935c5b 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
@@ -15,8 +15,8 @@
 namespace hyperflux
 {
 
-inline constexpr std::uint16_t minimum_protocol_version = 6;
-inline constexpr std::uint16_t maximum_protocol_version = 6;
+inline constexpr std::uint16_t minimum_protocol_version = 7;
+inline constexpr std::uint16_t maximum_protocol_version = 7;
 inline constexpr std::size_t max_wire_message_bytes = 1048576;
 inline constexpr std::size_t max_json_depth = 128;
 
@@ -475,6 +475,91 @@ struct ControllerActions
     friend bool operator==(const ControllerActions&, const ControllerActions&) = default;
 };
 
+// One generation-bound receiver child route without a host device path.
+struct NativeRoute
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    DeviceKind device_kind;
+    VendorId vendor_id;
+    ProductId product_id;
+    RouteState route_state;
+    NativeRouteAccess access;
+    NativeProtocolFamily protocol_family;
+    NativeReportByteCount report_bytes;
+    std::optional<NativeRouteToken> route_token;
+    std::optional<ResourceKey> resource;
+    friend bool operator==(const NativeRoute&, const NativeRoute&) = default;
+};
+
+// Bounded sequence-consistent native route inventory.
+struct NativeRouteInventory
+{
+    EventCursor cursor;
+    std::vector<NativeRoute> routes;
+    friend bool operator==(const NativeRouteInventory&, const NativeRouteInventory&) = default;
+};
+
+// One idempotent lease-bound native child feature-report exchange.
+struct NativeExchangeRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    NativeRouteToken route_token;
+    NativeReportHex report;
+    NativeExchangeTimeoutMs timeout_ms;
+    friend bool operator==(const NativeExchangeRequest&, const NativeExchangeRequest&) = default;
+};
+
+// The native request provably did not reach the receiver.
+struct NativeExchangeNotSent
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const NativeExchangeNotSent&, const NativeExchangeNotSent&) = default;
+};
+
+// The SET report may have reached the receiver and must not be repeated automatically.
+struct NativeExchangeUncertain
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const NativeExchangeUncertain&, const NativeExchangeUncertain&) = default;
+};
+
+// A response matching the exact native request identity was retained.
+struct NativeExchangeMatchedResponse
+{
+    NativeReportHex response;
+    friend bool operator==(const NativeExchangeMatchedResponse&, const NativeExchangeMatchedResponse&) = default;
+};
+
+// One sequence-bound complete native route change.
+struct NativeRouteEvent
+{
+    SequenceNumber sequence;
+    NativeRouteEventKind kind;
+    NativeRoute route;
+    friend bool operator==(const NativeRouteEvent&, const NativeRouteEvent&) = default;
+};
+
+// Bounded native route changes with explicit cursor-gap state.
+struct NativeRouteEventBatch
+{
+    SubscriptionId subscription_id;
+    EventCursor next_cursor;
+    std::vector<NativeRouteEvent> events;
+    SequenceNumber oldest_available;
+    SequenceNumber latest_available;
+    DroppedEventCount dropped_events;
+    bool cursor_gap;
+    bool has_more;
+    friend bool operator==(const NativeRouteEventBatch&, const NativeRouteEventBatch&) = default;
+};
+
 // Stable structured request failure.
 struct RpcError
 {
@@ -566,6 +651,33 @@ struct ControllerOwnershipOwnedByOther
 // Contradiction-free viewer-specific controller ownership.
 using ControllerOwnership = std::variant<ControllerOwnershipUnowned, ControllerOwnershipOwnedByViewer, ControllerOwnershipOwnedByOther>;
 
+// The request is safe to retry with a new identity.
+struct NativeExchangeResultNotSent
+{
+    static constexpr std::string_view certainty = "not-sent";
+    NativeExchangeNotSent detail;
+    friend bool operator==(const NativeExchangeResultNotSent&, const NativeExchangeResultNotSent&) = default;
+};
+
+// Automatic retry is forbidden because SET delivery is uncertain.
+struct NativeExchangeResultMayHaveBeenSent
+{
+    static constexpr std::string_view certainty = "may-have-been-sent";
+    NativeExchangeUncertain detail;
+    friend bool operator==(const NativeExchangeResultMayHaveBeenSent&, const NativeExchangeResultMayHaveBeenSent&) = default;
+};
+
+// The exact matching response was retained.
+struct NativeExchangeResultMatchedResponse
+{
+    static constexpr std::string_view certainty = "matched-response";
+    NativeExchangeMatchedResponse detail;
+    friend bool operator==(const NativeExchangeResultMatchedResponse&, const NativeExchangeResultMatchedResponse&) = default;
+};
+
+// Contradiction-free native transport certainty and response.
+using NativeExchangeResult = std::variant<NativeExchangeResultNotSent, NativeExchangeResultMayHaveBeenSent, NativeExchangeResultMatchedResponse>;
+
 // Exact qualified receiver-backed application controller.
 struct ControllerView
 {
@@ -612,6 +724,15 @@ struct IntegrationView
     friend bool operator==(const IntegrationView&, const IntegrationView&) = default;
 };
 
+// Idempotent native exchange identity and contradiction-free result.
+struct NativeExchangeOutcome
+{
+    RequestId request_id;
+    NativeRouteToken route_token;
+    NativeExchangeResult result;
+    friend bool operator==(const NativeExchangeOutcome&, const NativeExchangeOutcome&) = default;
+};
+
 struct NegotiationRequestEnvelope
 {
     RequestId request_id;
@@ -687,7 +808,25 @@ struct RpcRequestDiagnostics
     SessionRequestEnvelope<EmptyRequest> request;
 };
 
-using RpcRequest = std::variant<RpcRequestNegotiate, RpcRequestSnapshot, RpcRequestIntegrationView, RpcRequestAcquireLease, RpcRequestRenewLease, RpcRequestReleaseLease, RpcRequestSubmitTransaction, RpcRequestTransactionOutcome, RpcRequestSubscribe, RpcRequestDiagnostics>;
+struct RpcRequestNativeEnumerate
+{
+    static constexpr std::string_view method = "native-enumerate";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestNativeTransact
+{
+    static constexpr std::string_view method = "native-transact";
+    SessionRequestEnvelope<NativeExchangeRequest> request;
+};
+
+struct RpcRequestNativeWatch
+{
+    static constexpr std::string_view method = "native-watch";
+    SessionRequestEnvelope<SubscriptionRequest> request;
+};
+
+using RpcRequest = std::variant<RpcRequestNegotiate, RpcRequestSnapshot, RpcRequestIntegrationView, RpcRequestAcquireLease, RpcRequestRenewLease, RpcRequestReleaseLease, RpcRequestSubmitTransaction, RpcRequestTransactionOutcome, RpcRequestSubscribe, RpcRequestDiagnostics, RpcRequestNativeEnumerate, RpcRequestNativeTransact, RpcRequestNativeWatch>;
 
 template<typename T>
 struct SuccessEnvelope
@@ -764,7 +903,25 @@ struct RpcResponseDiagnosticsSuccess
     SuccessEnvelope<DiagnosticSnapshot> response;
 };
 
-using RpcResponse = std::variant<RpcResponseNegotiateSuccess, RpcResponseSnapshotSuccess, RpcResponseIntegrationViewSuccess, RpcResponseAcquireLeaseSuccess, RpcResponseRenewLeaseSuccess, RpcResponseReleaseLeaseSuccess, RpcResponseSubmitTransactionSuccess, RpcResponseTransactionOutcomeSuccess, RpcResponseSubscribeSuccess, RpcResponseDiagnosticsSuccess, ErrorEnvelope>;
+struct RpcResponseNativeEnumerateSuccess
+{
+    static constexpr std::string_view type = "native-enumerate-success";
+    SuccessEnvelope<NativeRouteInventory> response;
+};
+
+struct RpcResponseNativeTransactSuccess
+{
+    static constexpr std::string_view type = "native-transact-success";
+    SuccessEnvelope<NativeExchangeOutcome> response;
+};
+
+struct RpcResponseNativeWatchSuccess
+{
+    static constexpr std::string_view type = "native-watch-success";
+    SuccessEnvelope<NativeRouteEventBatch> response;
+};
+
+using RpcResponse = std::variant<RpcResponseNegotiateSuccess, RpcResponseSnapshotSuccess, RpcResponseIntegrationViewSuccess, RpcResponseAcquireLeaseSuccess, RpcResponseRenewLeaseSuccess, RpcResponseReleaseLeaseSuccess, RpcResponseSubmitTransactionSuccess, RpcResponseTransactionOutcomeSuccess, RpcResponseSubscribeSuccess, RpcResponseDiagnosticsSuccess, RpcResponseNativeEnumerateSuccess, RpcResponseNativeTransactSuccess, RpcResponseNativeWatchSuccess, ErrorEnvelope>;
 
 struct MethodDescriptor
 {
@@ -774,7 +931,7 @@ struct MethodDescriptor
     std::optional<std::string_view> required_feature;
 };
 
-inline constexpr MethodDescriptor methods[10] = {
+inline constexpr MethodDescriptor methods[13] = {
     {"negotiate", "ClientHello", "ServerHello", std::nullopt},
     {"snapshot", "EmptyRequest", "BridgeSnapshot", std::nullopt},
     {"integration-view", "EmptyRequest", "IntegrationView", std::optional<std::string_view>("integration-view-projection")},
@@ -785,6 +942,9 @@ inline constexpr MethodDescriptor methods[10] = {
     {"transaction-outcome", "TransactionLookup", "TransactionResult", std::optional<std::string_view>("atomic-transactions")},
     {"subscribe", "SubscriptionRequest", "EventBatch", std::optional<std::string_view>("event-subscriptions")},
     {"diagnostics", "EmptyRequest", "DiagnosticSnapshot", std::optional<std::string_view>("structured-diagnostics")},
+    {"native-enumerate", "EmptyRequest", "NativeRouteInventory", std::optional<std::string_view>("native-receiver-tunnel")},
+    {"native-transact", "NativeExchangeRequest", "NativeExchangeOutcome", std::optional<std::string_view>("native-receiver-tunnel")},
+    {"native-watch", "SubscriptionRequest", "NativeRouteEventBatch", std::optional<std::string_view>("native-receiver-tunnel")},
 };
 
 } // namespace hyperflux
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
new file mode 100644
index 0000000..adca140
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
@@ -0,0 +1,2228 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "domain_json.hpp"
+#include "protocol_v7_types.hpp"
+
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace hyperflux::json_codec
+{
+
+template<>
+[[nodiscard]] ::hyperflux::v7::EmptyRequest decode<::hyperflux::v7::EmptyRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::EmptyRequest>(const ::hyperflux::v7::EmptyRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::RgbColor decode<::hyperflux::v7::RgbColor>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::RgbColor>(const ::hyperflux::v7::RgbColor& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ClientHello decode<::hyperflux::v7::ClientHello>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ClientHello>(const ::hyperflux::v7::ClientHello& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ServerHello decode<::hyperflux::v7::ServerHello>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ServerHello>(const ::hyperflux::v7::ServerHello& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ResourceKey decode<::hyperflux::v7::ResourceKey>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ResourceKey>(const ::hyperflux::v7::ResourceKey& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LeaseRequest decode<::hyperflux::v7::LeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LeaseRequest>(const ::hyperflux::v7::LeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LeaseGrant decode<::hyperflux::v7::LeaseGrant>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LeaseGrant>(const ::hyperflux::v7::LeaseGrant& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LeaseConflict decode<::hyperflux::v7::LeaseConflict>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LeaseConflict>(const ::hyperflux::v7::LeaseConflict& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LeaseRejection decode<::hyperflux::v7::LeaseRejection>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LeaseRejection>(const ::hyperflux::v7::LeaseRejection& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::RenewLeaseRequest decode<::hyperflux::v7::RenewLeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::RenewLeaseRequest>(const ::hyperflux::v7::RenewLeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ReleaseLeaseRequest decode<::hyperflux::v7::ReleaseLeaseRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ReleaseLeaseRequest>(const ::hyperflux::v7::ReleaseLeaseRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::EventCursor decode<::hyperflux::v7::EventCursor>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::EventCursor>(const ::hyperflux::v7::EventCursor& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ReturnEpoch decode<::hyperflux::v7::ReturnEpoch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ReturnEpoch>(const ::hyperflux::v7::ReturnEpoch& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::EndpointSnapshot decode<::hyperflux::v7::EndpointSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::EndpointSnapshot>(const ::hyperflux::v7::EndpointSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::BatteryObservation decode<::hyperflux::v7::BatteryObservation>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::BatteryObservation>(const ::hyperflux::v7::BatteryObservation& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ResourceOwnershipSnapshot decode<::hyperflux::v7::ResourceOwnershipSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ResourceOwnershipSnapshot>(const ::hyperflux::v7::ResourceOwnershipSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LogicalDeviceSnapshot decode<::hyperflux::v7::LogicalDeviceSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LogicalDeviceSnapshot>(const ::hyperflux::v7::LogicalDeviceSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ReceiverSnapshot decode<::hyperflux::v7::ReceiverSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ReceiverSnapshot>(const ::hyperflux::v7::ReceiverSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::BridgeSnapshot decode<::hyperflux::v7::BridgeSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::BridgeSnapshot>(const ::hyperflux::v7::BridgeSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LightingFrame decode<::hyperflux::v7::LightingFrame>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LightingFrame>(const ::hyperflux::v7::LightingFrame& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::DeviceProfileBinding decode<::hyperflux::v7::DeviceProfileBinding>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::DeviceProfileBinding>(const ::hyperflux::v7::DeviceProfileBinding& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::StableLightingIntent decode<::hyperflux::v7::StableLightingIntent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::StableLightingIntent>(const ::hyperflux::v7::StableLightingIntent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionRequest decode<::hyperflux::v7::TransactionRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionRequest>(const ::hyperflux::v7::TransactionRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionProgress decode<::hyperflux::v7::TransactionProgress>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionProgress>(const ::hyperflux::v7::TransactionProgress& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionTerminal decode<::hyperflux::v7::TransactionTerminal>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionTerminal>(const ::hyperflux::v7::TransactionTerminal& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionUnavailable decode<::hyperflux::v7::TransactionUnavailable>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionUnavailable>(const ::hyperflux::v7::TransactionUnavailable& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionLookup decode<::hyperflux::v7::TransactionLookup>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionLookup>(const ::hyperflux::v7::TransactionLookup& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::SubscriptionRequest decode<::hyperflux::v7::SubscriptionRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::SubscriptionRequest>(const ::hyperflux::v7::SubscriptionRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::BridgeEvent decode<::hyperflux::v7::BridgeEvent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::BridgeEvent>(const ::hyperflux::v7::BridgeEvent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::EventBatch decode<::hyperflux::v7::EventBatch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::EventBatch>(const ::hyperflux::v7::EventBatch& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::DiagnosticFinding decode<::hyperflux::v7::DiagnosticFinding>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::DiagnosticFinding>(const ::hyperflux::v7::DiagnosticFinding& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::DiagnosticSnapshot decode<::hyperflux::v7::DiagnosticSnapshot>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::DiagnosticSnapshot>(const ::hyperflux::v7::DiagnosticSnapshot& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ProfileBindingView decode<::hyperflux::v7::ProfileBindingView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ProfileBindingView>(const ::hyperflux::v7::ProfileBindingView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::DeviceInventoryView decode<::hyperflux::v7::DeviceInventoryView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::DeviceInventoryView>(const ::hyperflux::v7::DeviceInventoryView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::PresentationView decode<::hyperflux::v7::PresentationView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::PresentationView>(const ::hyperflux::v7::PresentationView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LightingTopologyView decode<::hyperflux::v7::LightingTopologyView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LightingTopologyView>(const ::hyperflux::v7::LightingTopologyView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::UnownedController decode<::hyperflux::v7::UnownedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::UnownedController>(const ::hyperflux::v7::UnownedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ViewerOwnedController decode<::hyperflux::v7::ViewerOwnedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ViewerOwnedController>(const ::hyperflux::v7::ViewerOwnedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::OtherOwnedController decode<::hyperflux::v7::OtherOwnedController>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::OtherOwnedController>(const ::hyperflux::v7::OtherOwnedController& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ControllerActions decode<::hyperflux::v7::ControllerActions>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ControllerActions>(const ::hyperflux::v7::ControllerActions& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ControllerView decode<::hyperflux::v7::ControllerView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ControllerView>(const ::hyperflux::v7::ControllerView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::IntegrationReceiverView decode<::hyperflux::v7::IntegrationReceiverView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::IntegrationReceiverView>(const ::hyperflux::v7::IntegrationReceiverView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::IntegrationView decode<::hyperflux::v7::IntegrationView>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::IntegrationView>(const ::hyperflux::v7::IntegrationView& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeRoute decode<::hyperflux::v7::NativeRoute>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeRoute>(const ::hyperflux::v7::NativeRoute& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeRouteInventory decode<::hyperflux::v7::NativeRouteInventory>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeRouteInventory>(const ::hyperflux::v7::NativeRouteInventory& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeRequest decode<::hyperflux::v7::NativeExchangeRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeRequest>(const ::hyperflux::v7::NativeExchangeRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeNotSent decode<::hyperflux::v7::NativeExchangeNotSent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeNotSent>(const ::hyperflux::v7::NativeExchangeNotSent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeUncertain decode<::hyperflux::v7::NativeExchangeUncertain>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeUncertain>(const ::hyperflux::v7::NativeExchangeUncertain& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeMatchedResponse decode<::hyperflux::v7::NativeExchangeMatchedResponse>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeMatchedResponse>(const ::hyperflux::v7::NativeExchangeMatchedResponse& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeOutcome decode<::hyperflux::v7::NativeExchangeOutcome>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeOutcome>(const ::hyperflux::v7::NativeExchangeOutcome& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeRouteEvent decode<::hyperflux::v7::NativeRouteEvent>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeRouteEvent>(const ::hyperflux::v7::NativeRouteEvent& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeRouteEventBatch decode<::hyperflux::v7::NativeRouteEventBatch>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeRouteEventBatch>(const ::hyperflux::v7::NativeRouteEventBatch& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::RpcError decode<::hyperflux::v7::RpcError>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::RpcError>(const ::hyperflux::v7::RpcError& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::LeaseResult decode<::hyperflux::v7::LeaseResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::LeaseResult>(const ::hyperflux::v7::LeaseResult& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::TransactionResult decode<::hyperflux::v7::TransactionResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::TransactionResult>(const ::hyperflux::v7::TransactionResult& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ControllerOwnership decode<::hyperflux::v7::ControllerOwnership>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ControllerOwnership>(const ::hyperflux::v7::ControllerOwnership& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NativeExchangeResult decode<::hyperflux::v7::NativeExchangeResult>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NativeExchangeResult>(const ::hyperflux::v7::NativeExchangeResult& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::NegotiationRequestEnvelope decode<::hyperflux::v7::NegotiationRequestEnvelope>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::NegotiationRequestEnvelope>(const ::hyperflux::v7::NegotiationRequestEnvelope& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::ErrorEnvelope decode<::hyperflux::v7::ErrorEnvelope>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::ErrorEnvelope>(const ::hyperflux::v7::ErrorEnvelope& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::RpcRequest decode<::hyperflux::v7::RpcRequest>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::RpcRequest>(const ::hyperflux::v7::RpcRequest& value);
+
+template<>
+[[nodiscard]] ::hyperflux::v7::RpcResponse decode<::hyperflux::v7::RpcResponse>(const Json& value);
+
+template<>
+[[nodiscard]] Json encode<::hyperflux::v7::RpcResponse>(const ::hyperflux::v7::RpcResponse& value);
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::EmptyRequest decode<::hyperflux::v7::EmptyRequest>(const Json& value)
+{
+    require_object(value, {});
+    return ::hyperflux::v7::EmptyRequest {};
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::EmptyRequest>(const ::hyperflux::v7::EmptyRequest& value)
+{
+    Json result = Json::object();
+    static_cast<void>(value);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::RgbColor decode<::hyperflux::v7::RgbColor>(const Json& value)
+{
+    require_object(value, {"red", "green", "blue"});
+    return ::hyperflux::v7::RgbColor {
+        decode<::hyperflux::ColorChannel>(required_field(value, "red")),
+        decode<::hyperflux::ColorChannel>(required_field(value, "green")),
+        decode<::hyperflux::ColorChannel>(required_field(value, "blue")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::RgbColor>(const ::hyperflux::v7::RgbColor& value)
+{
+    Json result = Json::object();
+    result["red"] = encode(value.red);
+    result["green"] = encode(value.green);
+    result["blue"] = encode(value.blue);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ClientHello decode<::hyperflux::v7::ClientHello>(const Json& value)
+{
+    require_object(value, {"client_id", "client_name", "minimum_version", "maximum_version", "required_features", "optional_features"});
+    return ::hyperflux::v7::ClientHello {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::ClientName>(required_field(value, "client_name")),
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "minimum_version")),
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "maximum_version")),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "required_features"), 64),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "optional_features"), 64),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ClientHello>(const ::hyperflux::v7::ClientHello& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["client_name"] = encode(value.client_name);
+    result["minimum_version"] = encode(value.minimum_version);
+    result["maximum_version"] = encode(value.maximum_version);
+    result["required_features"] = encode_vector(value.required_features);
+    result["optional_features"] = encode_vector(value.optional_features);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ServerHello decode<::hyperflux::v7::ServerHello>(const Json& value)
+{
+    require_object(value, {"selected_version", "server_instance_id", "protocol_session_id", "negotiation_token", "bridge_version", "enabled_features", "event_buffer_capacity"});
+    return ::hyperflux::v7::ServerHello {
+        decode<::hyperflux::ProtocolVersion>(required_field(value, "selected_version")),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<::hyperflux::ProtocolSessionId>(required_field(value, "protocol_session_id")),
+        decode<::hyperflux::NegotiationToken>(required_field(value, "negotiation_token")),
+        decode<::hyperflux::ComponentVersion>(required_field(value, "bridge_version")),
+        decode_vector<::hyperflux::ProtocolFeatureId>(required_field(value, "enabled_features"), 64),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "event_buffer_capacity")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ServerHello>(const ::hyperflux::v7::ServerHello& value)
+{
+    Json result = Json::object();
+    result["selected_version"] = encode(value.selected_version);
+    result["server_instance_id"] = encode(value.server_instance_id);
+    result["protocol_session_id"] = encode(value.protocol_session_id);
+    result["negotiation_token"] = encode(value.negotiation_token);
+    result["bridge_version"] = encode(value.bridge_version);
+    result["enabled_features"] = encode_vector(value.enabled_features);
+    result["event_buffer_capacity"] = encode(value.event_buffer_capacity);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ResourceKey decode<::hyperflux::v7::ResourceKey>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "kind"});
+    return ::hyperflux::v7::ResourceKey {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::ResourceKind>(required_field(value, "kind")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ResourceKey>(const ::hyperflux::v7::ResourceKey& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["kind"] = encode(value.kind);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LeaseRequest decode<::hyperflux::v7::LeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "resources", "duration_ms"});
+    return ::hyperflux::v7::LeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_vector<::hyperflux::v7::ResourceKey>(required_field(value, "resources"), 32),
+        decode<::hyperflux::LeaseDurationMs>(required_field(value, "duration_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LeaseRequest>(const ::hyperflux::v7::LeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["resources"] = encode_vector(value.resources);
+    result["duration_ms"] = encode(value.duration_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LeaseGrant decode<::hyperflux::v7::LeaseGrant>(const Json& value)
+{
+    require_object(value, {"lease_id", "client_id", "resources", "expires_at_ms", "state"});
+    return ::hyperflux::v7::LeaseGrant {
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_vector<::hyperflux::v7::ResourceKey>(required_field(value, "resources"), 32),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+        decode<::hyperflux::LeaseState>(required_field(value, "state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LeaseGrant>(const ::hyperflux::v7::LeaseGrant& value)
+{
+    Json result = Json::object();
+    result["lease_id"] = encode(value.lease_id);
+    result["client_id"] = encode(value.client_id);
+    result["resources"] = encode_vector(value.resources);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    result["state"] = encode(value.state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LeaseConflict decode<::hyperflux::v7::LeaseConflict>(const Json& value)
+{
+    require_object(value, {"conflicting_client", "conflicting_resource"});
+    return ::hyperflux::v7::LeaseConflict {
+        decode<::hyperflux::ClientId>(required_field(value, "conflicting_client")),
+        decode<::hyperflux::v7::ResourceKey>(required_field(value, "conflicting_resource")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LeaseConflict>(const ::hyperflux::v7::LeaseConflict& value)
+{
+    Json result = Json::object();
+    result["conflicting_client"] = encode(value.conflicting_client);
+    result["conflicting_resource"] = encode(value.conflicting_resource);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LeaseRejection decode<::hyperflux::v7::LeaseRejection>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::v7::LeaseRejection {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LeaseRejection>(const ::hyperflux::v7::LeaseRejection& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::RenewLeaseRequest decode<::hyperflux::v7::RenewLeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id", "duration_ms"});
+    return ::hyperflux::v7::RenewLeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::LeaseDurationMs>(required_field(value, "duration_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::RenewLeaseRequest>(const ::hyperflux::v7::RenewLeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["duration_ms"] = encode(value.duration_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ReleaseLeaseRequest decode<::hyperflux::v7::ReleaseLeaseRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id"});
+    return ::hyperflux::v7::ReleaseLeaseRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ReleaseLeaseRequest>(const ::hyperflux::v7::ReleaseLeaseRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::EventCursor decode<::hyperflux::v7::EventCursor>(const Json& value)
+{
+    require_object(value, {"stream_id", "stream_epoch", "projection_revision", "sequence"});
+    return ::hyperflux::v7::EventCursor {
+        decode<::hyperflux::StreamId>(required_field(value, "stream_id")),
+        decode<::hyperflux::StreamEpoch>(required_field(value, "stream_epoch")),
+        decode<::hyperflux::ProjectionRevision>(required_field(value, "projection_revision")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::EventCursor>(const ::hyperflux::v7::EventCursor& value)
+{
+    Json result = Json::object();
+    result["stream_id"] = encode(value.stream_id);
+    result["stream_epoch"] = encode(value.stream_epoch);
+    result["projection_revision"] = encode(value.projection_revision);
+    result["sequence"] = encode(value.sequence);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ReturnEpoch decode<::hyperflux::v7::ReturnEpoch>(const Json& value)
+{
+    require_object(value, {"generation_id", "device_id", "endpoint_id", "epoch_sequence", "opened_at_ms", "opening_evidence", "phase", "delivery_state"});
+    return ::hyperflux::v7::ReturnEpoch {
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "epoch_sequence")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "opened_at_ms")),
+        decode<::hyperflux::ReturnEvidence>(required_field(value, "opening_evidence")),
+        decode<::hyperflux::ReturnPhase>(required_field(value, "phase")),
+        decode<::hyperflux::RestoreDeliveryState>(required_field(value, "delivery_state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ReturnEpoch>(const ::hyperflux::v7::ReturnEpoch& value)
+{
+    Json result = Json::object();
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["epoch_sequence"] = encode(value.epoch_sequence);
+    result["opened_at_ms"] = encode(value.opened_at_ms);
+    result["opening_evidence"] = encode(value.opening_evidence);
+    result["phase"] = encode(value.phase);
+    result["delivery_state"] = encode(value.delivery_state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::EndpointSnapshot decode<::hyperflux::v7::EndpointSnapshot>(const Json& value)
+{
+    require_object(value, {"endpoint_id", "route_kind", "route_state", "connection_mode", "power_state", "sleep_state", "activity_state", "contact_state", "freshness", "confidence", "evidence_claim_id", "observed_at_ms", "return_epoch"});
+    return ::hyperflux::v7::EndpointSnapshot {
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::RouteKind>(required_field(value, "route_kind")),
+        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::ConnectionMode>(required_field(value, "connection_mode")),
+        decode<::hyperflux::PowerState>(required_field(value, "power_state")),
+        decode<::hyperflux::SleepState>(required_field(value, "sleep_state")),
+        decode<::hyperflux::ActivityState>(required_field(value, "activity_state")),
+        decode<::hyperflux::ContactState>(required_field(value, "contact_state")),
+        decode<::hyperflux::FreshnessState>(required_field(value, "freshness")),
+        decode<::hyperflux::EvidenceConfidence>(required_field(value, "confidence")),
+        decode_optional_field<::hyperflux::EvidenceClaimId>(value, "evidence_claim_id"),
+        decode_optional_field<::hyperflux::MonotonicMs>(value, "observed_at_ms"),
+        decode_optional_field<::hyperflux::v7::ReturnEpoch>(value, "return_epoch"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::EndpointSnapshot>(const ::hyperflux::v7::EndpointSnapshot& value)
+{
+    Json result = Json::object();
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["route_kind"] = encode(value.route_kind);
+    result["route_state"] = encode(value.route_state);
+    result["connection_mode"] = encode(value.connection_mode);
+    result["power_state"] = encode(value.power_state);
+    result["sleep_state"] = encode(value.sleep_state);
+    result["activity_state"] = encode(value.activity_state);
+    result["contact_state"] = encode(value.contact_state);
+    result["freshness"] = encode(value.freshness);
+    result["confidence"] = encode(value.confidence);
+    result["evidence_claim_id"] = value.evidence_claim_id.has_value() ? encode(*value.evidence_claim_id) : Json(nullptr);
+    result["observed_at_ms"] = value.observed_at_ms.has_value() ? encode(*value.observed_at_ms) : Json(nullptr);
+    result["return_epoch"] = value.return_epoch.has_value() ? encode(*value.return_epoch) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::BatteryObservation decode<::hyperflux::v7::BatteryObservation>(const Json& value)
+{
+    require_object(value, {"availability", "percentage", "freshness", "confidence", "observed_at_ms"});
+    return ::hyperflux::v7::BatteryObservation {
+        decode<::hyperflux::TelemetryAvailability>(required_field(value, "availability")),
+        decode_optional_field<::hyperflux::BatteryPercent>(value, "percentage"),
+        decode<::hyperflux::FreshnessState>(required_field(value, "freshness")),
+        decode<::hyperflux::EvidenceConfidence>(required_field(value, "confidence")),
+        decode_optional_field<::hyperflux::MonotonicMs>(value, "observed_at_ms"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::BatteryObservation>(const ::hyperflux::v7::BatteryObservation& value)
+{
+    Json result = Json::object();
+    result["availability"] = encode(value.availability);
+    result["percentage"] = value.percentage.has_value() ? encode(*value.percentage) : Json(nullptr);
+    result["freshness"] = encode(value.freshness);
+    result["confidence"] = encode(value.confidence);
+    result["observed_at_ms"] = value.observed_at_ms.has_value() ? encode(*value.observed_at_ms) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ResourceOwnershipSnapshot decode<::hyperflux::v7::ResourceOwnershipSnapshot>(const Json& value)
+{
+    require_object(value, {"resource", "client_id", "lease_id", "expires_at_ms"});
+    return ::hyperflux::v7::ResourceOwnershipSnapshot {
+        decode<::hyperflux::v7::ResourceKey>(required_field(value, "resource")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ResourceOwnershipSnapshot>(const ::hyperflux::v7::ResourceOwnershipSnapshot& value)
+{
+    Json result = Json::object();
+    result["resource"] = encode(value.resource);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LogicalDeviceSnapshot decode<::hyperflux::v7::LogicalDeviceSnapshot>(const Json& value)
+{
+    require_object(value, {"device_id", "device_kind", "product_id", "profile_id", "profile_digest", "pairing", "presence", "support_level", "endpoints", "battery", "capabilities"});
+    return ::hyperflux::v7::LogicalDeviceSnapshot {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode_optional_field<::hyperflux::ProfileId>(value, "profile_id"),
+        decode_optional_field<::hyperflux::ProfileDigest>(value, "profile_digest"),
+        decode<::hyperflux::PairingState>(required_field(value, "pairing")),
+        decode<::hyperflux::PresenceState>(required_field(value, "presence")),
+        decode<::hyperflux::SupportLevel>(required_field(value, "support_level")),
+        decode_vector<::hyperflux::v7::EndpointSnapshot>(required_field(value, "endpoints"), 8),
+        decode<::hyperflux::v7::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LogicalDeviceSnapshot>(const ::hyperflux::v7::LogicalDeviceSnapshot& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["profile_id"] = value.profile_id.has_value() ? encode(*value.profile_id) : Json(nullptr);
+    result["profile_digest"] = value.profile_digest.has_value() ? encode(*value.profile_digest) : Json(nullptr);
+    result["pairing"] = encode(value.pairing);
+    result["presence"] = encode(value.presence);
+    result["support_level"] = encode(value.support_level);
+    result["endpoints"] = encode_vector(value.endpoints);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ReceiverSnapshot decode<::hyperflux::v7::ReceiverSnapshot>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "profile_id", "profile_digest", "lifecycle", "devices", "ownership", "stable_restore_enabled", "restore_state"});
+    return ::hyperflux::v7::ReceiverSnapshot {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode_optional_field<::hyperflux::ProfileId>(value, "profile_id"),
+        decode_optional_field<::hyperflux::ProfileDigest>(value, "profile_digest"),
+        decode<::hyperflux::ReceiverLifecycleState>(required_field(value, "lifecycle")),
+        decode_vector<::hyperflux::v7::LogicalDeviceSnapshot>(required_field(value, "devices"), 32),
+        decode_vector<::hyperflux::v7::ResourceOwnershipSnapshot>(required_field(value, "ownership"), 96),
+        decode<bool>(required_field(value, "stable_restore_enabled")),
+        decode<::hyperflux::RestoreState>(required_field(value, "restore_state")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ReceiverSnapshot>(const ::hyperflux::v7::ReceiverSnapshot& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["profile_id"] = value.profile_id.has_value() ? encode(*value.profile_id) : Json(nullptr);
+    result["profile_digest"] = value.profile_digest.has_value() ? encode(*value.profile_digest) : Json(nullptr);
+    result["lifecycle"] = encode(value.lifecycle);
+    result["devices"] = encode_vector(value.devices);
+    result["ownership"] = encode_vector(value.ownership);
+    result["stable_restore_enabled"] = encode(value.stable_restore_enabled);
+    result["restore_state"] = encode(value.restore_state);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::BridgeSnapshot decode<::hyperflux::v7::BridgeSnapshot>(const Json& value)
+{
+    require_object(value, {"cursor", "receivers"});
+    return ::hyperflux::v7::BridgeSnapshot {
+        decode<::hyperflux::v7::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::v7::ReceiverSnapshot>(required_field(value, "receivers"), 16),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::BridgeSnapshot>(const ::hyperflux::v7::BridgeSnapshot& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["receivers"] = encode_vector(value.receivers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LightingFrame decode<::hyperflux::v7::LightingFrame>(const Json& value)
+{
+    require_object(value, {"device_id", "frame_index", "colors"});
+    return ::hyperflux::v7::LightingFrame {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::FrameIndex>(required_field(value, "frame_index")),
+        decode_vector<::hyperflux::v7::RgbColor>(required_field(value, "colors"), 4096),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LightingFrame>(const ::hyperflux::v7::LightingFrame& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["frame_index"] = encode(value.frame_index);
+    result["colors"] = encode_vector(value.colors);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::DeviceProfileBinding decode<::hyperflux::v7::DeviceProfileBinding>(const Json& value)
+{
+    require_object(value, {"device_id", "profile_id", "profile_digest", "application_slot_count"});
+    return ::hyperflux::v7::DeviceProfileBinding {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::ProfileId>(required_field(value, "profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "profile_digest")),
+        decode<::hyperflux::LedCount>(required_field(value, "application_slot_count")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::DeviceProfileBinding>(const ::hyperflux::v7::DeviceProfileBinding& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["profile_id"] = encode(value.profile_id);
+    result["profile_digest"] = encode(value.profile_digest);
+    result["application_slot_count"] = encode(value.application_slot_count);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::StableLightingIntent decode<::hyperflux::v7::StableLightingIntent>(const Json& value)
+{
+    require_object(value, {"device_id", "mode"});
+    return ::hyperflux::v7::StableLightingIntent {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::StableLightingMode>(required_field(value, "mode")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::StableLightingIntent>(const ::hyperflux::v7::StableLightingIntent& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["mode"] = encode(value.mode);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionRequest decode<::hyperflux::v7::TransactionRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "transaction_id", "client_id", "lease_id", "receiver_id", "generation_id", "receiver_profile_id", "receiver_profile_digest", "device_profiles", "transaction_class", "stable_intents", "deadline_ms", "resources", "frames"});
+    return ::hyperflux::v7::TransactionRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::ProfileId>(required_field(value, "receiver_profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "receiver_profile_digest")),
+        decode_vector<::hyperflux::v7::DeviceProfileBinding>(required_field(value, "device_profiles"), 32),
+        decode<::hyperflux::TransactionClass>(required_field(value, "transaction_class")),
+        decode_vector<::hyperflux::v7::StableLightingIntent>(required_field(value, "stable_intents"), 32),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "deadline_ms")),
+        decode_vector<::hyperflux::v7::ResourceKey>(required_field(value, "resources"), 32),
+        decode_vector<::hyperflux::v7::LightingFrame>(required_field(value, "frames"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionRequest>(const ::hyperflux::v7::TransactionRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["receiver_profile_id"] = encode(value.receiver_profile_id);
+    result["receiver_profile_digest"] = encode(value.receiver_profile_digest);
+    result["device_profiles"] = encode_vector(value.device_profiles);
+    result["transaction_class"] = encode(value.transaction_class);
+    result["stable_intents"] = encode_vector(value.stable_intents);
+    result["deadline_ms"] = encode(value.deadline_ms);
+    result["resources"] = encode_vector(value.resources);
+    result["frames"] = encode_vector(value.frames);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionProgress decode<::hyperflux::v7::TransactionProgress>(const Json& value)
+{
+    require_object(value, {"request_id", "request_digest", "transaction_id", "receiver_id", "generation_id", "state", "admission", "declared_frames", "delivered_frames", "side_effect_certainty", "live_write_executed"});
+    return ::hyperflux::v7::TransactionProgress {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::RequestDigest>(required_field(value, "request_digest")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::TransactionState>(required_field(value, "state")),
+        decode<::hyperflux::QueueAdmission>(required_field(value, "admission")),
+        decode<::hyperflux::FrameCount>(required_field(value, "declared_frames")),
+        decode<::hyperflux::DeliveredFrameCount>(required_field(value, "delivered_frames")),
+        decode<::hyperflux::SideEffectCertainty>(required_field(value, "side_effect_certainty")),
+        decode<bool>(required_field(value, "live_write_executed")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionProgress>(const ::hyperflux::v7::TransactionProgress& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["request_digest"] = encode(value.request_digest);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["state"] = encode(value.state);
+    result["admission"] = encode(value.admission);
+    result["declared_frames"] = encode(value.declared_frames);
+    result["delivered_frames"] = encode(value.delivered_frames);
+    result["side_effect_certainty"] = encode(value.side_effect_certainty);
+    result["live_write_executed"] = encode(value.live_write_executed);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionTerminal decode<::hyperflux::v7::TransactionTerminal>(const Json& value)
+{
+    require_object(value, {"request_id", "request_digest", "transaction_id", "receiver_id", "generation_id", "state", "declared_frames", "delivered_frames", "side_effect_certainty", "live_write_executed", "automatic_retry", "device_application", "terminal_sequence", "error_kind", "superseded_by"});
+    return ::hyperflux::v7::TransactionTerminal {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::RequestDigest>(required_field(value, "request_digest")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::TransactionState>(required_field(value, "state")),
+        decode<::hyperflux::FrameCount>(required_field(value, "declared_frames")),
+        decode<::hyperflux::DeliveredFrameCount>(required_field(value, "delivered_frames")),
+        decode<::hyperflux::SideEffectCertainty>(required_field(value, "side_effect_certainty")),
+        decode<bool>(required_field(value, "live_write_executed")),
+        decode<bool>(required_field(value, "automatic_retry")),
+        decode<::hyperflux::DeviceApplicationState>(required_field(value, "device_application")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "terminal_sequence")),
+        decode_optional_field<::hyperflux::ProtocolErrorKind>(value, "error_kind"),
+        decode_optional_field<::hyperflux::TransactionId>(value, "superseded_by"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionTerminal>(const ::hyperflux::v7::TransactionTerminal& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["request_digest"] = encode(value.request_digest);
+    result["transaction_id"] = encode(value.transaction_id);
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["state"] = encode(value.state);
+    result["declared_frames"] = encode(value.declared_frames);
+    result["delivered_frames"] = encode(value.delivered_frames);
+    result["side_effect_certainty"] = encode(value.side_effect_certainty);
+    result["live_write_executed"] = encode(value.live_write_executed);
+    result["automatic_retry"] = encode(value.automatic_retry);
+    result["device_application"] = encode(value.device_application);
+    result["terminal_sequence"] = encode(value.terminal_sequence);
+    result["error_kind"] = value.error_kind.has_value() ? encode(*value.error_kind) : Json(nullptr);
+    result["superseded_by"] = value.superseded_by.has_value() ? encode(*value.superseded_by) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionUnavailable decode<::hyperflux::v7::TransactionUnavailable>(const Json& value)
+{
+    require_object(value, {"transaction_id", "error_kind", "finding_id"});
+    return ::hyperflux::v7::TransactionUnavailable {
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionUnavailable>(const ::hyperflux::v7::TransactionUnavailable& value)
+{
+    Json result = Json::object();
+    result["transaction_id"] = encode(value.transaction_id);
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionLookup decode<::hyperflux::v7::TransactionLookup>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "transaction_id"});
+    return ::hyperflux::v7::TransactionLookup {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::TransactionId>(required_field(value, "transaction_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionLookup>(const ::hyperflux::v7::TransactionLookup& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["transaction_id"] = encode(value.transaction_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::SubscriptionRequest decode<::hyperflux::v7::SubscriptionRequest>(const Json& value)
+{
+    require_object(value, {"client_id", "subscription_id", "expected_cursor", "max_events"});
+    return ::hyperflux::v7::SubscriptionRequest {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode_optional_field<::hyperflux::SubscriptionId>(value, "subscription_id"),
+        decode_optional_field<::hyperflux::v7::EventCursor>(value, "expected_cursor"),
+        decode<::hyperflux::EventBatchLimit>(required_field(value, "max_events")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::SubscriptionRequest>(const ::hyperflux::v7::SubscriptionRequest& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["subscription_id"] = value.subscription_id.has_value() ? encode(*value.subscription_id) : Json(nullptr);
+    result["expected_cursor"] = value.expected_cursor.has_value() ? encode(*value.expected_cursor) : Json(nullptr);
+    result["max_events"] = encode(value.max_events);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::BridgeEvent decode<::hyperflux::v7::BridgeEvent>(const Json& value)
+{
+    require_object(value, {"sequence", "kind", "receiver_id", "generation_id", "device_id", "lease_id", "transaction_id", "finding_id"});
+    return ::hyperflux::v7::BridgeEvent {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode<::hyperflux::EventKind>(required_field(value, "kind")),
+        decode_optional_field<::hyperflux::ReceiverId>(value, "receiver_id"),
+        decode_optional_field<::hyperflux::GenerationId>(value, "generation_id"),
+        decode_optional_field<::hyperflux::LogicalDeviceId>(value, "device_id"),
+        decode_optional_field<::hyperflux::LeaseId>(value, "lease_id"),
+        decode_optional_field<::hyperflux::TransactionId>(value, "transaction_id"),
+        decode_optional_field<::hyperflux::FindingId>(value, "finding_id"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::BridgeEvent>(const ::hyperflux::v7::BridgeEvent& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["kind"] = encode(value.kind);
+    result["receiver_id"] = value.receiver_id.has_value() ? encode(*value.receiver_id) : Json(nullptr);
+    result["generation_id"] = value.generation_id.has_value() ? encode(*value.generation_id) : Json(nullptr);
+    result["device_id"] = value.device_id.has_value() ? encode(*value.device_id) : Json(nullptr);
+    result["lease_id"] = value.lease_id.has_value() ? encode(*value.lease_id) : Json(nullptr);
+    result["transaction_id"] = value.transaction_id.has_value() ? encode(*value.transaction_id) : Json(nullptr);
+    result["finding_id"] = value.finding_id.has_value() ? encode(*value.finding_id) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::EventBatch decode<::hyperflux::v7::EventBatch>(const Json& value)
+{
+    require_object(value, {"subscription_id", "next_cursor", "events", "oldest_available", "latest_available", "dropped_events", "cursor_gap", "has_more"});
+    return ::hyperflux::v7::EventBatch {
+        decode<::hyperflux::SubscriptionId>(required_field(value, "subscription_id")),
+        decode<::hyperflux::v7::EventCursor>(required_field(value, "next_cursor")),
+        decode_vector<::hyperflux::v7::BridgeEvent>(required_field(value, "events"), 256),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "oldest_available")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "latest_available")),
+        decode<::hyperflux::DroppedEventCount>(required_field(value, "dropped_events")),
+        decode<bool>(required_field(value, "cursor_gap")),
+        decode<bool>(required_field(value, "has_more")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::EventBatch>(const ::hyperflux::v7::EventBatch& value)
+{
+    Json result = Json::object();
+    result["subscription_id"] = encode(value.subscription_id);
+    result["next_cursor"] = encode(value.next_cursor);
+    result["events"] = encode_vector(value.events);
+    result["oldest_available"] = encode(value.oldest_available);
+    result["latest_available"] = encode(value.latest_available);
+    result["dropped_events"] = encode(value.dropped_events);
+    result["cursor_gap"] = encode(value.cursor_gap);
+    result["has_more"] = encode(value.has_more);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::DiagnosticFinding decode<::hyperflux::v7::DiagnosticFinding>(const Json& value)
+{
+    require_object(value, {"finding_id", "severity", "cause", "explanation", "safe_action", "privacy", "documentation"});
+    return ::hyperflux::v7::DiagnosticFinding {
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+        decode<::hyperflux::ErrorSeverity>(required_field(value, "severity")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "cause")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "explanation")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "safe_action")),
+        decode<::hyperflux::PrivacyClass>(required_field(value, "privacy")),
+        decode<::hyperflux::DocumentationPath>(required_field(value, "documentation")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::DiagnosticFinding>(const ::hyperflux::v7::DiagnosticFinding& value)
+{
+    Json result = Json::object();
+    result["finding_id"] = encode(value.finding_id);
+    result["severity"] = encode(value.severity);
+    result["cause"] = encode(value.cause);
+    result["explanation"] = encode(value.explanation);
+    result["safe_action"] = encode(value.safe_action);
+    result["privacy"] = encode(value.privacy);
+    result["documentation"] = encode(value.documentation);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::DiagnosticSnapshot decode<::hyperflux::v7::DiagnosticSnapshot>(const Json& value)
+{
+    require_object(value, {"sequence", "findings", "event_buffer_capacity", "transaction_queue_capacity"});
+    return ::hyperflux::v7::DiagnosticSnapshot {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode_vector<::hyperflux::v7::DiagnosticFinding>(required_field(value, "findings"), 128),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "event_buffer_capacity")),
+        decode<::hyperflux::QueueCapacity>(required_field(value, "transaction_queue_capacity")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::DiagnosticSnapshot>(const ::hyperflux::v7::DiagnosticSnapshot& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["findings"] = encode_vector(value.findings);
+    result["event_buffer_capacity"] = encode(value.event_buffer_capacity);
+    result["transaction_queue_capacity"] = encode(value.transaction_queue_capacity);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ProfileBindingView decode<::hyperflux::v7::ProfileBindingView>(const Json& value)
+{
+    require_object(value, {"profile_id", "profile_digest"});
+    return ::hyperflux::v7::ProfileBindingView {
+        decode<::hyperflux::ProfileId>(required_field(value, "profile_id")),
+        decode<::hyperflux::ProfileDigest>(required_field(value, "profile_digest")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ProfileBindingView>(const ::hyperflux::v7::ProfileBindingView& value)
+{
+    Json result = Json::object();
+    result["profile_id"] = encode(value.profile_id);
+    result["profile_digest"] = encode(value.profile_digest);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::DeviceInventoryView decode<::hyperflux::v7::DeviceInventoryView>(const Json& value)
+{
+    require_object(value, {"device_id", "device_kind", "product_id", "profile", "model_name", "pairing", "presence", "availability", "support_level", "endpoints", "battery", "capabilities"});
+    return ::hyperflux::v7::DeviceInventoryView {
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode_optional_field<::hyperflux::v7::ProfileBindingView>(value, "profile"),
+        decode_optional_field<::hyperflux::ModelName>(value, "model_name"),
+        decode<::hyperflux::PairingState>(required_field(value, "pairing")),
+        decode<::hyperflux::PresenceState>(required_field(value, "presence")),
+        decode<::hyperflux::InventoryAvailability>(required_field(value, "availability")),
+        decode<::hyperflux::SupportLevel>(required_field(value, "support_level")),
+        decode_vector<::hyperflux::v7::EndpointSnapshot>(required_field(value, "endpoints"), 8),
+        decode<::hyperflux::v7::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::DeviceInventoryView>(const ::hyperflux::v7::DeviceInventoryView& value)
+{
+    Json result = Json::object();
+    result["device_id"] = encode(value.device_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["profile"] = value.profile.has_value() ? encode(*value.profile) : Json(nullptr);
+    result["model_name"] = value.model_name.has_value() ? encode(*value.model_name) : Json(nullptr);
+    result["pairing"] = encode(value.pairing);
+    result["presence"] = encode(value.presence);
+    result["availability"] = encode(value.availability);
+    result["support_level"] = encode(value.support_level);
+    result["endpoints"] = encode_vector(value.endpoints);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::PresentationView decode<::hyperflux::v7::PresentationView>(const Json& value)
+{
+    require_object(value, {"upstream_id", "owner", "project_version", "source_revision", "model_key", "layout_key", "transport_variant"});
+    return ::hyperflux::v7::PresentationView {
+        decode<::hyperflux::UpstreamId>(required_field(value, "upstream_id")),
+        decode<::hyperflux::UpstreamOwner>(required_field(value, "owner")),
+        decode<::hyperflux::ComponentVersion>(required_field(value, "project_version")),
+        decode<::hyperflux::SourceRevision>(required_field(value, "source_revision")),
+        decode<::hyperflux::PresentationKey>(required_field(value, "model_key")),
+        decode_optional_field<::hyperflux::PresentationKey>(value, "layout_key"),
+        decode<::hyperflux::TransportVariant>(required_field(value, "transport_variant")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::PresentationView>(const ::hyperflux::v7::PresentationView& value)
+{
+    Json result = Json::object();
+    result["upstream_id"] = encode(value.upstream_id);
+    result["owner"] = encode(value.owner);
+    result["project_version"] = encode(value.project_version);
+    result["source_revision"] = encode(value.source_revision);
+    result["model_key"] = encode(value.model_key);
+    result["layout_key"] = value.layout_key.has_value() ? encode(*value.layout_key) : Json(nullptr);
+    result["transport_variant"] = encode(value.transport_variant);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LightingTopologyView decode<::hyperflux::v7::LightingTopologyView>(const Json& value)
+{
+    require_object(value, {"physical_led_count", "application_slot_count", "rows", "columns"});
+    return ::hyperflux::v7::LightingTopologyView {
+        decode<::hyperflux::LedCount>(required_field(value, "physical_led_count")),
+        decode<::hyperflux::LedCount>(required_field(value, "application_slot_count")),
+        decode<::hyperflux::LedCount>(required_field(value, "rows")),
+        decode<::hyperflux::LedCount>(required_field(value, "columns")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LightingTopologyView>(const ::hyperflux::v7::LightingTopologyView& value)
+{
+    Json result = Json::object();
+    result["physical_led_count"] = encode(value.physical_led_count);
+    result["application_slot_count"] = encode(value.application_slot_count);
+    result["rows"] = encode(value.rows);
+    result["columns"] = encode(value.columns);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::UnownedController decode<::hyperflux::v7::UnownedController>(const Json& value)
+{
+    require_object(value, {});
+    return ::hyperflux::v7::UnownedController {};
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::UnownedController>(const ::hyperflux::v7::UnownedController& value)
+{
+    Json result = Json::object();
+    static_cast<void>(value);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ViewerOwnedController decode<::hyperflux::v7::ViewerOwnedController>(const Json& value)
+{
+    require_object(value, {"lease_id", "expires_at_ms"});
+    return ::hyperflux::v7::ViewerOwnedController {
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ViewerOwnedController>(const ::hyperflux::v7::ViewerOwnedController& value)
+{
+    Json result = Json::object();
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::OtherOwnedController decode<::hyperflux::v7::OtherOwnedController>(const Json& value)
+{
+    require_object(value, {"client_id", "lease_id", "expires_at_ms"});
+    return ::hyperflux::v7::OtherOwnedController {
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::MonotonicMs>(required_field(value, "expires_at_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::OtherOwnedController>(const ::hyperflux::v7::OtherOwnedController& value)
+{
+    Json result = Json::object();
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["expires_at_ms"] = encode(value.expires_at_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ControllerActions decode<::hyperflux::v7::ControllerActions>(const Json& value)
+{
+    require_object(value, {"can_acquire", "can_release", "can_submit_now"});
+    return ::hyperflux::v7::ControllerActions {
+        decode<bool>(required_field(value, "can_acquire")),
+        decode<bool>(required_field(value, "can_release")),
+        decode<bool>(required_field(value, "can_submit_now")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ControllerActions>(const ::hyperflux::v7::ControllerActions& value)
+{
+    Json result = Json::object();
+    result["can_acquire"] = encode(value.can_acquire);
+    result["can_release"] = encode(value.can_release);
+    result["can_submit_now"] = encode(value.can_submit_now);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ControllerView decode<::hyperflux::v7::ControllerView>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "endpoint_id", "device_kind", "product_id", "receiver_profile", "device_profile", "model_name", "presentation", "availability", "battery", "capabilities", "lighting", "resource", "ownership", "actions"});
+    return ::hyperflux::v7::ControllerView {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode<::hyperflux::v7::ProfileBindingView>(required_field(value, "receiver_profile")),
+        decode<::hyperflux::v7::ProfileBindingView>(required_field(value, "device_profile")),
+        decode<::hyperflux::ModelName>(required_field(value, "model_name")),
+        decode<::hyperflux::v7::PresentationView>(required_field(value, "presentation")),
+        decode<::hyperflux::ControllerAvailability>(required_field(value, "availability")),
+        decode<::hyperflux::v7::BatteryObservation>(required_field(value, "battery")),
+        decode_vector<::hyperflux::CapabilityId>(required_field(value, "capabilities"), 128),
+        decode<::hyperflux::v7::LightingTopologyView>(required_field(value, "lighting")),
+        decode<::hyperflux::v7::ResourceKey>(required_field(value, "resource")),
+        decode<::hyperflux::v7::ControllerOwnership>(required_field(value, "ownership")),
+        decode<::hyperflux::v7::ControllerActions>(required_field(value, "actions")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ControllerView>(const ::hyperflux::v7::ControllerView& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["product_id"] = encode(value.product_id);
+    result["receiver_profile"] = encode(value.receiver_profile);
+    result["device_profile"] = encode(value.device_profile);
+    result["model_name"] = encode(value.model_name);
+    result["presentation"] = encode(value.presentation);
+    result["availability"] = encode(value.availability);
+    result["battery"] = encode(value.battery);
+    result["capabilities"] = encode_vector(value.capabilities);
+    result["lighting"] = encode(value.lighting);
+    result["resource"] = encode(value.resource);
+    result["ownership"] = encode(value.ownership);
+    result["actions"] = encode(value.actions);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::IntegrationReceiverView decode<::hyperflux::v7::IntegrationReceiverView>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "profile", "model_name", "lifecycle", "stable_restore_enabled", "restore_state", "inventory", "controllers"});
+    return ::hyperflux::v7::IntegrationReceiverView {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode_optional_field<::hyperflux::v7::ProfileBindingView>(value, "profile"),
+        decode_optional_field<::hyperflux::ModelName>(value, "model_name"),
+        decode<::hyperflux::ReceiverLifecycleState>(required_field(value, "lifecycle")),
+        decode<bool>(required_field(value, "stable_restore_enabled")),
+        decode<::hyperflux::RestoreState>(required_field(value, "restore_state")),
+        decode_vector<::hyperflux::v7::DeviceInventoryView>(required_field(value, "inventory"), 32),
+        decode_vector<::hyperflux::v7::ControllerView>(required_field(value, "controllers"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::IntegrationReceiverView>(const ::hyperflux::v7::IntegrationReceiverView& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["profile"] = value.profile.has_value() ? encode(*value.profile) : Json(nullptr);
+    result["model_name"] = value.model_name.has_value() ? encode(*value.model_name) : Json(nullptr);
+    result["lifecycle"] = encode(value.lifecycle);
+    result["stable_restore_enabled"] = encode(value.stable_restore_enabled);
+    result["restore_state"] = encode(value.restore_state);
+    result["inventory"] = encode_vector(value.inventory);
+    result["controllers"] = encode_vector(value.controllers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::IntegrationView decode<::hyperflux::v7::IntegrationView>(const Json& value)
+{
+    require_object(value, {"cursor", "receivers"});
+    return ::hyperflux::v7::IntegrationView {
+        decode<::hyperflux::v7::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::v7::IntegrationReceiverView>(required_field(value, "receivers"), 16),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::IntegrationView>(const ::hyperflux::v7::IntegrationView& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["receivers"] = encode_vector(value.receivers);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeRoute decode<::hyperflux::v7::NativeRoute>(const Json& value)
+{
+    require_object(value, {"receiver_id", "generation_id", "device_id", "endpoint_id", "device_kind", "vendor_id", "product_id", "route_state", "access", "protocol_family", "report_bytes", "route_token", "resource"});
+    return ::hyperflux::v7::NativeRoute {
+        decode<::hyperflux::ReceiverId>(required_field(value, "receiver_id")),
+        decode<::hyperflux::GenerationId>(required_field(value, "generation_id")),
+        decode<::hyperflux::LogicalDeviceId>(required_field(value, "device_id")),
+        decode<::hyperflux::EndpointId>(required_field(value, "endpoint_id")),
+        decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
+        decode<::hyperflux::VendorId>(required_field(value, "vendor_id")),
+        decode<::hyperflux::ProductId>(required_field(value, "product_id")),
+        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::NativeRouteAccess>(required_field(value, "access")),
+        decode<::hyperflux::NativeProtocolFamily>(required_field(value, "protocol_family")),
+        decode<::hyperflux::NativeReportByteCount>(required_field(value, "report_bytes")),
+        decode_optional_field<::hyperflux::NativeRouteToken>(value, "route_token"),
+        decode_optional_field<::hyperflux::v7::ResourceKey>(value, "resource"),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeRoute>(const ::hyperflux::v7::NativeRoute& value)
+{
+    Json result = Json::object();
+    result["receiver_id"] = encode(value.receiver_id);
+    result["generation_id"] = encode(value.generation_id);
+    result["device_id"] = encode(value.device_id);
+    result["endpoint_id"] = encode(value.endpoint_id);
+    result["device_kind"] = encode(value.device_kind);
+    result["vendor_id"] = encode(value.vendor_id);
+    result["product_id"] = encode(value.product_id);
+    result["route_state"] = encode(value.route_state);
+    result["access"] = encode(value.access);
+    result["protocol_family"] = encode(value.protocol_family);
+    result["report_bytes"] = encode(value.report_bytes);
+    result["route_token"] = value.route_token.has_value() ? encode(*value.route_token) : Json(nullptr);
+    result["resource"] = value.resource.has_value() ? encode(*value.resource) : Json(nullptr);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeRouteInventory decode<::hyperflux::v7::NativeRouteInventory>(const Json& value)
+{
+    require_object(value, {"cursor", "routes"});
+    return ::hyperflux::v7::NativeRouteInventory {
+        decode<::hyperflux::v7::EventCursor>(required_field(value, "cursor")),
+        decode_vector<::hyperflux::v7::NativeRoute>(required_field(value, "routes"), 32),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeRouteInventory>(const ::hyperflux::v7::NativeRouteInventory& value)
+{
+    Json result = Json::object();
+    result["cursor"] = encode(value.cursor);
+    result["routes"] = encode_vector(value.routes);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeRequest decode<::hyperflux::v7::NativeExchangeRequest>(const Json& value)
+{
+    require_object(value, {"request_id", "client_id", "lease_id", "route_token", "report", "timeout_ms"});
+    return ::hyperflux::v7::NativeExchangeRequest {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ClientId>(required_field(value, "client_id")),
+        decode<::hyperflux::LeaseId>(required_field(value, "lease_id")),
+        decode<::hyperflux::NativeRouteToken>(required_field(value, "route_token")),
+        decode<::hyperflux::NativeReportHex>(required_field(value, "report")),
+        decode<::hyperflux::NativeExchangeTimeoutMs>(required_field(value, "timeout_ms")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeRequest>(const ::hyperflux::v7::NativeExchangeRequest& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["client_id"] = encode(value.client_id);
+    result["lease_id"] = encode(value.lease_id);
+    result["route_token"] = encode(value.route_token);
+    result["report"] = encode(value.report);
+    result["timeout_ms"] = encode(value.timeout_ms);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeNotSent decode<::hyperflux::v7::NativeExchangeNotSent>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::v7::NativeExchangeNotSent {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeNotSent>(const ::hyperflux::v7::NativeExchangeNotSent& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeUncertain decode<::hyperflux::v7::NativeExchangeUncertain>(const Json& value)
+{
+    require_object(value, {"error_kind", "finding_id"});
+    return ::hyperflux::v7::NativeExchangeUncertain {
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "error_kind")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeUncertain>(const ::hyperflux::v7::NativeExchangeUncertain& value)
+{
+    Json result = Json::object();
+    result["error_kind"] = encode(value.error_kind);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeMatchedResponse decode<::hyperflux::v7::NativeExchangeMatchedResponse>(const Json& value)
+{
+    require_object(value, {"response"});
+    return ::hyperflux::v7::NativeExchangeMatchedResponse {
+        decode<::hyperflux::NativeReportHex>(required_field(value, "response")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeMatchedResponse>(const ::hyperflux::v7::NativeExchangeMatchedResponse& value)
+{
+    Json result = Json::object();
+    result["response"] = encode(value.response);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeOutcome decode<::hyperflux::v7::NativeExchangeOutcome>(const Json& value)
+{
+    require_object(value, {"request_id", "route_token", "result"});
+    return ::hyperflux::v7::NativeExchangeOutcome {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::NativeRouteToken>(required_field(value, "route_token")),
+        decode<::hyperflux::v7::NativeExchangeResult>(required_field(value, "result")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeOutcome>(const ::hyperflux::v7::NativeExchangeOutcome& value)
+{
+    Json result = Json::object();
+    result["request_id"] = encode(value.request_id);
+    result["route_token"] = encode(value.route_token);
+    result["result"] = encode(value.result);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeRouteEvent decode<::hyperflux::v7::NativeRouteEvent>(const Json& value)
+{
+    require_object(value, {"sequence", "kind", "route"});
+    return ::hyperflux::v7::NativeRouteEvent {
+        decode<::hyperflux::SequenceNumber>(required_field(value, "sequence")),
+        decode<::hyperflux::NativeRouteEventKind>(required_field(value, "kind")),
+        decode<::hyperflux::v7::NativeRoute>(required_field(value, "route")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeRouteEvent>(const ::hyperflux::v7::NativeRouteEvent& value)
+{
+    Json result = Json::object();
+    result["sequence"] = encode(value.sequence);
+    result["kind"] = encode(value.kind);
+    result["route"] = encode(value.route);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeRouteEventBatch decode<::hyperflux::v7::NativeRouteEventBatch>(const Json& value)
+{
+    require_object(value, {"subscription_id", "next_cursor", "events", "oldest_available", "latest_available", "dropped_events", "cursor_gap", "has_more"});
+    return ::hyperflux::v7::NativeRouteEventBatch {
+        decode<::hyperflux::SubscriptionId>(required_field(value, "subscription_id")),
+        decode<::hyperflux::v7::EventCursor>(required_field(value, "next_cursor")),
+        decode_vector<::hyperflux::v7::NativeRouteEvent>(required_field(value, "events"), 256),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "oldest_available")),
+        decode<::hyperflux::SequenceNumber>(required_field(value, "latest_available")),
+        decode<::hyperflux::DroppedEventCount>(required_field(value, "dropped_events")),
+        decode<bool>(required_field(value, "cursor_gap")),
+        decode<bool>(required_field(value, "has_more")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeRouteEventBatch>(const ::hyperflux::v7::NativeRouteEventBatch& value)
+{
+    Json result = Json::object();
+    result["subscription_id"] = encode(value.subscription_id);
+    result["next_cursor"] = encode(value.next_cursor);
+    result["events"] = encode_vector(value.events);
+    result["oldest_available"] = encode(value.oldest_available);
+    result["latest_available"] = encode(value.latest_available);
+    result["dropped_events"] = encode(value.dropped_events);
+    result["cursor_gap"] = encode(value.cursor_gap);
+    result["has_more"] = encode(value.has_more);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::RpcError decode<::hyperflux::v7::RpcError>(const Json& value)
+{
+    require_object(value, {"request_id", "kind", "message", "finding_id"});
+    return ::hyperflux::v7::RpcError {
+        decode_optional_field<::hyperflux::RequestId>(value, "request_id"),
+        decode<::hyperflux::ProtocolErrorKind>(required_field(value, "kind")),
+        decode<::hyperflux::HumanMessage>(required_field(value, "message")),
+        decode<::hyperflux::FindingId>(required_field(value, "finding_id")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::RpcError>(const ::hyperflux::v7::RpcError& value)
+{
+    Json result = Json::object();
+    result["request_id"] = value.request_id.has_value() ? encode(*value.request_id) : Json(nullptr);
+    result["kind"] = encode(value.kind);
+    result["message"] = encode(value.message);
+    result["finding_id"] = encode(value.finding_id);
+    return result;
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::LeaseResult decode<::hyperflux::v7::LeaseResult>(const Json& value)
+{
+    require_object(value, {"outcome", "detail"});
+    const auto& tag_value = required_field(value, "outcome");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("LeaseResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "granted")
+    {
+        return ::hyperflux::v7::LeaseResult {::hyperflux::v7::LeaseResultGranted {
+            decode<::hyperflux::v7::LeaseGrant>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "conflict")
+    {
+        return ::hyperflux::v7::LeaseResult {::hyperflux::v7::LeaseResultConflict {
+            decode<::hyperflux::v7::LeaseConflict>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "rejected")
+    {
+        return ::hyperflux::v7::LeaseResult {::hyperflux::v7::LeaseResultRejected {
+            decode<::hyperflux::v7::LeaseRejection>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown LeaseResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::LeaseResult>(const ::hyperflux::v7::LeaseResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"outcome", std::string(Alternative::outcome)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::TransactionResult decode<::hyperflux::v7::TransactionResult>(const Json& value)
+{
+    require_object(value, {"outcome", "detail"});
+    const auto& tag_value = required_field(value, "outcome");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("TransactionResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "progress")
+    {
+        return ::hyperflux::v7::TransactionResult {::hyperflux::v7::TransactionResultProgress {
+            decode<::hyperflux::v7::TransactionProgress>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "terminal")
+    {
+        return ::hyperflux::v7::TransactionResult {::hyperflux::v7::TransactionResultTerminal {
+            decode<::hyperflux::v7::TransactionTerminal>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "unavailable")
+    {
+        return ::hyperflux::v7::TransactionResult {::hyperflux::v7::TransactionResultUnavailable {
+            decode<::hyperflux::v7::TransactionUnavailable>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown TransactionResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::TransactionResult>(const ::hyperflux::v7::TransactionResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"outcome", std::string(Alternative::outcome)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ControllerOwnership decode<::hyperflux::v7::ControllerOwnership>(const Json& value)
+{
+    require_object(value, {"state", "detail"});
+    const auto& tag_value = required_field(value, "state");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("ControllerOwnership tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "unowned")
+    {
+        return ::hyperflux::v7::ControllerOwnership {::hyperflux::v7::ControllerOwnershipUnowned {
+            decode<::hyperflux::v7::UnownedController>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "owned-by-viewer")
+    {
+        return ::hyperflux::v7::ControllerOwnership {::hyperflux::v7::ControllerOwnershipOwnedByViewer {
+            decode<::hyperflux::v7::ViewerOwnedController>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "owned-by-other")
+    {
+        return ::hyperflux::v7::ControllerOwnership {::hyperflux::v7::ControllerOwnershipOwnedByOther {
+            decode<::hyperflux::v7::OtherOwnedController>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown ControllerOwnership tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ControllerOwnership>(const ::hyperflux::v7::ControllerOwnership& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"state", std::string(Alternative::state)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NativeExchangeResult decode<::hyperflux::v7::NativeExchangeResult>(const Json& value)
+{
+    require_object(value, {"certainty", "detail"});
+    const auto& tag_value = required_field(value, "certainty");
+    if(!tag_value.is_string())
+    {
+        throw CodecError("NativeExchangeResult tag must be a string");
+    }
+    const auto tag = tag_value.get<std::string>();
+    if(tag == "not-sent")
+    {
+        return ::hyperflux::v7::NativeExchangeResult {::hyperflux::v7::NativeExchangeResultNotSent {
+            decode<::hyperflux::v7::NativeExchangeNotSent>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "may-have-been-sent")
+    {
+        return ::hyperflux::v7::NativeExchangeResult {::hyperflux::v7::NativeExchangeResultMayHaveBeenSent {
+            decode<::hyperflux::v7::NativeExchangeUncertain>(required_field(value, "detail"))
+        }};
+    }
+    if(tag == "matched-response")
+    {
+        return ::hyperflux::v7::NativeExchangeResult {::hyperflux::v7::NativeExchangeResultMatchedResponse {
+            decode<::hyperflux::v7::NativeExchangeMatchedResponse>(required_field(value, "detail"))
+        }};
+    }
+    throw CodecError("unknown NativeExchangeResult tag");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NativeExchangeResult>(const ::hyperflux::v7::NativeExchangeResult& value)
+{
+    return std::visit(
+        [](const auto& alternative) {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            return Json {
+                {"certainty", std::string(Alternative::certainty)},
+                {"detail", encode(alternative.detail)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::NegotiationRequestEnvelope decode<::hyperflux::v7::NegotiationRequestEnvelope>(const Json& value)
+{
+    require_object(value, {"request_id", "params"});
+    return ::hyperflux::v7::NegotiationRequestEnvelope {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::v7::ClientHello>(required_field(value, "params")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::NegotiationRequestEnvelope>(const ::hyperflux::v7::NegotiationRequestEnvelope& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"params", encode(value.params)},
+    };
+}
+
+template<typename T>
+[[nodiscard]] ::hyperflux::v7::SessionRequestEnvelope<T> decode_session_request(
+    const Json& value)
+{
+    require_object(value, {"request_id", "protocol_session_id", "negotiation_token", "params"});
+    return ::hyperflux::v7::SessionRequestEnvelope<T> {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ProtocolSessionId>(required_field(value, "protocol_session_id")),
+        decode<::hyperflux::NegotiationToken>(required_field(value, "negotiation_token")),
+        decode<T>(required_field(value, "params")),
+    };
+}
+
+template<typename T>
+[[nodiscard]] Json encode_session_request(
+    const ::hyperflux::v7::SessionRequestEnvelope<T>& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"protocol_session_id", encode(value.protocol_session_id)},
+        {"negotiation_token", encode(value.negotiation_token)},
+        {"params", encode(value.params)},
+    };
+}
+
+template<typename T>
+[[nodiscard]] ::hyperflux::v7::SuccessEnvelope<T> decode_success(const Json& value)
+{
+    require_object(value, {"request_id", "server_instance_id", "result"});
+    return ::hyperflux::v7::SuccessEnvelope<T> {
+        decode<::hyperflux::RequestId>(required_field(value, "request_id")),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<T>(required_field(value, "result")),
+    };
+}
+
+template<typename T>
+[[nodiscard]] Json encode_success(
+    const ::hyperflux::v7::SuccessEnvelope<T>& value)
+{
+    return Json {
+        {"request_id", encode(value.request_id)},
+        {"server_instance_id", encode(value.server_instance_id)},
+        {"result", encode(value.result)},
+    };
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::ErrorEnvelope decode<::hyperflux::v7::ErrorEnvelope>(const Json& value)
+{
+    require_object(value, {"request_id", "server_instance_id", "error"});
+    return ::hyperflux::v7::ErrorEnvelope {
+        decode_optional_field<::hyperflux::RequestId>(value, "request_id"),
+        decode<::hyperflux::ServerInstanceId>(required_field(value, "server_instance_id")),
+        decode<::hyperflux::v7::RpcError>(required_field(value, "error")),
+    };
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::ErrorEnvelope>(const ::hyperflux::v7::ErrorEnvelope& value)
+{
+    return Json {
+        {"request_id", value.request_id.has_value() ? encode(*value.request_id) : Json(nullptr)},
+        {"server_instance_id", encode(value.server_instance_id)},
+        {"error", encode(value.error)},
+    };
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::RpcRequest decode<::hyperflux::v7::RpcRequest>(const Json& value)
+{
+    require_object(value, {"method", "request"});
+    const auto& method_value = required_field(value, "method");
+    if(!method_value.is_string())
+    {
+        throw CodecError("RPC request method must be a string");
+    }
+    const auto method = method_value.get<std::string>();
+    const auto& envelope = required_field(value, "request");
+    if(method == "negotiate")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestNegotiate {decode<::hyperflux::v7::NegotiationRequestEnvelope>(envelope)}};
+    }
+    if(method == "snapshot")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestSnapshot {decode_session_request<::hyperflux::v7::EmptyRequest>(envelope)}};
+    }
+    if(method == "integration-view")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestIntegrationView {decode_session_request<::hyperflux::v7::EmptyRequest>(envelope)}};
+    }
+    if(method == "acquire-lease")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestAcquireLease {decode_session_request<::hyperflux::v7::LeaseRequest>(envelope)}};
+    }
+    if(method == "renew-lease")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestRenewLease {decode_session_request<::hyperflux::v7::RenewLeaseRequest>(envelope)}};
+    }
+    if(method == "release-lease")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestReleaseLease {decode_session_request<::hyperflux::v7::ReleaseLeaseRequest>(envelope)}};
+    }
+    if(method == "submit-transaction")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestSubmitTransaction {decode_session_request<::hyperflux::v7::TransactionRequest>(envelope)}};
+    }
+    if(method == "transaction-outcome")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestTransactionOutcome {decode_session_request<::hyperflux::v7::TransactionLookup>(envelope)}};
+    }
+    if(method == "subscribe")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestSubscribe {decode_session_request<::hyperflux::v7::SubscriptionRequest>(envelope)}};
+    }
+    if(method == "diagnostics")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestDiagnostics {decode_session_request<::hyperflux::v7::EmptyRequest>(envelope)}};
+    }
+    if(method == "native-enumerate")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestNativeEnumerate {decode_session_request<::hyperflux::v7::EmptyRequest>(envelope)}};
+    }
+    if(method == "native-transact")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestNativeTransact {decode_session_request<::hyperflux::v7::NativeExchangeRequest>(envelope)}};
+    }
+    if(method == "native-watch")
+    {
+        return ::hyperflux::v7::RpcRequest {::hyperflux::v7::RpcRequestNativeWatch {decode_session_request<::hyperflux::v7::SubscriptionRequest>(envelope)}};
+    }
+    throw CodecError("unknown RPC request method");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::RpcRequest>(const ::hyperflux::v7::RpcRequest& value)
+{
+    return std::visit(
+        [](const auto& request) {
+            using Request = std::decay_t<decltype(request)>;
+            Json envelope;
+            if constexpr(std::is_same_v<Request, ::hyperflux::v7::RpcRequestNegotiate>)
+            {
+                envelope = encode(request.request);
+            }
+            else
+            {
+                envelope = encode_session_request(request.request);
+            }
+            return Json {
+                {"method", std::string(Request::method)},
+                {"request", std::move(envelope)},
+            };
+        },
+        value);
+}
+
+template<>
+[[nodiscard]] inline ::hyperflux::v7::RpcResponse decode<::hyperflux::v7::RpcResponse>(const Json& value)
+{
+    require_object(value, {"type", "response"});
+    const auto& type_value = required_field(value, "type");
+    if(!type_value.is_string())
+    {
+        throw CodecError("RPC response type must be a string");
+    }
+    const auto type = type_value.get<std::string>();
+    const auto& envelope = required_field(value, "response");
+    if(type == "negotiate-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseNegotiateSuccess {
+            decode_success<::hyperflux::v7::ServerHello>(envelope)
+        }};
+    }
+    if(type == "snapshot-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseSnapshotSuccess {
+            decode_success<::hyperflux::v7::BridgeSnapshot>(envelope)
+        }};
+    }
+    if(type == "integration-view-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseIntegrationViewSuccess {
+            decode_success<::hyperflux::v7::IntegrationView>(envelope)
+        }};
+    }
+    if(type == "acquire-lease-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseAcquireLeaseSuccess {
+            decode_success<::hyperflux::v7::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "renew-lease-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseRenewLeaseSuccess {
+            decode_success<::hyperflux::v7::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "release-lease-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseReleaseLeaseSuccess {
+            decode_success<::hyperflux::v7::LeaseResult>(envelope)
+        }};
+    }
+    if(type == "submit-transaction-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseSubmitTransactionSuccess {
+            decode_success<::hyperflux::v7::TransactionResult>(envelope)
+        }};
+    }
+    if(type == "transaction-outcome-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseTransactionOutcomeSuccess {
+            decode_success<::hyperflux::v7::TransactionResult>(envelope)
+        }};
+    }
+    if(type == "subscribe-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseSubscribeSuccess {
+            decode_success<::hyperflux::v7::EventBatch>(envelope)
+        }};
+    }
+    if(type == "diagnostics-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseDiagnosticsSuccess {
+            decode_success<::hyperflux::v7::DiagnosticSnapshot>(envelope)
+        }};
+    }
+    if(type == "native-enumerate-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseNativeEnumerateSuccess {
+            decode_success<::hyperflux::v7::NativeRouteInventory>(envelope)
+        }};
+    }
+    if(type == "native-transact-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseNativeTransactSuccess {
+            decode_success<::hyperflux::v7::NativeExchangeOutcome>(envelope)
+        }};
+    }
+    if(type == "native-watch-success")
+    {
+        return ::hyperflux::v7::RpcResponse {::hyperflux::v7::RpcResponseNativeWatchSuccess {
+            decode_success<::hyperflux::v7::NativeRouteEventBatch>(envelope)
+        }};
+    }
+    if(type == "error")
+    {
+        return ::hyperflux::v7::RpcResponse {decode<::hyperflux::v7::ErrorEnvelope>(envelope)};
+    }
+    throw CodecError("unknown RPC response type");
+}
+
+template<>
+[[nodiscard]] inline Json encode<::hyperflux::v7::RpcResponse>(const ::hyperflux::v7::RpcResponse& value)
+{
+    return std::visit(
+        [](const auto& response) {
+            using Response = std::decay_t<decltype(response)>;
+            if constexpr(std::is_same_v<Response, ::hyperflux::v7::ErrorEnvelope>)
+            {
+                return Json {
+                    {"type", "error"},
+                    {"response", encode(response)},
+                };
+            }
+            else
+            {
+                return Json {
+                    {"type", std::string(Response::type)},
+                    {"response", encode_success(response.response)},
+                };
+            }
+        },
+        value);
+}
+
+} // namespace hyperflux::json_codec
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
new file mode 100644
index 0000000..b99d15b
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
@@ -0,0 +1,950 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "domain_types.hpp"
+
+#include <cstddef>
+#include <cstdint>
+#include <optional>
+#include <string_view>
+#include <variant>
+#include <vector>
+
+namespace hyperflux::v7
+{
+
+inline constexpr std::uint16_t minimum_protocol_version = 7;
+inline constexpr std::uint16_t maximum_protocol_version = 7;
+inline constexpr std::size_t max_wire_message_bytes = 1048576;
+inline constexpr std::size_t max_json_depth = 128;
+
+// A method request with no method-specific fields.
+struct EmptyRequest
+{
+    friend bool operator==(const EmptyRequest&, const EmptyRequest&) = default;
+};
+
+// One canonical eight-bit RGB color.
+struct RgbColor
+{
+    ColorChannel red;
+    ColorChannel green;
+    ColorChannel blue;
+    friend bool operator==(const RgbColor&, const RgbColor&) = default;
+};
+
+// Bounded client protocol and feature offer.
+struct ClientHello
+{
+    ClientId client_id;
+    ClientName client_name;
+    ProtocolVersion minimum_version;
+    ProtocolVersion maximum_version;
+    std::vector<ProtocolFeatureId> required_features;
+    std::vector<ProtocolFeatureId> optional_features;
+    friend bool operator==(const ClientHello&, const ClientHello&) = default;
+};
+
+// Negotiated protocol version and bridge feature set.
+struct ServerHello
+{
+    ProtocolVersion selected_version;
+    ServerInstanceId server_instance_id;
+    ProtocolSessionId protocol_session_id;
+    NegotiationToken negotiation_token;
+    ComponentVersion bridge_version;
+    std::vector<ProtocolFeatureId> enabled_features;
+    QueueCapacity event_buffer_capacity;
+    friend bool operator==(const ServerHello&, const ServerHello&) = default;
+};
+
+// One device-scoped writable resource.
+struct ResourceKey
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    ResourceKind kind;
+    friend bool operator==(const ResourceKey&, const ResourceKey&) = default;
+};
+
+// Atomic request for one or more writable resources.
+struct LeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    std::vector<ResourceKey> resources;
+    LeaseDurationMs duration_ms;
+    friend bool operator==(const LeaseRequest&, const LeaseRequest&) = default;
+};
+
+// Granted ownership lease.
+struct LeaseGrant
+{
+    LeaseId lease_id;
+    ClientId client_id;
+    std::vector<ResourceKey> resources;
+    MonotonicMs expires_at_ms;
+    LeaseState state;
+    friend bool operator==(const LeaseGrant&, const LeaseGrant&) = default;
+};
+
+// Deterministic first conflict from an otherwise atomic lease request.
+struct LeaseConflict
+{
+    ClientId conflicting_client;
+    ResourceKey conflicting_resource;
+    friend bool operator==(const LeaseConflict&, const LeaseConflict&) = default;
+};
+
+// Structured lease rejection unrelated to another owner.
+struct LeaseRejection
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const LeaseRejection&, const LeaseRejection&) = default;
+};
+
+// Idempotent renewal of one existing lease.
+struct RenewLeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    LeaseDurationMs duration_ms;
+    friend bool operator==(const RenewLeaseRequest&, const RenewLeaseRequest&) = default;
+};
+
+// Idempotent release of one existing lease.
+struct ReleaseLeaseRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    friend bool operator==(const ReleaseLeaseRequest&, const ReleaseLeaseRequest&) = default;
+};
+
+// Complete resumable position in one event stream projection.
+struct EventCursor
+{
+    StreamId stream_id;
+    StreamEpoch stream_epoch;
+    ProjectionRevision projection_revision;
+    SequenceNumber sequence;
+    friend bool operator==(const EventCursor&, const EventCursor&) = default;
+};
+
+// Generation-bound endpoint return state without claiming physical lighting application.
+struct ReturnEpoch
+{
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    SequenceNumber epoch_sequence;
+    MonotonicMs opened_at_ms;
+    ReturnEvidence opening_evidence;
+    ReturnPhase phase;
+    RestoreDeliveryState delivery_state;
+    friend bool operator==(const ReturnEpoch&, const ReturnEpoch&) = default;
+};
+
+// Independent route, power, sleep, activity, contact, and freshness facts.
+struct EndpointSnapshot
+{
+    EndpointId endpoint_id;
+    RouteKind route_kind;
+    RouteState route_state;
+    ConnectionMode connection_mode;
+    PowerState power_state;
+    SleepState sleep_state;
+    ActivityState activity_state;
+    ContactState contact_state;
+    FreshnessState freshness;
+    EvidenceConfidence confidence;
+    std::optional<EvidenceClaimId> evidence_claim_id;
+    std::optional<MonotonicMs> observed_at_ms;
+    std::optional<ReturnEpoch> return_epoch;
+    friend bool operator==(const EndpointSnapshot&, const EndpointSnapshot&) = default;
+};
+
+// Battery availability and value without collapsing unknown and unavailable.
+struct BatteryObservation
+{
+    TelemetryAvailability availability;
+    std::optional<BatteryPercent> percentage;
+    FreshnessState freshness;
+    EvidenceConfidence confidence;
+    std::optional<MonotonicMs> observed_at_ms;
+    friend bool operator==(const BatteryObservation&, const BatteryObservation&) = default;
+};
+
+// Current bounded application ownership for one generation-scoped resource.
+struct ResourceOwnershipSnapshot
+{
+    ResourceKey resource;
+    ClientId client_id;
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const ResourceOwnershipSnapshot&, const ResourceOwnershipSnapshot&) = default;
+};
+
+// Application-neutral logical controller state.
+struct LogicalDeviceSnapshot
+{
+    LogicalDeviceId device_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    std::optional<ProfileId> profile_id;
+    std::optional<ProfileDigest> profile_digest;
+    PairingState pairing;
+    PresenceState presence;
+    SupportLevel support_level;
+    std::vector<EndpointSnapshot> endpoints;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    friend bool operator==(const LogicalDeviceSnapshot&, const LogicalDeviceSnapshot&) = default;
+};
+
+// Generation-bound receiver and child inventory.
+struct ReceiverSnapshot
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    std::optional<ProfileId> profile_id;
+    std::optional<ProfileDigest> profile_digest;
+    ReceiverLifecycleState lifecycle;
+    std::vector<LogicalDeviceSnapshot> devices;
+    std::vector<ResourceOwnershipSnapshot> ownership;
+    bool stable_restore_enabled;
+    RestoreState restore_state;
+    friend bool operator==(const ReceiverSnapshot&, const ReceiverSnapshot&) = default;
+};
+
+// Sequence-bound complete bridge snapshot.
+struct BridgeSnapshot
+{
+    EventCursor cursor;
+    std::vector<ReceiverSnapshot> receivers;
+    friend bool operator==(const BridgeSnapshot&, const BridgeSnapshot&) = default;
+};
+
+// One logical-device direct-mode frame.
+struct LightingFrame
+{
+    LogicalDeviceId device_id;
+    FrameIndex frame_index;
+    std::vector<RgbColor> colors;
+    friend bool operator==(const LightingFrame&, const LightingFrame&) = default;
+};
+
+// Exact profile and lighting dimensions bound to one transaction target.
+struct DeviceProfileBinding
+{
+    LogicalDeviceId device_id;
+    ProfileId profile_id;
+    ProfileDigest profile_digest;
+    LedCount application_slot_count;
+    friend bool operator==(const DeviceProfileBinding&, const DeviceProfileBinding&) = default;
+};
+
+// Explicit semantic stable-lighting intent for one frame target.
+struct StableLightingIntent
+{
+    LogicalDeviceId device_id;
+    StableLightingMode mode;
+    friend bool operator==(const StableLightingIntent&, const StableLightingIntent&) = default;
+};
+
+// Atomic generation- and ownership-bound operation.
+struct TransactionRequest
+{
+    RequestId request_id;
+    TransactionId transaction_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    ProfileId receiver_profile_id;
+    ProfileDigest receiver_profile_digest;
+    std::vector<DeviceProfileBinding> device_profiles;
+    TransactionClass transaction_class;
+    std::vector<StableLightingIntent> stable_intents;
+    MonotonicMs deadline_ms;
+    std::vector<ResourceKey> resources;
+    std::vector<LightingFrame> frames;
+    friend bool operator==(const TransactionRequest&, const TransactionRequest&) = default;
+};
+
+// Nonterminal generation-bound transaction projection.
+struct TransactionProgress
+{
+    RequestId request_id;
+    RequestDigest request_digest;
+    TransactionId transaction_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    TransactionState state;
+    QueueAdmission admission;
+    FrameCount declared_frames;
+    DeliveredFrameCount delivered_frames;
+    SideEffectCertainty side_effect_certainty;
+    bool live_write_executed;
+    friend bool operator==(const TransactionProgress&, const TransactionProgress&) = default;
+};
+
+// Immutable terminal transaction outcome retained for bounded lookup.
+struct TransactionTerminal
+{
+    RequestId request_id;
+    RequestDigest request_digest;
+    TransactionId transaction_id;
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    TransactionState state;
+    FrameCount declared_frames;
+    DeliveredFrameCount delivered_frames;
+    SideEffectCertainty side_effect_certainty;
+    bool live_write_executed;
+    bool automatic_retry;
+    DeviceApplicationState device_application;
+    SequenceNumber terminal_sequence;
+    std::optional<ProtocolErrorKind> error_kind;
+    std::optional<TransactionId> superseded_by;
+    friend bool operator==(const TransactionTerminal&, const TransactionTerminal&) = default;
+};
+
+// Outcome lookup cannot return a retained transaction record.
+struct TransactionUnavailable
+{
+    TransactionId transaction_id;
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const TransactionUnavailable&, const TransactionUnavailable&) = default;
+};
+
+// Idempotent lookup of one previously submitted transaction.
+struct TransactionLookup
+{
+    RequestId request_id;
+    ClientId client_id;
+    TransactionId transaction_id;
+    friend bool operator==(const TransactionLookup&, const TransactionLookup&) = default;
+};
+
+// Bounded event subscription cursor.
+struct SubscriptionRequest
+{
+    ClientId client_id;
+    std::optional<SubscriptionId> subscription_id;
+    std::optional<EventCursor> expected_cursor;
+    EventBatchLimit max_events;
+    friend bool operator==(const SubscriptionRequest&, const SubscriptionRequest&) = default;
+};
+
+// Sequence-bound typed event with snapshot references.
+struct BridgeEvent
+{
+    SequenceNumber sequence;
+    EventKind kind;
+    std::optional<ReceiverId> receiver_id;
+    std::optional<GenerationId> generation_id;
+    std::optional<LogicalDeviceId> device_id;
+    std::optional<LeaseId> lease_id;
+    std::optional<TransactionId> transaction_id;
+    std::optional<FindingId> finding_id;
+    friend bool operator==(const BridgeEvent&, const BridgeEvent&) = default;
+};
+
+// Bounded event result with explicit cursor-gap state.
+struct EventBatch
+{
+    SubscriptionId subscription_id;
+    EventCursor next_cursor;
+    std::vector<BridgeEvent> events;
+    SequenceNumber oldest_available;
+    SequenceNumber latest_available;
+    DroppedEventCount dropped_events;
+    bool cursor_gap;
+    bool has_more;
+    friend bool operator==(const EventBatch&, const EventBatch&) = default;
+};
+
+// One privacy-classified actionable finding.
+struct DiagnosticFinding
+{
+    FindingId finding_id;
+    ErrorSeverity severity;
+    HumanMessage cause;
+    HumanMessage explanation;
+    HumanMessage safe_action;
+    PrivacyClass privacy;
+    DocumentationPath documentation;
+    friend bool operator==(const DiagnosticFinding&, const DiagnosticFinding&) = default;
+};
+
+// Bounded bridge findings and queue health.
+struct DiagnosticSnapshot
+{
+    SequenceNumber sequence;
+    std::vector<DiagnosticFinding> findings;
+    QueueCapacity event_buffer_capacity;
+    QueueCapacity transaction_queue_capacity;
+    friend bool operator==(const DiagnosticSnapshot&, const DiagnosticSnapshot&) = default;
+};
+
+// Exact immutable profile authority exposed to integrations.
+struct ProfileBindingView
+{
+    ProfileId profile_id;
+    ProfileDigest profile_digest;
+    friend bool operator==(const ProfileBindingView&, const ProfileBindingView&) = default;
+};
+
+// Truthful paired-device inventory independent of application controller registration.
+struct DeviceInventoryView
+{
+    LogicalDeviceId device_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    std::optional<ProfileBindingView> profile;
+    std::optional<ModelName> model_name;
+    PairingState pairing;
+    PresenceState presence;
+    InventoryAvailability availability;
+    SupportLevel support_level;
+    std::vector<EndpointSnapshot> endpoints;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    friend bool operator==(const DeviceInventoryView&, const DeviceInventoryView&) = default;
+};
+
+// Pinned upstream presentation authority without hardware transport policy.
+struct PresentationView
+{
+    UpstreamId upstream_id;
+    UpstreamOwner owner;
+    ComponentVersion project_version;
+    SourceRevision source_revision;
+    PresentationKey model_key;
+    std::optional<PresentationKey> layout_key;
+    TransportVariant transport_variant;
+    friend bool operator==(const PresentationView&, const PresentationView&) = default;
+};
+
+// Application-facing lighting dimensions without receiver carrier mapping.
+struct LightingTopologyView
+{
+    LedCount physical_led_count;
+    LedCount application_slot_count;
+    LedCount rows;
+    LedCount columns;
+    friend bool operator==(const LightingTopologyView&, const LightingTopologyView&) = default;
+};
+
+// Writable controller currently has no application owner.
+struct UnownedController
+{
+    friend bool operator==(const UnownedController&, const UnownedController&) = default;
+};
+
+// Writable controller is owned by the requesting client.
+struct ViewerOwnedController
+{
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const ViewerOwnedController&, const ViewerOwnedController&) = default;
+};
+
+// Writable controller is owned by another application client.
+struct OtherOwnedController
+{
+    ClientId client_id;
+    LeaseId lease_id;
+    MonotonicMs expires_at_ms;
+    friend bool operator==(const OtherOwnedController&, const OtherOwnedController&) = default;
+};
+
+// Viewer-specific actions derived from availability and ownership.
+struct ControllerActions
+{
+    bool can_acquire;
+    bool can_release;
+    bool can_submit_now;
+    friend bool operator==(const ControllerActions&, const ControllerActions&) = default;
+};
+
+// One generation-bound receiver child route without a host device path.
+struct NativeRoute
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    DeviceKind device_kind;
+    VendorId vendor_id;
+    ProductId product_id;
+    RouteState route_state;
+    NativeRouteAccess access;
+    NativeProtocolFamily protocol_family;
+    NativeReportByteCount report_bytes;
+    std::optional<NativeRouteToken> route_token;
+    std::optional<ResourceKey> resource;
+    friend bool operator==(const NativeRoute&, const NativeRoute&) = default;
+};
+
+// Bounded sequence-consistent native route inventory.
+struct NativeRouteInventory
+{
+    EventCursor cursor;
+    std::vector<NativeRoute> routes;
+    friend bool operator==(const NativeRouteInventory&, const NativeRouteInventory&) = default;
+};
+
+// One idempotent lease-bound native child feature-report exchange.
+struct NativeExchangeRequest
+{
+    RequestId request_id;
+    ClientId client_id;
+    LeaseId lease_id;
+    NativeRouteToken route_token;
+    NativeReportHex report;
+    NativeExchangeTimeoutMs timeout_ms;
+    friend bool operator==(const NativeExchangeRequest&, const NativeExchangeRequest&) = default;
+};
+
+// The native request provably did not reach the receiver.
+struct NativeExchangeNotSent
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const NativeExchangeNotSent&, const NativeExchangeNotSent&) = default;
+};
+
+// The SET report may have reached the receiver and must not be repeated automatically.
+struct NativeExchangeUncertain
+{
+    ProtocolErrorKind error_kind;
+    FindingId finding_id;
+    friend bool operator==(const NativeExchangeUncertain&, const NativeExchangeUncertain&) = default;
+};
+
+// A response matching the exact native request identity was retained.
+struct NativeExchangeMatchedResponse
+{
+    NativeReportHex response;
+    friend bool operator==(const NativeExchangeMatchedResponse&, const NativeExchangeMatchedResponse&) = default;
+};
+
+// One sequence-bound complete native route change.
+struct NativeRouteEvent
+{
+    SequenceNumber sequence;
+    NativeRouteEventKind kind;
+    NativeRoute route;
+    friend bool operator==(const NativeRouteEvent&, const NativeRouteEvent&) = default;
+};
+
+// Bounded native route changes with explicit cursor-gap state.
+struct NativeRouteEventBatch
+{
+    SubscriptionId subscription_id;
+    EventCursor next_cursor;
+    std::vector<NativeRouteEvent> events;
+    SequenceNumber oldest_available;
+    SequenceNumber latest_available;
+    DroppedEventCount dropped_events;
+    bool cursor_gap;
+    bool has_more;
+    friend bool operator==(const NativeRouteEventBatch&, const NativeRouteEventBatch&) = default;
+};
+
+// Stable structured request failure.
+struct RpcError
+{
+    std::optional<RequestId> request_id;
+    ProtocolErrorKind kind;
+    HumanMessage message;
+    FindingId finding_id;
+    friend bool operator==(const RpcError&, const RpcError&) = default;
+};
+
+// Every requested resource was granted.
+struct LeaseResultGranted
+{
+    static constexpr std::string_view outcome = "granted";
+    LeaseGrant detail;
+    friend bool operator==(const LeaseResultGranted&, const LeaseResultGranted&) = default;
+};
+
+// Another client owns at least one requested resource; none were granted.
+struct LeaseResultConflict
+{
+    static constexpr std::string_view outcome = "conflict";
+    LeaseConflict detail;
+    friend bool operator==(const LeaseResultConflict&, const LeaseResultConflict&) = default;
+};
+
+// The request failed without granting any resource.
+struct LeaseResultRejected
+{
+    static constexpr std::string_view outcome = "rejected";
+    LeaseRejection detail;
+    friend bool operator==(const LeaseResultRejected&, const LeaseResultRejected&) = default;
+};
+
+// Contradiction-free atomic lease outcome.
+using LeaseResult = std::variant<LeaseResultGranted, LeaseResultConflict, LeaseResultRejected>;
+
+// The transaction has not reached a terminal state.
+struct TransactionResultProgress
+{
+    static constexpr std::string_view outcome = "progress";
+    TransactionProgress detail;
+    friend bool operator==(const TransactionResultProgress&, const TransactionResultProgress&) = default;
+};
+
+// The immutable terminal outcome is retained.
+struct TransactionResultTerminal
+{
+    static constexpr std::string_view outcome = "terminal";
+    TransactionTerminal detail;
+    friend bool operator==(const TransactionResultTerminal&, const TransactionResultTerminal&) = default;
+};
+
+// No retained outcome can answer this lookup.
+struct TransactionResultUnavailable
+{
+    static constexpr std::string_view outcome = "unavailable";
+    TransactionUnavailable detail;
+    friend bool operator==(const TransactionResultUnavailable&, const TransactionResultUnavailable&) = default;
+};
+
+// Contradiction-free current, terminal, or unavailable transaction outcome.
+using TransactionResult = std::variant<TransactionResultProgress, TransactionResultTerminal, TransactionResultUnavailable>;
+
+// No application currently owns the controller.
+struct ControllerOwnershipUnowned
+{
+    static constexpr std::string_view state = "unowned";
+    UnownedController detail;
+    friend bool operator==(const ControllerOwnershipUnowned&, const ControllerOwnershipUnowned&) = default;
+};
+
+// The requesting client owns the controller.
+struct ControllerOwnershipOwnedByViewer
+{
+    static constexpr std::string_view state = "owned-by-viewer";
+    ViewerOwnedController detail;
+    friend bool operator==(const ControllerOwnershipOwnedByViewer&, const ControllerOwnershipOwnedByViewer&) = default;
+};
+
+// Another application client owns the controller.
+struct ControllerOwnershipOwnedByOther
+{
+    static constexpr std::string_view state = "owned-by-other";
+    OtherOwnedController detail;
+    friend bool operator==(const ControllerOwnershipOwnedByOther&, const ControllerOwnershipOwnedByOther&) = default;
+};
+
+// Contradiction-free viewer-specific controller ownership.
+using ControllerOwnership = std::variant<ControllerOwnershipUnowned, ControllerOwnershipOwnedByViewer, ControllerOwnershipOwnedByOther>;
+
+// The request is safe to retry with a new identity.
+struct NativeExchangeResultNotSent
+{
+    static constexpr std::string_view certainty = "not-sent";
+    NativeExchangeNotSent detail;
+    friend bool operator==(const NativeExchangeResultNotSent&, const NativeExchangeResultNotSent&) = default;
+};
+
+// Automatic retry is forbidden because SET delivery is uncertain.
+struct NativeExchangeResultMayHaveBeenSent
+{
+    static constexpr std::string_view certainty = "may-have-been-sent";
+    NativeExchangeUncertain detail;
+    friend bool operator==(const NativeExchangeResultMayHaveBeenSent&, const NativeExchangeResultMayHaveBeenSent&) = default;
+};
+
+// The exact matching response was retained.
+struct NativeExchangeResultMatchedResponse
+{
+    static constexpr std::string_view certainty = "matched-response";
+    NativeExchangeMatchedResponse detail;
+    friend bool operator==(const NativeExchangeResultMatchedResponse&, const NativeExchangeResultMatchedResponse&) = default;
+};
+
+// Contradiction-free native transport certainty and response.
+using NativeExchangeResult = std::variant<NativeExchangeResultNotSent, NativeExchangeResultMayHaveBeenSent, NativeExchangeResultMatchedResponse>;
+
+// Exact qualified receiver-backed application controller.
+struct ControllerView
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    DeviceKind device_kind;
+    ProductId product_id;
+    ProfileBindingView receiver_profile;
+    ProfileBindingView device_profile;
+    ModelName model_name;
+    PresentationView presentation;
+    ControllerAvailability availability;
+    BatteryObservation battery;
+    std::vector<CapabilityId> capabilities;
+    LightingTopologyView lighting;
+    ResourceKey resource;
+    ControllerOwnership ownership;
+    ControllerActions actions;
+    friend bool operator==(const ControllerView&, const ControllerView&) = default;
+};
+
+// One receiver generation with complete inventory and qualified controllers.
+struct IntegrationReceiverView
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    std::optional<ProfileBindingView> profile;
+    std::optional<ModelName> model_name;
+    ReceiverLifecycleState lifecycle;
+    bool stable_restore_enabled;
+    RestoreState restore_state;
+    std::vector<DeviceInventoryView> inventory;
+    std::vector<ControllerView> controllers;
+    friend bool operator==(const IntegrationReceiverView&, const IntegrationReceiverView&) = default;
+};
+
+// Client-specific application view projected once by bridge policy.
+struct IntegrationView
+{
+    EventCursor cursor;
+    std::vector<IntegrationReceiverView> receivers;
+    friend bool operator==(const IntegrationView&, const IntegrationView&) = default;
+};
+
+// Idempotent native exchange identity and contradiction-free result.
+struct NativeExchangeOutcome
+{
+    RequestId request_id;
+    NativeRouteToken route_token;
+    NativeExchangeResult result;
+    friend bool operator==(const NativeExchangeOutcome&, const NativeExchangeOutcome&) = default;
+};
+
+struct NegotiationRequestEnvelope
+{
+    RequestId request_id;
+    ClientHello params;
+};
+
+template<typename T>
+struct SessionRequestEnvelope
+{
+    RequestId request_id;
+    ProtocolSessionId protocol_session_id;
+    NegotiationToken negotiation_token;
+    T params;
+};
+
+struct RpcRequestNegotiate
+{
+    static constexpr std::string_view method = "negotiate";
+    NegotiationRequestEnvelope request;
+};
+
+struct RpcRequestSnapshot
+{
+    static constexpr std::string_view method = "snapshot";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestIntegrationView
+{
+    static constexpr std::string_view method = "integration-view";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestAcquireLease
+{
+    static constexpr std::string_view method = "acquire-lease";
+    SessionRequestEnvelope<LeaseRequest> request;
+};
+
+struct RpcRequestRenewLease
+{
+    static constexpr std::string_view method = "renew-lease";
+    SessionRequestEnvelope<RenewLeaseRequest> request;
+};
+
+struct RpcRequestReleaseLease
+{
+    static constexpr std::string_view method = "release-lease";
+    SessionRequestEnvelope<ReleaseLeaseRequest> request;
+};
+
+struct RpcRequestSubmitTransaction
+{
+    static constexpr std::string_view method = "submit-transaction";
+    SessionRequestEnvelope<TransactionRequest> request;
+};
+
+struct RpcRequestTransactionOutcome
+{
+    static constexpr std::string_view method = "transaction-outcome";
+    SessionRequestEnvelope<TransactionLookup> request;
+};
+
+struct RpcRequestSubscribe
+{
+    static constexpr std::string_view method = "subscribe";
+    SessionRequestEnvelope<SubscriptionRequest> request;
+};
+
+struct RpcRequestDiagnostics
+{
+    static constexpr std::string_view method = "diagnostics";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestNativeEnumerate
+{
+    static constexpr std::string_view method = "native-enumerate";
+    SessionRequestEnvelope<EmptyRequest> request;
+};
+
+struct RpcRequestNativeTransact
+{
+    static constexpr std::string_view method = "native-transact";
+    SessionRequestEnvelope<NativeExchangeRequest> request;
+};
+
+struct RpcRequestNativeWatch
+{
+    static constexpr std::string_view method = "native-watch";
+    SessionRequestEnvelope<SubscriptionRequest> request;
+};
+
+using RpcRequest = std::variant<RpcRequestNegotiate, RpcRequestSnapshot, RpcRequestIntegrationView, RpcRequestAcquireLease, RpcRequestRenewLease, RpcRequestReleaseLease, RpcRequestSubmitTransaction, RpcRequestTransactionOutcome, RpcRequestSubscribe, RpcRequestDiagnostics, RpcRequestNativeEnumerate, RpcRequestNativeTransact, RpcRequestNativeWatch>;
+
+template<typename T>
+struct SuccessEnvelope
+{
+    RequestId request_id;
+    ServerInstanceId server_instance_id;
+    T result;
+};
+
+struct ErrorEnvelope
+{
+    std::optional<RequestId> request_id;
+    ServerInstanceId server_instance_id;
+    RpcError error;
+};
+
+struct RpcResponseNegotiateSuccess
+{
+    static constexpr std::string_view type = "negotiate-success";
+    SuccessEnvelope<ServerHello> response;
+};
+
+struct RpcResponseSnapshotSuccess
+{
+    static constexpr std::string_view type = "snapshot-success";
+    SuccessEnvelope<BridgeSnapshot> response;
+};
+
+struct RpcResponseIntegrationViewSuccess
+{
+    static constexpr std::string_view type = "integration-view-success";
+    SuccessEnvelope<IntegrationView> response;
+};
+
+struct RpcResponseAcquireLeaseSuccess
+{
+    static constexpr std::string_view type = "acquire-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseRenewLeaseSuccess
+{
+    static constexpr std::string_view type = "renew-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseReleaseLeaseSuccess
+{
+    static constexpr std::string_view type = "release-lease-success";
+    SuccessEnvelope<LeaseResult> response;
+};
+
+struct RpcResponseSubmitTransactionSuccess
+{
+    static constexpr std::string_view type = "submit-transaction-success";
+    SuccessEnvelope<TransactionResult> response;
+};
+
+struct RpcResponseTransactionOutcomeSuccess
+{
+    static constexpr std::string_view type = "transaction-outcome-success";
+    SuccessEnvelope<TransactionResult> response;
+};
+
+struct RpcResponseSubscribeSuccess
+{
+    static constexpr std::string_view type = "subscribe-success";
+    SuccessEnvelope<EventBatch> response;
+};
+
+struct RpcResponseDiagnosticsSuccess
+{
+    static constexpr std::string_view type = "diagnostics-success";
+    SuccessEnvelope<DiagnosticSnapshot> response;
+};
+
+struct RpcResponseNativeEnumerateSuccess
+{
+    static constexpr std::string_view type = "native-enumerate-success";
+    SuccessEnvelope<NativeRouteInventory> response;
+};
+
+struct RpcResponseNativeTransactSuccess
+{
+    static constexpr std::string_view type = "native-transact-success";
+    SuccessEnvelope<NativeExchangeOutcome> response;
+};
+
+struct RpcResponseNativeWatchSuccess
+{
+    static constexpr std::string_view type = "native-watch-success";
+    SuccessEnvelope<NativeRouteEventBatch> response;
+};
+
+using RpcResponse = std::variant<RpcResponseNegotiateSuccess, RpcResponseSnapshotSuccess, RpcResponseIntegrationViewSuccess, RpcResponseAcquireLeaseSuccess, RpcResponseRenewLeaseSuccess, RpcResponseReleaseLeaseSuccess, RpcResponseSubmitTransactionSuccess, RpcResponseTransactionOutcomeSuccess, RpcResponseSubscribeSuccess, RpcResponseDiagnosticsSuccess, RpcResponseNativeEnumerateSuccess, RpcResponseNativeTransactSuccess, RpcResponseNativeWatchSuccess, ErrorEnvelope>;
+
+struct MethodDescriptor
+{
+    std::string_view name;
+    std::string_view request;
+    std::string_view response;
+    std::optional<std::string_view> required_feature;
+};
+
+inline constexpr MethodDescriptor methods[13] = {
+    {"negotiate", "ClientHello", "ServerHello", std::nullopt},
+    {"snapshot", "EmptyRequest", "BridgeSnapshot", std::nullopt},
+    {"integration-view", "EmptyRequest", "IntegrationView", std::optional<std::string_view>("integration-view-projection")},
+    {"acquire-lease", "LeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"renew-lease", "RenewLeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"release-lease", "ReleaseLeaseRequest", "LeaseResult", std::optional<std::string_view>("ownership-leases")},
+    {"submit-transaction", "TransactionRequest", "TransactionResult", std::optional<std::string_view>("atomic-transactions")},
+    {"transaction-outcome", "TransactionLookup", "TransactionResult", std::optional<std::string_view>("atomic-transactions")},
+    {"subscribe", "SubscriptionRequest", "EventBatch", std::optional<std::string_view>("event-subscriptions")},
+    {"diagnostics", "EmptyRequest", "DiagnosticSnapshot", std::optional<std::string_view>("structured-diagnostics")},
+    {"native-enumerate", "EmptyRequest", "NativeRouteInventory", std::optional<std::string_view>("native-receiver-tunnel")},
+    {"native-transact", "NativeExchangeRequest", "NativeExchangeOutcome", std::optional<std::string_view>("native-receiver-tunnel")},
+    {"native-watch", "SubscriptionRequest", "NativeRouteEventBatch", std::optional<std::string_view>("native-receiver-tunnel")},
+};
+
+} // namespace hyperflux::v7
diff --git a/sdk/python/hyperflux_sdk/generated/domain_types.py b/sdk/python/hyperflux_sdk/generated/domain_types.py
index 8b5a723..5ad5c1c 100644
--- a/sdk/python/hyperflux_sdk/generated/domain_types.py
+++ b/sdk/python/hyperflux_sdk/generated/domain_types.py
@@ -365,6 +365,30 @@ def __post_init__(self) -> None:
             raise ValueError("EventBatchLimit is outside the canonical range")
 
 
+@dataclass(frozen=True, slots=True)
+class NativeExchangeTimeoutMs:
+    value: int
+    WIRE_ENCODING: ClassVar[str] = "number"
+
+    def __post_init__(self) -> None:
+        if isinstance(self.value, bool) or not isinstance(self.value, int):
+            raise TypeError("NativeExchangeTimeoutMs requires an integer")
+        if not 1 <= self.value <= 1000:
+            raise ValueError("NativeExchangeTimeoutMs is outside the canonical range")
+
+
+@dataclass(frozen=True, slots=True)
+class NativeReportByteCount:
+    value: int
+    WIRE_ENCODING: ClassVar[str] = "number"
+
+    def __post_init__(self) -> None:
+        if isinstance(self.value, bool) or not isinstance(self.value, int):
+            raise TypeError("NativeReportByteCount requires an integer")
+        if not 1 <= self.value <= 4096:
+            raise ValueError("NativeReportByteCount is outside the canonical range")
+
+
 @dataclass(frozen=True, slots=True)
 class ReceiverId:
     value: str
@@ -761,6 +785,39 @@ def __post_init__(self) -> None:
             raise ValueError("RestoreTriggerId is outside the canonical length")
 
 
+@dataclass(frozen=True, slots=True)
+class NativeRouteToken:
+    value: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.value, str):
+            raise TypeError("NativeRouteToken requires a string")
+        if not 64 <= len(self.value) <= 64:
+            raise ValueError("NativeRouteToken is outside the canonical length")
+
+
+@dataclass(frozen=True, slots=True)
+class NativeReportHex:
+    value: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.value, str):
+            raise TypeError("NativeReportHex requires a string")
+        if not 180 <= len(self.value) <= 180:
+            raise ValueError("NativeReportHex is outside the canonical length")
+
+
+@dataclass(frozen=True, slots=True)
+class NativeProtocolFamily:
+    value: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.value, str):
+            raise TypeError("NativeProtocolFamily requires a string")
+        if not 1 <= len(self.value) <= 64:
+            raise ValueError("NativeProtocolFamily is outside the canonical length")
+
+
 class DeviceKind(str, Enum):
     RECEIVER = "receiver"
     MAT = "mat"
@@ -941,6 +998,7 @@ class ResourceKind(str, Enum):
     LIGHTING = "lighting"
     SETTINGS = "settings"
     PAIRING = "pairing"
+    NATIVE_CONTROL = "native-control"
 
 
 class TransactionClass(str, Enum):
@@ -1126,6 +1184,18 @@ class ErrorSeverity(str, Enum):
     CRITICAL = "critical"
 
 
+class NativeRouteAccess(str, Enum):
+    QUALIFIED = "qualified"
+    CANDIDATE = "candidate"
+    BACKEND_REQUIRED = "backend-required"
+
+
+class NativeRouteEventKind(str, Enum):
+    AVAILABLE = "available"
+    UNAVAILABLE = "unavailable"
+    GENERATION_REPLACED = "generation-replaced"
+
+
 __all__ = [
     "GenerationId",
     "VendorId",
@@ -1157,6 +1227,8 @@ class ErrorSeverity(str, Enum):
     "DispatchNonce",
     "WallClockUnixMs",
     "EventBatchLimit",
+    "NativeExchangeTimeoutMs",
+    "NativeReportByteCount",
     "ReceiverId",
     "LogicalDeviceId",
     "EndpointId",
@@ -1193,6 +1265,9 @@ class ErrorSeverity(str, Enum):
     "PresentationKey",
     "TransportVariant",
     "RestoreTriggerId",
+    "NativeRouteToken",
+    "NativeReportHex",
+    "NativeProtocolFamily",
     "DeviceKind",
     "ProfileKind",
     "RouteKind",
@@ -1238,4 +1313,6 @@ class ErrorSeverity(str, Enum):
     "TelemetryAvailability",
     "LeaseOutcome",
     "ErrorSeverity",
+    "NativeRouteAccess",
+    "NativeRouteEventKind",
 ]
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 1c6a123..5260b16 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac'
+PROFILE_SOURCE_SHA256: Final = '5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -849,7 +849,7 @@
                                 'Receiver inventory does not imply child availability.',
                                 'The receiver and mat do not appear as addressable RGB controllers.'],
                'revision': 2,
-               'runtime_sha256': 'ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6',
+               'runtime_sha256': '4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/receivers/razer-hyperflux-v2-1532-00cf.json',
                'transport': {'application_raw_frames': False,
@@ -857,6 +857,15 @@
                              'backend_id': 1,
                              'generation_bound': True,
                              'maximum_targets': 115,
+                             'native_exchange': {'initial_response_delay_us': 8000,
+                                                 'match_ranges': [{'length': 2, 'offset': 2},
+                                                                  {'length': 2, 'offset': 6}],
+                                                 'max_response_attempts': 5,
+                                                 'protocol_family': 'razer-feature-report-v1',
+                                                 'report_bytes': 90,
+                                                 'response_report_index': 0,
+                                                 'response_retry_delay_us': 10000,
+                                                 'set_report_index': 0},
                              'pairing_inventory': {'decoder': 'razer-hyperflux-v2-feature-01-v1'}}},
               {'capabilities': [{'access': 'read',
                                  'evidence_claims': ['claim.surface.hard-edition.identity-indicator'],
@@ -884,7 +893,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac'}
+ 'source_sha256': '5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_types.py b/sdk/python/hyperflux_sdk/generated/protocol_types.py
index f8943c3..677d4ed 100644
--- a/sdk/python/hyperflux_sdk/generated/protocol_types.py
+++ b/sdk/python/hyperflux_sdk/generated/protocol_types.py
@@ -40,6 +40,13 @@
     LogicalDeviceId,
     ModelName,
     MonotonicMs,
+    NativeExchangeTimeoutMs,
+    NativeProtocolFamily,
+    NativeReportByteCount,
+    NativeReportHex,
+    NativeRouteAccess,
+    NativeRouteEventKind,
+    NativeRouteToken,
     NegotiationToken,
     PairingState,
     PowerState,
@@ -84,12 +91,13 @@
     TransportVariant,
     UpstreamId,
     UpstreamOwner,
+    VendorId,
 )
 
 T = TypeVar("T")
 
-MINIMUM_PROTOCOL_VERSION = 6
-MAXIMUM_PROTOCOL_VERSION = 6
+MINIMUM_PROTOCOL_VERSION = 7
+MAXIMUM_PROTOCOL_VERSION = 7
 MAX_WIRE_MESSAGE_BYTES = 1048576
 MAX_JSON_DEPTH = 128
 FIELD_LIMITS = {
@@ -116,6 +124,8 @@
     ("IntegrationReceiverView", "inventory"): 32,
     ("IntegrationReceiverView", "controllers"): 32,
     ("IntegrationView", "receivers"): 16,
+    ("NativeRouteInventory", "routes"): 32,
+    ("NativeRouteEventBatch", "events"): 256,
 }
 SUPPORTED_FEATURES = (
     "ownership-leases",
@@ -127,6 +137,7 @@
     "event-subscriptions",
     "structured-diagnostics",
     "return-lifecycle-projection",
+    "native-receiver-tunnel",
 )
 
 @dataclass(frozen=True, slots=True)
@@ -546,6 +557,83 @@ class ControllerActions:
     can_submit_now: bool
 
 
+@dataclass(frozen=True, slots=True)
+class NativeRoute:
+    """One generation-bound receiver child route without a host device path."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    device_kind: DeviceKind
+    vendor_id: VendorId
+    product_id: ProductId
+    route_state: RouteState
+    access: NativeRouteAccess
+    protocol_family: NativeProtocolFamily
+    report_bytes: NativeReportByteCount
+    route_token: NativeRouteToken | None
+    resource: ResourceKey | None
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteInventory:
+    """Bounded sequence-consistent native route inventory."""
+    cursor: EventCursor
+    routes: tuple[NativeRoute, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeRequest:
+    """One idempotent lease-bound native child feature-report exchange."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+    route_token: NativeRouteToken
+    report: NativeReportHex
+    timeout_ms: NativeExchangeTimeoutMs
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeNotSent:
+    """The native request provably did not reach the receiver."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeUncertain:
+    """The SET report may have reached the receiver and must not be repeated automatically."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeMatchedResponse:
+    """A response matching the exact native request identity was retained."""
+    response: NativeReportHex
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteEvent:
+    """One sequence-bound complete native route change."""
+    sequence: SequenceNumber
+    kind: NativeRouteEventKind
+    route: NativeRoute
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteEventBatch:
+    """Bounded native route changes with explicit cursor-gap state."""
+    subscription_id: SubscriptionId
+    next_cursor: EventCursor
+    events: tuple[NativeRouteEvent, ...]
+    oldest_available: SequenceNumber
+    latest_available: SequenceNumber
+    dropped_events: DroppedEventCount
+    cursor_gap: bool
+    has_more: bool
+
+
 @dataclass(frozen=True, slots=True)
 class RpcError:
     """Stable structured request failure."""
@@ -627,6 +715,30 @@ class ControllerOwnershipOwnedByOther:
 ControllerOwnership: TypeAlias = ControllerOwnershipUnowned | ControllerOwnershipOwnedByViewer | ControllerOwnershipOwnedByOther
 
 
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultNotSent:
+    """The request is safe to retry with a new identity."""
+    CERTAINTY: ClassVar[str] = "not-sent"
+    detail: NativeExchangeNotSent
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultMayHaveBeenSent:
+    """Automatic retry is forbidden because SET delivery is uncertain."""
+    CERTAINTY: ClassVar[str] = "may-have-been-sent"
+    detail: NativeExchangeUncertain
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultMatchedResponse:
+    """The exact matching response was retained."""
+    CERTAINTY: ClassVar[str] = "matched-response"
+    detail: NativeExchangeMatchedResponse
+
+
+NativeExchangeResult: TypeAlias = NativeExchangeResultNotSent | NativeExchangeResultMayHaveBeenSent | NativeExchangeResultMatchedResponse
+
+
 @dataclass(frozen=True, slots=True)
 class ControllerView:
     """Exact qualified receiver-backed application controller."""
@@ -670,6 +782,14 @@ class IntegrationView:
     receivers: tuple[IntegrationReceiverView, ...]
 
 
+@dataclass(frozen=True, slots=True)
+class NativeExchangeOutcome:
+    """Idempotent native exchange identity and contradiction-free result."""
+    request_id: RequestId
+    route_token: NativeRouteToken
+    result: NativeExchangeResult
+
+
 @dataclass(frozen=True, slots=True)
 class NegotiationRequestEnvelope:
     request_id: RequestId
@@ -744,7 +864,25 @@ class RpcRequestDiagnostics:
     request: SessionRequestEnvelope[EmptyRequest]
 
 
-RpcRequest: TypeAlias = RpcRequestNegotiate | RpcRequestSnapshot | RpcRequestIntegrationView | RpcRequestAcquireLease | RpcRequestRenewLease | RpcRequestReleaseLease | RpcRequestSubmitTransaction | RpcRequestTransactionOutcome | RpcRequestSubscribe | RpcRequestDiagnostics
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeEnumerate:
+    METHOD: ClassVar[str] = "native-enumerate"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeTransact:
+    METHOD: ClassVar[str] = "native-transact"
+    request: SessionRequestEnvelope[NativeExchangeRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeWatch:
+    METHOD: ClassVar[str] = "native-watch"
+    request: SessionRequestEnvelope[SubscriptionRequest]
+
+
+RpcRequest: TypeAlias = RpcRequestNegotiate | RpcRequestSnapshot | RpcRequestIntegrationView | RpcRequestAcquireLease | RpcRequestRenewLease | RpcRequestReleaseLease | RpcRequestSubmitTransaction | RpcRequestTransactionOutcome | RpcRequestSubscribe | RpcRequestDiagnostics | RpcRequestNativeEnumerate | RpcRequestNativeTransact | RpcRequestNativeWatch
 
 
 @dataclass(frozen=True, slots=True)
@@ -821,7 +959,25 @@ class RpcResponseDiagnosticsSuccess:
     response: SuccessEnvelope[DiagnosticSnapshot]
 
 
-RpcResponse: TypeAlias = RpcResponseNegotiateSuccess | RpcResponseSnapshotSuccess | RpcResponseIntegrationViewSuccess | RpcResponseAcquireLeaseSuccess | RpcResponseRenewLeaseSuccess | RpcResponseReleaseLeaseSuccess | RpcResponseSubmitTransactionSuccess | RpcResponseTransactionOutcomeSuccess | RpcResponseSubscribeSuccess | RpcResponseDiagnosticsSuccess | ErrorEnvelope
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeEnumerateSuccess:
+    TYPE: ClassVar[str] = "native-enumerate-success"
+    response: SuccessEnvelope[NativeRouteInventory]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeTransactSuccess:
+    TYPE: ClassVar[str] = "native-transact-success"
+    response: SuccessEnvelope[NativeExchangeOutcome]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeWatchSuccess:
+    TYPE: ClassVar[str] = "native-watch-success"
+    response: SuccessEnvelope[NativeRouteEventBatch]
+
+
+RpcResponse: TypeAlias = RpcResponseNegotiateSuccess | RpcResponseSnapshotSuccess | RpcResponseIntegrationViewSuccess | RpcResponseAcquireLeaseSuccess | RpcResponseRenewLeaseSuccess | RpcResponseReleaseLeaseSuccess | RpcResponseSubmitTransactionSuccess | RpcResponseTransactionOutcomeSuccess | RpcResponseSubscribeSuccess | RpcResponseDiagnosticsSuccess | RpcResponseNativeEnumerateSuccess | RpcResponseNativeTransactSuccess | RpcResponseNativeWatchSuccess | ErrorEnvelope
 
 
 METHODS = (
@@ -835,6 +991,9 @@ class RpcResponseDiagnosticsSuccess:
     ("transaction-outcome", "TransactionLookup", "TransactionResult", "atomic-transactions"),
     ("subscribe", "SubscriptionRequest", "EventBatch", "event-subscriptions"),
     ("diagnostics", "EmptyRequest", "DiagnosticSnapshot", "structured-diagnostics"),
+    ("native-enumerate", "EmptyRequest", "NativeRouteInventory", "native-receiver-tunnel"),
+    ("native-transact", "NativeExchangeRequest", "NativeExchangeOutcome", "native-receiver-tunnel"),
+    ("native-watch", "SubscriptionRequest", "NativeRouteEventBatch", "native-receiver-tunnel"),
 )
 
 __all__ = [
@@ -885,6 +1044,14 @@ class RpcResponseDiagnosticsSuccess:
     "ViewerOwnedController",
     "OtherOwnedController",
     "ControllerActions",
+    "NativeRoute",
+    "NativeRouteInventory",
+    "NativeExchangeRequest",
+    "NativeExchangeNotSent",
+    "NativeExchangeUncertain",
+    "NativeExchangeMatchedResponse",
+    "NativeRouteEvent",
+    "NativeRouteEventBatch",
     "RpcError",
     "LeaseResultGranted",
     "LeaseResultConflict",
@@ -898,9 +1065,14 @@ class RpcResponseDiagnosticsSuccess:
     "ControllerOwnershipOwnedByViewer",
     "ControllerOwnershipOwnedByOther",
     "ControllerOwnership",
+    "NativeExchangeResultNotSent",
+    "NativeExchangeResultMayHaveBeenSent",
+    "NativeExchangeResultMatchedResponse",
+    "NativeExchangeResult",
     "ControllerView",
     "IntegrationReceiverView",
     "IntegrationView",
+    "NativeExchangeOutcome",
     "NegotiationRequestEnvelope",
     "SessionRequestEnvelope",
     "SuccessEnvelope",
@@ -915,6 +1087,9 @@ class RpcResponseDiagnosticsSuccess:
     "RpcRequestTransactionOutcome",
     "RpcRequestSubscribe",
     "RpcRequestDiagnostics",
+    "RpcRequestNativeEnumerate",
+    "RpcRequestNativeTransact",
+    "RpcRequestNativeWatch",
     "RpcRequest",
     "RpcResponseNegotiateSuccess",
     "RpcResponseSnapshotSuccess",
@@ -926,5 +1101,8 @@ class RpcResponseDiagnosticsSuccess:
     "RpcResponseTransactionOutcomeSuccess",
     "RpcResponseSubscribeSuccess",
     "RpcResponseDiagnosticsSuccess",
+    "RpcResponseNativeEnumerateSuccess",
+    "RpcResponseNativeTransactSuccess",
+    "RpcResponseNativeWatchSuccess",
     "RpcResponse",
 ]
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py b/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
new file mode 100644
index 0000000..677d4ed
--- /dev/null
+++ b/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
@@ -0,0 +1,1108 @@
+"""Generated by ./hfx generate. Do not edit manually."""
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from dataclasses import dataclass
+from typing import ClassVar, Generic, TypeAlias, TypeVar
+
+from .domain_types import (
+    ActivityState,
+    BatteryPercent,
+    CapabilityId,
+    ClientId,
+    ClientName,
+    ColorChannel,
+    ComponentVersion,
+    ConnectionMode,
+    ContactState,
+    ControllerAvailability,
+    DeliveredFrameCount,
+    DeviceApplicationState,
+    DeviceKind,
+    DocumentationPath,
+    DroppedEventCount,
+    EndpointId,
+    ErrorSeverity,
+    EventBatchLimit,
+    EventKind,
+    EvidenceClaimId,
+    EvidenceConfidence,
+    FindingId,
+    FrameCount,
+    FrameIndex,
+    FreshnessState,
+    GenerationId,
+    HumanMessage,
+    InventoryAvailability,
+    LeaseDurationMs,
+    LeaseId,
+    LeaseState,
+    LedCount,
+    LogicalDeviceId,
+    ModelName,
+    MonotonicMs,
+    NativeExchangeTimeoutMs,
+    NativeProtocolFamily,
+    NativeReportByteCount,
+    NativeReportHex,
+    NativeRouteAccess,
+    NativeRouteEventKind,
+    NativeRouteToken,
+    NegotiationToken,
+    PairingState,
+    PowerState,
+    PresenceState,
+    PresentationKey,
+    PrivacyClass,
+    ProductId,
+    ProfileDigest,
+    ProfileId,
+    ProjectionRevision,
+    ProtocolErrorKind,
+    ProtocolFeatureId,
+    ProtocolSessionId,
+    ProtocolVersion,
+    QueueAdmission,
+    QueueCapacity,
+    ReceiverId,
+    ReceiverLifecycleState,
+    RequestDigest,
+    RequestId,
+    ResourceKind,
+    RestoreDeliveryState,
+    RestoreState,
+    ReturnEvidence,
+    ReturnPhase,
+    RouteKind,
+    RouteState,
+    SequenceNumber,
+    ServerInstanceId,
+    SideEffectCertainty,
+    SleepState,
+    SourceRevision,
+    StableLightingMode,
+    StreamEpoch,
+    StreamId,
+    SubscriptionId,
+    SupportLevel,
+    TelemetryAvailability,
+    TransactionClass,
+    TransactionId,
+    TransactionState,
+    TransportVariant,
+    UpstreamId,
+    UpstreamOwner,
+    VendorId,
+)
+
+T = TypeVar("T")
+
+MINIMUM_PROTOCOL_VERSION = 7
+MAXIMUM_PROTOCOL_VERSION = 7
+MAX_WIRE_MESSAGE_BYTES = 1048576
+MAX_JSON_DEPTH = 128
+FIELD_LIMITS = {
+    ("ClientHello", "required_features"): 64,
+    ("ClientHello", "optional_features"): 64,
+    ("ServerHello", "enabled_features"): 64,
+    ("LeaseRequest", "resources"): 32,
+    ("LeaseGrant", "resources"): 32,
+    ("LogicalDeviceSnapshot", "endpoints"): 8,
+    ("LogicalDeviceSnapshot", "capabilities"): 128,
+    ("ReceiverSnapshot", "devices"): 32,
+    ("ReceiverSnapshot", "ownership"): 96,
+    ("BridgeSnapshot", "receivers"): 16,
+    ("LightingFrame", "colors"): 4096,
+    ("TransactionRequest", "device_profiles"): 32,
+    ("TransactionRequest", "stable_intents"): 32,
+    ("TransactionRequest", "resources"): 32,
+    ("TransactionRequest", "frames"): 32,
+    ("EventBatch", "events"): 256,
+    ("DiagnosticSnapshot", "findings"): 128,
+    ("DeviceInventoryView", "endpoints"): 8,
+    ("DeviceInventoryView", "capabilities"): 128,
+    ("ControllerView", "capabilities"): 128,
+    ("IntegrationReceiverView", "inventory"): 32,
+    ("IntegrationReceiverView", "controllers"): 32,
+    ("IntegrationView", "receivers"): 16,
+    ("NativeRouteInventory", "routes"): 32,
+    ("NativeRouteEventBatch", "events"): 256,
+}
+SUPPORTED_FEATURES = (
+    "ownership-leases",
+    "atomic-transactions",
+    "profile-bound-transactions",
+    "semantic-stable-lighting",
+    "snapshot-profile-bindings",
+    "integration-view-projection",
+    "event-subscriptions",
+    "structured-diagnostics",
+    "return-lifecycle-projection",
+    "native-receiver-tunnel",
+)
+
+@dataclass(frozen=True, slots=True)
+class EmptyRequest:
+    """A method request with no method-specific fields."""
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class RgbColor:
+    """One canonical eight-bit RGB color."""
+    red: ColorChannel
+    green: ColorChannel
+    blue: ColorChannel
+
+
+@dataclass(frozen=True, slots=True)
+class ClientHello:
+    """Bounded client protocol and feature offer."""
+    client_id: ClientId
+    client_name: ClientName
+    minimum_version: ProtocolVersion
+    maximum_version: ProtocolVersion
+    required_features: tuple[ProtocolFeatureId, ...]
+    optional_features: tuple[ProtocolFeatureId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class ServerHello:
+    """Negotiated protocol version and bridge feature set."""
+    selected_version: ProtocolVersion
+    server_instance_id: ServerInstanceId
+    protocol_session_id: ProtocolSessionId
+    negotiation_token: NegotiationToken
+    bridge_version: ComponentVersion
+    enabled_features: tuple[ProtocolFeatureId, ...]
+    event_buffer_capacity: QueueCapacity
+
+
+@dataclass(frozen=True, slots=True)
+class ResourceKey:
+    """One device-scoped writable resource."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    kind: ResourceKind
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseRequest:
+    """Atomic request for one or more writable resources."""
+    request_id: RequestId
+    client_id: ClientId
+    resources: tuple[ResourceKey, ...]
+    duration_ms: LeaseDurationMs
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseGrant:
+    """Granted ownership lease."""
+    lease_id: LeaseId
+    client_id: ClientId
+    resources: tuple[ResourceKey, ...]
+    expires_at_ms: MonotonicMs
+    state: LeaseState
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseConflict:
+    """Deterministic first conflict from an otherwise atomic lease request."""
+    conflicting_client: ClientId
+    conflicting_resource: ResourceKey
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseRejection:
+    """Structured lease rejection unrelated to another owner."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class RenewLeaseRequest:
+    """Idempotent renewal of one existing lease."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+    duration_ms: LeaseDurationMs
+
+
+@dataclass(frozen=True, slots=True)
+class ReleaseLeaseRequest:
+    """Idempotent release of one existing lease."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+
+
+@dataclass(frozen=True, slots=True)
+class EventCursor:
+    """Complete resumable position in one event stream projection."""
+    stream_id: StreamId
+    stream_epoch: StreamEpoch
+    projection_revision: ProjectionRevision
+    sequence: SequenceNumber
+
+
+@dataclass(frozen=True, slots=True)
+class ReturnEpoch:
+    """Generation-bound endpoint return state without claiming physical lighting application."""
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    epoch_sequence: SequenceNumber
+    opened_at_ms: MonotonicMs
+    opening_evidence: ReturnEvidence
+    phase: ReturnPhase
+    delivery_state: RestoreDeliveryState
+
+
+@dataclass(frozen=True, slots=True)
+class EndpointSnapshot:
+    """Independent route, power, sleep, activity, contact, and freshness facts."""
+    endpoint_id: EndpointId
+    route_kind: RouteKind
+    route_state: RouteState
+    connection_mode: ConnectionMode
+    power_state: PowerState
+    sleep_state: SleepState
+    activity_state: ActivityState
+    contact_state: ContactState
+    freshness: FreshnessState
+    confidence: EvidenceConfidence
+    evidence_claim_id: EvidenceClaimId | None
+    observed_at_ms: MonotonicMs | None
+    return_epoch: ReturnEpoch | None
+
+
+@dataclass(frozen=True, slots=True)
+class BatteryObservation:
+    """Battery availability and value without collapsing unknown and unavailable."""
+    availability: TelemetryAvailability
+    percentage: BatteryPercent | None
+    freshness: FreshnessState
+    confidence: EvidenceConfidence
+    observed_at_ms: MonotonicMs | None
+
+
+@dataclass(frozen=True, slots=True)
+class ResourceOwnershipSnapshot:
+    """Current bounded application ownership for one generation-scoped resource."""
+    resource: ResourceKey
+    client_id: ClientId
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class LogicalDeviceSnapshot:
+    """Application-neutral logical controller state."""
+    device_id: LogicalDeviceId
+    device_kind: DeviceKind
+    product_id: ProductId
+    profile_id: ProfileId | None
+    profile_digest: ProfileDigest | None
+    pairing: PairingState
+    presence: PresenceState
+    support_level: SupportLevel
+    endpoints: tuple[EndpointSnapshot, ...]
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class ReceiverSnapshot:
+    """Generation-bound receiver and child inventory."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    profile_id: ProfileId | None
+    profile_digest: ProfileDigest | None
+    lifecycle: ReceiverLifecycleState
+    devices: tuple[LogicalDeviceSnapshot, ...]
+    ownership: tuple[ResourceOwnershipSnapshot, ...]
+    stable_restore_enabled: bool
+    restore_state: RestoreState
+
+
+@dataclass(frozen=True, slots=True)
+class BridgeSnapshot:
+    """Sequence-bound complete bridge snapshot."""
+    cursor: EventCursor
+    receivers: tuple[ReceiverSnapshot, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class LightingFrame:
+    """One logical-device direct-mode frame."""
+    device_id: LogicalDeviceId
+    frame_index: FrameIndex
+    colors: tuple[RgbColor, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class DeviceProfileBinding:
+    """Exact profile and lighting dimensions bound to one transaction target."""
+    device_id: LogicalDeviceId
+    profile_id: ProfileId
+    profile_digest: ProfileDigest
+    application_slot_count: LedCount
+
+
+@dataclass(frozen=True, slots=True)
+class StableLightingIntent:
+    """Explicit semantic stable-lighting intent for one frame target."""
+    device_id: LogicalDeviceId
+    mode: StableLightingMode
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionRequest:
+    """Atomic generation- and ownership-bound operation."""
+    request_id: RequestId
+    transaction_id: TransactionId
+    client_id: ClientId
+    lease_id: LeaseId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    receiver_profile_id: ProfileId
+    receiver_profile_digest: ProfileDigest
+    device_profiles: tuple[DeviceProfileBinding, ...]
+    transaction_class: TransactionClass
+    stable_intents: tuple[StableLightingIntent, ...]
+    deadline_ms: MonotonicMs
+    resources: tuple[ResourceKey, ...]
+    frames: tuple[LightingFrame, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionProgress:
+    """Nonterminal generation-bound transaction projection."""
+    request_id: RequestId
+    request_digest: RequestDigest
+    transaction_id: TransactionId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    state: TransactionState
+    admission: QueueAdmission
+    declared_frames: FrameCount
+    delivered_frames: DeliveredFrameCount
+    side_effect_certainty: SideEffectCertainty
+    live_write_executed: bool
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionTerminal:
+    """Immutable terminal transaction outcome retained for bounded lookup."""
+    request_id: RequestId
+    request_digest: RequestDigest
+    transaction_id: TransactionId
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    state: TransactionState
+    declared_frames: FrameCount
+    delivered_frames: DeliveredFrameCount
+    side_effect_certainty: SideEffectCertainty
+    live_write_executed: bool
+    automatic_retry: bool
+    device_application: DeviceApplicationState
+    terminal_sequence: SequenceNumber
+    error_kind: ProtocolErrorKind | None
+    superseded_by: TransactionId | None
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionUnavailable:
+    """Outcome lookup cannot return a retained transaction record."""
+    transaction_id: TransactionId
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionLookup:
+    """Idempotent lookup of one previously submitted transaction."""
+    request_id: RequestId
+    client_id: ClientId
+    transaction_id: TransactionId
+
+
+@dataclass(frozen=True, slots=True)
+class SubscriptionRequest:
+    """Bounded event subscription cursor."""
+    client_id: ClientId
+    subscription_id: SubscriptionId | None
+    expected_cursor: EventCursor | None
+    max_events: EventBatchLimit
+
+
+@dataclass(frozen=True, slots=True)
+class BridgeEvent:
+    """Sequence-bound typed event with snapshot references."""
+    sequence: SequenceNumber
+    kind: EventKind
+    receiver_id: ReceiverId | None
+    generation_id: GenerationId | None
+    device_id: LogicalDeviceId | None
+    lease_id: LeaseId | None
+    transaction_id: TransactionId | None
+    finding_id: FindingId | None
+
+
+@dataclass(frozen=True, slots=True)
+class EventBatch:
+    """Bounded event result with explicit cursor-gap state."""
+    subscription_id: SubscriptionId
+    next_cursor: EventCursor
+    events: tuple[BridgeEvent, ...]
+    oldest_available: SequenceNumber
+    latest_available: SequenceNumber
+    dropped_events: DroppedEventCount
+    cursor_gap: bool
+    has_more: bool
+
+
+@dataclass(frozen=True, slots=True)
+class DiagnosticFinding:
+    """One privacy-classified actionable finding."""
+    finding_id: FindingId
+    severity: ErrorSeverity
+    cause: HumanMessage
+    explanation: HumanMessage
+    safe_action: HumanMessage
+    privacy: PrivacyClass
+    documentation: DocumentationPath
+
+
+@dataclass(frozen=True, slots=True)
+class DiagnosticSnapshot:
+    """Bounded bridge findings and queue health."""
+    sequence: SequenceNumber
+    findings: tuple[DiagnosticFinding, ...]
+    event_buffer_capacity: QueueCapacity
+    transaction_queue_capacity: QueueCapacity
+
+
+@dataclass(frozen=True, slots=True)
+class ProfileBindingView:
+    """Exact immutable profile authority exposed to integrations."""
+    profile_id: ProfileId
+    profile_digest: ProfileDigest
+
+
+@dataclass(frozen=True, slots=True)
+class DeviceInventoryView:
+    """Truthful paired-device inventory independent of application controller registration."""
+    device_id: LogicalDeviceId
+    device_kind: DeviceKind
+    product_id: ProductId
+    profile: ProfileBindingView | None
+    model_name: ModelName | None
+    pairing: PairingState
+    presence: PresenceState
+    availability: InventoryAvailability
+    support_level: SupportLevel
+    endpoints: tuple[EndpointSnapshot, ...]
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class PresentationView:
+    """Pinned upstream presentation authority without hardware transport policy."""
+    upstream_id: UpstreamId
+    owner: UpstreamOwner
+    project_version: ComponentVersion
+    source_revision: SourceRevision
+    model_key: PresentationKey
+    layout_key: PresentationKey | None
+    transport_variant: TransportVariant
+
+
+@dataclass(frozen=True, slots=True)
+class LightingTopologyView:
+    """Application-facing lighting dimensions without receiver carrier mapping."""
+    physical_led_count: LedCount
+    application_slot_count: LedCount
+    rows: LedCount
+    columns: LedCount
+
+
+@dataclass(frozen=True, slots=True)
+class UnownedController:
+    """Writable controller currently has no application owner."""
+    pass
+
+
+@dataclass(frozen=True, slots=True)
+class ViewerOwnedController:
+    """Writable controller is owned by the requesting client."""
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class OtherOwnedController:
+    """Writable controller is owned by another application client."""
+    client_id: ClientId
+    lease_id: LeaseId
+    expires_at_ms: MonotonicMs
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerActions:
+    """Viewer-specific actions derived from availability and ownership."""
+    can_acquire: bool
+    can_release: bool
+    can_submit_now: bool
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRoute:
+    """One generation-bound receiver child route without a host device path."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    device_kind: DeviceKind
+    vendor_id: VendorId
+    product_id: ProductId
+    route_state: RouteState
+    access: NativeRouteAccess
+    protocol_family: NativeProtocolFamily
+    report_bytes: NativeReportByteCount
+    route_token: NativeRouteToken | None
+    resource: ResourceKey | None
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteInventory:
+    """Bounded sequence-consistent native route inventory."""
+    cursor: EventCursor
+    routes: tuple[NativeRoute, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeRequest:
+    """One idempotent lease-bound native child feature-report exchange."""
+    request_id: RequestId
+    client_id: ClientId
+    lease_id: LeaseId
+    route_token: NativeRouteToken
+    report: NativeReportHex
+    timeout_ms: NativeExchangeTimeoutMs
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeNotSent:
+    """The native request provably did not reach the receiver."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeUncertain:
+    """The SET report may have reached the receiver and must not be repeated automatically."""
+    error_kind: ProtocolErrorKind
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeMatchedResponse:
+    """A response matching the exact native request identity was retained."""
+    response: NativeReportHex
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteEvent:
+    """One sequence-bound complete native route change."""
+    sequence: SequenceNumber
+    kind: NativeRouteEventKind
+    route: NativeRoute
+
+
+@dataclass(frozen=True, slots=True)
+class NativeRouteEventBatch:
+    """Bounded native route changes with explicit cursor-gap state."""
+    subscription_id: SubscriptionId
+    next_cursor: EventCursor
+    events: tuple[NativeRouteEvent, ...]
+    oldest_available: SequenceNumber
+    latest_available: SequenceNumber
+    dropped_events: DroppedEventCount
+    cursor_gap: bool
+    has_more: bool
+
+
+@dataclass(frozen=True, slots=True)
+class RpcError:
+    """Stable structured request failure."""
+    request_id: RequestId | None
+    kind: ProtocolErrorKind
+    message: HumanMessage
+    finding_id: FindingId
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultGranted:
+    """Every requested resource was granted."""
+    OUTCOME: ClassVar[str] = "granted"
+    detail: LeaseGrant
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultConflict:
+    """Another client owns at least one requested resource; none were granted."""
+    OUTCOME: ClassVar[str] = "conflict"
+    detail: LeaseConflict
+
+
+@dataclass(frozen=True, slots=True)
+class LeaseResultRejected:
+    """The request failed without granting any resource."""
+    OUTCOME: ClassVar[str] = "rejected"
+    detail: LeaseRejection
+
+
+LeaseResult: TypeAlias = LeaseResultGranted | LeaseResultConflict | LeaseResultRejected
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultProgress:
+    """The transaction has not reached a terminal state."""
+    OUTCOME: ClassVar[str] = "progress"
+    detail: TransactionProgress
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultTerminal:
+    """The immutable terminal outcome is retained."""
+    OUTCOME: ClassVar[str] = "terminal"
+    detail: TransactionTerminal
+
+
+@dataclass(frozen=True, slots=True)
+class TransactionResultUnavailable:
+    """No retained outcome can answer this lookup."""
+    OUTCOME: ClassVar[str] = "unavailable"
+    detail: TransactionUnavailable
+
+
+TransactionResult: TypeAlias = TransactionResultProgress | TransactionResultTerminal | TransactionResultUnavailable
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipUnowned:
+    """No application currently owns the controller."""
+    STATE: ClassVar[str] = "unowned"
+    detail: UnownedController
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipOwnedByViewer:
+    """The requesting client owns the controller."""
+    STATE: ClassVar[str] = "owned-by-viewer"
+    detail: ViewerOwnedController
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerOwnershipOwnedByOther:
+    """Another application client owns the controller."""
+    STATE: ClassVar[str] = "owned-by-other"
+    detail: OtherOwnedController
+
+
+ControllerOwnership: TypeAlias = ControllerOwnershipUnowned | ControllerOwnershipOwnedByViewer | ControllerOwnershipOwnedByOther
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultNotSent:
+    """The request is safe to retry with a new identity."""
+    CERTAINTY: ClassVar[str] = "not-sent"
+    detail: NativeExchangeNotSent
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultMayHaveBeenSent:
+    """Automatic retry is forbidden because SET delivery is uncertain."""
+    CERTAINTY: ClassVar[str] = "may-have-been-sent"
+    detail: NativeExchangeUncertain
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeResultMatchedResponse:
+    """The exact matching response was retained."""
+    CERTAINTY: ClassVar[str] = "matched-response"
+    detail: NativeExchangeMatchedResponse
+
+
+NativeExchangeResult: TypeAlias = NativeExchangeResultNotSent | NativeExchangeResultMayHaveBeenSent | NativeExchangeResultMatchedResponse
+
+
+@dataclass(frozen=True, slots=True)
+class ControllerView:
+    """Exact qualified receiver-backed application controller."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    device_id: LogicalDeviceId
+    endpoint_id: EndpointId
+    device_kind: DeviceKind
+    product_id: ProductId
+    receiver_profile: ProfileBindingView
+    device_profile: ProfileBindingView
+    model_name: ModelName
+    presentation: PresentationView
+    availability: ControllerAvailability
+    battery: BatteryObservation
+    capabilities: tuple[CapabilityId, ...]
+    lighting: LightingTopologyView
+    resource: ResourceKey
+    ownership: ControllerOwnership
+    actions: ControllerActions
+
+
+@dataclass(frozen=True, slots=True)
+class IntegrationReceiverView:
+    """One receiver generation with complete inventory and qualified controllers."""
+    receiver_id: ReceiverId
+    generation_id: GenerationId
+    profile: ProfileBindingView | None
+    model_name: ModelName | None
+    lifecycle: ReceiverLifecycleState
+    stable_restore_enabled: bool
+    restore_state: RestoreState
+    inventory: tuple[DeviceInventoryView, ...]
+    controllers: tuple[ControllerView, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class IntegrationView:
+    """Client-specific application view projected once by bridge policy."""
+    cursor: EventCursor
+    receivers: tuple[IntegrationReceiverView, ...]
+
+
+@dataclass(frozen=True, slots=True)
+class NativeExchangeOutcome:
+    """Idempotent native exchange identity and contradiction-free result."""
+    request_id: RequestId
+    route_token: NativeRouteToken
+    result: NativeExchangeResult
+
+
+@dataclass(frozen=True, slots=True)
+class NegotiationRequestEnvelope:
+    request_id: RequestId
+    params: ClientHello
+
+
+@dataclass(frozen=True, slots=True)
+class SessionRequestEnvelope(Generic[T]):
+    request_id: RequestId
+    protocol_session_id: ProtocolSessionId
+    negotiation_token: NegotiationToken
+    params: T
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNegotiate:
+    METHOD: ClassVar[str] = "negotiate"
+    request: NegotiationRequestEnvelope
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSnapshot:
+    METHOD: ClassVar[str] = "snapshot"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestIntegrationView:
+    METHOD: ClassVar[str] = "integration-view"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestAcquireLease:
+    METHOD: ClassVar[str] = "acquire-lease"
+    request: SessionRequestEnvelope[LeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestRenewLease:
+    METHOD: ClassVar[str] = "renew-lease"
+    request: SessionRequestEnvelope[RenewLeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestReleaseLease:
+    METHOD: ClassVar[str] = "release-lease"
+    request: SessionRequestEnvelope[ReleaseLeaseRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSubmitTransaction:
+    METHOD: ClassVar[str] = "submit-transaction"
+    request: SessionRequestEnvelope[TransactionRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestTransactionOutcome:
+    METHOD: ClassVar[str] = "transaction-outcome"
+    request: SessionRequestEnvelope[TransactionLookup]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestSubscribe:
+    METHOD: ClassVar[str] = "subscribe"
+    request: SessionRequestEnvelope[SubscriptionRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestDiagnostics:
+    METHOD: ClassVar[str] = "diagnostics"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeEnumerate:
+    METHOD: ClassVar[str] = "native-enumerate"
+    request: SessionRequestEnvelope[EmptyRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeTransact:
+    METHOD: ClassVar[str] = "native-transact"
+    request: SessionRequestEnvelope[NativeExchangeRequest]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcRequestNativeWatch:
+    METHOD: ClassVar[str] = "native-watch"
+    request: SessionRequestEnvelope[SubscriptionRequest]
+
+
+RpcRequest: TypeAlias = RpcRequestNegotiate | RpcRequestSnapshot | RpcRequestIntegrationView | RpcRequestAcquireLease | RpcRequestRenewLease | RpcRequestReleaseLease | RpcRequestSubmitTransaction | RpcRequestTransactionOutcome | RpcRequestSubscribe | RpcRequestDiagnostics | RpcRequestNativeEnumerate | RpcRequestNativeTransact | RpcRequestNativeWatch
+
+
+@dataclass(frozen=True, slots=True)
+class SuccessEnvelope(Generic[T]):
+    request_id: RequestId
+    server_instance_id: ServerInstanceId
+    result: T
+
+
+@dataclass(frozen=True, slots=True)
+class ErrorEnvelope:
+    request_id: RequestId | None
+    server_instance_id: ServerInstanceId
+    error: RpcError
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNegotiateSuccess:
+    TYPE: ClassVar[str] = "negotiate-success"
+    response: SuccessEnvelope[ServerHello]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSnapshotSuccess:
+    TYPE: ClassVar[str] = "snapshot-success"
+    response: SuccessEnvelope[BridgeSnapshot]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseIntegrationViewSuccess:
+    TYPE: ClassVar[str] = "integration-view-success"
+    response: SuccessEnvelope[IntegrationView]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseAcquireLeaseSuccess:
+    TYPE: ClassVar[str] = "acquire-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseRenewLeaseSuccess:
+    TYPE: ClassVar[str] = "renew-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseReleaseLeaseSuccess:
+    TYPE: ClassVar[str] = "release-lease-success"
+    response: SuccessEnvelope[LeaseResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSubmitTransactionSuccess:
+    TYPE: ClassVar[str] = "submit-transaction-success"
+    response: SuccessEnvelope[TransactionResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseTransactionOutcomeSuccess:
+    TYPE: ClassVar[str] = "transaction-outcome-success"
+    response: SuccessEnvelope[TransactionResult]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseSubscribeSuccess:
+    TYPE: ClassVar[str] = "subscribe-success"
+    response: SuccessEnvelope[EventBatch]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseDiagnosticsSuccess:
+    TYPE: ClassVar[str] = "diagnostics-success"
+    response: SuccessEnvelope[DiagnosticSnapshot]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeEnumerateSuccess:
+    TYPE: ClassVar[str] = "native-enumerate-success"
+    response: SuccessEnvelope[NativeRouteInventory]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeTransactSuccess:
+    TYPE: ClassVar[str] = "native-transact-success"
+    response: SuccessEnvelope[NativeExchangeOutcome]
+
+
+@dataclass(frozen=True, slots=True)
+class RpcResponseNativeWatchSuccess:
+    TYPE: ClassVar[str] = "native-watch-success"
+    response: SuccessEnvelope[NativeRouteEventBatch]
+
+
+RpcResponse: TypeAlias = RpcResponseNegotiateSuccess | RpcResponseSnapshotSuccess | RpcResponseIntegrationViewSuccess | RpcResponseAcquireLeaseSuccess | RpcResponseRenewLeaseSuccess | RpcResponseReleaseLeaseSuccess | RpcResponseSubmitTransactionSuccess | RpcResponseTransactionOutcomeSuccess | RpcResponseSubscribeSuccess | RpcResponseDiagnosticsSuccess | RpcResponseNativeEnumerateSuccess | RpcResponseNativeTransactSuccess | RpcResponseNativeWatchSuccess | ErrorEnvelope
+
+
+METHODS = (
+    ("negotiate", "ClientHello", "ServerHello", None),
+    ("snapshot", "EmptyRequest", "BridgeSnapshot", None),
+    ("integration-view", "EmptyRequest", "IntegrationView", "integration-view-projection"),
+    ("acquire-lease", "LeaseRequest", "LeaseResult", "ownership-leases"),
+    ("renew-lease", "RenewLeaseRequest", "LeaseResult", "ownership-leases"),
+    ("release-lease", "ReleaseLeaseRequest", "LeaseResult", "ownership-leases"),
+    ("submit-transaction", "TransactionRequest", "TransactionResult", "atomic-transactions"),
+    ("transaction-outcome", "TransactionLookup", "TransactionResult", "atomic-transactions"),
+    ("subscribe", "SubscriptionRequest", "EventBatch", "event-subscriptions"),
+    ("diagnostics", "EmptyRequest", "DiagnosticSnapshot", "structured-diagnostics"),
+    ("native-enumerate", "EmptyRequest", "NativeRouteInventory", "native-receiver-tunnel"),
+    ("native-transact", "NativeExchangeRequest", "NativeExchangeOutcome", "native-receiver-tunnel"),
+    ("native-watch", "SubscriptionRequest", "NativeRouteEventBatch", "native-receiver-tunnel"),
+)
+
+__all__ = [
+    "MAXIMUM_PROTOCOL_VERSION",
+    "FIELD_LIMITS",
+    "MAX_JSON_DEPTH",
+    "MAX_WIRE_MESSAGE_BYTES",
+    "METHODS",
+    "MINIMUM_PROTOCOL_VERSION",
+    "SUPPORTED_FEATURES",
+    "EmptyRequest",
+    "RgbColor",
+    "ClientHello",
+    "ServerHello",
+    "ResourceKey",
+    "LeaseRequest",
+    "LeaseGrant",
+    "LeaseConflict",
+    "LeaseRejection",
+    "RenewLeaseRequest",
+    "ReleaseLeaseRequest",
+    "EventCursor",
+    "ReturnEpoch",
+    "EndpointSnapshot",
+    "BatteryObservation",
+    "ResourceOwnershipSnapshot",
+    "LogicalDeviceSnapshot",
+    "ReceiverSnapshot",
+    "BridgeSnapshot",
+    "LightingFrame",
+    "DeviceProfileBinding",
+    "StableLightingIntent",
+    "TransactionRequest",
+    "TransactionProgress",
+    "TransactionTerminal",
+    "TransactionUnavailable",
+    "TransactionLookup",
+    "SubscriptionRequest",
+    "BridgeEvent",
+    "EventBatch",
+    "DiagnosticFinding",
+    "DiagnosticSnapshot",
+    "ProfileBindingView",
+    "DeviceInventoryView",
+    "PresentationView",
+    "LightingTopologyView",
+    "UnownedController",
+    "ViewerOwnedController",
+    "OtherOwnedController",
+    "ControllerActions",
+    "NativeRoute",
+    "NativeRouteInventory",
+    "NativeExchangeRequest",
+    "NativeExchangeNotSent",
+    "NativeExchangeUncertain",
+    "NativeExchangeMatchedResponse",
+    "NativeRouteEvent",
+    "NativeRouteEventBatch",
+    "RpcError",
+    "LeaseResultGranted",
+    "LeaseResultConflict",
+    "LeaseResultRejected",
+    "LeaseResult",
+    "TransactionResultProgress",
+    "TransactionResultTerminal",
+    "TransactionResultUnavailable",
+    "TransactionResult",
+    "ControllerOwnershipUnowned",
+    "ControllerOwnershipOwnedByViewer",
+    "ControllerOwnershipOwnedByOther",
+    "ControllerOwnership",
+    "NativeExchangeResultNotSent",
+    "NativeExchangeResultMayHaveBeenSent",
+    "NativeExchangeResultMatchedResponse",
+    "NativeExchangeResult",
+    "ControllerView",
+    "IntegrationReceiverView",
+    "IntegrationView",
+    "NativeExchangeOutcome",
+    "NegotiationRequestEnvelope",
+    "SessionRequestEnvelope",
+    "SuccessEnvelope",
+    "ErrorEnvelope",
+    "RpcRequestNegotiate",
+    "RpcRequestSnapshot",
+    "RpcRequestIntegrationView",
+    "RpcRequestAcquireLease",
+    "RpcRequestRenewLease",
+    "RpcRequestReleaseLease",
+    "RpcRequestSubmitTransaction",
+    "RpcRequestTransactionOutcome",
+    "RpcRequestSubscribe",
+    "RpcRequestDiagnostics",
+    "RpcRequestNativeEnumerate",
+    "RpcRequestNativeTransact",
+    "RpcRequestNativeWatch",
+    "RpcRequest",
+    "RpcResponseNegotiateSuccess",
+    "RpcResponseSnapshotSuccess",
+    "RpcResponseIntegrationViewSuccess",
+    "RpcResponseAcquireLeaseSuccess",
+    "RpcResponseRenewLeaseSuccess",
+    "RpcResponseReleaseLeaseSuccess",
+    "RpcResponseSubmitTransactionSuccess",
+    "RpcResponseTransactionOutcomeSuccess",
+    "RpcResponseSubscribeSuccess",
+    "RpcResponseDiagnosticsSuccess",
+    "RpcResponseNativeEnumerateSuccess",
+    "RpcResponseNativeTransactSuccess",
+    "RpcResponseNativeWatchSuccess",
+    "RpcResponse",
+]
diff --git a/tests/c/kernel_uapi_smoke.c b/tests/c/kernel_uapi_smoke.c
index 026bbcd..258d5d7 100644
--- a/tests/c/kernel_uapi_smoke.c
+++ b/tests/c/kernel_uapi_smoke.c
@@ -5,6 +5,7 @@
 #include "hyperflux_next.h"
 
 _Static_assert(HFX_UAPI_ABI_VERSION == 1U, "unexpected ABI version");
+_Static_assert(HFX_UAPI_NATIVE_ABI_VERSION == 2U, "unexpected native ABI version");
 _Static_assert(HFX_UAPI_IOCTL_MAGIC == 0xb7, "unexpected ioctl family");
 
 _Static_assert(sizeof(struct hfx_uapi_info) == 40, "info layout drift");
@@ -15,10 +16,14 @@ _Static_assert(sizeof(struct hfx_uapi_submit) == 1872, "submit layout drift");
 _Static_assert(sizeof(struct hfx_uapi_transaction_result) == 104, "result layout drift");
 _Static_assert(sizeof(struct hfx_uapi_observation) == 40, "observation layout drift");
 _Static_assert(sizeof(struct hfx_uapi_read_observations) == 1328, "observation batch layout drift");
+_Static_assert(sizeof(struct hfx_uapi_native_exchange_submit) == 216, "native submit layout drift");
+_Static_assert(sizeof(struct hfx_uapi_native_exchange_result) == 216, "native result layout drift");
 
 _Static_assert(offsetof(struct hfx_uapi_info, version) == 0, "version must lead info");
 _Static_assert(offsetof(struct hfx_uapi_info, size) == 4, "size must follow version");
 _Static_assert(offsetof(struct hfx_uapi_submit, frames) == 72, "frame array offset drift");
+_Static_assert(offsetof(struct hfx_uapi_native_exchange_submit, report) == 112, "native report offset drift");
+_Static_assert(offsetof(struct hfx_uapi_native_exchange_result, response) == 120, "native response offset drift");
 
 _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_GET_INFO) == sizeof(struct hfx_uapi_info), "info ioctl size drift");
 _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_BEGIN_SESSION) == sizeof(struct hfx_uapi_begin_session), "begin ioctl size drift");
@@ -26,6 +31,8 @@ _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_END_SESSION) == sizeof(struct hfx_uapi_e
 _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_SUBMIT) == sizeof(struct hfx_uapi_submit), "submit ioctl size drift");
 _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_GET_TRANSACTION_RESULT) == sizeof(struct hfx_uapi_transaction_result), "result ioctl size drift");
 _Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_READ_OBSERVATIONS) == sizeof(struct hfx_uapi_read_observations), "observation ioctl size drift");
+_Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_SUBMIT_NATIVE_EXCHANGE) == sizeof(struct hfx_uapi_native_exchange_submit), "native submit ioctl size drift");
+_Static_assert(_IOC_SIZE(HFX_UAPI_IOCTL_GET_NATIVE_EXCHANGE_RESULT) == sizeof(struct hfx_uapi_native_exchange_result), "native result ioctl size drift");
 
 int main(void)
 {
diff --git a/tests/cpp/domain_types_smoke.cpp b/tests/cpp/domain_types_smoke.cpp
index d7b5a56..9bdff20 100644
--- a/tests/cpp/domain_types_smoke.cpp
+++ b/tests/cpp/domain_types_smoke.cpp
@@ -10,6 +10,7 @@
 #include <hyperflux/generated/protocol_v4_types.hpp>
 #include <hyperflux/generated/protocol_v5_types.hpp>
 #include <hyperflux/generated/protocol_v6_types.hpp>
+#include <hyperflux/generated/protocol_v7_types.hpp>
 
 #include <string_view>
 
@@ -38,8 +39,8 @@ int main()
     {
         return 3;
     }
-    static_assert(minimum_protocol_version == 6);
-    static_assert(maximum_protocol_version == 6);
+    static_assert(minimum_protocol_version == 7);
+    static_assert(maximum_protocol_version == 7);
     static_assert(v1::minimum_protocol_version == 1);
     static_assert(v1::maximum_protocol_version == 1);
     static_assert(v2::minimum_protocol_version == 2);
@@ -52,6 +53,8 @@ int main()
     static_assert(v5::maximum_protocol_version == 5);
     static_assert(v6::minimum_protocol_version == 6);
     static_assert(v6::maximum_protocol_version == 6);
+    static_assert(v7::minimum_protocol_version == 7);
+    static_assert(v7::maximum_protocol_version == 7);
     if(methods[0].name != std::string_view{"negotiate"}
        || methods[0].required_feature.has_value())
     {
diff --git a/tests/cpp/kernel_profile_table_smoke.cpp b/tests/cpp/kernel_profile_table_smoke.cpp
index 2021f55..4e4923d 100644
--- a/tests/cpp/kernel_profile_table_smoke.cpp
+++ b/tests/cpp/kernel_profile_table_smoke.cpp
@@ -2,18 +2,37 @@
 
 #include <array>
 #include <cstdint>
+
+struct NativeMatchRange
+{
+    std::uint16_t offset;
+    std::uint16_t length;
+};
+
 struct ReceiverMatch
 {
     std::uint16_t vendor_id;
     std::uint16_t product_id;
-    std::uint8_t backend_id;
-    std::uint8_t pairing_inventory_kind;
+    std::uint32_t backend_id;
+    std::uint32_t pairing_inventory_kind;
+    std::uint32_t native_exchange_kind;
+    std::uint16_t native_report_bytes;
+    std::uint16_t native_set_report_index;
+    std::uint16_t native_response_report_index;
+    std::uint32_t native_initial_response_delay_us;
+    std::uint32_t native_response_retry_delay_us;
+    std::uint16_t native_max_response_attempts;
+    std::uint16_t native_match_range_count;
+    NativeMatchRange native_match_ranges[4];
 };
 
 #define HFX_PAIRING_INVENTORY_NONE 0
 #define HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1 1
-#define HFX_RECEIVER_PROFILE(vendor, product, backend, inventory) \
-    ReceiverMatch{vendor, product, backend, inventory},
+#define HFX_NATIVE_EXCHANGE_NONE 0
+#define HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 1
+#define HFX_RECEIVER_PROFILE(vendor, product, backend, ...) \
+    ReceiverMatch{.vendor_id = vendor, .product_id = product, \
+                  .backend_id = backend, __VA_ARGS__},
 
 constexpr std::array receiver_matches = {
 #include "../../driver/kernel/generated/hyperflux_receiver_profiles.inc"
@@ -26,5 +45,17 @@ int main()
     static_assert(receiver_matches[0].product_id == 0x00cf);
     static_assert(receiver_matches[0].backend_id == 1);
     static_assert(receiver_matches[0].pairing_inventory_kind == 1);
+    static_assert(receiver_matches[0].native_exchange_kind == 1);
+    static_assert(receiver_matches[0].native_report_bytes == 90);
+    static_assert(receiver_matches[0].native_set_report_index == 0);
+    static_assert(receiver_matches[0].native_response_report_index == 0);
+    static_assert(receiver_matches[0].native_initial_response_delay_us == 8000);
+    static_assert(receiver_matches[0].native_response_retry_delay_us == 10000);
+    static_assert(receiver_matches[0].native_max_response_attempts == 5);
+    static_assert(receiver_matches[0].native_match_range_count == 2);
+    static_assert(receiver_matches[0].native_match_ranges[0].offset == 2);
+    static_assert(receiver_matches[0].native_match_ranges[0].length == 2);
+    static_assert(receiver_matches[0].native_match_ranges[1].offset == 6);
+    static_assert(receiver_matches[0].native_match_ranges[1].length == 2);
     return 0;
 }
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index f6a9b67..f68302e 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac"
+  "source_sha256": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
 }
diff --git a/tests/test_assurance.py b/tests/test_assurance.py
index 4897636..50af19b 100644
--- a/tests/test_assurance.py
+++ b/tests/test_assurance.py
@@ -107,20 +107,51 @@ def test_candidate_baseline_binds_the_exact_protected_system(self) -> None:
             baseline["protected_behavior"]["sha256"],
         )
 
-        catalog = load_json(ROOT / "generated" / "profiles" / "catalog.json")
-        self.assertEqual(catalog["source_sha256"], baseline["profiles"]["source_sha256"])
-        runtime_digests = {
-            profile["profile_id"]: profile["runtime_sha256"]
-            for profile in catalog["profiles"]
+        self.assertEqual(
+            baseline["profiles"]["source_sha256"],
+            "6c14575bdb3887301e5f440e6ff7350da718960c91fc4ae516a43f76bf02a1ac",
+        )
+        baseline_runtime_digests = {
+            profile["profile_id"]: profile["sha256"]
+            for profile in baseline["profiles"]["runtime"]
         }
         self.assertEqual(
-            runtime_digests,
+            baseline_runtime_digests,
             {
-                profile["profile_id"]: profile["sha256"]
-                for profile in baseline["profiles"]["runtime"]
+                "child.razer.basilisk-v3-pro-35k.00cd": (
+                    "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf"
+                ),
+                "child.razer.deathstalker-v2-pro-tkl.0296": (
+                    "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63"
+                ),
+                "receiver.razer.hyperflux-v2.1532-00cf": (
+                    "ff258c7eb0ff16ee7df5aa9964aad7cf9fe0915b4252897aa561421a05ee96c6"
+                ),
+                "surface.razer.hyperflux-v2-hard-edition": (
+                    "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9"
+                ),
             },
         )
 
+        catalog = load_json(ROOT / "generated" / "profiles" / "catalog.json")
+        current_runtime_digests = {
+            profile["profile_id"]: profile["runtime_sha256"]
+            for profile in catalog["profiles"]
+        }
+        for protected_profile_id in (
+            "child.razer.basilisk-v3-pro-35k.00cd",
+            "child.razer.deathstalker-v2-pro-tkl.0296",
+            "surface.razer.hyperflux-v2-hard-edition",
+        ):
+            self.assertEqual(
+                current_runtime_digests[protected_profile_id],
+                baseline_runtime_digests[protected_profile_id],
+            )
+        self.assertNotEqual(
+            current_runtime_digests["receiver.razer.hyperflux-v2.1532-00cf"],
+            baseline_runtime_digests["receiver.razer.hyperflux-v2.1532-00cf"],
+        )
+
     def test_static_and_package_performance_budgets_fail_closed(self) -> None:
         static = verify_static_performance_budgets(ROOT, self.metrics)
         self.assertEqual(static["bridge-command-queue-capacity"], 128.0)
diff --git a/tests/test_kernel_driver.py b/tests/test_kernel_driver.py
index e43e69e..663bce2 100644
--- a/tests/test_kernel_driver.py
+++ b/tests/test_kernel_driver.py
@@ -43,6 +43,55 @@ def test_composite_activity_uses_kernel_report_metadata(self) -> None:
         self.assertIn("report->id", callback)
         self.assertNotIn("data[0]", callback)
 
+    def test_native_exchange_transport_is_child_model_agnostic(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-native.c").read_text(
+            encoding="utf-8"
+        ).lower()
+        for forbidden in (
+            "0x00cd",
+            "0x0296",
+            "basilisk",
+            "deathstalker",
+        ):
+            self.assertNotIn(forbidden, source)
+
+    def test_native_exchange_sends_once_then_retries_only_get(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-native.c").read_text(
+            encoding="utf-8"
+        )
+        start = source.index("static int hfx_native_record_dispatch")
+        end = source.index("static int hfx_native_reserve", start)
+        dispatch = source[start:end]
+        loop_start = dispatch.index("for (attempt")
+        response_loop = dispatch[loop_start:]
+
+        self.assertEqual(dispatch.count("hfx_native_usb_set("), 1)
+        self.assertNotIn("hfx_native_usb_set(", response_loop)
+        self.assertEqual(response_loop.count("hfx_native_usb_get("), 1)
+        self.assertIn("native_max_response_attempts", response_loop)
+        self.assertIn("native_response_retry_delay_us", response_loop)
+
+    def test_native_exchange_uses_declarative_receiver_profile(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-native.c").read_text(
+            encoding="utf-8"
+        )
+        for profile_field in (
+            "profile->native_report_bytes",
+            "profile->native_set_report_index",
+            "profile->native_response_report_index",
+            "profile->native_initial_response_delay_us",
+            "profile->native_response_retry_delay_us",
+            "profile->native_max_response_attempts",
+            "profile->native_match_ranges",
+        ):
+            self.assertIn(profile_field, source)
+
+        table = (
+            ROOT / "driver/kernel/generated/hyperflux_receiver_profiles.inc"
+        ).read_text(encoding="utf-8")
+        self.assertIn("HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1", table)
+        self.assertIn(".native_match_ranges", table)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_kernel_uapi.py b/tests/test_kernel_uapi.py
index b2441ea..e7ff547 100644
--- a/tests/test_kernel_uapi.py
+++ b/tests/test_kernel_uapi.py
@@ -8,11 +8,16 @@
 import tempfile
 import unittest
 
-from tools.hfxdev.kernel_uapi import MAX_IOCTL_STRUCT_BYTES, load_kernel_uapi
+from tools.hfxdev.kernel_uapi import (
+    MAX_IOCTL_STRUCT_BYTES,
+    load_kernel_uapi,
+    load_kernel_uapi_registry,
+)
 from tools.hfxdev.model import ModelError, load_json
 
 
 ROOT = Path(__file__).resolve().parents[1]
+FROZEN_V1_SOURCE_SHA256 = "e93cdf3e8232d6178015125934b256b671e0560a2b934c193be29b250389e24f"
 
 
 class KernelUapiTests(unittest.TestCase):
@@ -45,6 +50,59 @@ def test_canonical_layout_is_deterministic_and_bounded(self) -> None:
         )
         self.assertTrue(all(item.size < MAX_IOCTL_STRUCT_BYTES for item in first.structs))
 
+    def test_v1_source_and_ioctl_contract_remain_frozen(self) -> None:
+        catalog = load_kernel_uapi(ROOT)
+        self.assertEqual(catalog.source_sha256, FROZEN_V1_SOURCE_SHA256)
+        self.assertEqual(catalog.abi_version, 1)
+        self.assertEqual(
+            [(item.name, item.number, item.direction, item.struct_name) for item in catalog.ioctls],
+            [
+                ("get_info", 0x00, "read", "info"),
+                ("begin_session", 0x01, "read_write", "begin_session"),
+                ("end_session", 0x02, "write", "end_session"),
+                ("submit", 0x03, "read_write", "submit"),
+                (
+                    "get_transaction_result",
+                    0x04,
+                    "read_write",
+                    "transaction_result",
+                ),
+                ("read_observations", 0x05, "read_write", "read_observations"),
+            ],
+        )
+
+    def test_native_exchange_is_additive_fixed_width_v2(self) -> None:
+        registry = load_kernel_uapi_registry(ROOT)
+        self.assertEqual(
+            [
+                (entry.abi_version, entry.role, entry.version_macro)
+                for entry in registry.entries
+            ],
+            [
+                (1, "baseline", "abi_version"),
+                (2, "native_exchange", "native_abi_version"),
+            ],
+        )
+        native = registry.entries[1].catalog
+        self.assertEqual(native.ioctl_magic, registry.baseline.ioctl_magic)
+        self.assertEqual(
+            {item.name: item.size for item in native.structs},
+            {"native_exchange_submit": 216, "native_exchange_result": 216},
+        )
+        self.assertEqual(
+            [(item.name, item.number) for item in native.ioctls],
+            [
+                ("submit_native_exchange", 0x06),
+                ("get_native_exchange_result", 0x07),
+            ],
+        )
+        self.assertEqual(native.limits["native_report_bytes"], 90)
+        certainty = next(item for item in native.enums if item.name == "native_exchange_certainty")
+        self.assertEqual(
+            [(item.name, item.value) for item in certainty.values],
+            [("not_sent", 1), ("may_have_been_sent", 2), ("matched_response", 3)],
+        )
+
     def test_boundary_has_no_pointer_or_product_presentation_fields(self) -> None:
         catalog = load_kernel_uapi(ROOT)
         forbidden_types = {"pointer", "usize", "isize", "string", "path"}
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index 0550fd1..e57bc18 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -88,6 +88,35 @@ def test_canonical_profiles_compile_deterministically(self) -> None:
         self.assertEqual(len(digests), len(set(digests)))
         self.assertTrue(all(len(digest) == 64 for digest in digests))
 
+    def test_receiver_native_exchange_is_declarative_bounded_and_digest_bound(self) -> None:
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        native = receiver["transport"]["native_exchange"]
+        self.assertEqual(native["protocol_family"], "razer-feature-report-v1")
+        self.assertEqual(native["report_bytes"], 90)
+        self.assertEqual(native["set_report_index"], 0)
+        self.assertEqual(native["response_report_index"], 0)
+        self.assertEqual(native["match_ranges"], [{"offset": 2, "length": 2}, {"offset": 6, "length": 2}])
+        before = self.runtime_profile_digest(receiver, capabilities)
+        native["response_retry_delay_us"] += 1
+        self.validate_profiles(profiles, capabilities, claims)
+        self.assertNotEqual(self.runtime_profile_digest(receiver, capabilities), before)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        receiver["transport"]["native_exchange"]["match_ranges"][1] = {
+            "offset": 3,
+            "length": 5,
+        }
+        with self.assertRaisesRegex(ModelError, "sorted and disjoint"):
+            self.validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        receiver["transport"]["native_exchange"]["report_bytes"] = 89
+        with self.assertRaisesRegex(ModelError, "exactly 90 bytes"):
+            self.validate_profiles(profiles, capabilities, claims)
+
     def test_runtime_digest_is_profile_local_and_ignores_presentation_only_edits(self) -> None:
         profiles, capabilities, _ = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
diff --git a/tests/test_protocol.py b/tests/test_protocol.py
index 8b5fe50..43a91ca 100644
--- a/tests/test_protocol.py
+++ b/tests/test_protocol.py
@@ -21,8 +21,8 @@
 class ProtocolCompilerTests(unittest.TestCase):
     def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
         registry = load_protocol_registry(ROOT)
-        self.assertEqual(registry.current_version, 6)
-        self.assertEqual([item.version for item in registry.versions], [1, 2, 3, 4, 5, 6])
+        self.assertEqual(registry.current_version, 7)
+        self.assertEqual([item.version for item in registry.versions], [1, 2, 3, 4, 5, 6, 7])
         self.assertEqual(
             registry.versions[0].source_sha256,
             "ed3df1f1627ca8a836f509ead3ab7dc7a4cbc6116f6da4accb2cc53e7500859f",
@@ -52,6 +52,7 @@ def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
         )
         v5 = registry.versions[4].catalog
         v6 = registry.versions[5].catalog
+        v7 = registry.versions[6].catalog
         self.assertNotIn(
             "device_profiles", [field.name for field in v1_transaction.fields]
         )
@@ -90,6 +91,15 @@ def test_catalog_is_versioned_and_generated_deterministically(self) -> None:
             record for record in v6.records if record.name == "EndpointSnapshot"
         )
         self.assertIn("return_epoch", [field.name for field in v6_endpoint.fields])
+        self.assertIn("native-receiver-tunnel", registry.versions[6].served_features)
+        self.assertEqual(
+            [
+                method.name
+                for method in v7.methods
+                if method.required_feature == "native-receiver-tunnel"
+            ],
+            ["native-enumerate", "native-transact", "native-watch"],
+        )
         first = load_protocol_catalog(ROOT)
         second = load_protocol_catalog(ROOT)
         self.assertEqual(first, second)
@@ -108,7 +118,8 @@ def test_generated_declarations_follow_record_and_union_dependencies(self) -> No
         self.assertIn(
             "Self::Snapshot(envelope)\n"
             "            | Self::IntegrationView(envelope)\n"
-            "            | Self::Diagnostics(envelope) => &envelope.request_id,",
+            "            | Self::Diagnostics(envelope)\n"
+            "            | Self::NativeEnumerate(envelope) => &envelope.request_id,",
             rust,
         )
         self.assertLess(
diff --git a/tools/hfxdev/generators/kernel_uapi.py b/tools/hfxdev/generators/kernel_uapi.py
index 15d5ece..131abc0 100644
--- a/tools/hfxdev/generators/kernel_uapi.py
+++ b/tools/hfxdev/generators/kernel_uapi.py
@@ -4,7 +4,10 @@
 
 import re
 
-from ..kernel_uapi import KernelUapi, UapiField, UapiStruct
+from ..kernel_uapi import KernelUapi, KernelUapiRegistry, UapiField, UapiStruct
+
+
+KernelUapiSource = KernelUapi | KernelUapiRegistry
 
 
 def _macro(value: str) -> str:
@@ -76,11 +79,38 @@ def _rust_can_derive_default(struct: UapiStruct, catalog: KernelUapi) -> bool:
     return True
 
 
-def c_header(catalog: KernelUapi) -> str:
+def _catalog_entries(
+    source: KernelUapiSource,
+) -> tuple[tuple[KernelUapi, str, str, str], ...]:
+    if isinstance(source, KernelUapiRegistry):
+        return tuple(
+            (entry.catalog, entry.version_macro, entry.role, entry.catalog_name)
+            for entry in source.entries
+        )
+    return ((source, "abi_version", "baseline", "kernel-uapi.json"),)
+
+
+def _source_comments(source: KernelUapiSource, prefix: str, suffix: str) -> list[str]:
+    entries = _catalog_entries(source)
+    ending = f" {suffix}" if suffix else ""
+    comments = [f"{prefix} UAPI source SHA-256: {entries[0][0].source_sha256}{ending}"]
+    if isinstance(source, KernelUapiRegistry):
+        comments.append(f"{prefix} UAPI registry SHA-256: {source.source_sha256}{ending}")
+        for catalog, _macro_name, role, catalog_name in entries[1:]:
+            comments.append(
+                f"{prefix} UAPI {role} source {catalog_name} SHA-256: "
+                f"{catalog.source_sha256}{ending}"
+            )
+    return comments
+
+
+def c_header(source: KernelUapiSource) -> str:
+    entries = _catalog_entries(source)
+    baseline = entries[0][0]
     lines = [
         "/* Generated by ./hfx generate. Do not edit manually. */",
         "/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */",
-        f"/* UAPI source SHA-256: {catalog.source_sha256} */",
+        *_source_comments(source, "/*", "*/"),
         "",
         "#ifndef _UAPI_HYPERFLUX_NEXT_H",
         "#define _UAPI_HYPERFLUX_NEXT_H",
@@ -88,43 +118,52 @@ def c_header(catalog: KernelUapi) -> str:
         "#include <linux/ioctl.h>",
         "#include <linux/types.h>",
         "",
-        f"#define HFX_UAPI_ABI_VERSION {catalog.abi_version}U",
-        f"#define HFX_UAPI_IOCTL_MAGIC 0x{catalog.ioctl_magic:02x}",
+        f"#define HFX_UAPI_{_macro(entries[0][1])} {baseline.abi_version}U",
+        f"#define HFX_UAPI_IOCTL_MAGIC 0x{baseline.ioctl_magic:02x}",
     ]
-    for name, value in catalog.limits.items():
-        suffix = "ULL" if value > 0xFFFFFFFF else "U"
-        lines.append(f"#define HFX_UAPI_{_macro(name)} {value}{suffix}")
-    for enum in catalog.enums:
-        lines.append("")
-        for value in enum.values:
-            lines.append(
-                f"#define HFX_UAPI_{_macro(enum.name)}_{_macro(value.name)} {value.value}U"
-            )
-    for struct in catalog.structs:
-        lines.extend(["", f"struct hfx_uapi_{struct.name} {{"])
-        for field in struct.fields:
-            declaration = f"\t{_c_type(field.type_name)} {field.name}"
-            if field.count is not None:
-                declaration += f"[{_count_c(field)}]"
-            lines.append(f"{declaration};")
-        lines.append("};")
+    for catalog, version_macro, _role, _catalog_name in entries[1:]:
+        lines.append(f"#define HFX_UAPI_{_macro(version_macro)} {catalog.abi_version}U")
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for name, value in catalog.limits.items():
+            suffix = "ULL" if value > 0xFFFFFFFF else "U"
+            lines.append(f"#define HFX_UAPI_{_macro(name)} {value}{suffix}")
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for enum in catalog.enums:
+            lines.append("")
+            for value in enum.values:
+                lines.append(
+                    f"#define HFX_UAPI_{_macro(enum.name)}_{_macro(value.name)} {value.value}U"
+                )
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for struct in catalog.structs:
+            lines.extend(["", f"struct hfx_uapi_{struct.name} {{"])
+            for field in struct.fields:
+                declaration = f"\t{_c_type(field.type_name)} {field.name}"
+                if field.count is not None:
+                    declaration += f"[{_count_c(field)}]"
+                lines.append(f"{declaration};")
+            lines.append("};")
     direction = {"read": "_IOR", "write": "_IOW", "read_write": "_IOWR"}
     lines.append("")
-    for ioctl in catalog.ioctls:
-        lines.extend(
-            [
-                f"#define HFX_UAPI_IOCTL_{_macro(ioctl.name)} \\",
-                f"\t{direction[ioctl.direction]}(HFX_UAPI_IOCTL_MAGIC, 0x{ioctl.number:02x}, \\",
-                f"\t\tstruct hfx_uapi_{ioctl.struct_name})",
-            ]
-        )
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for ioctl in catalog.ioctls:
+            lines.extend(
+                [
+                    f"#define HFX_UAPI_IOCTL_{_macro(ioctl.name)} \\",
+                    f"\t{direction[ioctl.direction]}(HFX_UAPI_IOCTL_MAGIC, 0x{ioctl.number:02x}, \\",
+                    f"\t\tstruct hfx_uapi_{ioctl.struct_name})",
+                ]
+            )
     lines.extend(["", "#endif", ""])
     return "\n".join(lines)
 
 
-def rust_bindings(catalog: KernelUapi) -> str:
+def rust_bindings(source: KernelUapiSource) -> str:
+    entries = _catalog_entries(source)
+    baseline = entries[0][0]
     count_limits = {
         field.count
+        for catalog, _version_macro, _role, _catalog_name in entries
         for struct in catalog.structs
         for field in struct.fields
         if isinstance(field.count, str)
@@ -132,61 +171,68 @@ def rust_bindings(catalog: KernelUapi) -> str:
     lines = [
         "// Generated by ./hfx generate. Do not edit manually.",
         "// SPDX-License-Identifier: GPL-2.0-only",
-        f"// UAPI source SHA-256: {catalog.source_sha256}",
+        *_source_comments(source, "//", ""),
         "",
         "#[repr(C, align(8))]",
         "#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]",
         "pub struct AlignedU64(pub u64);",
         "",
-        f"pub const HFX_UAPI_ABI_VERSION: u32 = {catalog.abi_version};",
-        f"pub const HFX_UAPI_IOCTL_MAGIC: u8 = 0x{catalog.ioctl_magic:02x};",
+        f"pub const HFX_UAPI_{_macro(entries[0][1])}: u32 = {baseline.abi_version};",
+        f"pub const HFX_UAPI_IOCTL_MAGIC: u8 = 0x{baseline.ioctl_magic:02x};",
     ]
-    for name, value in catalog.limits.items():
-        rust_type = "usize" if name in count_limits else "u64"
+    for catalog, version_macro, _role, _catalog_name in entries[1:]:
         lines.append(
-            f"pub const HFX_UAPI_{_macro(name)}: {rust_type} = {_rust_number(value)};"
+            f"pub const HFX_UAPI_{_macro(version_macro)}: u32 = {catalog.abi_version};"
         )
-    for enum in catalog.enums:
-        lines.append("")
-        for value in enum.values:
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for name, value in catalog.limits.items():
+            rust_type = "usize" if name in count_limits else "u64"
             lines.append(
-                f"pub const HFX_UAPI_{_macro(enum.name)}_{_macro(value.name)}: u32 = "
-                f"{_rust_number(value.value)};"
+                f"pub const HFX_UAPI_{_macro(name)}: {rust_type} = {_rust_number(value)};"
             )
-    for struct in catalog.structs:
-        derives = "Clone, Copy, Debug, Default, Eq, PartialEq"
-        if not _rust_can_derive_default(struct, catalog):
-            derives = "Clone, Copy, Debug, Eq, PartialEq"
-        lines.extend(
-            [
-                "",
-                "#[repr(C)]",
-                f"#[derive({derives})]",
-                f"pub struct HfxUapi{_pascal(struct.name)} {{",
-            ]
-        )
-        for field in struct.fields:
-            rust_type = _rust_type(field.type_name)
-            if field.count is not None:
-                rust_type = f"[{rust_type}; {_count_rust(field)}]"
-            lines.append(f"    pub {field.name}: {rust_type},")
-        lines.append("}")
-        if not _rust_can_derive_default(struct, catalog):
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for enum in catalog.enums:
+            lines.append("")
+            for value in enum.values:
+                lines.append(
+                    f"pub const HFX_UAPI_{_macro(enum.name)}_{_macro(value.name)}: u32 = "
+                    f"{_rust_number(value.value)};"
+                )
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for struct in catalog.structs:
+            derives = "Clone, Copy, Debug, Default, Eq, PartialEq"
+            if not _rust_can_derive_default(struct, catalog):
+                derives = "Clone, Copy, Debug, Eq, PartialEq"
             lines.extend(
                 [
                     "",
-                    f"impl Default for HfxUapi{_pascal(struct.name)} {{",
-                    "    fn default() -> Self {",
-                    "        Self {",
-                    *[
-                        f"            {field.name}: {_rust_default(field)},"
-                        for field in struct.fields
-                    ],
-                    "        }",
-                    "    }",
-                    "}",
+                    "#[repr(C)]",
+                    f"#[derive({derives})]",
+                    f"pub struct HfxUapi{_pascal(struct.name)} {{",
                 ]
             )
+            for field in struct.fields:
+                rust_type = _rust_type(field.type_name)
+                if field.count is not None:
+                    rust_type = f"[{rust_type}; {_count_rust(field)}]"
+                lines.append(f"    pub {field.name}: {rust_type},")
+            lines.append("}")
+            if not _rust_can_derive_default(struct, catalog):
+                lines.extend(
+                    [
+                        "",
+                        f"impl Default for HfxUapi{_pascal(struct.name)} {{",
+                        "    fn default() -> Self {",
+                        "        Self {",
+                        *[
+                            f"            {field.name}: {_rust_default(field)},"
+                            for field in struct.fields
+                        ],
+                        "        }",
+                        "    }",
+                        "}",
+                    ]
+                )
     direction = {"read": "Read", "write": "Write", "read_write": "ReadWrite"}
     lines.extend(
         [
@@ -206,27 +252,34 @@ def rust_bindings(catalog: KernelUapi) -> str:
             "}",
         ]
     )
-    for ioctl in catalog.ioctls:
-        lines.extend(
-            [
-                "",
-                f"pub const HFX_UAPI_IOCTL_{_macro(ioctl.name)}: IoctlDescriptor = IoctlDescriptor {{",
-                f"    number: 0x{ioctl.number:02x},",
-                f"    direction: IoctlDirection::{direction[ioctl.direction]},",
-                f"    size: core::mem::size_of::<HfxUapi{_pascal(ioctl.struct_name)}>(),",
-                "};",
-            ]
-        )
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for ioctl in catalog.ioctls:
+            lines.extend(
+                [
+                    "",
+                    f"pub const HFX_UAPI_IOCTL_{_macro(ioctl.name)}: IoctlDescriptor = IoctlDescriptor {{",
+                    f"    number: 0x{ioctl.number:02x},",
+                    f"    direction: IoctlDirection::{direction[ioctl.direction]},",
+                    f"    size: core::mem::size_of::<HfxUapi{_pascal(ioctl.struct_name)}>(),",
+                    "};",
+                ]
+            )
     return "\n".join(lines) + "\n"
 
 
-def markdown(catalog: KernelUapi) -> str:
+def markdown(source: KernelUapiSource) -> str:
+    entries = _catalog_entries(source)
     lines = [
         "# Kernel UAPI",
         "",
         "> Generated by `./hfx generate`. Do not edit manually.",
         "",
-        f"ABI version: `{catalog.abi_version}`.",
+        "ABI catalogs: "
+        + ", ".join(
+            f"`{catalog.abi_version}` ({role})"
+            for catalog, _version_macro, role, _catalog_name in entries
+        )
+        + ".",
         "",
         "The UAPI contains fixed-width values, no pointers, and no application or product presentation.",
         "",
@@ -235,16 +288,20 @@ def markdown(catalog: KernelUapi) -> str:
         "| Structure | Size | Purpose boundary |",
         "| --- | ---: | --- |",
     ]
-    ioctl_structs = {item.struct_name: item.name for item in catalog.ioctls}
-    for struct in catalog.structs:
-        owner = ioctl_structs.get(struct.name, "nested payload")
-        lines.append(f"| `hfx_uapi_{struct.name}` | {struct.size} | `{owner}` |")
+    for catalog, _version_macro, role, _catalog_name in entries:
+        ioctl_structs = {item.struct_name: item.name for item in catalog.ioctls}
+        for struct in catalog.structs:
+            owner = ioctl_structs.get(struct.name, "nested payload")
+            lines.append(
+                f"| `hfx_uapi_{struct.name}` | {struct.size} | `{owner}` ({role}) |"
+            )
     lines.extend(["", "## Ioctls", "", "| Name | Number | Direction | Structure |", "| --- | ---: | --- | --- |"])
-    for ioctl in catalog.ioctls:
-        lines.append(
-            f"| `{ioctl.name}` | `0x{ioctl.number:02x}` | `{ioctl.direction}` | "
-            f"`hfx_uapi_{ioctl.struct_name}` |"
-        )
+    for catalog, _version_macro, _role, _catalog_name in entries:
+        for ioctl in catalog.ioctls:
+            lines.append(
+                f"| `{ioctl.name}` | `0x{ioctl.number:02x}` | `{ioctl.direction}` | "
+                f"`hfx_uapi_{ioctl.struct_name}` |"
+            )
     lines.extend(
         [
             "",
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index 964a548..12a3af3 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -309,6 +309,24 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeMatchRangeRecord {",
+        "    pub offset: u16,",
+        "    pub length: u16,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeExchangeRecord {",
+        "    pub protocol_family: &'static str,",
+        "    pub report_bytes: u16,",
+        "    pub set_report_index: u8,",
+        "    pub response_report_index: u8,",
+        "    pub initial_response_delay_us: u32,",
+        "    pub response_retry_delay_us: u32,",
+        "    pub max_response_attempts: u8,",
+        "    pub match_ranges: &'static [NativeMatchRangeRecord],",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct ProfileRecord {",
         "    pub id: &'static str,",
         "    pub runtime_sha256: &'static str,",
@@ -326,6 +344,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "    pub required_sibling_kinds: &'static [DeviceKind],",
         "    pub exact_child_combinations: bool,",
         "    pub capabilities: &'static [CapabilityRecord],",
+        "    pub native_exchange: Option<NativeExchangeRecord>,",
         "    pub lighting: Option<LightingTopology>,",
         "    pub passive: Option<PassiveTelemetryRecord>,",
         "    pub lifecycle: Option<LifecyclePolicyRecord>,",
@@ -406,6 +425,19 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 lines.append(f"const CARRIERS_{index}: &[u16] = &[")
                 lines.extend(_wrapped_numbers(lighting["application_index_to_carrier"]))
                 lines.extend(["];", ""])
+        native_exchange = profile.get("transport", {}).get("native_exchange")
+        if native_exchange:
+            lines.append(f"const NATIVE_MATCH_RANGES_{index}: &[NativeMatchRangeRecord] = &[")
+            for item in native_exchange["match_ranges"]:
+                lines.extend(
+                    [
+                        "    NativeMatchRangeRecord {",
+                        f"        offset: {item['offset']},",
+                        f"        length: {item['length']},",
+                        "    },",
+                    ]
+                )
+            lines.extend(["];", ""])
         passive = profile.get("transport", {}).get("passive")
         if passive:
             contact = passive["contact"] or {"off_mat": [], "on_mat": []}
@@ -443,6 +475,25 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
             "DeviceKind", compatibility.get("required_sibling_kinds", [])
         )
         exact_child_combinations = str(compatibility.get("exact_child_combinations", False)).lower()
+        native_exchange = profile.get("transport", {}).get("native_exchange")
+        if native_exchange:
+            native_exchange_lines = [
+                "        native_exchange: Some(NativeExchangeRecord {",
+                f"            protocol_family: {json.dumps(native_exchange['protocol_family'])},",
+                f"            report_bytes: {native_exchange['report_bytes']},",
+                f"            set_report_index: {native_exchange['set_report_index']},",
+                f"            response_report_index: {native_exchange['response_report_index']},",
+                "            initial_response_delay_us: "
+                f"{native_exchange['initial_response_delay_us']},",
+                "            response_retry_delay_us: "
+                f"{native_exchange['response_retry_delay_us']},",
+                "            max_response_attempts: "
+                f"{native_exchange['max_response_attempts']},",
+                f"            match_ranges: NATIVE_MATCH_RANGES_{index},",
+                "        }),",
+            ]
+        else:
+            native_exchange_lines = ["        native_exchange: None,"]
         lighting = profile.get("transport", {}).get("lighting")
         if lighting:
             lighting_value = None
@@ -534,6 +585,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 f"        required_sibling_kinds: {required_sibling_kinds},",
                 f"        exact_child_combinations: {exact_child_combinations},",
                 f"        capabilities: CAPABILITIES_{index},",
+                *native_exchange_lines,
                 *(
                     [
                         "        lighting: Some(LightingTopology {",
@@ -937,10 +989,49 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
         }.get(inventory_decoder)
         if inventory_kind is None:
             raise ValueError(f"unsupported kernel pairing inventory decoder: {inventory_decoder}")
-        lines.append(
-            f'HFX_RECEIVER_PROFILE(0x{identity["vendor_id"]:04x}, '
-            f'0x{identity["product_id"]:04x}, {transport["backend_id"]}, '
-            f'{inventory_kind})'
+        native = transport.get("native_exchange")
+        if native is None:
+            native_kind = "HFX_NATIVE_EXCHANGE_NONE"
+            native_values = {
+                "report_bytes": 0,
+                "set_report_index": 0,
+                "response_report_index": 0,
+                "initial_response_delay_us": 0,
+                "response_retry_delay_us": 0,
+                "max_response_attempts": 0,
+            }
+            match_ranges: list[dict[str, int]] = []
+        else:
+            native_kind = {
+                "razer-feature-report-v1": "HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1"
+            }.get(native["protocol_family"])
+            if native_kind is None:
+                raise ValueError(
+                    f"unsupported kernel native exchange protocol: {native['protocol_family']}"
+                )
+            native_values = native
+            match_ranges = native["match_ranges"]
+        range_values = ", ".join(
+            f"{{ .offset = {item['offset']}, .length = {item['length']} }}"
+            for item in match_ranges
+        )
+        lines.extend(
+            [
+                "HFX_RECEIVER_PROFILE(",
+                f'\t0x{identity["vendor_id"]:04x}, 0x{identity["product_id"]:04x},',
+                f'\t{transport["backend_id"]},',
+                f"\t.pairing_inventory_kind = {inventory_kind},",
+                f"\t.native_exchange_kind = {native_kind},",
+                f'\t.native_report_bytes = {native_values["report_bytes"]},',
+                f'\t.native_set_report_index = {native_values["set_report_index"]},',
+                f'\t.native_response_report_index = {native_values["response_report_index"]},',
+                f'\t.native_initial_response_delay_us = {native_values["initial_response_delay_us"]},',
+                f'\t.native_response_retry_delay_us = {native_values["response_retry_delay_us"]},',
+                f'\t.native_max_response_attempts = {native_values["max_response_attempts"]},',
+                f"\t.native_match_range_count = {len(match_ranges)},",
+                f"\t.native_match_ranges = {{ {range_values} }}",
+                ")",
+            ]
         )
     lines.extend(["", "#undef HFX_RECEIVER_PROFILE", ""])
     return "\n".join(lines)
diff --git a/tools/hfxdev/kernel_uapi.py b/tools/hfxdev/kernel_uapi.py
index 12a6ff8..33a6a54 100644
--- a/tools/hfxdev/kernel_uapi.py
+++ b/tools/hfxdev/kernel_uapi.py
@@ -27,6 +27,15 @@
     "structs",
     "ioctls",
 }
+REGISTRY_TOP_LEVEL_KEYS = {"$schema", "schema", "entries"}
+REGISTRY_ENTRY_KEYS = {
+    "abi_version",
+    "catalog",
+    "schema",
+    "schema_ref",
+    "version_macro",
+    "role",
+}
 MAX_IOCTL_STRUCT_BYTES = 1 << 14
 
 
@@ -79,6 +88,27 @@ def struct(self, name: str) -> UapiStruct:
         return next(item for item in self.structs if item.name == name)
 
 
+@dataclass(frozen=True)
+class KernelUapiRegistryEntry:
+    abi_version: int
+    catalog_name: str
+    schema_name: str
+    schema_ref: str
+    version_macro: str
+    role: str
+    catalog: KernelUapi
+
+
+@dataclass(frozen=True)
+class KernelUapiRegistry:
+    entries: tuple[KernelUapiRegistryEntry, ...]
+    source_sha256: str
+
+    @property
+    def baseline(self) -> KernelUapi:
+        return self.entries[0].catalog
+
+
 def _name(value: object, label: str) -> str:
     if not isinstance(value, str) or NAME.fullmatch(value) is None:
         raise ModelError(f"kernel UAPI {label} must be a canonical snake-case name")
@@ -116,13 +146,19 @@ def _align(offset: int, alignment: int) -> int:
     return (offset + alignment - 1) // alignment * alignment
 
 
-def load_kernel_uapi(root: Path) -> KernelUapi:
-    path = root / "uapi" / "kernel-uapi.json"
+def _load_kernel_uapi_catalog(
+    root: Path,
+    catalog_name: str,
+    *,
+    schema_ref: str,
+    schema_name: str,
+) -> KernelUapi:
+    path = root / "uapi" / catalog_name
     value = load_json(path)
     _exact_keys(value, TOP_LEVEL_KEYS, "catalog")
-    if value["$schema"] != "../schemas/kernel-uapi.schema.json":
+    if value["$schema"] != schema_ref:
         raise ModelError("kernel UAPI catalog has an unexpected schema reference")
-    if value["schema"] != "hyperflux-kernel-uapi-v1":
+    if value["schema"] != schema_name:
         raise ModelError("unsupported kernel UAPI catalog schema")
 
     abi_version = _integer(value["abi_version"], "ABI version", minimum=1, maximum=0xFFFFFFFF)
@@ -259,3 +295,114 @@ def load_kernel_uapi(root: Path) -> KernelUapi:
         ioctls=tuple(ioctls),
         source_sha256=sha256_file(path),
     )
+
+
+def load_kernel_uapi(root: Path) -> KernelUapi:
+    return _load_kernel_uapi_catalog(
+        root,
+        "kernel-uapi.json",
+        schema_ref="../schemas/kernel-uapi.schema.json",
+        schema_name="hyperflux-kernel-uapi-v1",
+    )
+
+
+def load_kernel_uapi_registry(root: Path) -> KernelUapiRegistry:
+    path = root / "uapi" / "registry.json"
+    value = load_json(path)
+    _exact_keys(value, REGISTRY_TOP_LEVEL_KEYS, "registry")
+    if value["$schema"] != "../schemas/kernel-uapi-registry.schema.json":
+        raise ModelError("kernel UAPI registry has an unexpected schema reference")
+    if value["schema"] != "hyperflux-kernel-uapi-registry-v1":
+        raise ModelError("unsupported kernel UAPI registry schema")
+
+    raw_entries = value["entries"]
+    if not isinstance(raw_entries, list) or not raw_entries:
+        raise ModelError("kernel UAPI registry entries must be a nonempty array")
+
+    entries: list[KernelUapiRegistryEntry] = []
+    for raw_entry in raw_entries:
+        if not isinstance(raw_entry, dict):
+            raise ModelError("kernel UAPI registry entry must be an object")
+        _exact_keys(raw_entry, REGISTRY_ENTRY_KEYS, "registry entry")
+        abi_version = _integer(
+            raw_entry["abi_version"],
+            "registry ABI version",
+            minimum=1,
+            maximum=0xFFFFFFFF,
+        )
+        catalog_name = raw_entry["catalog"]
+        if (
+            not isinstance(catalog_name, str)
+            or Path(catalog_name).name != catalog_name
+            or not catalog_name.endswith(".json")
+        ):
+            raise ModelError("kernel UAPI registry catalog must be a local JSON file name")
+        schema_name = raw_entry["schema"]
+        schema_ref = raw_entry["schema_ref"]
+        if not isinstance(schema_name, str) or not schema_name.startswith("hyperflux-kernel-uapi-"):
+            raise ModelError("kernel UAPI registry schema name is invalid")
+        if not isinstance(schema_ref, str) or not schema_ref.startswith("../schemas/"):
+            raise ModelError("kernel UAPI registry schema reference is invalid")
+        version_macro = _name(raw_entry["version_macro"], "registry version macro")
+        role = _name(raw_entry["role"], "registry role")
+        catalog = _load_kernel_uapi_catalog(
+            root,
+            catalog_name,
+            schema_ref=schema_ref,
+            schema_name=schema_name,
+        )
+        if catalog.abi_version != abi_version:
+            raise ModelError(
+                f"kernel UAPI registry ABI {abi_version} does not match {catalog_name}"
+            )
+        entries.append(
+            KernelUapiRegistryEntry(
+                abi_version=abi_version,
+                catalog_name=catalog_name,
+                schema_name=schema_name,
+                schema_ref=schema_ref,
+                version_macro=version_macro,
+                role=role,
+                catalog=catalog,
+            )
+        )
+
+    require_unique([str(item.abi_version) for item in entries], "kernel UAPI registry ABI")
+    require_unique([item.catalog_name for item in entries], "kernel UAPI registry catalog")
+    require_unique([item.version_macro for item in entries], "kernel UAPI registry version macro")
+    require_unique([item.role for item in entries], "kernel UAPI registry role")
+    if [item.abi_version for item in entries] != sorted(item.abi_version for item in entries):
+        raise ModelError("kernel UAPI registry entries must be ordered by ABI version")
+    if (
+        entries[0].abi_version != 1
+        or entries[0].catalog_name != "kernel-uapi.json"
+        or entries[0].version_macro != "abi_version"
+        or entries[0].role != "baseline"
+    ):
+        raise ModelError("kernel UAPI registry must preserve the v1 baseline first")
+
+    magic = entries[0].catalog.ioctl_magic
+    if any(item.catalog.ioctl_magic != magic for item in entries):
+        raise ModelError("kernel UAPI registry catalogs must share one ioctl magic")
+    require_unique(
+        [item.name for entry in entries for item in entry.catalog.enums],
+        "kernel UAPI registry enum",
+    )
+    require_unique(
+        [item.name for entry in entries for item in entry.catalog.structs],
+        "kernel UAPI registry struct",
+    )
+    require_unique(
+        [name for entry in entries for name in entry.catalog.limits],
+        "kernel UAPI registry limit",
+    )
+    require_unique(
+        [item.name for entry in entries for item in entry.catalog.ioctls],
+        "kernel UAPI registry ioctl",
+    )
+    require_unique(
+        [str(item.number) for entry in entries for item in entry.catalog.ioctls],
+        "kernel UAPI registry ioctl number",
+    )
+
+    return KernelUapiRegistry(entries=tuple(entries), source_sha256=sha256_file(path))
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 56ec85e..83d259f 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -74,6 +74,26 @@
     "route",
     "report_implies_route_available",
 }
+RECEIVER_TRANSPORT_KEYS = {
+    "backend",
+    "backend_id",
+    "maximum_targets",
+    "generation_bound",
+    "application_raw_frames",
+    "pairing_inventory",
+    "native_exchange",
+}
+NATIVE_EXCHANGE_KEYS = {
+    "protocol_family",
+    "report_bytes",
+    "set_report_index",
+    "response_report_index",
+    "initial_response_delay_us",
+    "response_retry_delay_us",
+    "max_response_attempts",
+    "match_ranges",
+}
+NATIVE_MATCH_RANGE_KEYS = {"offset", "length"}
 LIFECYCLE_KEYS = {
     "power_off_departure_evidence",
     "return_policy_id",
@@ -515,6 +535,55 @@ def _raw_values(value: object, label: str) -> list[int]:
     return value
 
 
+def _validate_native_exchange(profile_id: str, value: object) -> None:
+    if not isinstance(value, dict):
+        raise ModelError(f"{profile_id}: native exchange must be an object")
+    _expect_keys(value, NATIVE_EXCHANGE_KEYS, f"{profile_id} native exchange")
+    missing = sorted(NATIVE_EXCHANGE_KEYS - set(value))
+    if missing:
+        raise ModelError(f"{profile_id}: incomplete native exchange: {', '.join(missing)}")
+    if value["protocol_family"] != "razer-feature-report-v1":
+        raise ModelError(f"{profile_id}: unsupported native exchange protocol")
+    if value["report_bytes"] != 90:
+        raise ModelError(f"{profile_id}: native exchange report must be exactly 90 bytes")
+    integer_bounds = {
+        "set_report_index": (0, 255),
+        "response_report_index": (0, 255),
+        "initial_response_delay_us": (0, 100_000),
+        "response_retry_delay_us": (1, 100_000),
+        "max_response_attempts": (1, 16),
+    }
+    for key, (minimum, maximum) in integer_bounds.items():
+        item = value[key]
+        if isinstance(item, bool) or not isinstance(item, int) or not minimum <= item <= maximum:
+            raise ModelError(f"{profile_id}: native exchange {key} is out of bounds")
+    ranges = value["match_ranges"]
+    if not isinstance(ranges, list) or not 1 <= len(ranges) <= 4:
+        raise ModelError(f"{profile_id}: native exchange needs one to four match ranges")
+    previous_end = 0
+    for index, item in enumerate(ranges):
+        if not isinstance(item, dict):
+            raise ModelError(f"{profile_id}: native match range must be an object")
+        _expect_keys(item, NATIVE_MATCH_RANGE_KEYS, f"{profile_id} native match range")
+        if set(item) != NATIVE_MATCH_RANGE_KEYS:
+            raise ModelError(f"{profile_id}: native match range is incomplete")
+        offset = item["offset"]
+        length = item["length"]
+        if (
+            isinstance(offset, bool)
+            or not isinstance(offset, int)
+            or isinstance(length, bool)
+            or not isinstance(length, int)
+            or offset < 0
+            or length <= 0
+            or offset + length > value["report_bytes"]
+        ):
+            raise ModelError(f"{profile_id}: native match range is out of bounds")
+        if index and offset < previous_end:
+            raise ModelError(f"{profile_id}: native match ranges must be sorted and disjoint")
+        previous_end = offset + length
+
+
 def _validate_passive(
     profile: dict[str, Any], lifecycle_policy_index: dict[str, dict[str, Any]]
 ) -> None:
@@ -525,14 +594,7 @@ def _validate_passive(
     if kind == "receiver":
         _expect_keys(
             transport,
-            {
-                "backend",
-                "backend_id",
-                "maximum_targets",
-                "generation_bound",
-                "application_raw_frames",
-                "pairing_inventory",
-            },
+            RECEIVER_TRANSPORT_KEYS,
             f"{profile['profile_id']} receiver transport",
         )
         inventory = transport.get("pairing_inventory")
@@ -550,6 +612,9 @@ def _validate_passive(
                 raise ModelError(
                     f"{profile['profile_id']}: unsupported pairing inventory decoder"
                 )
+        native_exchange = transport.get("native_exchange")
+        if native_exchange is not None:
+            _validate_native_exchange(profile["profile_id"], native_exchange)
         return
     if kind != "child":
         if transport:
diff --git a/tools/hfxdev/render.py b/tools/hfxdev/render.py
index d6954af..8674bc2 100644
--- a/tools/hfxdev/render.py
+++ b/tools/hfxdev/render.py
@@ -109,7 +109,7 @@
     rust_types as protocol_rust_types,
     rust_registry as protocol_rust_registry,
 )
-from .kernel_uapi import load_kernel_uapi
+from .kernel_uapi import load_kernel_uapi_registry
 from .knowledge import compiled_knowledge_catalog
 from .integrations import (
     compiled_catalog as compiled_integration_catalog,
@@ -241,7 +241,7 @@ def rendered_files(root: Path) -> dict[Path, str]:
     protocol_registry = load_protocol_registry(root)
     protocol = protocol_registry.current
     errors = load_error_catalog(root)
-    kernel_uapi = load_kernel_uapi(root)
+    kernel_uapi = load_kernel_uapi_registry(root)
     integrations = compiled_integration_catalog(root)
     openrazer_metadata = load_imported_metadata(root)
     openrazer_compatibility = load_openrazer_compatibility_contract(root)
diff --git a/uapi/README.md b/uapi/README.md
index 8b6203c..0d03f5a 100644
--- a/uapi/README.md
+++ b/uapi/README.md
@@ -8,7 +8,7 @@ This is a structural collection, not a second source of truth. Follow the author
 
 | Owner | Canonical inputs | Generated outputs |
 | --- | ---: | ---: |
-| [Kernel driver contract](../driver/README.md) | 1 | 0 |
+| [Kernel driver contract](../driver/README.md) | 3 | 0 |
 
 ## Safe Changes
 
diff --git a/uapi/native-exchange-v2.json b/uapi/native-exchange-v2.json
new file mode 100644
index 0000000..18f465e
--- /dev/null
+++ b/uapi/native-exchange-v2.json
@@ -0,0 +1,74 @@
+{
+  "$schema": "../schemas/kernel-uapi-native-exchange.schema.json",
+  "schema": "hyperflux-kernel-uapi-native-exchange-v2",
+  "abi_version": 2,
+  "ioctl_magic": 183,
+  "limits": {
+    "native_digest_bytes": 32,
+    "native_report_bytes": 90,
+    "native_max_results": 128,
+    "native_control_timeout_ns": 1000000000
+  },
+  "enums": [
+    {
+      "name": "native_exchange_certainty",
+      "values": [
+        {"name": "not_sent", "value": 1},
+        {"name": "may_have_been_sent", "value": 2},
+        {"name": "matched_response", "value": 3}
+      ]
+    }
+  ],
+  "structs": [
+    {
+      "name": "native_exchange_submit",
+      "fields": [
+        {"name": "version", "type": "u32"},
+        {"name": "size", "type": "u32"},
+        {"name": "receiver_generation", "type": "u64"},
+        {"name": "authorization_epoch", "type": "u64"},
+        {"name": "dispatch_nonce", "type": "u64"},
+        {"name": "deadline_boottime_ns", "type": "u64"},
+        {"name": "endpoint_slot", "type": "u32"},
+        {"name": "report_length", "type": "u32"},
+        {"name": "route_token_digest", "type": "u8", "count": "native_digest_bytes"},
+        {"name": "request_digest", "type": "u8", "count": "native_digest_bytes"},
+        {"name": "report", "type": "u8", "count": "native_report_bytes"},
+        {"name": "kernel_sequence", "type": "u64"}
+      ]
+    },
+    {
+      "name": "native_exchange_result",
+      "fields": [
+        {"name": "version", "type": "u32"},
+        {"name": "size", "type": "u32"},
+        {"name": "receiver_generation", "type": "u64"},
+        {"name": "authorization_epoch", "type": "u64"},
+        {"name": "kernel_sequence", "type": "u64"},
+        {"name": "dispatch_nonce", "type": "u64"},
+        {"name": "endpoint_slot", "type": "u32"},
+        {"name": "certainty", "type": "u32"},
+        {"name": "route_token_digest", "type": "u8", "count": "native_digest_bytes"},
+        {"name": "request_digest", "type": "u8", "count": "native_digest_bytes"},
+        {"name": "transport_errno", "type": "i32"},
+        {"name": "response_length", "type": "u32"},
+        {"name": "response", "type": "u8", "count": "native_report_bytes"},
+        {"name": "reserved", "type": "u16"}
+      ]
+    }
+  ],
+  "ioctls": [
+    {
+      "name": "submit_native_exchange",
+      "number": 6,
+      "direction": "read_write",
+      "struct": "native_exchange_submit"
+    },
+    {
+      "name": "get_native_exchange_result",
+      "number": 7,
+      "direction": "read_write",
+      "struct": "native_exchange_result"
+    }
+  ]
+}
diff --git a/uapi/registry.json b/uapi/registry.json
new file mode 100644
index 0000000..fed6f00
--- /dev/null
+++ b/uapi/registry.json
@@ -0,0 +1,22 @@
+{
+  "$schema": "../schemas/kernel-uapi-registry.schema.json",
+  "schema": "hyperflux-kernel-uapi-registry-v1",
+  "entries": [
+    {
+      "abi_version": 1,
+      "catalog": "kernel-uapi.json",
+      "schema": "hyperflux-kernel-uapi-v1",
+      "schema_ref": "../schemas/kernel-uapi.schema.json",
+      "version_macro": "abi_version",
+      "role": "baseline"
+    },
+    {
+      "abi_version": 2,
+      "catalog": "native-exchange-v2.json",
+      "schema": "hyperflux-kernel-uapi-native-exchange-v2",
+      "schema_ref": "../schemas/kernel-uapi-native-exchange.schema.json",
+      "version_macro": "native_abi_version",
+      "role": "native_exchange"
+    }
+  ]
+}

From b71e8fa246526a8daef14da714d89821ec0470c1 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 11:23:27 +0400
Subject: [PATCH 39/67] feat: add source-bound native parity qualification

---
 docs/generated/installation.md                |   6 +-
 .../openrazer/native-probe-catalog.json       | 811 +++++++++++++++
 .../openrazer/native-probe-policy.json        | 193 ++++
 packaging/generated/install-plan.json         |  35 +
 ...tive-transport-parity-evidence.schema.json | 144 +++
 ...openrazer-native-probe-catalog.schema.json | 166 ++++
 .../openrazer-native-probe-policy.schema.json |  88 ++
 tests/test_integrations.py                    |  77 ++
 tests/test_native_parity.py                   | 300 ++++++
 tools/hfxdev/cli.py                           |  41 +
 tools/hfxdev/native_parity.py                 | 924 ++++++++++++++++++
 tools/hfxdev/native_probe.py                  | 749 ++++++++++++++
 tools/hfxdev/verify.py                        |  14 +
 verification/tests.json                       |   4 +-
 14 files changed, 3547 insertions(+), 5 deletions(-)
 create mode 100644 integrations/openrazer/native-probe-catalog.json
 create mode 100644 integrations/openrazer/native-probe-policy.json
 create mode 100644 schemas/native-transport-parity-evidence.schema.json
 create mode 100644 schemas/openrazer-native-probe-catalog.schema.json
 create mode 100644 schemas/openrazer-native-probe-policy.schema.json
 create mode 100644 tests/test_native_parity.py
 create mode 100644 tools/hfxdev/native_parity.py
 create mode 100644 tools/hfxdev/native_probe.py

diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index e8090db..e769c06 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -33,7 +33,7 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `167` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `172` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,12 +47,12 @@ The expanded source payload contains `167` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 56 | `-` |
+| `schemas` | 59 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
-| `integration-authority` | 6 | `-` |
+| `integration-authority` | 8 | `-` |
 | `cpp-sdk-headers` | 30 | `-` |
 | `documentation` | 39 | `-` |
 | `readme` | 1 | `-` |
diff --git a/integrations/openrazer/native-probe-catalog.json b/integrations/openrazer/native-probe-catalog.json
new file mode 100644
index 0000000..b07fa0b
--- /dev/null
+++ b/integrations/openrazer/native-probe-catalog.json
@@ -0,0 +1,811 @@
+{
+  "$schema": "../../schemas/openrazer-native-probe-catalog.schema.json",
+  "schema": "hyperflux-openrazer-native-probe-catalog-v1",
+  "upstream": {
+    "id": "openrazer",
+    "repository": "https://github.com/openrazer/openrazer.git",
+    "version": "3.12.1-41-g6820f9d",
+    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
+  },
+  "policy_sha256": "802c5a515e01e1fc71f6b43243b0ec6dbb009f64a9c83f2049bba098e17de448",
+  "inventory_sha256": "bf02e41424652869aeefdab9d63288bc4dcf2d4ca56c0bf253988b1af04cb8bf",
+  "report_size": 90,
+  "busy_retry": {
+    "status": 1,
+    "maximum_attempts": 5
+  },
+  "source_files": [
+    {
+      "path": "driver/razerchromacommon.c",
+      "sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829"
+    },
+    {
+      "path": "driver/razercommon.h",
+      "sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65"
+    },
+    {
+      "path": "driver/razerkbd_driver.c",
+      "sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df"
+    },
+    {
+      "path": "driver/razermouse_driver.c",
+      "sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff"
+    }
+  ],
+  "devices": [
+    {
+      "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+      "wireless_identity": {
+        "vendor_id": 5426,
+        "product_id": 205,
+        "model_name": "Razer Basilisk V3 Pro 35K (Wireless)",
+        "device_kind": "mouse",
+        "transport_variant": "wireless"
+      },
+      "direct_usb_reference": {
+        "vendor_id": 5426,
+        "product_id": 204,
+        "model_name": "Razer Basilisk V3 Pro 35K (Wired)",
+        "device_kind": "mouse",
+        "transport_variant": "wired"
+      },
+      "probes": [
+        {
+          "method": "get_firmware",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "firmware_version",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_firmware_version",
+            "request_owner": "razer_attr_read_firmware_version",
+            "source_line": 765,
+            "source_sha256": "80cb0bdcdd2a9d7c33b91322d2594c5e4c05723f01e29e64af033fc487d38662"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 129,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "6f515dc63df6f31f2cf56fc146d06f18ba75259c74100eee343106f7c66b33a5",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "firmware-version",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_serial",
+          "privacy": "redacted-equality-only",
+          "driver": {
+            "attribute": "device_serial",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_device_serial",
+            "request_owner": "razer_attr_read_device_serial",
+            "source_line": 1373,
+            "source_sha256": "47b6441ef48de520297d8743b555cc2873b4fb6f7223e0352ad0708cc539e113"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 130,
+            "data_size": 22,
+            "arguments": [
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            "normalized_sha256": "1ee6772a2962f0e212d4db1ce62dfc328155bb7e508a50940059c1a89e1afcaf",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "redacted-serial-equality",
+          "comparison": "redacted-equality"
+        },
+        {
+          "method": "get_device_mode",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "device_mode",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_device_mode",
+            "request_owner": "razer_attr_read_device_mode",
+            "source_line": 4007,
+            "source_sha256": "898fbf1a8338f6edf4c36f26d6d2e5eadcef52b57180686606ca39d4464253a7"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 132,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "0e29a171dc97a2793a7b5d70dd7ffda9b5c27765be31101eb94f15c93aacb515",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "device-mode",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_battery",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "charge_level",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_charge_level",
+            "request_owner": "razer_attr_read_charge_level",
+            "source_line": 1532,
+            "source_sha256": "4ac4766ac285a9c670be2941a89804e00c482efc0b9903a41bfb06535b727ec3"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 128,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "619cccfff3ef4e128bf0d7a7f3f494ab0f7b3cf0a71d0919d9c57e99fad5e259",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "battery-u8",
+          "comparison": "domain-valid"
+        },
+        {
+          "method": "is_charging",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "charge_status",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_charge_status",
+            "request_owner": "razer_attr_read_charge_status",
+            "source_line": 1633,
+            "source_sha256": "247ab66d8083c5484592890dd98fe4453679e0e9a2a9cca630420d875e8f346a"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 132,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "71b61f8c9ed82779e8b2be6edcd63f610f82d1fefb4a516242d56bcef616a2c1",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "boolean-u8",
+          "comparison": "domain-valid"
+        },
+        {
+          "method": "get_dpi_xy",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "dpi",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_dpi",
+            "request_owner": "razer_attr_read_dpi",
+            "source_line": 2620,
+            "source_sha256": "f2d5fece316d18b1c104c388945b6703a969cea65f0f3b92224c024525956d7f"
+          },
+          "request": {
+            "command_class": 4,
+            "command_id": 133,
+            "data_size": 7,
+            "arguments": [
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            "normalized_sha256": "7d7beaef2d24499a4e0df524829255f8b9789a3cba830c898952110ddf92a129",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "dpi-xy",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_dpi_stages",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "dpi_stages",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_dpi_stages",
+            "request_owner": "razer_attr_read_dpi_stages",
+            "source_line": 3176,
+            "source_sha256": "9e027c4e30109c5d4503ec664cdaacf7b524772800aae2296d4a306a91e4c6db"
+          },
+          "request": {
+            "command_class": 4,
+            "command_id": 134,
+            "data_size": 38,
+            "arguments": [
+              1,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            "normalized_sha256": "37d678de6396383525ac9ea8148e3483a1533483b06a1db4ab527b9f97790d98",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "dpi-stages",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_poll_rate",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "poll_rate",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_poll_rate",
+            "request_owner": "razer_attr_read_poll_rate",
+            "source_line": 1838,
+            "source_sha256": "af007d5b3f2e2f7c7120754e39b2cef6ef11f2e8190705cb61c8484ba95429e4"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 133,
+            "data_size": 1,
+            "arguments": [
+              0
+            ],
+            "normalized_sha256": "59cde20e90b1a6c9c7610300fafc13721de5b125ce086033f83da0b7d2672b09",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "polling-rate-code",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_idle_time",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "device_idle_time",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_device_idle_time",
+            "request_owner": "razer_attr_read_device_idle_time",
+            "source_line": 3312,
+            "source_sha256": "68914aaaffdc83c6c0a67a2db5e1f2b332e36876e52d6f3cfb7fa4e8e524af99"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 131,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "3d611bb978844bbd12c701d07967e23c6269147dd7ae61abcd4e26f4727b4019",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "be16-seconds",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_low_battery_threshold",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "charge_low_threshold",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_charge_low_threshold",
+            "request_owner": "razer_attr_read_charge_low_threshold",
+            "source_line": 3513,
+            "source_sha256": "2f3dfbbd401de6bb010940f434697f07ec7033051e9027ca138725ce52b60b89"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 129,
+            "data_size": 1,
+            "arguments": [
+              0
+            ],
+            "normalized_sha256": "e1d5df8eb568ddf6438a0eec03a9983cbd90613704b939b627fe065a11eee358",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "u8-value",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_scroll_mode",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "scroll_mode",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_scroll_mode",
+            "request_owner": "razer_attr_read_scroll_mode",
+            "source_line": 2842,
+            "source_sha256": "f596cabd69ba25e23fba94494e54632e2e9f4009901238b377028fec69cd015b"
+          },
+          "request": {
+            "command_class": 2,
+            "command_id": 148,
+            "data_size": 2,
+            "arguments": [
+              1,
+              0
+            ],
+            "normalized_sha256": "6712f9337b164c49eb2513b28cde56ef3088f71300b46bac8a8ca9d377c3210b",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "u8-value",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_scroll_acceleration",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "scroll_acceleration",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_scroll_acceleration",
+            "request_owner": "razer_attr_read_scroll_acceleration",
+            "source_line": 2890,
+            "source_sha256": "5bca30d5a567cd70c1abaaadd029db82ae0c231d49295c673edabee4e09399ff"
+          },
+          "request": {
+            "command_class": 2,
+            "command_id": 150,
+            "data_size": 2,
+            "arguments": [
+              1,
+              0
+            ],
+            "normalized_sha256": "ad61e408ab890d336a639f74c1cbb2f2ac2c429462b88437bdc0a7bf76924429",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "boolean-u8",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_scroll_smart_reel",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "scroll_smart_reel",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_scroll_smart_reel",
+            "request_owner": "razer_attr_read_scroll_smart_reel",
+            "source_line": 2938,
+            "source_sha256": "33e327d93701aa382ad97207719e851b379dd4c0a6c6488dc48caef610be0639"
+          },
+          "request": {
+            "command_class": 2,
+            "command_id": 151,
+            "data_size": 2,
+            "arguments": [
+              1,
+              0
+            ],
+            "normalized_sha256": "6a93f7ed1f907cef96385f251d761a8375a4670e54c12c6765197e6f75e34e2d",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "boolean-u8",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_brightness",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "matrix_brightness",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_matrix_brightness",
+            "request_owner": "razer_attr_read_matrix_brightness",
+            "source_line": 2309,
+            "source_sha256": "8936de697b1078c0d897f83f786ecd7526c80455305d5c2ffddd534c8e0248e8"
+          },
+          "request": {
+            "command_class": 15,
+            "command_id": 132,
+            "data_size": 3,
+            "arguments": [
+              1,
+              0,
+              0
+            ],
+            "normalized_sha256": "6dc893b23766f23cb0d6f3a47282286f56687bdc00bbfed6f54ea8501b91ab27",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "u8-value",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_logo_brightness",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "logo_led_brightness",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_logo_led_brightness",
+            "request_owner": "razer_attr_read_led_brightness",
+            "source_line": 4160,
+            "source_sha256": "a7afde4ad8e28df647866a7f7dec5e515381104edd10ffa9796df313187bcf86"
+          },
+          "request": {
+            "command_class": 15,
+            "command_id": 132,
+            "data_size": 3,
+            "arguments": [
+              1,
+              4,
+              0
+            ],
+            "normalized_sha256": "7081fc31b97e1873d8b7e8fbdc524b461140ef7527c35de708f238c92540d019",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "u8-value",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_scroll_brightness",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "scroll_led_brightness",
+            "source_path": "driver/razermouse_driver.c",
+            "reader": "razer_attr_read_scroll_led_brightness",
+            "request_owner": "razer_attr_read_led_brightness",
+            "source_line": 4160,
+            "source_sha256": "a7afde4ad8e28df647866a7f7dec5e515381104edd10ffa9796df313187bcf86"
+          },
+          "request": {
+            "command_class": 15,
+            "command_id": 132,
+            "data_size": 3,
+            "arguments": [
+              1,
+              1,
+              0
+            ],
+            "normalized_sha256": "8c042e4a4346cb9b0e576999326c0ce27f1d3b4ef3f598fd64d10876d7207311",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "u8-value",
+          "comparison": "exact-semantic"
+        }
+      ]
+    },
+    {
+      "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+      "wireless_identity": {
+        "vendor_id": 5426,
+        "product_id": 662,
+        "model_name": "Razer DeathStalker V2 Pro TKL (Wireless)",
+        "device_kind": "keyboard",
+        "transport_variant": "wireless"
+      },
+      "direct_usb_reference": {
+        "vendor_id": 5426,
+        "product_id": 664,
+        "model_name": "Razer DeathStalker V2 Pro TKL (Wired)",
+        "device_kind": "keyboard",
+        "transport_variant": "wired"
+      },
+      "probes": [
+        {
+          "method": "get_firmware",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "firmware_version",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_firmware_version",
+            "request_owner": "razer_attr_read_firmware_version",
+            "source_line": 2176,
+            "source_sha256": "6d7c1e47cc33578e73a6c4d871ce389283db1b5db97f0f1b75c5883418e211f9"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 129,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "6f515dc63df6f31f2cf56fc146d06f18ba75259c74100eee343106f7c66b33a5",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "firmware-version",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_serial",
+          "privacy": "redacted-equality-only",
+          "driver": {
+            "attribute": "device_serial",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_device_serial",
+            "request_owner": "razer_attr_read_device_serial",
+            "source_line": 2143,
+            "source_sha256": "619b348495fb5ac76d20c7fcdda3de4f6426f67a8bbcc79987eb46be81cc40fd"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 130,
+            "data_size": 22,
+            "arguments": [
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0,
+              0
+            ],
+            "normalized_sha256": "1ee6772a2962f0e212d4db1ce62dfc328155bb7e508a50940059c1a89e1afcaf",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "redacted-serial-equality",
+          "comparison": "redacted-equality"
+        },
+        {
+          "method": "get_device_mode",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "device_mode",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_device_mode",
+            "request_owner": "razer_attr_read_device_mode",
+            "source_line": 4322,
+            "source_sha256": "1722c7ef941ca73e29afd916ba1812de88ee658608afa0e825a4ec847d59f290"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 132,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "0e29a171dc97a2793a7b5d70dd7ffda9b5c27765be31101eb94f15c93aacb515",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "device-mode",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_keyboard_layout",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "kbd_layout",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_kbd_layout",
+            "request_owner": "razer_attr_read_kbd_layout",
+            "source_line": 487,
+            "source_sha256": "ef8bd45645c5498c7d70591af816ba31f2ac1a7675893724dd377e9ad477906d"
+          },
+          "request": {
+            "command_class": 0,
+            "command_id": 134,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "62f026f9ed773e9addd1949eec2fedafc274bdc9fe4e817e420e92430bafb502",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "keyboard-layout",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_battery",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "charge_level",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_charge_level",
+            "request_owner": "razer_attr_read_charge_level",
+            "source_line": 663,
+            "source_sha256": "d6faf79e5398bf13c7549b23002d7aef6657d7e1c60a69dc830e8494b925f392"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 128,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "619cccfff3ef4e128bf0d7a7f3f494ab0f7b3cf0a71d0919d9c57e99fad5e259",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "battery-u8",
+          "comparison": "domain-valid"
+        },
+        {
+          "method": "is_charging",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "charge_status",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_charge_status",
+            "request_owner": "razer_attr_read_charge_status",
+            "source_line": 711,
+            "source_sha256": "d50dcc9e97058f280bd6548b709fc4d08eed6555cbb9019c6aa9db4a61e4eb33"
+          },
+          "request": {
+            "command_class": 7,
+            "command_id": 132,
+            "data_size": 2,
+            "arguments": [
+              0,
+              0
+            ],
+            "normalized_sha256": "71b61f8c9ed82779e8b2be6edcd63f610f82d1fefb4a516242d56bcef616a2c1",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "boolean-u8",
+          "comparison": "domain-valid"
+        },
+        {
+          "method": "get_game_mode",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "game_led_state",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_game_led_state",
+            "request_owner": "razer_attr_read_game_led_state",
+            "source_line": 974,
+            "source_sha256": "42bcb7bc45638187f7891736c7eee0df61b8bb4254b6bd346386d1956535acd2"
+          },
+          "request": {
+            "command_class": 3,
+            "command_id": 128,
+            "data_size": 3,
+            "arguments": [
+              1,
+              8,
+              0
+            ],
+            "normalized_sha256": "b08684ef58cbfa7b1f24343eebb92ed3959195557302fee5e10fd92de53688eb",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "led-state",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_macro_mode",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "macro_led_state",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_macro_led_state",
+            "request_owner": "razer_attr_read_macro_led_state",
+            "source_line": 1175,
+            "source_sha256": "8945f0a18041478e1983470b2af29a387028d24c368b0451c8da34b6df8a7222"
+          },
+          "request": {
+            "command_class": 3,
+            "command_id": 128,
+            "data_size": 3,
+            "arguments": [
+              1,
+              7,
+              0
+            ],
+            "normalized_sha256": "9d10013cfdf451680ab360d4ff5971202c5055c779d639cd43297c57b46bc868",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "led-state",
+          "comparison": "exact-semantic"
+        },
+        {
+          "method": "get_macro_effect",
+          "privacy": "summary-only",
+          "driver": {
+            "attribute": "macro_led_effect",
+            "source_path": "driver/razerkbd_driver.c",
+            "reader": "razer_attr_read_macro_led_effect",
+            "request_owner": "razer_attr_read_macro_led_effect",
+            "source_line": 1812,
+            "source_sha256": "52c249a6453a4205fae261da1b1217a2ea8319cd1e6b707707c0e2efca48a24a"
+          },
+          "request": {
+            "command_class": 3,
+            "command_id": 130,
+            "data_size": 3,
+            "arguments": [
+              1,
+              7,
+              0
+            ],
+            "normalized_sha256": "b669336d199af906aded8ebb675ffca556eb3da873daa33489bc53e2588562a8",
+            "transaction_id_from_upstream": true,
+            "crc_recomputed_by_upstream": true
+          },
+          "response_summary": "led-effect",
+          "comparison": "exact-semantic"
+        }
+      ]
+    }
+  ]
+}
diff --git a/integrations/openrazer/native-probe-policy.json b/integrations/openrazer/native-probe-policy.json
new file mode 100644
index 0000000..978f8a5
--- /dev/null
+++ b/integrations/openrazer/native-probe-policy.json
@@ -0,0 +1,193 @@
+{
+  "$schema": "../../schemas/openrazer-native-probe-policy.schema.json",
+  "schema": "hyperflux-openrazer-native-probe-policy-v1",
+  "upstream_id": "openrazer",
+  "source_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "report_size": 90,
+  "busy_retry": {
+    "status": 1,
+    "maximum_attempts": 5
+  },
+  "bindings": [
+    {
+      "method": "get_battery",
+      "device_kinds": ["keyboard", "mouse"],
+      "driver_attribute": "charge_level",
+      "request_owner": "razer_attr_read_charge_level",
+      "request_expression": "razer_chroma_misc_get_battery_level()",
+      "response_summary": "battery-u8",
+      "comparison": "domain-valid"
+    },
+    {
+      "method": "get_brightness",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "matrix_brightness",
+      "request_owner": "razer_attr_read_matrix_brightness",
+      "request_expression": "razer_chroma_extended_matrix_get_brightness(VARSTORE, ZERO_LED)",
+      "response_summary": "u8-value",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_device_mode",
+      "device_kinds": ["keyboard", "mouse"],
+      "driver_attribute": "device_mode",
+      "request_owner": "razer_attr_read_device_mode",
+      "request_expression": "razer_chroma_standard_get_device_mode()",
+      "response_summary": "device-mode",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_dpi_stages",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "dpi_stages",
+      "request_owner": "razer_attr_read_dpi_stages",
+      "request_expression": "razer_chroma_misc_get_dpi_stages(VARSTORE)",
+      "response_summary": "dpi-stages",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_dpi_xy",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "dpi",
+      "request_owner": "razer_attr_read_dpi",
+      "request_expression": "razer_chroma_misc_get_dpi_xy(NOSTORE)",
+      "response_summary": "dpi-xy",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_firmware",
+      "device_kinds": ["keyboard", "mouse"],
+      "driver_attribute": "firmware_version",
+      "request_owner": "razer_attr_read_firmware_version",
+      "request_expression": "razer_chroma_standard_get_firmware_version()",
+      "response_summary": "firmware-version",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_game_mode",
+      "device_kinds": ["keyboard"],
+      "driver_attribute": "game_led_state",
+      "request_owner": "razer_attr_read_game_led_state",
+      "request_expression": "razer_chroma_standard_get_led_state(VARSTORE, GAME_LED)",
+      "response_summary": "led-state",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_idle_time",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "device_idle_time",
+      "request_owner": "razer_attr_read_device_idle_time",
+      "request_expression": "razer_chroma_misc_get_idle_time()",
+      "response_summary": "be16-seconds",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_keyboard_layout",
+      "device_kinds": ["keyboard"],
+      "driver_attribute": "kbd_layout",
+      "request_owner": "razer_attr_read_kbd_layout",
+      "request_expression": "get_razer_report(0x00, 0x86, 0x02)",
+      "response_summary": "keyboard-layout",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_logo_brightness",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "logo_led_brightness",
+      "request_owner": "razer_attr_read_led_brightness",
+      "request_expression": "razer_chroma_extended_matrix_get_brightness(VARSTORE, LOGO_LED)",
+      "response_summary": "u8-value",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_low_battery_threshold",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "charge_low_threshold",
+      "request_owner": "razer_attr_read_charge_low_threshold",
+      "request_expression": "razer_chroma_misc_get_low_battery_threshold()",
+      "response_summary": "u8-value",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_macro_effect",
+      "device_kinds": ["keyboard"],
+      "driver_attribute": "macro_led_effect",
+      "request_owner": "razer_attr_read_macro_led_effect",
+      "request_expression": "razer_chroma_standard_get_led_effect(VARSTORE, MACRO_LED)",
+      "response_summary": "led-effect",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_macro_mode",
+      "device_kinds": ["keyboard"],
+      "driver_attribute": "macro_led_state",
+      "request_owner": "razer_attr_read_macro_led_state",
+      "request_expression": "razer_chroma_standard_get_led_state(VARSTORE, MACRO_LED)",
+      "response_summary": "led-state",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_poll_rate",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "poll_rate",
+      "request_owner": "razer_attr_read_poll_rate",
+      "request_expression": "razer_chroma_misc_get_polling_rate()",
+      "response_summary": "polling-rate-code",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_scroll_acceleration",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "scroll_acceleration",
+      "request_owner": "razer_attr_read_scroll_acceleration",
+      "request_expression": "razer_chroma_misc_get_scroll_acceleration()",
+      "response_summary": "boolean-u8",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_scroll_brightness",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "scroll_led_brightness",
+      "request_owner": "razer_attr_read_led_brightness",
+      "request_expression": "razer_chroma_extended_matrix_get_brightness(VARSTORE, SCROLL_WHEEL_LED)",
+      "response_summary": "u8-value",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_scroll_mode",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "scroll_mode",
+      "request_owner": "razer_attr_read_scroll_mode",
+      "request_expression": "razer_chroma_misc_get_scroll_mode()",
+      "response_summary": "u8-value",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_scroll_smart_reel",
+      "device_kinds": ["mouse"],
+      "driver_attribute": "scroll_smart_reel",
+      "request_owner": "razer_attr_read_scroll_smart_reel",
+      "request_expression": "razer_chroma_misc_get_scroll_smart_reel()",
+      "response_summary": "boolean-u8",
+      "comparison": "exact-semantic"
+    },
+    {
+      "method": "get_serial",
+      "device_kinds": ["keyboard", "mouse"],
+      "driver_attribute": "device_serial",
+      "request_owner": "razer_attr_read_device_serial",
+      "request_expression": "razer_chroma_standard_get_serial()",
+      "response_summary": "redacted-serial-equality",
+      "comparison": "redacted-equality"
+    },
+    {
+      "method": "is_charging",
+      "device_kinds": ["keyboard", "mouse"],
+      "driver_attribute": "charge_status",
+      "request_owner": "razer_attr_read_charge_status",
+      "request_expression": "razer_chroma_misc_get_charging_status()",
+      "response_summary": "boolean-u8",
+      "comparison": "domain-valid"
+    }
+  ]
+}
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 3a9933d..1bde1bd 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -473,6 +473,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/native-transport-parity-evidence.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/native-transport-parity-evidence.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/openrazer-compatibility.schema.json",
@@ -494,6 +501,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-probe-catalog.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-probe-catalog.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-probe-policy.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-probe-policy.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/package-build-manifest.schema.json",
@@ -732,6 +753,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-probe-catalog.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-probe-catalog.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-probe-policy.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-probe-policy.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/generated/domain_json.hpp",
diff --git a/schemas/native-transport-parity-evidence.schema.json b/schemas/native-transport-parity-evidence.schema.json
new file mode 100644
index 0000000..f6382e0
--- /dev/null
+++ b/schemas/native-transport-parity-evidence.schema.json
@@ -0,0 +1,144 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json",
+  "title": "Privacy-safe native transport parity evidence",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "created_at",
+    "source_revision",
+    "profile_id",
+    "upstream_commit",
+    "catalog_sha256",
+    "safety",
+    "observations",
+    "coverage",
+    "conclusion"
+  ],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-native-transport-parity-evidence-v1"},
+    "created_at": {"type": "string", "format": "date-time"},
+    "source_revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "profile_id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$"},
+    "upstream_commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "catalog_sha256": {"$ref": "#/$defs/sha256"},
+    "safety": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "read_only",
+        "settings_changed",
+        "serials_persisted",
+        "raw_reports_persisted",
+        "private_paths_persisted",
+        "network_upload",
+        "file_mode"
+      ],
+      "properties": {
+        "read_only": {"const": true},
+        "settings_changed": {"const": false},
+        "serials_persisted": {"const": false},
+        "raw_reports_persisted": {"const": false},
+        "private_paths_persisted": {"const": false},
+        "network_upload": {"const": false},
+        "file_mode": {"const": "0600"}
+      }
+    },
+    "observations": {
+      "type": "array",
+      "maxItems": 256,
+      "items": {"$ref": "#/$defs/observation"}
+    },
+    "coverage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["required", "passed", "missing", "failed"],
+      "properties": {
+        "required": {"$ref": "#/$defs/methods"},
+        "passed": {"$ref": "#/$defs/methods"},
+        "missing": {"$ref": "#/$defs/methods"},
+        "failed": {"$ref": "#/$defs/methods"}
+      }
+    },
+    "conclusion": {"enum": ["passed", "incomplete", "backend-required"]}
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "methods": {
+      "type": "array",
+      "maxItems": 128,
+      "uniqueItems": true,
+      "items": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"}
+    },
+    "observation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "method",
+        "origin",
+        "comparison",
+        "request",
+        "response",
+        "receiver_comparison"
+      ],
+      "properties": {
+        "method": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+        "origin": {"enum": ["direct-semantic-reference", "receiver-route"]},
+        "comparison": {
+          "enum": ["exact-semantic", "domain-valid", "redacted-equality"]
+        },
+        "request": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "sha256",
+            "command_class",
+            "command_id",
+            "data_size",
+            "upstream_signature_matched",
+            "complete_capture",
+            "reconstructed_from_upstream"
+          ],
+          "properties": {
+            "sha256": {"$ref": "#/$defs/sha256"},
+            "command_class": {"type": "integer", "minimum": 0, "maximum": 255},
+            "command_id": {"type": "integer", "minimum": 128, "maximum": 255},
+            "data_size": {"type": "integer", "minimum": 0, "maximum": 80},
+            "upstream_signature_matched": {"type": "boolean"},
+            "complete_capture": {"type": "boolean"},
+            "reconstructed_from_upstream": {"type": "boolean"}
+          }
+        },
+        "response": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["status", "structural_match", "complete_capture", "summary"],
+          "properties": {
+            "status": {"type": "integer", "minimum": 0, "maximum": 255},
+            "structural_match": {"type": "boolean"},
+            "complete_capture": {"type": "boolean"},
+            "summary": {
+              "type": "object",
+              "additionalProperties": {
+                "type": ["boolean", "integer", "string", "array", "null"]
+              }
+            }
+          }
+        },
+        "receiver_comparison": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["attempts", "unchanged_request", "standard_response", "semantic_parity"],
+          "properties": {
+            "attempts": {"type": "integer", "minimum": 0, "maximum": 8},
+            "unchanged_request": {"type": ["boolean", "null"]},
+            "standard_response": {"type": ["boolean", "null"]},
+            "semantic_parity": {"type": ["boolean", "null"]}
+          }
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/openrazer-native-probe-catalog.schema.json b/schemas/openrazer-native-probe-catalog.schema.json
new file mode 100644
index 0000000..e1961ed
--- /dev/null
+++ b/schemas/openrazer-native-probe-catalog.schema.json
@@ -0,0 +1,166 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-probe-catalog-v1.json",
+  "title": "Source-bound OpenRazer native qualification probe catalog",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "upstream",
+    "policy_sha256",
+    "inventory_sha256",
+    "report_size",
+    "busy_retry",
+    "source_files",
+    "devices"
+  ],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-openrazer-native-probe-catalog-v1"},
+    "upstream": {"$ref": "#/$defs/upstream"},
+    "policy_sha256": {"$ref": "#/$defs/sha256"},
+    "inventory_sha256": {"$ref": "#/$defs/sha256"},
+    "report_size": {"const": 90},
+    "busy_retry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "maximum_attempts"],
+      "properties": {
+        "status": {"const": 1},
+        "maximum_attempts": {"type": "integer", "minimum": 1, "maximum": 8}
+      }
+    },
+    "source_files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 32,
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "sha256"],
+        "properties": {
+          "path": {"type": "string", "pattern": "^[A-Za-z0-9_./-]+$"},
+          "sha256": {"$ref": "#/$defs/sha256"}
+        }
+      }
+    },
+    "devices": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 128,
+      "items": {"$ref": "#/$defs/device"}
+    }
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "upstream": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "repository", "version", "commit", "license_expression"],
+      "properties": {
+        "id": {"const": "openrazer"},
+        "repository": {"type": "string", "format": "uri"},
+        "version": {"type": "string"},
+        "commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        "license_expression": {"type": "string"}
+      }
+    },
+    "identity": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["vendor_id", "product_id", "model_name", "device_kind", "transport_variant"],
+      "properties": {
+        "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "model_name": {"type": "string", "minLength": 1},
+        "device_kind": {"enum": ["keyboard", "mouse"]},
+        "transport_variant": {"enum": ["wired", "wireless"]}
+      }
+    },
+    "device": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["profile_id", "wireless_identity", "direct_usb_reference", "probes"],
+      "properties": {
+        "profile_id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$"},
+        "wireless_identity": {"$ref": "#/$defs/identity"},
+        "direct_usb_reference": {"$ref": "#/$defs/identity"},
+        "probes": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {"$ref": "#/$defs/probe"}
+        }
+      }
+    },
+    "probe": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["method", "privacy", "driver", "request", "response_summary", "comparison"],
+      "properties": {
+        "method": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+        "privacy": {"enum": ["summary-only", "redacted-equality-only"]},
+        "driver": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["attribute", "source_path", "reader", "request_owner", "source_line", "source_sha256"],
+          "properties": {
+            "attribute": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+            "source_path": {"enum": ["driver/razerkbd_driver.c", "driver/razermouse_driver.c"]},
+            "reader": {"type": "string", "pattern": "^razer_attr_read_[a-z0-9_]+$"},
+            "request_owner": {"type": "string", "pattern": "^razer_attr_read_[a-z0-9_]+$"},
+            "source_line": {"type": "integer", "minimum": 1},
+            "source_sha256": {"$ref": "#/$defs/sha256"}
+          }
+        },
+        "request": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "command_class",
+            "command_id",
+            "data_size",
+            "arguments",
+            "normalized_sha256",
+            "transaction_id_from_upstream",
+            "crc_recomputed_by_upstream"
+          ],
+          "properties": {
+            "command_class": {"type": "integer", "minimum": 0, "maximum": 255},
+            "command_id": {"type": "integer", "minimum": 128, "maximum": 255},
+            "data_size": {"type": "integer", "minimum": 0, "maximum": 80},
+            "arguments": {
+              "type": "array",
+              "maxItems": 80,
+              "items": {"type": "integer", "minimum": 0, "maximum": 255}
+            },
+            "normalized_sha256": {"$ref": "#/$defs/sha256"},
+            "transaction_id_from_upstream": {"const": true},
+            "crc_recomputed_by_upstream": {"const": true}
+          }
+        },
+        "response_summary": {
+          "enum": [
+            "battery-u8",
+            "be16-seconds",
+            "boolean-u8",
+            "device-mode",
+            "dpi-stages",
+            "dpi-xy",
+            "firmware-version",
+            "keyboard-layout",
+            "led-effect",
+            "led-state",
+            "polling-rate-code",
+            "redacted-serial-equality",
+            "u8-value"
+          ]
+        },
+        "comparison": {
+          "enum": ["exact-semantic", "domain-valid", "redacted-equality"]
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/openrazer-native-probe-policy.schema.json b/schemas/openrazer-native-probe-policy.schema.json
new file mode 100644
index 0000000..2417dee
--- /dev/null
+++ b/schemas/openrazer-native-probe-policy.schema.json
@@ -0,0 +1,88 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-probe-policy-v1.json",
+  "title": "OpenRazer native read-only qualification probe policy",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema",
+    "upstream_id",
+    "source_commit",
+    "report_size",
+    "busy_retry",
+    "bindings"
+  ],
+  "properties": {
+    "$schema": {"type": "string"},
+    "schema": {"const": "hyperflux-openrazer-native-probe-policy-v1"},
+    "upstream_id": {"const": "openrazer"},
+    "source_commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "report_size": {"const": 90},
+    "busy_retry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["status", "maximum_attempts"],
+      "properties": {
+        "status": {"const": 1},
+        "maximum_attempts": {"type": "integer", "minimum": 1, "maximum": 8}
+      }
+    },
+    "bindings": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 128,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "method",
+          "device_kinds",
+          "driver_attribute",
+          "request_owner",
+          "request_expression",
+          "response_summary",
+          "comparison"
+        ],
+        "properties": {
+          "method": {"$ref": "#/$defs/method"},
+          "device_kinds": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 2,
+            "uniqueItems": true,
+            "items": {"enum": ["keyboard", "mouse"]}
+          },
+          "driver_attribute": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"},
+          "request_owner": {"type": "string", "pattern": "^razer_attr_read_[a-z0-9_]+$"},
+          "request_expression": {
+            "type": "string",
+            "pattern": "^(?:razer_chroma_[a-z0-9_]+|get_razer_report)\\([A-Z0-9_x, ]*\\)$"
+          },
+          "response_summary": {
+            "enum": [
+              "battery-u8",
+              "be16-seconds",
+              "boolean-u8",
+              "device-mode",
+              "dpi-stages",
+              "dpi-xy",
+              "firmware-version",
+              "keyboard-layout",
+              "led-effect",
+              "led-state",
+              "polling-rate-code",
+              "redacted-serial-equality",
+              "u8-value"
+            ]
+          },
+          "comparison": {
+            "enum": ["exact-semantic", "domain-valid", "redacted-equality"]
+          }
+        }
+      }
+    }
+  },
+  "$defs": {
+    "method": {"type": "string", "pattern": "^[a-z][a-z0-9_]{0,127}$"}
+  }
+}
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index eca0b84..d23ac04 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -23,12 +23,18 @@
 from hfxdev.model import ModelError
 from hfxdev.model import load_json as model_load_json
 import hfxdev.native_control as native_control
+import hfxdev.native_probe as native_probe
 import hfxdev.openrazer as openrazer
 from hfxdev.native_control import (
     load_native_control_policy,
     load_native_method_inventory,
     transformed_native_inventory,
 )
+from hfxdev.native_probe import (
+    load_native_probe_catalog,
+    load_native_probe_policy,
+    transformed_native_probe_catalog,
+)
 from hfxdev.openrazer import (
     _ClassCatalog,
     load_import_selection,
@@ -151,6 +157,77 @@ def test_openrazer_native_policy_rejects_an_unclassified_upstream_method(self) -
             with self.assertRaisesRegex(ModelError, "unclassified: new_unreviewed_method"):
                 load_native_control_policy(ROOT)
 
+    def test_openrazer_native_probe_catalog_is_source_bound_and_privacy_safe(self) -> None:
+        policy = load_native_probe_policy(ROOT)
+        catalog = load_native_probe_catalog(ROOT)
+        self.assertEqual(catalog["report_size"], 90)
+        self.assertEqual(catalog["upstream"]["commit"], policy["source_commit"])
+        self.assertEqual(catalog["busy_retry"], {"status": 1, "maximum_attempts": 5})
+        comparisons = {value["method"]: value["comparison"] for value in policy["bindings"]}
+        self.assertEqual(comparisons["get_battery"], "domain-valid")
+        self.assertEqual(comparisons["is_charging"], "domain-valid")
+        self.assertEqual(comparisons["get_serial"], "redacted-equality")
+        self.assertEqual(comparisons["get_firmware"], "exact-semantic")
+
+        devices = {value["profile_id"]: value for value in catalog["devices"]}
+        mouse = devices["child.razer.basilisk-v3-pro-35k.00cd"]
+        keyboard = devices["child.razer.deathstalker-v2-pro-tkl.0296"]
+        self.assertEqual(mouse["wireless_identity"]["product_id"], 0x00CD)
+        self.assertEqual(mouse["direct_usb_reference"]["product_id"], 0x00CC)
+        self.assertEqual(keyboard["wireless_identity"]["product_id"], 0x0296)
+        self.assertEqual(keyboard["direct_usb_reference"]["product_id"], 0x0298)
+
+        for device in devices.values():
+            signatures = set()
+            for probe in device["probes"]:
+                request = probe["request"]
+                signature = (
+                    request["command_class"],
+                    request["command_id"],
+                    request["data_size"],
+                    tuple(request["arguments"]),
+                )
+                self.assertNotIn(signature, signatures)
+                signatures.add(signature)
+                self.assertTrue(request["transaction_id_from_upstream"])
+                self.assertTrue(request["crc_recomputed_by_upstream"])
+                self.assertEqual(probe["comparison"], comparisons[probe["method"]])
+                if probe["method"] == "get_serial":
+                    self.assertEqual(probe["privacy"], "redacted-equality-only")
+                    self.assertEqual(
+                        probe["response_summary"], "redacted-serial-equality"
+                    )
+
+        serialized = str(catalog)
+        for forbidden in (
+            "serial_value",
+            "raw_report",
+            "request_bytes",
+            "response_bytes",
+            "/home/",
+        ):
+            self.assertNotIn(forbidden, serialized)
+
+    def test_openrazer_native_probe_catalog_matches_exact_checkout_when_available(self) -> None:
+        source_value = os.environ.get("HFX_OPENRAZER_SOURCE_DIR")
+        if source_value is None:
+            self.skipTest("HFX_OPENRAZER_SOURCE_DIR is not configured")
+        self.assertEqual(
+            transformed_native_probe_catalog(ROOT, Path(source_value)),
+            load_native_probe_catalog(ROOT),
+        )
+
+    def test_openrazer_native_probe_policy_rejects_unbound_qualification_probe(self) -> None:
+        inventory = deepcopy(load_native_method_inventory(ROOT))
+        inventory["devices"][0]["qualification_probes"].append("unbound_probe")
+        with patch.object(
+            native_probe,
+            "load_native_method_inventory",
+            return_value=inventory,
+        ):
+            with self.assertRaisesRegex(ModelError, "coverage drift"):
+                load_native_probe_policy(ROOT)
+
     def test_openrazer_python_metadata_is_generated_from_the_pinned_import(self) -> None:
         metadata = load_imported_metadata(ROOT)
         rendered = python_openrazer_metadata(metadata)
diff --git a/tests/test_native_parity.py b/tests/test_native_parity.py
new file mode 100644
index 0000000..a810287
--- /dev/null
+++ b/tests/test_native_parity.py
@@ -0,0 +1,300 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import hashlib
+import json
+from copy import deepcopy
+from pathlib import Path
+import stat
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+
+from hfxdev.model import ModelError
+from hfxdev.native_parity import (
+    build_offline_parity_evidence,
+    canonical_request,
+    parse_usbmon_capture,
+    write_parity_evidence,
+)
+from hfxdev.native_probe import load_native_probe_catalog
+
+
+REVISION = "1" * 40
+
+
+def _crc(report: bytes | bytearray) -> int:
+    value = 0
+    for byte in report[2:88]:
+        value ^= byte
+    return value
+
+
+def _response(request: bytes, arguments: bytes, *, status: int = 2) -> bytes:
+    report = bytearray(90)
+    report[0] = status
+    report[1] = request[1]
+    report[2:4] = request[2:4]
+    report[5] = len(arguments)
+    report[6:8] = request[6:8]
+    report[8 : 8 + len(arguments)] = arguments
+    report[88] = _crc(report)
+    return bytes(report)
+
+
+def _words(value: bytes) -> str:
+    return " ".join(value[index : index + 4].hex() for index in range(0, len(value), 4))
+
+
+def _capture(request: bytes, response: bytes, *, device: int) -> str:
+    identifier = f"{device:03d}"
+    return "\n".join(
+        (
+            f"ffff000000000001 1000 S Co:3:{identifier}:0 s 21 09 0300 0000 005a 90 = {_words(request)}",
+            f"ffff000000000001 1001 C Co:3:{identifier}:0 0 90 >",
+            f"ffff000000000002 1002 S Ci:3:{identifier}:0 s a1 01 0300 0000 005a 90 <",
+            f"ffff000000000002 1003 C Ci:3:{identifier}:0 0 90 = {_words(response)}",
+            "",
+        )
+    )
+
+
+def _probe(profile_id: str, method: str) -> dict:
+    catalog = load_native_probe_catalog(ROOT)
+    profile = next(value for value in catalog["devices"] if value["profile_id"] == profile_id)
+    return next(value for value in profile["probes"] if value["method"] == method)
+
+
+class NativeParityTests(unittest.TestCase):
+    mouse_profile = "child.razer.basilisk-v3-pro-35k.00cd"
+    keyboard_profile = "child.razer.deathstalker-v2-pro-tkl.0296"
+
+    def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((2, 51)))
+        receiver_response = _response(receiver_request, bytes((2, 51)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        self.assertIn("get_firmware", evidence["coverage"]["passed"])
+        self.assertEqual(evidence["conclusion"], "incomplete")
+        routed = next(
+            value
+            for value in evidence["observations"]
+            if value["method"] == "get_firmware" and value["origin"] == "receiver-route"
+        )
+        self.assertEqual(
+            routed["receiver_comparison"],
+            {
+                "attempts": 1,
+                "unchanged_request": True,
+                "standard_response": True,
+                "semantic_parity": True,
+            },
+        )
+
+    def test_complete_request_rewrite_requires_a_backend(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        direct_request = canonical_request(probe, 0x1F)
+        direct_response = _response(direct_request, bytes((2, 51)))
+        receiver_request = bytearray(canonical_request(probe, 0x9F))
+        receiver_request[89] = 1
+        receiver_response = _response(bytes(receiver_request), bytes((2, 51)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(bytes(receiver_request), receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        self.assertEqual(evidence["conclusion"], "backend-required")
+        self.assertIn("get_firmware", evidence["coverage"]["failed"])
+
+    def test_serial_is_compared_in_memory_but_never_persisted(self) -> None:
+        probe = _probe(self.mouse_profile, "get_serial")
+        serial = b"PRIVATE-SERIAL-1234567"
+        self.assertEqual(len(serial), 22)
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, serial)
+        receiver_response = _response(receiver_request, serial)
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+            destination = write_parity_evidence(evidence, cache_root=root / "cache")
+            rendered = destination.read_text()
+            self.assertEqual(stat.S_IMODE(destination.stat().st_mode), 0o600)
+        self.assertIn("get_serial", evidence["coverage"]["passed"])
+        self.assertNotIn(serial.decode(), rendered)
+        self.assertNotIn(hashlib.sha256(serial).hexdigest(), rendered)
+        summaries = [
+            value["response"]["summary"]
+            for value in evidence["observations"]
+            if value["method"] == "get_serial"
+        ]
+        self.assertEqual(
+            summaries,
+            [
+                {"kind": "redacted-serial-equality", "redacted": True, "available": True},
+                {"kind": "redacted-serial-equality", "redacted": True, "available": True},
+            ],
+        )
+
+    def test_busy_retries_are_bounded_and_only_the_terminal_result_counts(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((2, 51)))
+        busy_response = _response(receiver_request, bytes((0, 0)), status=1)
+        success_response = _response(receiver_request, bytes((2, 51)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(
+                _capture(receiver_request, busy_response, device=11)
+                + _capture(receiver_request, success_response, device=11)
+            )
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        routed = next(
+            value for value in evidence["observations"] if value["origin"] == "receiver-route"
+        )
+        self.assertEqual(routed["receiver_comparison"]["attempts"], 2)
+        self.assertIn("get_firmware", evidence["coverage"]["passed"])
+
+    def test_dynamic_telemetry_requires_valid_values_not_identical_snapshots(self) -> None:
+        probe = _probe(self.mouse_profile, "get_battery")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((0, 128)))
+        receiver_response = _response(receiver_request, bytes((0, 144)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        routed = next(
+            value for value in evidence["observations"] if value["origin"] == "receiver-route"
+        )
+        self.assertEqual(routed["comparison"], "domain-valid")
+        self.assertTrue(routed["receiver_comparison"]["semantic_parity"])
+        self.assertIn("get_battery", evidence["coverage"]["passed"])
+
+    def test_keyboard_layout_matches_the_byte_exposed_by_openrazer(self) -> None:
+        probe = _probe(self.keyboard_profile, "get_keyboard_layout")
+        direct_request = canonical_request(probe, 0xFF)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((6, 0x80)))
+        receiver_response = _response(receiver_request, bytes((6, 0x00)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=13))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.keyboard_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        routed = next(
+            value for value in evidence["observations"] if value["origin"] == "receiver-route"
+        )
+        self.assertEqual(routed["response"]["summary"]["layout_code"], 6)
+        self.assertTrue(routed["receiver_comparison"]["semantic_parity"])
+
+    def test_parser_rejects_unmatched_or_nonstandard_reports(self) -> None:
+        with TemporaryDirectory() as directory:
+            capture = Path(directory) / "capture.txt"
+            capture.write_text(
+                "ffff 1 S Co:3:011:0 s 21 09 0300 0000 005a 90 = 0000000000000000\n"
+            )
+            with self.assertRaisesRegex(ModelError, "unmatched"):
+                parse_usbmon_capture(capture)
+
+    def test_writer_rederives_claims_and_rejects_symlink_cache_roots(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        request = canonical_request(probe, 0x1F)
+        response = _response(request, bytes((2, 51)))
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            direct.write_text(_capture(request, response, device=12))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+            forged = deepcopy(evidence)
+            forged["conclusion"] = "passed"
+            with self.assertRaisesRegex(ModelError, "conclusion differs"):
+                write_parity_evidence(forged, cache_root=root / "cache")
+
+            real = root / "real-cache"
+            real.mkdir()
+            linked = root / "linked-cache"
+            linked.symlink_to(real, target_is_directory=True)
+            with self.assertRaisesRegex(ModelError, "symbolic link"):
+                write_parity_evidence(evidence, cache_root=linked)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 01db899..e5cf545 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -14,6 +14,8 @@
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
 from .native_control import write_native_method_inventory
+from .native_parity import build_offline_parity_evidence, write_parity_evidence
+from .native_probe import write_native_probe_catalog
 from .distribution_package import build_distribution_package
 from .github_sync import COMPONENTS as GITHUB_COMPONENTS
 from .github_sync import apply as apply_github
@@ -104,6 +106,18 @@ def _parser() -> argparse.ArgumentParser:
     knowledge_import.add_argument("--openrazer-source", required=True, type=Path)
     knowledge_import.add_argument("--openrgb-source", required=True, type=Path)
 
+    native = commands.add_parser(
+        "native", help="inspect source-bound native receiver qualification evidence"
+    )
+    native_commands = native.add_subparsers(dest="native_command", required=True)
+    parity = native_commands.add_parser(
+        "parity", help="sanitize existing direct and receiver usbmon captures"
+    )
+    parity.add_argument("--profile", required=True)
+    parity.add_argument("--direct-capture", required=True, type=Path)
+    parity.add_argument("--receiver-capture", type=Path)
+    parity.add_argument("--receiver-result", type=Path)
+
     upstream = commands.add_parser("upstream", help="manage immutable upstream checkouts")
     upstream_commands = upstream.add_subparsers(dest="upstream_command", required=True)
     upstream_prepare = upstream_commands.add_parser(
@@ -260,6 +274,13 @@ def main(arguments: list[str] | None = None) -> int:
                 "Imported OpenRazer native control: "
                 f"{native_destination.relative_to(root)}"
             )
+            probe_destination = write_native_probe_catalog(
+                root, args.source.resolve()
+            )
+            print(
+                "Imported OpenRazer native probes: "
+                f"{probe_destination.relative_to(root)}"
+            )
             return 0
         if args.command == "knowledge":
             paths = import_upstream_catalogs(
@@ -270,6 +291,26 @@ def main(arguments: list[str] | None = None) -> int:
             for path in paths:
                 print(f"Generated {path.relative_to(root)}")
             return 0
+        if args.command == "native":
+            if args.native_command == "parity":
+                evidence = build_offline_parity_evidence(
+                    root,
+                    profile_id=args.profile,
+                    direct_capture=args.direct_capture,
+                    receiver_capture=args.receiver_capture,
+                    receiver_result=args.receiver_result,
+                )
+                destination = write_parity_evidence(evidence)
+                coverage = evidence["coverage"]
+                print(f"Native transport parity: {evidence['conclusion']}")
+                print(
+                    "Coverage: "
+                    f"{len(coverage['passed'])} passed, "
+                    f"{len(coverage['missing'])} incomplete, "
+                    f"{len(coverage['failed'])} failed"
+                )
+                print(f"Privacy-safe evidence: {destination}")
+                return 0
         if args.command == "upstream":
             prepared = prepare_upstreams(root, args.output)
             for identifier in prepared.fetched:
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
new file mode 100644
index 0000000..4f481bc
--- /dev/null
+++ b/tools/hfxdev/native_parity.py
@@ -0,0 +1,924 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import UTC, datetime
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import secrets
+import stat
+import subprocess
+from typing import Any
+
+from .model import ModelError, sha256_file
+from .native_probe import REPORT_SIZE, load_native_probe_catalog
+
+
+EVIDENCE_SCHEMA = "hyperflux-native-transport-parity-evidence-v1"
+USBMON_LIMIT_BYTES = 16 * 1024 * 1024
+USBMON_LIMIT_LINES = 65536
+PIPE_PATTERN = re.compile(r"C[oi]:(?P<bus>[0-9]+):(?P<device>[0-9]+):(?P<endpoint>[0-9]+)\Z")
+SHA256_PATTERN = re.compile(r"[0-9a-f]{64}\Z")
+SOURCE_REVISION_PATTERN = re.compile(r"[0-9a-f]{40}\Z")
+METHOD_PATTERN = re.compile(r"[a-z][a-z0-9_]{0,127}\Z")
+PROFILE_PATTERN = re.compile(r"child\.[a-z0-9.-]+\Z")
+SUCCESS_STATUS = 2
+COMPARISONS = {"exact-semantic", "domain-valid", "redacted-equality"}
+
+
+@dataclass(frozen=True)
+class UsbmonExchange:
+    timestamp_us: int
+    bus: int
+    device: int
+    interface: int
+    request: bytes
+    request_length: int
+    response: bytes
+    response_length: int
+
+
+@dataclass(frozen=True)
+class MatchedExchange:
+    method: str
+    probe: dict[str, Any]
+    exchange: UsbmonExchange
+    canonical_request: bytes
+    request_complete: bool
+    request_exact: bool | None
+    response_structural: bool
+    response_complete: bool
+    summary: dict[str, Any]
+    semantic_value: Any
+    serial_value: bytes | None
+
+
+def _bounded_int(value: Any, minimum: int, maximum: int) -> bool:
+    return (
+        isinstance(value, int)
+        and not isinstance(value, bool)
+        and minimum <= value <= maximum
+    )
+
+
+def _read_bounded_text(path: Path) -> str:
+    candidate = path.expanduser()
+    if candidate.is_symlink():
+        raise ModelError("native parity input may not be a symbolic link")
+    try:
+        metadata = candidate.stat()
+    except OSError as error:
+        raise ModelError(f"cannot inspect native parity input: {error}") from error
+    if not stat.S_ISREG(metadata.st_mode):
+        raise ModelError("native parity input must be a regular file")
+    if metadata.st_size > USBMON_LIMIT_BYTES:
+        raise ModelError("native parity input exceeds the bounded size limit")
+    try:
+        return candidate.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as error:
+        raise ModelError(f"cannot read native parity input: {error}") from error
+
+
+def _pipe_identity(value: str) -> tuple[int, int, int] | None:
+    match = PIPE_PATTERN.fullmatch(value)
+    if match is None:
+        return None
+    return tuple(int(match.group(name)) for name in ("bus", "device", "endpoint"))
+
+
+def _payload(tokens: list[str]) -> bytes:
+    try:
+        marker = tokens.index("=")
+    except ValueError:
+        return b""
+    chunks: list[str] = []
+    for token in tokens[marker + 1 :]:
+        if re.fullmatch(r"[0-9a-fA-F]+", token) is None or len(token) % 2:
+            break
+        chunks.append(token)
+    try:
+        value = bytes.fromhex("".join(chunks))
+    except ValueError as error:
+        raise ModelError("usbmon capture contains malformed hexadecimal payload") from error
+    if len(value) > REPORT_SIZE:
+        raise ModelError("usbmon capture contains an oversized Razer report")
+    return value
+
+
+def parse_usbmon_capture(path: Path) -> tuple[UsbmonExchange, ...]:
+    lines = _read_bounded_text(path).splitlines()
+    if len(lines) > USBMON_LIMIT_LINES:
+        raise ModelError("usbmon capture exceeds the bounded line limit")
+    pending: dict[tuple[int, int], list[tuple[int, int, bytes, int]]] = {}
+    exchanges: list[UsbmonExchange] = []
+    for line_number, line in enumerate(lines, start=1):
+        tokens = line.split()
+        if len(tokens) < 4:
+            continue
+        identity = _pipe_identity(tokens[3])
+        if identity is None:
+            continue
+        bus, device, _endpoint = identity
+        try:
+            timestamp_us = int(tokens[1])
+        except ValueError as error:
+            raise ModelError(f"usbmon line {line_number} has an invalid timestamp") from error
+
+        if tokens[2] == "S" and tokens[3].startswith("Co:"):
+            if len(tokens) < 11 or tokens[4] != "s":
+                continue
+            try:
+                request_type = int(tokens[5], 16)
+                request_id = int(tokens[6], 16)
+                value = int(tokens[7], 16)
+                interface = int(tokens[8], 16)
+                setup_length = int(tokens[9], 16)
+                report_length = int(tokens[10], 10)
+            except ValueError as error:
+                raise ModelError(f"usbmon line {line_number} has invalid control setup") from error
+            if (
+                request_type != 0x21
+                or request_id != 0x09
+                or value != 0x0300
+                or setup_length != REPORT_SIZE
+                or report_length != REPORT_SIZE
+            ):
+                continue
+            request = _payload(tokens)
+            if len(request) < 8:
+                raise ModelError("usbmon Razer request prefix is shorter than its header")
+            pending.setdefault((bus, device), []).append(
+                (timestamp_us, interface, request, report_length)
+            )
+            continue
+
+        if tokens[2] != "C" or not tokens[3].startswith("Ci:"):
+            continue
+        response = _payload(tokens)
+        if not response:
+            continue
+        queue = pending.get((bus, device))
+        if not queue:
+            raise ModelError("usbmon response has no preceding standard Razer request")
+        request_timestamp, interface, request, request_length = queue.pop(0)
+        try:
+            response_length = int(tokens[5], 10)
+        except (IndexError, ValueError) as error:
+            raise ModelError(f"usbmon line {line_number} has invalid response length") from error
+        if response_length != REPORT_SIZE or len(response) < 8:
+            raise ModelError("usbmon response is not a standard 90-byte Razer report")
+        exchanges.append(
+            UsbmonExchange(
+                timestamp_us=request_timestamp,
+                bus=bus,
+                device=device,
+                interface=interface,
+                request=request,
+                request_length=request_length,
+                response=response,
+                response_length=response_length,
+            )
+        )
+    if any(queue for queue in pending.values()):
+        raise ModelError("usbmon capture ends with an unmatched Razer request")
+    return tuple(exchanges)
+
+
+def _base_request(probe: dict[str, Any]) -> bytearray:
+    request = probe["request"]
+    report = bytearray(REPORT_SIZE)
+    report[5] = request["data_size"]
+    report[6] = request["command_class"]
+    report[7] = request["command_id"]
+    arguments = bytes(request["arguments"])
+    report[8 : 8 + len(arguments)] = arguments
+    return report
+
+
+def _report_crc(report: bytes | bytearray) -> int:
+    value = 0
+    for byte in report[2:88]:
+        value ^= byte
+    return value
+
+
+def canonical_request(probe: dict[str, Any], transaction_id: int) -> bytes:
+    if not 0 <= transaction_id <= 255:
+        raise ModelError("Razer transaction identifier is outside one byte")
+    report = _base_request(probe)
+    report[1] = transaction_id
+    report[88] = _report_crc(report)
+    return bytes(report)
+
+
+def _request_matches_signature(probe: dict[str, Any], request: bytes) -> bool:
+    if len(request) < 8 or request[0] != 0:
+        return False
+    canonical = canonical_request(probe, request[1])
+    semantic_end = min(len(request), 8 + canonical[5])
+    return request[5:semantic_end] == canonical[5:semantic_end]
+
+
+def _response_is_structural(request: bytes, response: bytes) -> bool:
+    if len(request) < 8 or len(response) < 8:
+        return False
+    if response[1] != request[1] or response[2:4] != request[2:4]:
+        return False
+    if response[6] != request[6] or response[7] != request[7]:
+        return False
+    if len(response) == REPORT_SIZE and response[88] != _report_crc(response):
+        return False
+    return True
+
+
+def _response_arguments(response: bytes) -> bytes:
+    if len(response) < 8:
+        return b""
+    data_size = min(response[5], 80)
+    return response[8 : min(len(response), 8 + data_size)]
+
+
+def _semantic_summary(
+    summary_kind: str,
+    response: bytes,
+) -> tuple[dict[str, Any], Any, bytes | None]:
+    arguments = _response_arguments(response)
+    expected = response[5] if len(response) >= 6 else 0
+    complete_arguments = len(arguments) == expected
+    summary: dict[str, Any] = {"kind": summary_kind}
+
+    if summary_kind == "redacted-serial-equality":
+        summary["redacted"] = True
+        summary["available"] = complete_arguments
+        return summary, None, bytes(arguments) if complete_arguments else None
+
+    value: Any = None
+    if summary_kind == "firmware-version" and len(arguments) >= 2:
+        value = (arguments[0], arguments[1])
+        summary.update({"major": value[0], "minor": value[1]})
+    elif summary_kind == "battery-u8" and arguments:
+        raw = arguments[-1]
+        value = raw
+        summary.update({"raw_level": raw, "percent_floor": raw * 100 // 255})
+    elif summary_kind in {"boolean-u8", "led-state", "led-effect", "u8-value"} and arguments:
+        value = arguments[-1]
+        summary["value"] = value
+        if summary_kind == "boolean-u8":
+            summary["enabled"] = bool(value)
+    elif summary_kind == "be16-seconds" and len(arguments) >= 2:
+        value = int.from_bytes(arguments[:2], "big")
+        summary["seconds"] = value
+    elif summary_kind == "device-mode" and len(arguments) >= 2:
+        value = (arguments[0], arguments[1])
+        summary.update({"mode": value[0], "parameter": value[1]})
+    elif summary_kind == "dpi-xy" and len(arguments) >= 5:
+        value = (
+            int.from_bytes(arguments[1:3], "big"),
+            int.from_bytes(arguments[3:5], "big"),
+        )
+        summary.update({"x": value[0], "y": value[1]})
+    elif summary_kind == "dpi-stages" and len(arguments) >= 3:
+        active, count = arguments[1], arguments[2]
+        required = count * 7 + 1
+        value = (active, count) if len(arguments) >= required else None
+        summary.update(
+            {
+                "active_stage": active,
+                "stage_count": count,
+                "complete_stage_table": len(arguments) >= required,
+            }
+        )
+    elif summary_kind == "keyboard-layout" and len(arguments) >= 2:
+        value = arguments[0]
+        summary["layout_code"] = value
+    elif summary_kind == "polling-rate-code" and arguments:
+        value = arguments[0]
+        rate = {1: 1000, 2: 500, 3: 125}.get(value)
+        summary.update({"code": value, "hertz": rate})
+    summary["available"] = value is not None
+    return summary, value, None
+
+
+def _profile(catalog: dict[str, Any], profile_id: str) -> dict[str, Any]:
+    matches = [value for value in catalog["devices"] if value["profile_id"] == profile_id]
+    if len(matches) != 1:
+        raise ModelError(f"unknown OpenRazer native parity profile: {profile_id}")
+    return matches[0]
+
+
+def _match_exchanges(
+    profile: dict[str, Any],
+    exchanges: tuple[UsbmonExchange, ...],
+) -> dict[str, list[MatchedExchange]]:
+    matched: dict[str, list[MatchedExchange]] = {}
+    for exchange in exchanges:
+        candidates = [
+            probe
+            for probe in profile["probes"]
+            if _request_matches_signature(probe, exchange.request)
+        ]
+        if not candidates:
+            continue
+        if len(candidates) != 1:
+            raise ModelError("captured Razer request is ambiguous in the source-bound catalog")
+        probe = candidates[0]
+        request_complete = len(exchange.request) == REPORT_SIZE
+        canonical = canonical_request(probe, exchange.request[1])
+        request_exact = exchange.request == canonical if request_complete else None
+        response_complete = len(exchange.response) == REPORT_SIZE
+        response_structural = _response_is_structural(exchange.request, exchange.response)
+        summary, semantic, serial = _semantic_summary(
+            probe["response_summary"], exchange.response
+        )
+        item = MatchedExchange(
+            method=probe["method"],
+            probe=probe,
+            exchange=exchange,
+            canonical_request=canonical,
+            request_complete=request_complete,
+            request_exact=request_exact,
+            response_structural=response_structural,
+            response_complete=response_complete,
+            summary=summary,
+            semantic_value=semantic,
+            serial_value=serial,
+        )
+        matched.setdefault(item.method, []).append(item)
+    return matched
+
+
+def _request_evidence(item: MatchedExchange) -> dict[str, Any]:
+    request = item.probe["request"]
+    observed = item.exchange.request if item.request_complete else item.canonical_request
+    return {
+        "sha256": hashlib.sha256(observed).hexdigest(),
+        "command_class": request["command_class"],
+        "command_id": request["command_id"],
+        "data_size": request["data_size"],
+        "upstream_signature_matched": True,
+        "complete_capture": item.request_complete,
+        "reconstructed_from_upstream": not item.request_complete,
+    }
+
+
+def _direct_observation(item: MatchedExchange) -> dict[str, Any]:
+    return {
+        "method": item.method,
+        "origin": "direct-semantic-reference",
+        "comparison": item.probe["comparison"],
+        "request": _request_evidence(item),
+        "response": {
+            "status": item.exchange.response[0],
+            "structural_match": item.response_structural,
+            "complete_capture": item.response_complete,
+            "summary": item.summary,
+        },
+        "receiver_comparison": {
+            "attempts": 0,
+            "unchanged_request": None,
+            "standard_response": None,
+            "semantic_parity": None,
+        },
+    }
+
+
+def _receiver_observation(
+    items: list[MatchedExchange],
+    direct: MatchedExchange | None,
+    maximum_attempts: int,
+) -> dict[str, Any]:
+    if not items:
+        raise ModelError("receiver parity observation requires at least one exchange")
+    if len(items) > maximum_attempts:
+        raise ModelError("receiver Busy retry count exceeds the read-only policy")
+    final = items[-1]
+    for earlier in items[:-1]:
+        if earlier.exchange.response[0] != 1:
+            raise ModelError("receiver retry sequence contains a non-Busy intermediate response")
+    request_states = {item.request_exact for item in items}
+    unchanged: bool | None
+    if False in request_states:
+        unchanged = False
+    elif request_states == {True}:
+        unchanged = True
+    else:
+        unchanged = None
+
+    standard: bool | None
+    if final.response_complete:
+        standard = final.response_structural and final.exchange.response[0] == SUCCESS_STATUS
+    else:
+        standard = None
+
+    semantic_parity: bool | None = None
+    if direct is not None:
+        comparison = final.probe["comparison"]
+        if comparison == "redacted-equality":
+            if final.serial_value is not None and direct.serial_value is not None:
+                semantic_parity = secrets.compare_digest(
+                    final.serial_value, direct.serial_value
+                )
+        elif comparison == "domain-valid":
+            semantic_parity = (
+                final.semantic_value is not None and direct.semantic_value is not None
+            )
+        elif final.semantic_value is not None and direct.semantic_value is not None:
+            semantic_parity = final.semantic_value == direct.semantic_value
+
+    return {
+        "method": final.method,
+        "origin": "receiver-route",
+        "comparison": final.probe["comparison"],
+        "request": _request_evidence(final),
+        "response": {
+            "status": final.exchange.response[0],
+            "structural_match": final.response_structural,
+            "complete_capture": final.response_complete,
+            "summary": final.summary,
+        },
+        "receiver_comparison": {
+            "attempts": len(items),
+            "unchanged_request": unchanged,
+            "standard_response": standard,
+            "semantic_parity": semantic_parity,
+        },
+    }
+
+
+def _apply_legacy_firmware_result(
+    observation: dict[str, Any],
+    path: Path,
+    kind: str,
+    maximum_attempts: int,
+) -> None:
+    value = json.loads(_read_bounded_text(path))
+    if value.get("schema") != "hyperflux-transport-parity-probe-v1":
+        raise ModelError("unsupported legacy parity result schema")
+    if value.get("operation") != "read-firmware-bounded-retry" or value.get("target") != kind:
+        raise ModelError("legacy parity result does not describe this firmware probe")
+    if value.get("settings_changed") is not False or value.get("network_upload") is not False:
+        raise ModelError("legacy parity result crosses the read-only privacy boundary")
+    attempts = value.get("attempts")
+    if not isinstance(attempts, list) or not 1 <= len(attempts) <= maximum_attempts:
+        raise ModelError("legacy parity result has an invalid retry count")
+    final = attempts[-1]
+    firmware = value.get("final_firmware")
+    if (
+        not isinstance(final, dict)
+        or not isinstance(firmware, dict)
+        or not isinstance(firmware.get("major"), int)
+        or not isinstance(firmware.get("minor"), int)
+    ):
+        raise ModelError("legacy parity result lacks a bounded firmware summary")
+    observation["response"] = {
+        "status": final.get("status", 0),
+        "structural_match": final.get("structural_match") is True,
+        "complete_capture": True,
+        "summary": {
+            "kind": "firmware-version",
+            "major": firmware["major"],
+            "minor": firmware["minor"],
+            "available": True,
+        },
+    }
+    comparison = observation["receiver_comparison"]
+    comparison["attempts"] = len(attempts)
+    comparison["standard_response"] = (
+        value.get("passed") is True
+        and final.get("status") == SUCCESS_STATUS
+        and final.get("structural_match") is True
+    )
+    comparison["semantic_parity"] = value.get("matches_direct") is True
+
+
+def _git_revision(root: Path) -> str:
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=root,
+            check=True,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=10,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot bind native parity evidence to source: {error}") from error
+    revision = result.stdout.strip()
+    if SOURCE_REVISION_PATTERN.fullmatch(revision) is None:
+        raise ModelError("native parity source revision is not an exact commit")
+    return revision
+
+
+def build_offline_parity_evidence(
+    root: Path,
+    *,
+    profile_id: str,
+    direct_capture: Path,
+    receiver_capture: Path | None = None,
+    receiver_result: Path | None = None,
+    created_at: str | None = None,
+    source_revision: str | None = None,
+) -> dict[str, Any]:
+    catalog = load_native_probe_catalog(root)
+    profile = _profile(catalog, profile_id)
+    direct_matches = _match_exchanges(profile, parse_usbmon_capture(direct_capture))
+    receiver_matches = (
+        _match_exchanges(profile, parse_usbmon_capture(receiver_capture))
+        if receiver_capture is not None
+        else {}
+    )
+    maximum_attempts = catalog["busy_retry"]["maximum_attempts"]
+    observations: list[dict[str, Any]] = []
+    receiver_observations: dict[str, dict[str, Any]] = {}
+    required = [probe["method"] for probe in profile["probes"]]
+    for method in required:
+        direct_items = direct_matches.get(method, [])
+        direct = direct_items[-1] if direct_items else None
+        if direct is not None:
+            observations.append(_direct_observation(direct))
+        routed = receiver_matches.get(method, [])
+        if routed:
+            receiver = _receiver_observation(routed, direct, maximum_attempts)
+            receiver_observations[method] = receiver
+            observations.append(receiver)
+
+    if receiver_result is not None:
+        firmware = receiver_observations.get("get_firmware")
+        if firmware is None:
+            raise ModelError("legacy receiver result has no matching captured firmware request")
+        _apply_legacy_firmware_result(
+            firmware,
+            receiver_result,
+            profile["wireless_identity"]["device_kind"],
+            maximum_attempts,
+        )
+
+    passed: list[str] = []
+    failed: list[str] = []
+    for method in required:
+        receiver = receiver_observations.get(method)
+        if receiver is None:
+            continue
+        comparison = receiver["receiver_comparison"]
+        values = (
+            comparison["unchanged_request"],
+            comparison["standard_response"],
+            comparison["semantic_parity"],
+        )
+        if all(value is True for value in values):
+            passed.append(method)
+        elif any(value is False for value in values):
+            failed.append(method)
+    missing = [method for method in required if method not in passed and method not in failed]
+    conclusion = "passed" if not missing and not failed else "incomplete"
+    if any(
+        observation["receiver_comparison"][field] is False
+        for observation in receiver_observations.values()
+        for field in ("unchanged_request", "standard_response")
+    ):
+        conclusion = "backend-required"
+
+    timestamp = created_at or datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    revision = source_revision or _git_revision(root)
+    if SOURCE_REVISION_PATTERN.fullmatch(revision) is None:
+        raise ModelError("native parity evidence source revision is invalid")
+    evidence = {
+        "$schema": "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json",
+        "schema": EVIDENCE_SCHEMA,
+        "created_at": timestamp,
+        "source_revision": revision,
+        "profile_id": profile_id,
+        "upstream_commit": catalog["upstream"]["commit"],
+        "catalog_sha256": sha256_file(
+            root / "integrations" / "openrazer" / "native-probe-catalog.json"
+        ),
+        "safety": {
+            "read_only": True,
+            "settings_changed": False,
+            "serials_persisted": False,
+            "raw_reports_persisted": False,
+            "private_paths_persisted": False,
+            "network_upload": False,
+            "file_mode": "0600",
+        },
+        "observations": observations,
+        "coverage": {
+            "required": required,
+            "passed": passed,
+            "missing": missing,
+            "failed": failed,
+        },
+        "conclusion": conclusion,
+    }
+    validate_parity_evidence(evidence)
+    return evidence
+
+
+def validate_parity_evidence(value: dict[str, Any]) -> None:
+    def exact_keys(item: dict[str, Any], expected: set[str], label: str) -> None:
+        missing_keys = sorted(expected - set(item))
+        extra_keys = sorted(set(item) - expected)
+        if missing_keys:
+            raise ModelError(f"{label}: missing keys: {', '.join(missing_keys)}")
+        if extra_keys:
+            raise ModelError(f"{label}: unsupported keys: {', '.join(extra_keys)}")
+
+    if not isinstance(value, dict):
+        raise ModelError("native parity evidence must be an object")
+    exact_keys(
+        value,
+        {
+            "$schema",
+            "schema",
+            "created_at",
+            "source_revision",
+            "profile_id",
+            "upstream_commit",
+            "catalog_sha256",
+            "safety",
+            "observations",
+            "coverage",
+            "conclusion",
+        },
+        "native parity evidence",
+    )
+    if value["$schema"] != "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json":
+        raise ModelError("native parity evidence schema reference is not canonical")
+    if value.get("schema") != EVIDENCE_SCHEMA:
+        raise ModelError("unsupported native transport parity evidence schema")
+    created_at = value.get("created_at")
+    if not isinstance(created_at, str) or not created_at.endswith("Z"):
+        raise ModelError("native parity evidence timestamp is not canonical UTC")
+    try:
+        datetime.fromisoformat(created_at.removesuffix("Z") + "+00:00")
+    except ValueError as error:
+        raise ModelError("native parity evidence timestamp is invalid") from error
+    profile_id = value.get("profile_id")
+    if not isinstance(profile_id, str) or PROFILE_PATTERN.fullmatch(profile_id) is None:
+        raise ModelError("native parity evidence profile identifier is invalid")
+    upstream_commit = value.get("upstream_commit")
+    if (
+        not isinstance(upstream_commit, str)
+        or SOURCE_REVISION_PATTERN.fullmatch(upstream_commit) is None
+    ):
+        raise ModelError("native parity evidence upstream commit is invalid")
+    if not isinstance(value.get("safety"), dict):
+        raise ModelError("native parity evidence safety declaration is missing")
+    if value.get("safety") != {
+        "read_only": True,
+        "settings_changed": False,
+        "serials_persisted": False,
+        "raw_reports_persisted": False,
+        "private_paths_persisted": False,
+        "network_upload": False,
+        "file_mode": "0600",
+    }:
+        raise ModelError("native parity evidence safety declaration is invalid")
+    source_revision = value.get("source_revision")
+    if (
+        not isinstance(source_revision, str)
+        or SOURCE_REVISION_PATTERN.fullmatch(source_revision) is None
+    ):
+        raise ModelError("native parity evidence source revision is invalid")
+    catalog_sha256 = value.get("catalog_sha256")
+    if (
+        not isinstance(catalog_sha256, str)
+        or SHA256_PATTERN.fullmatch(catalog_sha256) is None
+    ):
+        raise ModelError("native parity evidence catalog binding is invalid")
+    coverage = value.get("coverage")
+    if not isinstance(coverage, dict):
+        raise ModelError("native parity evidence coverage is missing")
+    exact_keys(
+        coverage,
+        {"required", "passed", "missing", "failed"},
+        "native parity evidence coverage",
+    )
+    required = coverage.get("required")
+    passed = coverage.get("passed")
+    missing = coverage.get("missing")
+    failed = coverage.get("failed")
+    if not all(isinstance(item, list) for item in (required, passed, missing, failed)):
+        raise ModelError("native parity evidence coverage is malformed")
+    for label, methods in (
+        ("required", required),
+        ("passed", passed),
+        ("missing", missing),
+        ("failed", failed),
+    ):
+        if (
+            len(methods) > 128
+            or len(methods) != len(set(methods))
+            or any(not isinstance(method, str) or METHOD_PATTERN.fullmatch(method) is None for method in methods)
+        ):
+            raise ModelError(f"native parity evidence {label} methods are invalid")
+        if methods != [method for method in required if method in set(methods)]:
+            raise ModelError(f"native parity evidence {label} methods are out of order")
+    if set(required) != set(passed) | set(missing) | set(failed):
+        raise ModelError("native parity evidence coverage is not exhaustive")
+    if set(passed) & set(missing) or set(passed) & set(failed) or set(missing) & set(failed):
+        raise ModelError("native parity evidence coverage overlaps")
+
+    observations = value.get("observations")
+    if not isinstance(observations, list) or len(observations) > 256:
+        raise ModelError("native parity evidence observations are not bounded")
+    routed: dict[str, dict[str, Any]] = {}
+    seen: set[tuple[str, str]] = set()
+    for index, observation in enumerate(observations):
+        label = f"native parity observation {index}"
+        if not isinstance(observation, dict):
+            raise ModelError(f"{label}: expected an object")
+        exact_keys(
+            observation,
+            {"method", "origin", "comparison", "request", "response", "receiver_comparison"},
+            label,
+        )
+        method = observation["method"]
+        origin = observation["origin"]
+        if method not in required or origin not in {
+            "direct-semantic-reference",
+            "receiver-route",
+        }:
+            raise ModelError(f"{label}: invalid method or origin")
+        if observation["comparison"] not in COMPARISONS:
+            raise ModelError(f"{label}: invalid comparison policy")
+        identity = (method, origin)
+        if identity in seen:
+            raise ModelError(f"{label}: duplicate method origin")
+        seen.add(identity)
+
+        request = observation["request"]
+        response = observation["response"]
+        comparison = observation["receiver_comparison"]
+        if not all(isinstance(item, dict) for item in (request, response, comparison)):
+            raise ModelError(f"{label}: malformed request, response, or comparison")
+        exact_keys(
+            request,
+            {
+                "sha256",
+                "command_class",
+                "command_id",
+                "data_size",
+                "upstream_signature_matched",
+                "complete_capture",
+                "reconstructed_from_upstream",
+            },
+            f"{label} request",
+        )
+        if (
+            not isinstance(request.get("sha256"), str)
+            or SHA256_PATTERN.fullmatch(request["sha256"]) is None
+            or not _bounded_int(request.get("command_class"), 0, 255)
+            or not _bounded_int(request.get("command_id"), 128, 255)
+            or not _bounded_int(request.get("data_size"), 0, 80)
+            or request.get("upstream_signature_matched") is not True
+            or not isinstance(request.get("complete_capture"), bool)
+            or not isinstance(request.get("reconstructed_from_upstream"), bool)
+            or request["complete_capture"] == request["reconstructed_from_upstream"]
+        ):
+            raise ModelError(f"{label}: invalid request evidence")
+        exact_keys(
+            response,
+            {"status", "structural_match", "complete_capture", "summary"},
+            f"{label} response",
+        )
+        if (
+            not _bounded_int(response.get("status"), 0, 255)
+            or not isinstance(response.get("structural_match"), bool)
+            or not isinstance(response.get("complete_capture"), bool)
+            or not isinstance(response.get("summary"), dict)
+        ):
+            raise ModelError(f"{label}: invalid response evidence")
+        exact_keys(
+            comparison,
+            {"attempts", "unchanged_request", "standard_response", "semantic_parity"},
+            f"{label} comparison",
+        )
+        attempts = comparison["attempts"]
+        states = tuple(
+            comparison[field]
+            for field in ("unchanged_request", "standard_response", "semantic_parity")
+        )
+        if (
+            not _bounded_int(attempts, 0, 8)
+            or any(state is not None and not isinstance(state, bool) for state in states)
+        ):
+            raise ModelError(f"{label}: invalid receiver comparison")
+        if origin == "direct-semantic-reference":
+            if attempts != 0 or states != (None, None, None):
+                raise ModelError(f"{label}: direct evidence claims a receiver outcome")
+        else:
+            if not 1 <= attempts <= 8:
+                raise ModelError(f"{label}: receiver attempts exceed the evidence bound")
+            routed[method] = observation
+
+    derived_passed: list[str] = []
+    derived_failed: list[str] = []
+    backend_required = False
+    for method in required:
+        observation = routed.get(method)
+        if observation is None:
+            continue
+        comparison = observation["receiver_comparison"]
+        states = tuple(
+            comparison[field]
+            for field in ("unchanged_request", "standard_response", "semantic_parity")
+        )
+        if all(state is True for state in states):
+            derived_passed.append(method)
+        elif any(state is False for state in states):
+            derived_failed.append(method)
+        if comparison["unchanged_request"] is False or comparison["standard_response"] is False:
+            backend_required = True
+    derived_missing = [
+        method
+        for method in required
+        if method not in derived_passed and method not in derived_failed
+    ]
+    if (passed, missing, failed) != (derived_passed, derived_missing, derived_failed):
+        raise ModelError("native parity evidence coverage differs from its observations")
+    expected_conclusion = (
+        "backend-required"
+        if backend_required
+        else "passed"
+        if not missing and not failed
+        else "incomplete"
+    )
+    if value.get("conclusion") != expected_conclusion:
+        raise ModelError("native parity evidence conclusion differs from its observations")
+    serialized = json.dumps(value, sort_keys=True, ensure_ascii=True)
+    if "/home/" in serialized:
+        raise ModelError("native parity evidence contains a private path")
+    forbidden_keys = {"serial", "serial_value", "raw_report", "request_bytes", "response_bytes"}
+
+    def walk(item: Any) -> None:
+        if isinstance(item, dict):
+            if forbidden_keys & set(item):
+                raise ModelError("native parity evidence contains forbidden raw material")
+            for child in item.values():
+                walk(child)
+        elif isinstance(item, list):
+            for child in item:
+                walk(child)
+
+    walk(value)
+
+
+def _default_cache_root() -> Path:
+    xdg = os.environ.get("XDG_CACHE_HOME")
+    base = Path(xdg).expanduser() if xdg else Path.home() / ".cache"
+    return base / "hyperflux-next" / "native-transport-parity"
+
+
+def write_parity_evidence(
+    value: dict[str, Any],
+    *,
+    cache_root: Path | None = None,
+) -> Path:
+    validate_parity_evidence(value)
+    base_value = cache_root if cache_root is not None else _default_cache_root()
+    if base_value.exists() and base_value.is_symlink():
+        raise ModelError("native parity cache root may not be a symbolic link")
+    base = base_value.expanduser().resolve()
+    base.mkdir(parents=True, mode=0o700, exist_ok=True)
+    try:
+        base.chmod(0o700)
+    except OSError as error:
+        raise ModelError(f"cannot secure native parity cache root: {error}") from error
+    stamp = re.sub(r"[^0-9TZ]", "", value["created_at"])
+    profile = re.sub(r"[^a-z0-9.-]", "-", value["profile_id"])
+    destination = base / f"{stamp}-{profile}.json"
+    if destination.exists() or destination.is_symlink():
+        raise ModelError("native parity evidence destination already exists")
+    temporary = base / f".{destination.name}.{secrets.token_hex(8)}.tmp"
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    payload = (json.dumps(value, indent=2, ensure_ascii=True) + "\n").encode()
+    descriptor = -1
+    try:
+        descriptor = os.open(temporary, flags, 0o600)
+        with os.fdopen(descriptor, "wb", closefd=True) as output:
+            descriptor = -1
+            output.write(payload)
+            output.flush()
+            os.fsync(output.fileno())
+        os.replace(temporary, destination)
+        destination.chmod(0o600)
+        directory = os.open(base, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory)
+        finally:
+            os.close(directory)
+    except OSError as error:
+        raise ModelError(f"cannot write native parity evidence: {error}") from error
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        temporary.unlink(missing_ok=True)
+    return destination
diff --git a/tools/hfxdev/native_probe.py b/tools/hfxdev/native_probe.py
new file mode 100644
index 0000000..aa96ee1
--- /dev/null
+++ b/tools/hfxdev/native_probe.py
@@ -0,0 +1,749 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from copy import deepcopy
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import subprocess
+from tempfile import TemporaryDirectory
+from typing import Any
+
+from .integrations import upstream_index
+from .model import ModelError, load_json, require_unique, sha256_file
+from .native_control import (
+    load_native_control_policy,
+    load_native_method_inventory,
+)
+from .openrazer import _source_commit
+
+
+POLICY_SCHEMA = "hyperflux-openrazer-native-probe-policy-v1"
+CATALOG_SCHEMA = "hyperflux-openrazer-native-probe-catalog-v1"
+REPORT_SIZE = 90
+METHOD_PATTERN = re.compile(r"[a-z][a-z0-9_]{0,127}\Z")
+FUNCTION_PATTERN = re.compile(r"razer_attr_read_[a-z0-9_]+\Z")
+EXPRESSION_PATTERN = re.compile(
+    r"(?P<function>razer_chroma_[a-z0-9_]+|get_razer_report)"
+    r"\((?P<arguments>[A-Z0-9_x, ]*)\)\Z"
+)
+SHA256_PATTERN = re.compile(r"[0-9a-f]{64}\Z")
+
+POLICY_KEYS = {
+    "$schema",
+    "schema",
+    "upstream_id",
+    "source_commit",
+    "report_size",
+    "busy_retry",
+    "bindings",
+}
+BINDING_KEYS = {
+    "method",
+    "device_kinds",
+    "driver_attribute",
+    "request_owner",
+    "request_expression",
+    "response_summary",
+    "comparison",
+}
+CATALOG_KEYS = {
+    "$schema",
+    "schema",
+    "upstream",
+    "policy_sha256",
+    "inventory_sha256",
+    "report_size",
+    "busy_retry",
+    "source_files",
+    "devices",
+}
+DEVICE_KEYS = {
+    "profile_id",
+    "wireless_identity",
+    "direct_usb_reference",
+    "probes",
+}
+PROBE_KEYS = {
+    "method",
+    "privacy",
+    "driver",
+    "request",
+    "response_summary",
+    "comparison",
+}
+DRIVER_KEYS = {
+    "attribute",
+    "source_path",
+    "reader",
+    "request_owner",
+    "source_line",
+    "source_sha256",
+}
+REQUEST_KEYS = {
+    "command_class",
+    "command_id",
+    "data_size",
+    "arguments",
+    "normalized_sha256",
+    "transaction_id_from_upstream",
+    "crc_recomputed_by_upstream",
+}
+SUMMARY_KINDS = {
+    "battery-u8",
+    "be16-seconds",
+    "boolean-u8",
+    "device-mode",
+    "dpi-stages",
+    "dpi-xy",
+    "firmware-version",
+    "keyboard-layout",
+    "led-effect",
+    "led-state",
+    "polling-rate-code",
+    "redacted-serial-equality",
+    "u8-value",
+}
+COMPARISON_KINDS = {"exact-semantic", "domain-valid", "redacted-equality"}
+DRIVER_SOURCES = {
+    "keyboard": "driver/razerkbd_driver.c",
+    "mouse": "driver/razermouse_driver.c",
+}
+
+
+def _canonical_bytes(value: Any) -> bytes:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def _digest(value: Any) -> str:
+    return hashlib.sha256(_canonical_bytes(value)).hexdigest()
+
+
+def _bounded_int(value: Any, minimum: int, maximum: int) -> bool:
+    return (
+        isinstance(value, int)
+        and not isinstance(value, bool)
+        and minimum <= value <= maximum
+    )
+
+
+def _exact_keys(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - set(value))
+    extras = sorted(set(value) - expected)
+    if missing:
+        raise ModelError(f"{label}: missing keys: {', '.join(missing)}")
+    if extras:
+        raise ModelError(f"{label}: unsupported keys: {', '.join(extras)}")
+
+
+def _policy_digest(policy: dict[str, Any]) -> str:
+    return _digest({key: value for key, value in policy.items() if key != "$schema"})
+
+
+def _inventory_digest(inventory: dict[str, Any]) -> str:
+    return _digest({key: value for key, value in inventory.items() if key != "$schema"})
+
+
+def load_native_probe_policy(root: Path) -> dict[str, Any]:
+    policy = load_json(root / "integrations" / "openrazer" / "native-probe-policy.json")
+    _exact_keys(policy, POLICY_KEYS, "OpenRazer native probe policy")
+    if policy["$schema"] != "../../schemas/openrazer-native-probe-policy.schema.json":
+        raise ModelError("OpenRazer native probe policy schema reference is not canonical")
+    if policy["schema"] != POLICY_SCHEMA:
+        raise ModelError("unsupported OpenRazer native probe policy schema")
+
+    upstream = upstream_index(root).get(policy["upstream_id"])
+    if upstream is None or upstream["id"] != "openrazer":
+        raise ModelError("OpenRazer native probe policy names an unknown upstream")
+    if policy["source_commit"] != upstream["commit"]:
+        raise ModelError("OpenRazer native probe policy differs from the upstream pin")
+    if policy["report_size"] != REPORT_SIZE:
+        raise ModelError("OpenRazer native probes require exact 90-byte reports")
+
+    busy = policy["busy_retry"]
+    if not isinstance(busy, dict):
+        raise ModelError("OpenRazer native probe Busy policy must be an object")
+    _exact_keys(busy, {"status", "maximum_attempts"}, "OpenRazer Busy policy")
+    if busy["status"] != 1 or not _bounded_int(busy["maximum_attempts"], 1, 8):
+        raise ModelError("OpenRazer native probe Busy policy is invalid")
+
+    native_policy = load_native_control_policy(root)
+    inventory = load_native_method_inventory(root)
+    read_only = set(native_policy["classifications"]["read_only"])
+    expected_by_kind: dict[str, set[str]] = {"keyboard": set(), "mouse": set()}
+    for device in inventory["devices"]:
+        expected_by_kind[device["wireless_identity"]["device_kind"]].update(
+            device["qualification_probes"]
+        )
+
+    bindings = policy["bindings"]
+    if not isinstance(bindings, list) or not bindings or len(bindings) > 128:
+        raise ModelError("OpenRazer native probe bindings must be a bounded list")
+    methods: list[str] = []
+    covered_by_kind: dict[str, set[str]] = {"keyboard": set(), "mouse": set()}
+    for index, binding in enumerate(bindings):
+        label = f"OpenRazer native probe binding {index}"
+        if not isinstance(binding, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(binding, BINDING_KEYS, label)
+        method = binding["method"]
+        if not isinstance(method, str) or METHOD_PATTERN.fullmatch(method) is None:
+            raise ModelError(f"{label}: invalid method")
+        if method not in read_only:
+            raise ModelError(f"{label}: method is not classified read-only")
+        kinds = binding["device_kinds"]
+        if (
+            not isinstance(kinds, list)
+            or not kinds
+            or len(kinds) > 2
+            or any(kind not in {"keyboard", "mouse"} for kind in kinds)
+        ):
+            raise ModelError(f"{label}: invalid device kinds")
+        require_unique(kinds, f"{label} device kind")
+        if kinds != sorted(kinds):
+            raise ModelError(f"{label}: device kinds must be sorted")
+        attribute = binding["driver_attribute"]
+        owner = binding["request_owner"]
+        expression = binding["request_expression"]
+        if (
+            not isinstance(attribute, str)
+            or METHOD_PATTERN.fullmatch(attribute) is None
+            or not isinstance(owner, str)
+            or FUNCTION_PATTERN.fullmatch(owner) is None
+            or not isinstance(expression, str)
+            or EXPRESSION_PATTERN.fullmatch(expression) is None
+            or binding["response_summary"] not in SUMMARY_KINDS
+            or binding["comparison"] not in COMPARISON_KINDS
+        ):
+            raise ModelError(f"{label}: invalid source binding")
+        if (method == "get_serial") != (binding["comparison"] == "redacted-equality"):
+            raise ModelError(f"{label}: serial comparison policy is invalid")
+        if binding["comparison"] == "domain-valid" and method not in {
+            "get_battery",
+            "is_charging",
+        }:
+            raise ModelError(f"{label}: dynamic comparison is not approved for this method")
+        for kind in kinds:
+            if method not in expected_by_kind[kind]:
+                raise ModelError(f"{label}: method is not a qualification probe for {kind}")
+            covered_by_kind[kind].add(method)
+        methods.append(method)
+    require_unique(methods, "OpenRazer native probe method")
+    if methods != sorted(methods):
+        raise ModelError("OpenRazer native probe bindings must be sorted")
+    if covered_by_kind != expected_by_kind:
+        details = []
+        for kind in ("keyboard", "mouse"):
+            missing = sorted(expected_by_kind[kind] - covered_by_kind[kind])
+            extra = sorted(covered_by_kind[kind] - expected_by_kind[kind])
+            if missing:
+                details.append(f"{kind} missing: {', '.join(missing)}")
+            if extra:
+                details.append(f"{kind} extra: {', '.join(extra)}")
+        raise ModelError("OpenRazer native probe coverage drift: " + "; ".join(details))
+    return policy
+
+
+def _skip_c_quoted(source: str, index: int, quote: str) -> int:
+    index += 1
+    while index < len(source):
+        if source[index] == "\\":
+            index += 2
+            continue
+        if source[index] == quote:
+            return index + 1
+        index += 1
+    raise ModelError("unterminated quoted string in pinned OpenRazer source")
+
+
+def _c_function(source: str, name: str) -> tuple[str, int]:
+    pattern = re.compile(
+        rf"(?m)^(?:static\s+)?(?:ssize_t|struct\s+razer_report)\s+{re.escape(name)}\s*\("
+    )
+    match = pattern.search(source)
+    if match is None:
+        raise ModelError(f"pinned OpenRazer source lacks function {name}")
+    brace = source.find("{", match.end())
+    if brace < 0:
+        raise ModelError(f"pinned OpenRazer function {name} has no body")
+    depth = 0
+    index = brace
+    while index < len(source):
+        if source.startswith("//", index):
+            newline = source.find("\n", index + 2)
+            index = len(source) if newline < 0 else newline + 1
+            continue
+        if source.startswith("/*", index):
+            end = source.find("*/", index + 2)
+            if end < 0:
+                raise ModelError(f"unterminated comment in OpenRazer function {name}")
+            index = end + 2
+            continue
+        character = source[index]
+        if character in {'"', "'"}:
+            index = _skip_c_quoted(source, index, character)
+            continue
+        if character == "{":
+            depth += 1
+        elif character == "}":
+            depth -= 1
+            if depth == 0:
+                end = index + 1
+                return source[match.start() : end], source.count("\n", 0, match.start()) + 1
+        index += 1
+    raise ModelError(f"unterminated OpenRazer function {name}")
+
+
+def _device_attribute_readers(source: str) -> dict[str, str]:
+    pattern = re.compile(
+        r"(?m)^static\s+DEVICE_ATTR\(\s*(?P<attribute>[a-z0-9_]+)\s*,"
+        r"\s*[0-7]+\s*,\s*(?P<reader>razer_attr_read_[a-z0-9_]+|NULL)\s*,"
+    )
+    readers: dict[str, str] = {}
+    for match in pattern.finditer(source):
+        attribute, reader = match.group("attribute"), match.group("reader")
+        if attribute in readers:
+            raise ModelError(f"duplicate OpenRazer driver attribute {attribute}")
+        if reader != "NULL":
+            readers[attribute] = reader
+    return readers
+
+
+def _simple_defines(source: str) -> dict[str, int]:
+    values: dict[str, int] = {}
+    pattern = re.compile(
+        r"(?m)^#define\s+(?P<name>[A-Z][A-Z0-9_]*)\s+(?P<value>0x[0-9A-Fa-f]+|[0-9]+)\s*(?://.*)?$"
+    )
+    for match in pattern.finditer(source):
+        values[match.group("name")] = int(match.group("value"), 0)
+    return values
+
+
+def _expression_function(expression: str) -> str:
+    match = EXPRESSION_PATTERN.fullmatch(expression)
+    if match is None:
+        raise ModelError(f"unsafe OpenRazer request expression: {expression}")
+    return match.group("function")
+
+
+def _compile_report_expressions(
+    source_root: Path,
+    expressions: list[str],
+) -> dict[str, bytes]:
+    chroma_path = source_root / "driver" / "razerchromacommon.c"
+    common_header = (source_root / "driver" / "razercommon.h").read_text(encoding="utf-8")
+    chroma_source = chroma_path.read_text(encoding="utf-8")
+    constants = _simple_defines(common_header)
+    required_constants = sorted(
+        {
+            token
+            for expression in expressions
+            for token in re.findall(r"\b[A-Z][A-Z0-9_]*\b", expression)
+        }
+    )
+    missing_constants = [name for name in required_constants if name not in constants]
+    if missing_constants:
+        raise ModelError(
+            "OpenRazer request expressions use unknown constants: "
+            + ", ".join(missing_constants)
+        )
+
+    functions = sorted(
+        {
+            _expression_function(expression)
+            for expression in expressions
+            if _expression_function(expression) != "get_razer_report"
+        }
+    )
+    function_sources = [_c_function(chroma_source, name)[0] for name in functions]
+    constant_lines = "\n".join(
+        f"#define {name} {constants[name]}" for name in required_constants
+    )
+    emit_lines = []
+    for expression in expressions:
+        emit_lines.append(
+            "    report = " + expression + ";\n"
+            "    for(size_t index = 0; index < sizeof(report); ++index)\n"
+            "        printf(\"%02x\", ((const unsigned char*)&report)[index]);\n"
+            "    putchar('\\n');"
+        )
+    harness = f"""
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <string.h>
+
+typedef uint8_t u8;
+typedef uint16_t __be16;
+union transaction_id_union {{
+    u8 id;
+    struct {{ u8 device : 3; u8 id : 5; }} parts;
+}};
+union command_id_union {{
+    u8 id;
+    struct {{ u8 direction : 1; u8 id : 7; }} parts;
+}};
+struct razer_report {{
+    u8 status;
+    union transaction_id_union transaction_id;
+    __be16 remaining_packets;
+    u8 protocol_type;
+    u8 data_size;
+    u8 command_class;
+    union command_id_union command_id;
+    u8 arguments[80];
+    u8 crc;
+    u8 reserved;
+}};
+_Static_assert(sizeof(struct razer_report) == 90, "unexpected report layout");
+{constant_lines}
+
+struct razer_report get_razer_report(unsigned char command_class,
+                                     unsigned char command_id,
+                                     unsigned char data_size)
+{{
+    struct razer_report report = {{0}};
+    report.command_class = command_class;
+    report.command_id.id = command_id;
+    report.data_size = data_size;
+    return report;
+}}
+
+{os.linesep.join(function_sources)}
+
+int main(void)
+{{
+    struct razer_report report;
+{os.linesep.join(emit_lines)}
+    return 0;
+}}
+"""
+    compiler = os.environ.get("CC", "cc")
+    with TemporaryDirectory(prefix="hyperflux-openrazer-probe-") as directory:
+        executable = Path(directory) / "probe"
+        try:
+            compiled = subprocess.run(
+                [compiler, "-x", "c", "-std=c11", "-Wall", "-Wextra", "-Werror", "-o", str(executable), "-"],
+                input=harness,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                check=False,
+                timeout=30,
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot compile pinned OpenRazer probe constructors: {error}") from error
+        if compiled.returncode != 0:
+            raise ModelError(
+                "pinned OpenRazer probe constructor compilation failed: "
+                + compiled.stderr.strip()
+            )
+        try:
+            rendered = subprocess.run(
+                [str(executable)],
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                check=False,
+                timeout=10,
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot execute pinned OpenRazer probe constructors: {error}") from error
+        if rendered.returncode != 0 or rendered.stderr:
+            raise ModelError("pinned OpenRazer probe constructor harness failed")
+    lines = rendered.stdout.splitlines()
+    if len(lines) != len(expressions):
+        raise ModelError("pinned OpenRazer probe constructor output is incomplete")
+    reports: dict[str, bytes] = {}
+    for expression, line in zip(expressions, lines, strict=True):
+        try:
+            report = bytes.fromhex(line)
+        except ValueError as error:
+            raise ModelError("pinned OpenRazer probe constructor emitted invalid hex") from error
+        if len(report) != REPORT_SIZE:
+            raise ModelError("pinned OpenRazer probe constructor emitted a non-90-byte report")
+        reports[expression] = report
+    return reports
+
+
+def _identity_projection(value: dict[str, Any]) -> dict[str, Any]:
+    return {
+        key: value[key]
+        for key in (
+            "vendor_id",
+            "product_id",
+            "model_name",
+            "device_kind",
+            "transport_variant",
+        )
+    }
+
+
+def transformed_native_probe_catalog(root: Path, source_root: Path) -> dict[str, Any]:
+    source_root = source_root.resolve()
+    policy = load_native_probe_policy(root)
+    inventory = load_native_method_inventory(root)
+    if _source_commit(source_root) != policy["source_commit"]:
+        raise ModelError("OpenRazer native probe checkout does not match the immutable pin")
+
+    bindings = {value["method"]: value for value in policy["bindings"]}
+    expressions = sorted({value["request_expression"] for value in policy["bindings"]})
+    reports = _compile_report_expressions(source_root, expressions)
+    source_cache: dict[str, str] = {}
+    reader_cache: dict[str, dict[str, str]] = {}
+    devices: list[dict[str, Any]] = []
+
+    for device in inventory["devices"]:
+        kind = device["wireless_identity"]["device_kind"]
+        source_path = DRIVER_SOURCES[kind]
+        if source_path not in source_cache:
+            source_cache[source_path] = (source_root / source_path).read_text(
+                encoding="utf-8"
+            )
+        source = source_cache[source_path]
+        readers = reader_cache.setdefault(source_path, _device_attribute_readers(source))
+        probes: list[dict[str, Any]] = []
+        methods = {value["id"]: value for value in device["methods"]}
+        for method in device["qualification_probes"]:
+            binding = bindings[method]
+            if kind not in binding["device_kinds"]:
+                raise ModelError(f"OpenRazer probe {method} is not bound for {kind}")
+            attribute = binding["driver_attribute"]
+            reader = readers.get(attribute)
+            if reader is None:
+                raise ModelError(f"OpenRazer driver lacks readable attribute {attribute}")
+            reader_source, _ = _c_function(source, reader)
+            owner = binding["request_owner"]
+            owner_source, owner_line = _c_function(source, owner)
+            if reader != owner and owner not in reader_source:
+                raise ModelError(
+                    f"OpenRazer attribute {attribute} does not delegate to {owner}"
+                )
+            constructor = _expression_function(binding["request_expression"])
+            if constructor not in owner_source:
+                raise ModelError(
+                    f"OpenRazer request owner {owner} does not use {constructor}"
+                )
+            report = reports[binding["request_expression"]]
+            data_size = report[5]
+            if report[0] != 0 or report[1] != 0 or report[4] != 0 or report[89] != 0:
+                raise ModelError(f"OpenRazer constructor for {method} has an invalid request header")
+            if report[7] < 0x80 or data_size > 80:
+                raise ModelError(f"OpenRazer qualification probe {method} is not a read command")
+            probes.append(
+                {
+                    "method": method,
+                    "privacy": methods[method]["privacy"],
+                    "driver": {
+                        "attribute": attribute,
+                        "source_path": source_path,
+                        "reader": reader,
+                        "request_owner": owner,
+                        "source_line": owner_line,
+                        "source_sha256": hashlib.sha256(owner_source.encode()).hexdigest(),
+                    },
+                    "request": {
+                        "command_class": report[6],
+                        "command_id": report[7],
+                        "data_size": data_size,
+                        "arguments": list(report[8 : 8 + data_size]),
+                        "normalized_sha256": hashlib.sha256(report).hexdigest(),
+                        "transaction_id_from_upstream": True,
+                        "crc_recomputed_by_upstream": True,
+                    },
+                    "response_summary": binding["response_summary"],
+                    "comparison": binding["comparison"],
+                }
+            )
+        devices.append(
+            {
+                "profile_id": device["profile_id"],
+                "wireless_identity": _identity_projection(device["wireless_identity"]),
+                "direct_usb_reference": _identity_projection(device["direct_usb_reference"]),
+                "probes": probes,
+            }
+        )
+
+    upstream = upstream_index(root)["openrazer"]
+    relevant_paths = sorted(
+        {
+            "driver/razercommon.h",
+            "driver/razerchromacommon.c",
+            *DRIVER_SOURCES.values(),
+        }
+    )
+    return {
+        "$schema": "../../schemas/openrazer-native-probe-catalog.schema.json",
+        "schema": CATALOG_SCHEMA,
+        "upstream": {
+            key: upstream[key]
+            for key in ("id", "repository", "version", "commit", "license_expression")
+        },
+        "policy_sha256": _policy_digest(policy),
+        "inventory_sha256": _inventory_digest(inventory),
+        "report_size": REPORT_SIZE,
+        "busy_retry": deepcopy(policy["busy_retry"]),
+        "source_files": [
+            {"path": path, "sha256": sha256_file(source_root / path)}
+            for path in relevant_paths
+        ],
+        "devices": devices,
+    }
+
+
+def load_native_probe_catalog(root: Path) -> dict[str, Any]:
+    catalog = load_json(root / "integrations" / "openrazer" / "native-probe-catalog.json")
+    _exact_keys(catalog, CATALOG_KEYS, "OpenRazer native probe catalog")
+    if catalog["$schema"] != "../../schemas/openrazer-native-probe-catalog.schema.json":
+        raise ModelError("OpenRazer native probe catalog schema reference is not canonical")
+    if catalog["schema"] != CATALOG_SCHEMA:
+        raise ModelError("unsupported OpenRazer native probe catalog schema")
+    policy = load_native_probe_policy(root)
+    inventory = load_native_method_inventory(root)
+    upstream = upstream_index(root)["openrazer"]
+    expected_upstream = {
+        key: upstream[key]
+        for key in ("id", "repository", "version", "commit", "license_expression")
+    }
+    if catalog["upstream"] != expected_upstream:
+        raise ModelError("OpenRazer native probe catalog upstream binding has drifted")
+    if catalog["policy_sha256"] != _policy_digest(policy):
+        raise ModelError("OpenRazer native probe catalog policy is stale")
+    if catalog["inventory_sha256"] != _inventory_digest(inventory):
+        raise ModelError("OpenRazer native probe catalog inventory is stale")
+    if catalog["report_size"] != REPORT_SIZE or catalog["busy_retry"] != policy["busy_retry"]:
+        raise ModelError("OpenRazer native probe catalog transport policy has drifted")
+
+    source_paths: list[str] = []
+    for index, source in enumerate(catalog["source_files"]):
+        label = f"OpenRazer native probe source {index}"
+        if not isinstance(source, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(source, {"path", "sha256"}, label)
+        path = source["path"]
+        if (
+            not isinstance(path, str)
+            or Path(path).is_absolute()
+            or ".." in Path(path).parts
+            or not isinstance(source["sha256"], str)
+            or SHA256_PATTERN.fullmatch(source["sha256"]) is None
+        ):
+            raise ModelError(f"{label}: invalid source binding")
+        source_paths.append(path)
+    require_unique(source_paths, "OpenRazer native probe source path")
+    expected_source_paths = sorted(
+        {
+            "driver/razercommon.h",
+            "driver/razerchromacommon.c",
+            *DRIVER_SOURCES.values(),
+        }
+    )
+    if source_paths != expected_source_paths:
+        raise ModelError("OpenRazer native probe source set has drifted")
+
+    inventory_devices = {value["profile_id"]: value for value in inventory["devices"]}
+    bindings = {value["method"]: value for value in policy["bindings"]}
+    if not isinstance(catalog["devices"], list) or not 1 <= len(catalog["devices"]) <= 128:
+        raise ModelError("OpenRazer native probe devices must be a bounded list")
+    profile_ids: list[str] = []
+    for index, device in enumerate(catalog["devices"]):
+        label = f"OpenRazer native probe device {index}"
+        if not isinstance(device, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(device, DEVICE_KEYS, label)
+        profile_id = device["profile_id"]
+        expected = inventory_devices.get(profile_id)
+        if expected is None:
+            raise ModelError(f"{label}: unknown profile")
+        if device["wireless_identity"] != _identity_projection(expected["wireless_identity"]):
+            raise ModelError(f"{label}: wireless identity has drifted")
+        if device["direct_usb_reference"] != _identity_projection(expected["direct_usb_reference"]):
+            raise ModelError(f"{label}: direct USB reference has drifted")
+        expected_methods = expected["qualification_probes"]
+        actual_methods: list[str] = []
+        signatures: list[tuple[Any, ...]] = []
+        method_records = {value["id"]: value for value in expected["methods"]}
+        for probe_index, probe in enumerate(device["probes"]):
+            probe_label = f"{label} probe {probe_index}"
+            if not isinstance(probe, dict):
+                raise ModelError(f"{probe_label}: expected an object")
+            _exact_keys(probe, PROBE_KEYS, probe_label)
+            method = probe["method"]
+            binding = bindings.get(method)
+            if binding is None:
+                raise ModelError(f"{probe_label}: unknown method")
+            if probe["privacy"] != method_records[method]["privacy"]:
+                raise ModelError(f"{probe_label}: privacy policy has drifted")
+            if probe["response_summary"] != binding["response_summary"]:
+                raise ModelError(f"{probe_label}: response summary has drifted")
+            if probe["comparison"] != binding["comparison"]:
+                raise ModelError(f"{probe_label}: comparison policy has drifted")
+            driver = probe["driver"]
+            request = probe["request"]
+            if not isinstance(driver, dict) or not isinstance(request, dict):
+                raise ModelError(f"{probe_label}: invalid source or request binding")
+            _exact_keys(driver, DRIVER_KEYS, f"{probe_label} driver")
+            _exact_keys(request, REQUEST_KEYS, f"{probe_label} request")
+            if (
+                driver["attribute"] != binding["driver_attribute"]
+                or driver["request_owner"] != binding["request_owner"]
+                or driver["source_path"] != DRIVER_SOURCES[expected["wireless_identity"]["device_kind"]]
+                or not isinstance(driver["reader"], str)
+                or FUNCTION_PATTERN.fullmatch(driver["reader"]) is None
+                or not _bounded_int(driver["source_line"], 1, 2**31 - 1)
+                or not isinstance(driver["source_sha256"], str)
+                or SHA256_PATTERN.fullmatch(driver["source_sha256"]) is None
+            ):
+                raise ModelError(f"{probe_label}: invalid driver binding")
+            arguments = request["arguments"]
+            if (
+                not _bounded_int(request["command_class"], 0, 0xFF)
+                or not _bounded_int(request["command_id"], 0x80, 0xFF)
+                or not _bounded_int(request["data_size"], 0, 80)
+                or not isinstance(arguments, list)
+                or len(arguments) != request["data_size"]
+                or any(not _bounded_int(value, 0, 255) for value in arguments)
+                or not isinstance(request["normalized_sha256"], str)
+                or SHA256_PATTERN.fullmatch(request["normalized_sha256"]) is None
+                or request["transaction_id_from_upstream"] is not True
+                or request["crc_recomputed_by_upstream"] is not True
+            ):
+                raise ModelError(f"{probe_label}: invalid request signature")
+            normalized = bytearray(REPORT_SIZE)
+            normalized[5] = request["data_size"]
+            normalized[6] = request["command_class"]
+            normalized[7] = request["command_id"]
+            normalized[8 : 8 + len(arguments)] = bytes(arguments)
+            if hashlib.sha256(normalized).hexdigest() != request["normalized_sha256"]:
+                raise ModelError(f"{probe_label}: normalized request digest has drifted")
+            signatures.append(
+                (
+                    request["command_class"],
+                    request["command_id"],
+                    request["data_size"],
+                    tuple(arguments),
+                )
+            )
+            actual_methods.append(method)
+        require_unique(actual_methods, f"{label} method")
+        require_unique(signatures, f"{label} request signature")
+        if actual_methods != expected_methods:
+            raise ModelError(f"{label}: qualification probe order has drifted")
+        profile_ids.append(profile_id)
+    require_unique(profile_ids, "OpenRazer native probe profile")
+    if profile_ids != sorted(inventory_devices):
+        raise ModelError("OpenRazer native probe catalog does not cover the exact selection")
+    return catalog
+
+
+def write_native_probe_catalog(root: Path, source_root: Path) -> Path:
+    destination = root / "integrations" / "openrazer" / "native-probe-catalog.json"
+    value = transformed_native_probe_catalog(root, source_root)
+    destination.write_text(
+        json.dumps(value, indent=2, ensure_ascii=True) + "\n",
+        encoding="utf-8",
+    )
+    return destination
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index ee6fdc6..94f6ee3 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -31,6 +31,11 @@
     load_native_method_inventory,
     transformed_native_inventory,
 )
+from .native_probe import (
+    load_native_probe_catalog,
+    load_native_probe_policy,
+    transformed_native_probe_catalog,
+)
 from .openrazer import (
     extract_openrazer_catalog,
     load_imported_metadata,
@@ -175,6 +180,8 @@ def _check_integration_contract(root: Path) -> None:
     load_imported_metadata(root)
     load_native_control_policy(root)
     load_native_method_inventory(root)
+    load_native_probe_policy(root)
+    load_native_probe_catalog(root)
 
 
 def _tool_environment(root: Path) -> dict[str, str]:
@@ -622,6 +629,13 @@ def _run_openrazer_metadata_contracts(root: Path, _node: TestNode) -> None:
             "committed OpenRazer native method inventory is stale; "
             "rerun ./hfx import openrazer"
         )
+    expected_probes = transformed_native_probe_catalog(root, source)
+    actual_probes = load_native_probe_catalog(root)
+    if actual_probes != expected_probes:
+        raise ModelError(
+            "committed OpenRazer native probe catalog is stale; "
+            "rerun ./hfx import openrazer"
+        )
 
 
 def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
diff --git a/verification/tests.json b/verification/tests.json
index 7bd509a..61867dc 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -49,7 +49,7 @@
       "timeout_seconds": 10,
       "dependencies": ["schema-contracts"],
       "isolation": "shared",
-      "cache_inputs": ["integrations/**/*.json", "schemas/integration-catalog.schema.json", "schemas/openrazer-native-*.schema.json", "tools/hfxdev/integrations.py", "tools/hfxdev/native_control.py", "tools/hfxdev/openrazer.py"],
+      "cache_inputs": ["integrations/**/*.json", "schemas/integration-catalog.schema.json", "schemas/native-transport-parity-evidence.schema.json", "schemas/openrazer-native-*.schema.json", "tools/hfxdev/integrations.py", "tools/hfxdev/native_control.py", "tools/hfxdev/native_parity.py", "tools/hfxdev/native_probe.py", "tools/hfxdev/openrazer.py"],
       "produced_evidence": ["integration-contract-result"],
       "resume_policy": "reuse-verified"
     },
@@ -157,7 +157,7 @@
       "timeout_seconds": 30,
       "dependencies": ["integration-contracts", "profile-contracts"],
       "isolation": "exclusive-process",
-      "cache_inputs": ["integrations/openrazer/*.json", "profiles/children/*.json", "schemas/imported-device-metadata.schema.json", "schemas/openrazer-native-*.schema.json", "schemas/upstream-metadata-import.schema.json", "tools/hfxdev/native_control.py", "tools/hfxdev/openrazer.py"],
+      "cache_inputs": ["integrations/openrazer/*.json", "profiles/children/*.json", "schemas/imported-device-metadata.schema.json", "schemas/openrazer-native-*.schema.json", "schemas/upstream-metadata-import.schema.json", "tools/hfxdev/native_control.py", "tools/hfxdev/native_probe.py", "tools/hfxdev/openrazer.py"],
       "produced_evidence": ["openrazer-metadata-result"],
       "resume_policy": "rerun"
     },

From 6598d19e876f10a7e677f3a2e236ebb6ed104af7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 13:16:26 +0400
Subject: [PATCH 40/67] feat: add source-bound OpenRazer native relay

---
 Cargo.lock                                    |  16 +
 Cargo.toml                                    |   2 +-
 assurance/generated/hyperflux-next.spdx.json  |  75 ++-
 assurance/performance-budgets.json            |  14 +
 crates/hfx-errors/src/generated.rs            | 164 ++++--
 crates/hfx-integration-model/src/lib.rs       |   2 +
 .../src/openrazer_native_generated.rs         |   9 +
 crates/hfx-ops/Cargo.toml                     |   1 +
 crates/hfx-ops/src/activation.rs              |  53 +-
 crates/hfx-ops/src/assessment.rs              |  75 ++-
 .../src/bin/hyperflux-next-activate.rs        |  45 +-
 crates/hfx-ops/src/lib.rs                     |   5 +-
 crates/hfx-ops/src/probe.rs                   | 118 +++-
 crates/hfx-ops/src/qualification.rs           |   8 +
 crates/hfx-ops/src/support.rs                 |  12 +-
 crates/hfx-uhid-relay/Cargo.toml              |  25 +
 crates/hfx-uhid-relay/src/bridge.rs           | 294 ++++++++++
 crates/hfx-uhid-relay/src/catalog.rs          | 278 +++++++++
 crates/hfx-uhid-relay/src/endpoint.rs         | 300 ++++++++++
 crates/hfx-uhid-relay/src/lib.rs              |  28 +
 crates/hfx-uhid-relay/src/main.rs             | 160 ++++++
 crates/hfx-uhid-relay/src/runtime.rs          | 301 ++++++++++
 crates/hfx-uhid-relay/src/supervisor.rs       | 524 +++++++++++++++++
 crates/hfx-uhid-relay/src/uhid.rs             | 326 +++++++++++
 docs/assets/social-preview.png                | Bin 9679 -> 9685 bytes
 docs/generated/distributions.md               |   8 +-
 docs/generated/error-catalog.md               |  30 +-
 docs/generated/installation.md                |  15 +-
 docs/generated/openrazer-native-deployment.md |  26 +
 docs/generated/performance-budgets.md         |  10 +-
 docs/generated/supply-chain.md                |   4 +-
 docs/generated/verification.md                |  10 +-
 errors/catalog.json                           |  26 +
 .../openrazer/native-route/catalog.json       |  45 ++
 .../openrazer/native-route/deployment.json    |  16 +
 ...usted-HyperFlux-native-HID-transport.patch | 538 ++++++++++++++++++
 .../openrazer/native-route/transform.json     |  35 ++
 packaging/distributions.json                  |  12 +-
 .../generated/hyperflux-next-bridge.service   |   4 +-
 .../hyperflux-next-openrazer-relay.service    |  47 ++
 packaging/generated/install-plan.json         |  83 ++-
 packaging/install.json                        |  35 +-
 schemas/distribution-packages.schema.json     |  14 +
 schemas/install-manifest.schema.json          |  25 +-
 .../openrazer-native-deployment.schema.json   |  53 ++
 ...openrazer-native-route-catalog.schema.json |  62 ++
 .../openrazer-native-transform.schema.json    |  46 ++
 schemas/package-build-manifest.schema.json    |  14 +-
 .../hyperflux/generated/error_catalog.hpp     | 127 +++--
 .../hyperflux_sdk/generated/error_catalog.py  | 126 ++--
 tests/test_distribution_debian.py             |   7 +-
 tests/test_install.py                         |   9 +-
 tests/test_package_pipeline.py                |  16 +-
 tools/hfxdev/cli.py                           |  16 +
 tools/hfxdev/distribution_debian.py           |  32 +-
 tools/hfxdev/distribution_package.py          |   4 +
 tools/hfxdev/distribution_rpm.py              |  46 +-
 tools/hfxdev/distributions.py                 |  21 +
 tools/hfxdev/generators/distributions.py      |   8 +
 tools/hfxdev/generators/install.py            |   5 +
 tools/hfxdev/generators/linux_runtime.py      |   9 +-
 tools/hfxdev/generators/openrazer_native.py   | 131 +++++
 tools/hfxdev/install.py                       |  92 ++-
 tools/hfxdev/openrazer_native_route.py        | 381 +++++++++++++
 tools/hfxdev/package_pipeline.py              | 213 ++++++-
 tools/hfxdev/render.py                        |  30 +-
 tools/hfxdev/testgraph.py                     |   1 +
 tools/hfxdev/verify.py                        | 103 +++-
 verification/tests.json                       |  26 +
 69 files changed, 5177 insertions(+), 219 deletions(-)
 create mode 100644 crates/hfx-integration-model/src/openrazer_native_generated.rs
 create mode 100644 crates/hfx-uhid-relay/Cargo.toml
 create mode 100644 crates/hfx-uhid-relay/src/bridge.rs
 create mode 100644 crates/hfx-uhid-relay/src/catalog.rs
 create mode 100644 crates/hfx-uhid-relay/src/endpoint.rs
 create mode 100644 crates/hfx-uhid-relay/src/lib.rs
 create mode 100644 crates/hfx-uhid-relay/src/main.rs
 create mode 100644 crates/hfx-uhid-relay/src/runtime.rs
 create mode 100644 crates/hfx-uhid-relay/src/supervisor.rs
 create mode 100644 crates/hfx-uhid-relay/src/uhid.rs
 create mode 100644 docs/generated/openrazer-native-deployment.md
 create mode 100644 integrations/openrazer/native-route/catalog.json
 create mode 100644 integrations/openrazer/native-route/deployment.json
 create mode 100644 integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
 create mode 100644 integrations/openrazer/native-route/transform.json
 create mode 100644 packaging/generated/hyperflux-next-openrazer-relay.service
 create mode 100644 schemas/openrazer-native-deployment.schema.json
 create mode 100644 schemas/openrazer-native-route-catalog.schema.json
 create mode 100644 schemas/openrazer-native-transform.schema.json
 create mode 100644 tools/hfxdev/generators/openrazer_native.py
 create mode 100644 tools/hfxdev/openrazer_native_route.py

diff --git a/Cargo.lock b/Cargo.lock
index dfd2657..f7870d5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -160,6 +160,7 @@ version = "0.0.0-dev.1"
 dependencies = [
  "hfx-domain",
  "hfx-errors",
+ "hfx-integration-model",
  "hfx-profiles",
  "hfx-protocol",
  "hfx-runtime",
@@ -218,6 +219,21 @@ dependencies = [
  "sha2",
 ]
 
+[[package]]
+name = "hfx-uhid-relay"
+version = "0.0.0-dev.1"
+dependencies = [
+ "hfx-domain",
+ "hfx-protocol",
+ "hfx-runtime",
+ "hfx-sdk",
+ "rustix",
+ "serde",
+ "serde_json",
+ "sha2",
+ "signal-hook",
+]
+
 [[package]]
 name = "hybrid-array"
 version = "0.4.10"
diff --git a/Cargo.toml b/Cargo.toml
index de4345c..a92b212 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-members = ["crates/hfx-bridge", "crates/hfx-core", "crates/hfx-daemon", "crates/hfx-domain", "crates/hfx-errors", "crates/hfx-integration-model", "crates/hfx-kernel-transport", "crates/hfx-ops", "crates/hfx-profiles", "crates/hfx-protocol", "crates/hfx-runtime", "crates/hfx-sdk", "crates/hfx-sim"]
+members = ["crates/hfx-bridge", "crates/hfx-core", "crates/hfx-daemon", "crates/hfx-domain", "crates/hfx-errors", "crates/hfx-integration-model", "crates/hfx-kernel-transport", "crates/hfx-ops", "crates/hfx-profiles", "crates/hfx-protocol", "crates/hfx-runtime", "crates/hfx-sdk", "crates/hfx-sim", "crates/hfx-uhid-relay"]
 resolver = "3"
 
 [workspace.package]
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 3ff4150..85ce3a1 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/92006b9561017382240993dd195de5c217e9e6fcc2e3614e6061698fd16b201d",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/27d52db25e0d72e5f52359a11aa5cfd97f1bc98f9b4800bc7c02c69b590a8754",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
@@ -441,6 +441,24 @@
       ],
       "comment": "HyperFlux workspace crate."
     },
+    {
+      "SPDXID": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "name": "hfx-uhid-relay",
+      "versionInfo": "0.0.0-dev.1",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "GPL-2.0-only",
+      "copyrightText": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:cargo/hfx-uhid-relay@0.0.0-dev.1"
+        }
+      ],
+      "comment": "HyperFlux workspace crate."
+    },
     {
       "SPDXID": "SPDXRef-Cargo-hybrid-array-0.4.10",
       "name": "hybrid-array",
@@ -1442,6 +1460,11 @@
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Cargo-hfx-errors-0.0.0-dev.1"
     },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-ops-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-integration-model-0.0.0-dev.1"
+    },
     {
       "spdxElementId": "SPDXRef-Cargo-hfx-ops-0.0.0-dev.1",
       "relationshipType": "DEPENDS_ON",
@@ -1572,6 +1595,51 @@
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Cargo-sha2-0.11.0"
     },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-domain-0.0.0-dev.1"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-protocol-0.0.0-dev.1"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-runtime-0.0.0-dev.1"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-sdk-0.0.0-dev.1"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-rustix-1.1.4"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-serde-1.0.229"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-serde-json-1.0.150"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-sha2-0.11.0"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-signal-hook-0.4.4"
+    },
     {
       "spdxElementId": "SPDXRef-Cargo-hybrid-array-0.4.10",
       "relationshipType": "DEPENDS_ON",
@@ -1827,6 +1895,11 @@
       "relationshipType": "CONTAINS",
       "relatedSpdxElement": "SPDXRef-Cargo-hfx-sim-0.0.0-dev.1"
     },
+    {
+      "spdxElementId": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1",
+      "relationshipType": "CONTAINS",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1"
+    },
     {
       "spdxElementId": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1",
       "relationshipType": "CONTAINS",
diff --git a/assurance/performance-budgets.json b/assurance/performance-budgets.json
index 72cabd8..fa86775 100644
--- a/assurance/performance-budgets.json
+++ b/assurance/performance-budgets.json
@@ -114,6 +114,20 @@
       "release_blocking": false,
       "rationale": "Upstream registry reuse must not silently turn the adapter into an oversized application fork."
     },
+    {
+      "id": "openrazer-native-relay-size",
+      "title": "OpenRazer native-route relay size",
+      "measurement_kind": "artifact-size",
+      "source": "packaging/install.json",
+      "selector": "openrazer-native-relay",
+      "unit": "bytes",
+      "maximum": 8000000,
+      "status": "enforced-software",
+      "sample_count": 1,
+      "warmup_count": 0,
+      "release_blocking": true,
+      "rationale": "The feature-only relay must remain a thin transport process rather than accumulating device semantics."
+    },
     {
       "id": "staged-payload-size",
       "title": "Canonical uncompressed installed payload size",
diff --git a/crates/hfx-errors/src/generated.rs b/crates/hfx-errors/src/generated.rs
index e8cf6e4..480c1b4 100644
--- a/crates/hfx-errors/src/generated.rs
+++ b/crates/hfx-errors/src/generated.rs
@@ -68,6 +68,7 @@ wire_enum!(ErrorCode {
     HfxIntegration001 => "HFX-INTEGRATION-001",
     HfxInternal001 => "HFX-INTERNAL-001",
     HfxKernel001 => "HFX-KERNEL-001",
+    HfxKernel002 => "HFX-KERNEL-002",
     HfxOutcome001 => "HFX-OUTCOME-001",
     HfxOutcome002 => "HFX-OUTCOME-002",
     HfxOwnership001 => "HFX-OWNERSHIP-001",
@@ -89,6 +90,7 @@ wire_enum!(ErrorCode {
 wire_enum!(RemediationId {
     AcquireNewLease => "acquire-new-lease",
     ActivateInstalledDriver => "activate-installed-driver",
+    ActivateOpenrazerRouteDriver => "activate-openrazer-route-driver",
     CollectSupportBundle => "collect-support-bundle",
     CorrectRequest => "correct-request",
     DisableUnsupportedFeature => "disable-unsupported-feature",
@@ -210,7 +212,7 @@ pub struct ErrorDescriptor {
 }
 
 pub const ERROR_CATALOG_SHA256: &str =
-    "dc21516800b761970c0e7c14a030424a56235610f3355f70f70259e2e4843e91";
+    "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066";
 pub const MAX_ERROR_COUNT: usize = 256;
 pub const MAX_REMEDIATION_COUNT: usize = 128;
 pub const MAX_SAFE_DETAIL_FIELDS: usize = 12;
@@ -231,6 +233,13 @@ pub const REMEDIATIONS: &[RemediationDescriptor] = &[
         verification: "Run Doctor and confirm the loaded and installed driver identities match.",
         automatic: false,
     },
+    RemediationDescriptor {
+        id: RemediationId::ActivateOpenrazerRouteDriver,
+        title: "Activate the OpenRazer route driver",
+        safe_action: "Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.",
+        verification: "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
+        automatic: false,
+    },
     RemediationDescriptor {
         id: RemediationId::CollectSupportBundle,
         title: "Collect a privacy-safe support bundle",
@@ -462,7 +471,40 @@ const DETAILS_4: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_5: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
+    SafeDetailFieldDescriptor {
+        name: "installed_abi",
+        kind: SafeDetailKind::Identifier,
+        required: true,
+        maximum_length: Some(64),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "Installed OpenRazer module source identity.",
+    },
+    SafeDetailFieldDescriptor {
+        name: "loaded_abi",
+        kind: SafeDetailKind::Identifier,
+        required: true,
+        maximum_length: Some(64),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "Loaded OpenRazer module source identity or activation state.",
+    },
+    SafeDetailFieldDescriptor {
+        name: "module",
+        kind: SafeDetailKind::Identifier,
+        required: true,
+        maximum_length: Some(64),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "OpenRazer native-route kernel module name.",
+    },
+];
+
+const DETAILS_6: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -473,7 +515,7 @@ const DETAILS_5: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction identity that has no retained or eviction record.",
 }];
 
-const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "history_capacity",
         kind: SafeDetailKind::U16,
@@ -496,7 +538,7 @@ const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "owner_name",
         kind: SafeDetailKind::Text,
@@ -519,9 +561,9 @@ const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_8_1: &[&str] = &["expired", "released", "revoked"];
+const DETAIL_VALUES_9_1: &[&str] = &["expired", "released", "revoked"];
 
-const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "lease_id",
         kind: SafeDetailKind::Identifier,
@@ -538,29 +580,29 @@ const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_8_1,
+        allowed_values: DETAIL_VALUES_9_1,
         privacy: PrivacyClass::Public,
         description: "Terminal lease state.",
     },
 ];
 
-const DETAIL_VALUES_9_0: &[&str] = &["load", "migrate", "validate"];
+const DETAIL_VALUES_10_0: &[&str] = &["load", "migrate", "validate"];
 
-const DETAIL_VALUES_9_1: &[&str] = &[
+const DETAIL_VALUES_10_1: &[&str] = &[
     "corrupt",
     "incompatible-schema",
     "missing",
     "permission-denied",
 ];
 
-const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_9_0,
+        allowed_values: DETAIL_VALUES_10_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-read phase.",
     },
@@ -570,24 +612,24 @@ const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_9_1,
+        allowed_values: DETAIL_VALUES_10_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAIL_VALUES_10_0: &[&str] = &["commit", "rollback", "snapshot"];
+const DETAIL_VALUES_11_0: &[&str] = &["commit", "rollback", "snapshot"];
 
-const DETAIL_VALUES_10_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
+const DETAIL_VALUES_11_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
 
-const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_10_0,
+        allowed_values: DETAIL_VALUES_11_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-write phase.",
     },
@@ -597,13 +639,13 @@ const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_10_1,
+        allowed_values: DETAIL_VALUES_11_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capability",
         kind: SafeDetailKind::Identifier,
@@ -626,7 +668,7 @@ const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "active_digest",
         kind: SafeDetailKind::Identifier,
@@ -659,7 +701,7 @@ const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "client_max_version",
         kind: SafeDetailKind::U16,
@@ -702,7 +744,7 @@ const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_14: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_15: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "feature",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -713,7 +755,7 @@ const DETAILS_14: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Requested protocol feature identifier.",
 }];
 
-const DETAIL_VALUES_15_1: &[&str] = &[
+const DETAIL_VALUES_16_1: &[&str] = &[
     "configuration",
     "diagnostics",
     "effects",
@@ -721,7 +763,7 @@ const DETAIL_VALUES_15_1: &[&str] = &[
     "restore",
 ];
 
-const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capacity",
         kind: SafeDetailKind::U16,
@@ -738,13 +780,13 @@ const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_15_1,
+        allowed_values: DETAIL_VALUES_16_1,
         privacy: PrivacyClass::Public,
         description: "Bounded queue that rejected admission.",
     },
 ];
 
-const DETAIL_VALUES_16_1: &[&str] = &[
+const DETAIL_VALUES_17_1: &[&str] = &[
     "duplicate",
     "missing",
     "out-of-range",
@@ -752,7 +794,7 @@ const DETAIL_VALUES_16_1: &[&str] = &[
     "unsupported",
 ];
 
-const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_17: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "field",
         kind: SafeDetailKind::Text,
@@ -769,7 +811,7 @@ const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_16_1,
+        allowed_values: DETAIL_VALUES_17_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized validation reason.",
     },
@@ -785,7 +827,7 @@ const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_17_0: &[&str] = &[
+const DETAIL_VALUES_18_0: &[&str] = &[
     "activating",
     "active-unready",
     "failed",
@@ -794,27 +836,27 @@ const DETAIL_VALUES_17_0: &[&str] = &[
     "unavailable",
 ];
 
-const DETAILS_17: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_18: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "service_state",
     kind: SafeDetailKind::Enum,
     required: true,
     maximum_length: None,
     maximum_value: None,
-    allowed_values: DETAIL_VALUES_17_0,
+    allowed_values: DETAIL_VALUES_18_0,
     privacy: PrivacyClass::Public,
     description: "Sanitized bridge service state.",
 }];
 
-const DETAIL_VALUES_18_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
+const DETAIL_VALUES_19_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
 
-const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "reason",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_18_0,
+        allowed_values: DETAIL_VALUES_19_0,
         privacy: PrivacyClass::Public,
         description: "Sanitized pre-dispatch failure reason.",
     },
@@ -830,7 +872,7 @@ const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_19: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_20: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -841,7 +883,7 @@ const DETAILS_19: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction whose transport outcome is uncertain.",
 }];
 
-const DETAILS_20: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "delivered_frames",
         kind: SafeDetailKind::U16,
@@ -975,6 +1017,26 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         privacy: PrivacyClass::Public,
         docs_path: "docs/generated/error-catalog.md#hfx-kernel-001",
     },
+    ErrorDescriptor {
+        code: ErrorCode::HfxKernel002,
+        error_class: ErrorClass::Kernel,
+        severity: ErrorSeverity::Error,
+        retry_policy: RetryPolicy::AfterRemediation,
+        side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
+        remediation_id: RemediationId::ActivateOpenrazerRouteDriver,
+        safe_detail_fields: DETAILS_5,
+        lifecycle: LifecycleDescriptor {
+            state: ErrorLifecycleState::Active,
+            introduced_in: "0.0.0-dev.1",
+            deprecated_in: None,
+            replacement_code: None,
+        },
+        owner: ErrorOwner::Packaging,
+        technical_cause: "A required OpenRazer native-route kernel module is missing or an older module remains active.",
+        user_explanation: "The OpenRazer route driver is not ready yet.",
+        privacy: PrivacyClass::Public,
+        docs_path: "docs/generated/error-catalog.md#hfx-kernel-002",
+    },
     ErrorDescriptor {
         code: ErrorCode::HfxOutcome001,
         error_class: ErrorClass::Outcome,
@@ -982,7 +1044,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_5,
+        safe_detail_fields: DETAILS_6,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1002,7 +1064,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_6,
+        safe_detail_fields: DETAILS_7,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1022,7 +1084,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::ReleaseOwner,
-        safe_detail_fields: DETAILS_7,
+        safe_detail_fields: DETAILS_8,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1042,7 +1104,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::AcquireNewLease,
-        safe_detail_fields: DETAILS_8,
+        safe_detail_fields: DETAILS_9,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1062,7 +1124,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_9,
+        safe_detail_fields: DETAILS_10,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1082,7 +1144,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_10,
+        safe_detail_fields: DETAILS_11,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1102,7 +1164,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::QualifyDevice,
-        safe_detail_fields: DETAILS_11,
+        safe_detail_fields: DETAILS_12,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1122,7 +1184,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::VerifyProfileCatalog,
-        safe_detail_fields: DETAILS_12,
+        safe_detail_fields: DETAILS_13,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1142,7 +1204,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::UpdateProtocolPeer,
-        safe_detail_fields: DETAILS_13,
+        safe_detail_fields: DETAILS_14,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1162,7 +1224,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::DisableUnsupportedFeature,
-        safe_detail_fields: DETAILS_14,
+        safe_detail_fields: DETAILS_15,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1182,7 +1244,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_15,
+        safe_detail_fields: DETAILS_16,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1202,7 +1264,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::CorrectRequest,
-        safe_detail_fields: DETAILS_16,
+        safe_detail_fields: DETAILS_17,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1222,7 +1284,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::StartBridge,
-        safe_detail_fields: DETAILS_17,
+        safe_detail_fields: DETAILS_18,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1242,7 +1304,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_18,
+        safe_detail_fields: DETAILS_19,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1262,7 +1324,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Possible,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_19,
+        safe_detail_fields: DETAILS_20,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1282,7 +1344,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Partial,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_20,
+        safe_detail_fields: DETAILS_21,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
diff --git a/crates/hfx-integration-model/src/lib.rs b/crates/hfx-integration-model/src/lib.rs
index 54faeac..7827c78 100644
--- a/crates/hfx-integration-model/src/lib.rs
+++ b/crates/hfx-integration-model/src/lib.rs
@@ -3,7 +3,9 @@
 #![forbid(unsafe_code)]
 
 mod generated;
+mod openrazer_native_generated;
 mod view;
 
 pub use generated::*;
+pub use openrazer_native_generated::*;
 pub use view::*;
diff --git a/crates/hfx-integration-model/src/openrazer_native_generated.rs b/crates/hfx-integration-model/src/openrazer_native_generated.rs
new file mode 100644
index 0000000..bc9984f
--- /dev/null
+++ b/crates/hfx-integration-model/src/openrazer_native_generated.rs
@@ -0,0 +1,9 @@
+// Generated by ./hfx generate. Do not edit manually.
+// SPDX-License-Identifier: GPL-2.0-only
+
+pub const OPENRAZER_NATIVE_DEPLOYMENT_SHA256: &str =
+    "8940c61d14a234049e1226d046b0ba41745d5ae69c387ba0c89f02b37c8dcd28";
+pub const OPENRAZER_NATIVE_DKMS_NAME: &str = "openrazer-driver";
+pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = "3.12.1";
+pub const OPENRAZER_NATIVE_DRIVER_MODULES: &[&str] =
+    &["razeraccessory", "razerkbd", "razerkraken", "razermouse"];
diff --git a/crates/hfx-ops/Cargo.toml b/crates/hfx-ops/Cargo.toml
index c81ab40..0e5d2ba 100644
--- a/crates/hfx-ops/Cargo.toml
+++ b/crates/hfx-ops/Cargo.toml
@@ -9,6 +9,7 @@ publish.workspace = true
 [dependencies]
 hfx-domain = { path = "../hfx-domain" }
 hfx-errors = { path = "../hfx-errors" }
+hfx-integration-model = { path = "../hfx-integration-model" }
 hfx-profiles = { path = "../hfx-profiles" }
 hfx-protocol = { path = "../hfx-protocol" }
 hfx-runtime = { path = "../hfx-runtime" }
diff --git a/crates/hfx-ops/src/activation.rs b/crates/hfx-ops/src/activation.rs
index 1c2df22..8fb7134 100644
--- a/crates/hfx-ops/src/activation.rs
+++ b/crates/hfx-ops/src/activation.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::probe::write_private_file;
+use crate::probe::{OpenRazerDriverState, write_private_file};
 use hfx_runtime::{LINUX_RUNTIME_SHA256, PRODUCT_VERSION};
 use serde::{Deserialize, Serialize};
 use std::fmt;
@@ -56,6 +56,8 @@ pub enum ActivationAction {
     ResumeBridge,
     LeaveBridgeStopped,
     ActivateDriver,
+    ActivateOpenRazerDriver,
+    RepairOpenRazerDriver,
 }
 
 #[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -65,6 +67,7 @@ pub struct ActivationDecision {
     pub bridge_was_active: bool,
     pub installed_module_identity: Option<String>,
     pub loaded_module_identity: Option<String>,
+    pub openrazer_driver_state: OpenRazerDriverState,
 }
 
 #[derive(Debug)]
@@ -110,6 +113,7 @@ pub fn decide_post_update(
     intent: Option<&UpdateIntent>,
     installed_module_identity: Option<&str>,
     loaded_module_identity: Option<&str>,
+    openrazer_driver_state: OpenRazerDriverState,
 ) -> Result<ActivationDecision, ActivationError> {
     let Some(installed) = installed_module_identity else {
         return Err(ActivationError::InstalledModuleUnavailable);
@@ -117,6 +121,12 @@ pub fn decide_post_update(
     let bridge_was_active = intent.is_some_and(|value| value.bridge_was_active);
     let action = match loaded_module_identity {
         Some(loaded) if loaded != installed => ActivationAction::ActivateDriver,
+        _ if openrazer_driver_state == OpenRazerDriverState::ActivationPending => {
+            ActivationAction::ActivateOpenRazerDriver
+        }
+        _ if openrazer_driver_state == OpenRazerDriverState::Unavailable => {
+            ActivationAction::RepairOpenRazerDriver
+        }
         _ if bridge_was_active => ActivationAction::ResumeBridge,
         _ => ActivationAction::LeaveBridgeStopped,
     };
@@ -125,6 +135,7 @@ pub fn decide_post_update(
         bridge_was_active,
         installed_module_identity: Some(installed.to_owned()),
         loaded_module_identity: loaded_module_identity.map(str::to_owned),
+        openrazer_driver_state,
     })
 }
 
@@ -226,24 +237,52 @@ mod tests {
     #[test]
     fn compatible_update_resumes_only_a_previously_active_bridge() {
         let active = UpdateIntent::new(true, Some("same".to_owned()));
-        let decision =
-            decide_post_update(Some(&active), Some("same"), Some("same")).expect("decision");
+        let decision = decide_post_update(
+            Some(&active),
+            Some("same"),
+            Some("same"),
+            OpenRazerDriverState::Ready,
+        )
+        .expect("decision");
         assert_eq!(decision.action, ActivationAction::ResumeBridge);
 
         let inactive = UpdateIntent::new(false, Some("same".to_owned()));
-        let decision =
-            decide_post_update(Some(&inactive), Some("same"), Some("same")).expect("decision");
+        let decision = decide_post_update(
+            Some(&inactive),
+            Some("same"),
+            Some("same"),
+            OpenRazerDriverState::Ready,
+        )
+        .expect("decision");
         assert_eq!(decision.action, ActivationAction::LeaveBridgeStopped);
     }
 
     #[test]
     fn driver_change_never_restarts_the_bridge() {
         let intent = UpdateIntent::new(true, Some("old".to_owned()));
-        let decision =
-            decide_post_update(Some(&intent), Some("new"), Some("old")).expect("decision");
+        let decision = decide_post_update(
+            Some(&intent),
+            Some("new"),
+            Some("old"),
+            OpenRazerDriverState::Ready,
+        )
+        .expect("decision");
         assert_eq!(decision.action, ActivationAction::ActivateDriver);
     }
 
+    #[test]
+    fn openrazer_driver_change_keeps_the_bridge_stopped() {
+        let intent = UpdateIntent::new(true, Some("same".to_owned()));
+        let decision = decide_post_update(
+            Some(&intent),
+            Some("same"),
+            Some("same"),
+            OpenRazerDriverState::ActivationPending,
+        )
+        .expect("decision");
+        assert_eq!(decision.action, ActivationAction::ActivateOpenRazerDriver);
+    }
+
     #[test]
     fn update_intent_round_trips_atomically() {
         let directory = temporary_directory();
diff --git a/crates/hfx-ops/src/assessment.rs b/crates/hfx-ops/src/assessment.rs
index 32a1fbe..f030922 100644
--- a/crates/hfx-ops/src/assessment.rs
+++ b/crates/hfx-ops/src/assessment.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::{ServiceState, SystemSnapshot};
+use crate::{OpenRazerDriverState, ServiceState, SystemSnapshot};
 use hfx_errors::{ErrorCode, error_by_code, remediation_by_id};
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
@@ -117,6 +117,45 @@ fn classify_driver(snapshot: &SystemSnapshot, working: &mut Vec<String>) -> Driv
     }
 }
 
+fn classify_openrazer_driver(
+    snapshot: &SystemSnapshot,
+    working: &mut Vec<String>,
+    findings: &mut Vec<AssessmentFinding>,
+) -> OpenRazerDriverState {
+    let state = snapshot.openrazer_driver.state();
+    if state == OpenRazerDriverState::Ready {
+        working.push("the OpenRazer native-route driver is ready".to_owned());
+        return state;
+    }
+    if let Some(module) = snapshot.openrazer_driver.blocking_module() {
+        findings.push(local_finding(
+            ErrorCode::HfxKernel002,
+            BTreeMap::from([
+                (
+                    "installed_abi".to_owned(),
+                    module
+                        .installed_identity
+                        .clone()
+                        .unwrap_or_else(|| "not-installed".to_owned()),
+                ),
+                (
+                    "loaded_abi".to_owned(),
+                    if module.loaded {
+                        module
+                            .loaded_identity
+                            .clone()
+                            .unwrap_or_else(|| "identity-unavailable".to_owned())
+                    } else {
+                        "not-loaded".to_owned()
+                    },
+                ),
+                ("module".to_owned(), module.module_name.clone()),
+            ]),
+        ));
+    }
+    state
+}
+
 #[must_use]
 pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
     let mut working = vec!["package metadata is available".to_owned()];
@@ -150,6 +189,8 @@ pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
         ));
     }
 
+    let openrazer_driver = classify_openrazer_driver(snapshot, &mut working, &mut findings);
+
     let bridge_ready = snapshot.service_state == ServiceState::Active && snapshot.bridge.is_some();
     if bridge_ready {
         working.push("the bridge diagnostic endpoint is responding".to_owned());
@@ -157,7 +198,8 @@ pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
     } else if !matches!(
         driver,
         DriverState::ActivationPending | DriverState::Unavailable
-    ) {
+    ) && openrazer_driver == OpenRazerDriverState::Ready
+    {
         findings.push(local_finding(
             ErrorCode::HfxService001,
             BTreeMap::from([(
@@ -282,7 +324,10 @@ pub fn render_status_text(assessment: &Assessment) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{BridgeHealth, ServiceState, SystemSnapshot};
+    use crate::{
+        BridgeHealth, KernelModuleIdentitySnapshot, OpenRazerDriverSnapshot, ServiceState,
+        SystemSnapshot,
+    };
     use hfx_domain::{ProjectionRevision, QueueCapacity, SequenceNumber, StreamEpoch, StreamId};
     use hfx_protocol::{BridgeSnapshot, DiagnosticSnapshot, EventCursor};
 
@@ -311,6 +356,14 @@ mod tests {
             package_version: "0.0.0-dev.1".to_owned(),
             installed_module_identity: Some("installed".to_owned()),
             loaded_module_identity: Some("installed".to_owned()),
+            openrazer_driver: OpenRazerDriverSnapshot {
+                modules: vec![KernelModuleIdentitySnapshot {
+                    module_name: "razerkbd".to_owned(),
+                    installed_identity: Some("installed".to_owned()),
+                    loaded: false,
+                    loaded_identity: None,
+                }],
+            },
             service_state: ServiceState::Active,
             bridge: Some(empty_bridge()),
             legacy_v2_stack_detected: false,
@@ -368,4 +421,20 @@ mod tests {
             "active-unready"
         );
     }
+
+    #[test]
+    fn stale_openrazer_module_blocks_ready_without_service_noise() {
+        let mut value = snapshot();
+        value.openrazer_driver.modules[0].loaded = true;
+        value.openrazer_driver.modules[0].loaded_identity = Some("old".to_owned());
+        value.service_state = ServiceState::Inactive;
+        value.bridge = None;
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.state, AssessmentState::NeedsAttention);
+        assert_eq!(assessment.findings.len(), 1);
+        assert_eq!(assessment.findings[0].code, "HFX-KERNEL-002");
+        assert_eq!(assessment.findings[0].details["module"], "razerkbd");
+    }
 }
diff --git a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
index c3a14e3..29c1cea 100644
--- a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
+++ b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
@@ -1,9 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use hfx_ops::{
-    ActivationAction, RealSystemProbe, ServiceState, SystemController, SystemProbe, UpdateIntent,
-    confirm_configuration, decide_post_update, load_update_intent, migrate_configuration,
-    record_update_intent, remove_update_intent,
+    ActivationAction, OpenRazerDriverState, RealSystemProbe, ServiceState, SystemController,
+    SystemProbe, UpdateIntent, confirm_configuration, decide_post_update, load_update_intent,
+    migrate_configuration, record_update_intent, remove_update_intent,
 };
 use hfx_runtime::{BRIDGE_CONFIGURATION_FILE_PATH, UPDATE_STATE_PATH};
 use std::env;
@@ -12,7 +12,26 @@ use std::thread;
 use std::time::Duration;
 
 fn usage() -> &'static str {
-    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|confirm-start|pre-remove>\n"
+    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|check-openrazer-driver|confirm-start|pre-remove>\n"
+}
+
+fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), String> {
+    match snapshot.openrazer_driver.state() {
+        OpenRazerDriverState::Ready => Ok(()),
+        OpenRazerDriverState::ActivationPending => Err(
+            "an older OpenRazer route module is active; reboot before starting the native relay"
+                .to_owned(),
+        ),
+        OpenRazerDriverState::Unavailable => {
+            let module = snapshot
+                .openrazer_driver
+                .blocking_module()
+                .map_or("unknown", |value| value.module_name.as_str());
+            Err(format!(
+                "the installed OpenRazer route module {module} is unavailable"
+            ))
+        }
+    }
 }
 
 fn wait_for_bridge_and_confirmation(probe: &RealSystemProbe) -> bool {
@@ -63,6 +82,7 @@ fn post_update(probe: &RealSystemProbe) -> Result<(), String> {
         intent.as_ref(),
         snapshot.installed_module_identity.as_deref(),
         snapshot.loaded_module_identity.as_deref(),
+        snapshot.openrazer_driver.state(),
     )
     .map_err(|error| format!("post-update decision failed: {error}"))?;
     match decision.action {
@@ -77,6 +97,16 @@ fn post_update(probe: &RealSystemProbe) -> Result<(), String> {
             );
             return Ok(());
         }
+        ActivationAction::ActivateOpenRazerDriver => {
+            println!("OpenRazer native-route driver activation is required.");
+            println!("Reboot, then run hyperfluxctl doctor before starting the bridge.");
+            return Ok(());
+        }
+        ActivationAction::RepairOpenRazerDriver => {
+            println!("The OpenRazer native-route driver installation is incomplete.");
+            println!("Run hyperfluxctl doctor for the exact missing module and safe action.");
+            return Ok(());
+        }
     }
     if matches!(decision.action, ActivationAction::ResumeBridge)
         && !wait_for_bridge_and_confirmation(probe)
@@ -93,6 +123,7 @@ fn prepare_start(probe: &RealSystemProbe) -> Result<(), String> {
     let snapshot = probe.snapshot();
     let installed = snapshot
         .installed_module_identity
+        .as_deref()
         .ok_or_else(|| "the installed kernel module is unavailable".to_owned())?;
     if snapshot
         .loaded_module_identity
@@ -103,12 +134,17 @@ fn prepare_start(probe: &RealSystemProbe) -> Result<(), String> {
             "a newer installed kernel module must be activated before the bridge starts".to_owned(),
         );
     }
+    ensure_openrazer_driver(&snapshot)?;
     migrate_configuration(Path::new(BRIDGE_CONFIGURATION_FILE_PATH))
         .map_err(|error| format!("configuration migration failed: {error}"))?;
     println!("HyperFlux Next start preparation completed.");
     Ok(())
 }
 
+fn check_openrazer_driver(probe: &RealSystemProbe) -> Result<(), String> {
+    ensure_openrazer_driver(&probe.snapshot())
+}
+
 fn confirm_start(_probe: &RealSystemProbe) -> Result<(), String> {
     confirm_configuration(Path::new(BRIDGE_CONFIGURATION_FILE_PATH))
         .map_err(|error| format!("configuration confirmation failed: {error}"))?;
@@ -141,6 +177,7 @@ fn run() -> Result<(), String> {
         "pre-update" => pre_update(&probe),
         "post-update" => post_update(&probe),
         "prepare-start" => prepare_start(&probe),
+        "check-openrazer-driver" => check_openrazer_driver(&probe),
         "confirm-start" => confirm_start(&probe),
         "pre-remove" => pre_remove(&probe),
         _ => Err(usage().to_owned()),
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 09d864e..5becc60 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -29,8 +29,9 @@ pub use configuration::{
     migrate_configuration, restore_qualification_configuration,
 };
 pub use probe::{
-    BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, ProbeError, RealCommandRunner,
-    RealSystemProbe, ServiceState, SystemController, SystemProbe, SystemSnapshot,
+    BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, KernelModuleIdentitySnapshot,
+    OpenRazerDriverSnapshot, OpenRazerDriverState, ProbeError, RealCommandRunner, RealSystemProbe,
+    ServiceState, SystemController, SystemProbe, SystemSnapshot,
 };
 pub use qualification::{
     ActionConfirmation, BatteryAvailability, BatteryView, CapabilityAccess, CapabilityView,
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 1f87bdb..1c7f1f0 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -3,6 +3,7 @@
 use hfx_domain::{
     ClientId, ClientName, EventBatchLimit, ProtocolFeatureId, ProtocolVersion, SequenceNumber,
 };
+use hfx_integration_model::OPENRAZER_NATIVE_DRIVER_MODULES;
 use hfx_profiles::receiver_profile_by_usb_id;
 use hfx_protocol::{
     BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, EventBatch, EventCursor,
@@ -170,12 +171,67 @@ pub struct SystemSnapshot {
     pub package_version: String,
     pub installed_module_identity: Option<String>,
     pub loaded_module_identity: Option<String>,
+    pub openrazer_driver: OpenRazerDriverSnapshot,
     pub service_state: ServiceState,
     pub bridge: Option<BridgeHealth>,
     pub legacy_v2_stack_detected: bool,
     pub supported_receiver_present: bool,
 }
 
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct KernelModuleIdentitySnapshot {
+    pub module_name: String,
+    pub installed_identity: Option<String>,
+    pub loaded: bool,
+    pub loaded_identity: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum OpenRazerDriverState {
+    Ready,
+    ActivationPending,
+    Unavailable,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct OpenRazerDriverSnapshot {
+    pub modules: Vec<KernelModuleIdentitySnapshot>,
+}
+
+impl OpenRazerDriverSnapshot {
+    #[must_use]
+    pub fn state(&self) -> OpenRazerDriverState {
+        if self
+            .modules
+            .iter()
+            .any(|module| module.installed_identity.is_none())
+        {
+            return OpenRazerDriverState::Unavailable;
+        }
+        if self.modules.iter().any(|module| {
+            module.loaded
+                && module.loaded_identity.as_deref() != module.installed_identity.as_deref()
+        }) {
+            return OpenRazerDriverState::ActivationPending;
+        }
+        OpenRazerDriverState::Ready
+    }
+
+    #[must_use]
+    pub fn blocking_module(&self) -> Option<&KernelModuleIdentitySnapshot> {
+        self.modules
+            .iter()
+            .find(|module| module.installed_identity.is_none())
+            .or_else(|| {
+                self.modules.iter().find(|module| {
+                    module.loaded
+                        && module.loaded_identity.as_deref() != module.installed_identity.as_deref()
+                })
+            })
+    }
+}
+
 pub trait SystemProbe {
     fn snapshot(&self) -> SystemSnapshot;
 }
@@ -258,25 +314,46 @@ impl<R: CommandRunner> RealSystemProbe<R> {
     }
 
     fn installed_module_identity(&self) -> Option<String> {
+        self.installed_identity(KERNEL_MODULE_NAME)
+    }
+
+    fn installed_identity(&self, module: &str) -> Option<String> {
         self.runner
-            .run(
-                "modinfo",
-                &["-F", "srcversion", KERNEL_MODULE_NAME],
-                self.timeout,
-            )
+            .run("modinfo", &["-F", "srcversion", module], self.timeout)
             .ok()
             .filter(|output| output.success)
             .and_then(|output| bounded_identity(&output.stdout))
     }
 
     fn loaded_module_identity(&self) -> Option<String> {
-        let module = KERNEL_MODULE_NAME.replace('-', "_");
+        self.loaded_identity(KERNEL_MODULE_NAME)
+    }
+
+    fn loaded_identity(&self, module: &str) -> Option<String> {
+        let module = module.replace('-', "_");
         let path = self.sys_module_root.join(module).join("srcversion");
         fs::read_to_string(path)
             .ok()
             .and_then(|value| bounded_identity(value.trim()))
     }
 
+    fn openrazer_driver(&self) -> OpenRazerDriverSnapshot {
+        OpenRazerDriverSnapshot {
+            modules: OPENRAZER_NATIVE_DRIVER_MODULES
+                .iter()
+                .map(|module| {
+                    let loaded_path = self.sys_module_root.join(module.replace('-', "_"));
+                    KernelModuleIdentitySnapshot {
+                        module_name: (*module).to_owned(),
+                        installed_identity: self.installed_identity(module),
+                        loaded: loaded_path.is_dir(),
+                        loaded_identity: self.loaded_identity(module),
+                    }
+                })
+                .collect(),
+        }
+    }
+
     fn service_state(&self) -> ServiceState {
         let Ok(output) = self.runner.run(
             "systemctl",
@@ -456,6 +533,7 @@ impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
             package_version: PRODUCT_VERSION.to_owned(),
             installed_module_identity: self.installed_module_identity(),
             loaded_module_identity: self.loaded_module_identity(),
+            openrazer_driver: self.openrazer_driver(),
             service_state,
             bridge,
             legacy_v2_stack_detected: self.legacy_v2_stack_detected(),
@@ -707,6 +785,34 @@ mod tests {
         assert_eq!(bounded_identity(&"a".repeat(65)), None);
     }
 
+    #[test]
+    fn openrazer_driver_state_distinguishes_unloaded_stale_and_missing_modules() {
+        let ready = OpenRazerDriverSnapshot {
+            modules: vec![KernelModuleIdentitySnapshot {
+                module_name: "razerkbd".to_owned(),
+                installed_identity: Some("new".to_owned()),
+                loaded: false,
+                loaded_identity: None,
+            }],
+        };
+        assert_eq!(ready.state(), OpenRazerDriverState::Ready);
+
+        let mut pending = ready.clone();
+        pending.modules[0].loaded = true;
+        pending.modules[0].loaded_identity = Some("old".to_owned());
+        assert_eq!(pending.state(), OpenRazerDriverState::ActivationPending);
+
+        let mut unavailable = ready;
+        unavailable.modules[0].installed_identity = None;
+        assert_eq!(unavailable.state(), OpenRazerDriverState::Unavailable);
+        assert_eq!(
+            unavailable
+                .blocking_module()
+                .map(|module| module.module_name.as_str()),
+            Some("razerkbd")
+        );
+    }
+
     #[test]
     fn legacy_v2_service_is_detected_without_claiming_next_is_ready() {
         let probe = RealSystemProbe::with_paths(
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index a34bf35..b26f798 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1331,6 +1331,14 @@ mod tests {
             package_version: PRODUCT_VERSION.to_owned(),
             installed_module_identity: Some("same".to_owned()),
             loaded_module_identity: Some("same".to_owned()),
+            openrazer_driver: crate::OpenRazerDriverSnapshot {
+                modules: vec![crate::KernelModuleIdentitySnapshot {
+                    module_name: "razerkbd".to_owned(),
+                    installed_identity: Some("same".to_owned()),
+                    loaded: false,
+                    loaded_identity: None,
+                }],
+            },
             service_state: ServiceState::Active,
             bridge: None,
             legacy_v2_stack_detected: false,
diff --git a/crates/hfx-ops/src/support.rs b/crates/hfx-ops/src/support.rs
index b7e7af9..626f221 100644
--- a/crates/hfx-ops/src/support.rs
+++ b/crates/hfx-ops/src/support.rs
@@ -227,7 +227,9 @@ fn hex_prefix(bytes: &[u8], length: usize) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::{ServiceState, SystemSnapshot};
+    use crate::{
+        KernelModuleIdentitySnapshot, OpenRazerDriverSnapshot, ServiceState, SystemSnapshot,
+    };
     use std::fs;
     use std::os::unix::fs::PermissionsExt as _;
     use std::time::{SystemTime, UNIX_EPOCH};
@@ -237,6 +239,14 @@ mod tests {
             package_version: PRODUCT_VERSION.to_owned(),
             installed_module_identity: Some("ABC".to_owned()),
             loaded_module_identity: None,
+            openrazer_driver: OpenRazerDriverSnapshot {
+                modules: vec![KernelModuleIdentitySnapshot {
+                    module_name: "razerkbd".to_owned(),
+                    installed_identity: Some("ABC".to_owned()),
+                    loaded: false,
+                    loaded_identity: None,
+                }],
+            },
             service_state: ServiceState::Inactive,
             bridge: None,
             legacy_v2_stack_detected: false,
diff --git a/crates/hfx-uhid-relay/Cargo.toml b/crates/hfx-uhid-relay/Cargo.toml
new file mode 100644
index 0000000..1989ea7
--- /dev/null
+++ b/crates/hfx-uhid-relay/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "hfx-uhid-relay"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+hfx-domain = { path = "../hfx-domain" }
+hfx-protocol = { path = "../hfx-protocol" }
+hfx-runtime = { path = "../hfx-runtime" }
+hfx-sdk = { path = "../hfx-sdk" }
+rustix = { workspace = true, features = ["event"] }
+serde = { workspace = true }
+serde_json.workspace = true
+sha2.workspace = true
+signal-hook.workspace = true
+
+[lints]
+workspace = true
+
+[[bin]]
+name = "hyperflux-next-uhid-relay"
+path = "src/main.rs"
diff --git a/crates/hfx-uhid-relay/src/bridge.rs b/crates/hfx-uhid-relay/src/bridge.rs
new file mode 100644
index 0000000..6f66b94
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/bridge.rs
@@ -0,0 +1,294 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::uhid::FEATURE_REPORT_BYTES;
+use hfx_domain::{
+    ClientId, ClientName, LeaseDurationMs, LeaseId, NativeExchangeTimeoutMs, NativeReportHex,
+    NativeRouteAccess, ProtocolFeatureId, ProtocolVersion, RouteState,
+};
+use hfx_protocol::{
+    CURRENT_PROTOCOL_VERSION, LeaseResult, NativeExchangeResult, NativeRoute,
+    NativeRouteEventBatch, NativeRouteInventory,
+};
+use hfx_sdk::{EventSubscription, HyperFluxClient, KernelRequestIdentitySource, SdkClientConfig};
+use std::fmt;
+use std::os::unix::net::UnixStream;
+use std::path::Path;
+use std::time::{Duration, Instant};
+
+const NATIVE_FEATURE: &str = "native-receiver-tunnel";
+const LEASE_DURATION_MS: u32 = 30_000;
+const LEASE_RENEW_INTERVAL: Duration = Duration::from_secs(10);
+const SOCKET_TIMEOUT: Duration = Duration::from_secs(3);
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum BridgeExchangeResult {
+    MatchedResponse([u8; FEATURE_REPORT_BYTES]),
+    NotSent,
+    MayHaveBeenSent,
+}
+
+pub trait BridgeExchange {
+    fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult;
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeBridgeError {
+    InvalidRoute,
+    InvalidIdentity,
+    BridgeUnavailable,
+    LeaseConflict,
+    LeaseRejected,
+}
+
+impl fmt::Display for NativeBridgeError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidRoute => "native route is not qualified and writable",
+            Self::InvalidIdentity => "native relay client identity is invalid",
+            Self::BridgeUnavailable => "HyperFlux bridge is unavailable",
+            Self::LeaseConflict => "native route is owned by another application",
+            Self::LeaseRejected => "native route lease was rejected",
+        })
+    }
+}
+
+impl std::error::Error for NativeBridgeError {}
+
+pub struct NativeBridge {
+    client: HyperFluxClient<UnixStream, KernelRequestIdentitySource>,
+    route: NativeRoute,
+    lease_id: LeaseId,
+    last_lease_renewal: Instant,
+}
+
+pub struct NativeRouteMonitor {
+    client: HyperFluxClient<UnixStream, KernelRequestIdentitySource>,
+}
+
+impl NativeRouteMonitor {
+    /// Connects one read-only native-route monitor without acquiring a lease.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed bridge or identity failure.
+    pub fn connect(socket_path: &Path) -> Result<Self, NativeBridgeError> {
+        let stream = configured_stream(socket_path)?;
+        let config = client_config(
+            ClientId::try_from("hfx-openrazer-monitor")
+                .map_err(|_| NativeBridgeError::InvalidIdentity)?,
+            ClientName::try_from("HyperFlux OpenRazer route monitor")
+                .map_err(|_| NativeBridgeError::InvalidIdentity)?,
+        )?;
+        let client = HyperFluxClient::connect(stream, config, KernelRequestIdentitySource)
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+        Ok(Self { client })
+    }
+
+    /// Enumerates the complete current native-route set.
+    ///
+    /// # Errors
+    ///
+    /// Returns a bridge failure when the connection cannot answer.
+    pub fn enumerate(&mut self) -> Result<NativeRouteInventory, NativeBridgeError> {
+        self.client
+            .native_enumerate()
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)
+    }
+
+    /// Reads one bounded native-route event batch.
+    ///
+    /// # Errors
+    ///
+    /// Returns a bridge failure when the connection cannot answer.
+    pub fn watch(
+        &mut self,
+        subscription: EventSubscription,
+    ) -> Result<NativeRouteEventBatch, NativeBridgeError> {
+        self.client
+            .native_watch(subscription)
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)
+    }
+}
+
+impl NativeBridge {
+    /// Connects to protocol v7 and acquires the exact route's native-control
+    /// resource before any UHID endpoint becomes visible.
+    ///
+    /// # Errors
+    ///
+    /// Fails closed for candidate, unavailable, un-tokenized, malformed, or
+    /// already-owned routes and for bridge negotiation failures.
+    pub fn connect(
+        socket_path: &Path,
+        route: NativeRoute,
+        instance: u32,
+    ) -> Result<Self, NativeBridgeError> {
+        validate_route(&route)?;
+        let stream = configured_stream(socket_path)?;
+        let config = client_config(
+            ClientId::try_from(format!("hfx-openrazer-{instance:08x}"))
+                .map_err(|_| NativeBridgeError::InvalidIdentity)?,
+            ClientName::try_from("HyperFlux OpenRazer native relay")
+                .map_err(|_| NativeBridgeError::InvalidIdentity)?,
+        )?;
+        let mut client = HyperFluxClient::connect(stream, config, KernelRequestIdentitySource)
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+        let resource = route
+            .resource
+            .clone()
+            .ok_or(NativeBridgeError::InvalidRoute)?;
+        let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS)
+            .map_err(|_| NativeBridgeError::InvalidIdentity)?;
+        let lease = client
+            .acquire_lease(vec![resource], duration)
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+        let lease_id = match lease {
+            LeaseResult::Granted(grant) => grant.lease_id,
+            LeaseResult::Conflict(_) => return Err(NativeBridgeError::LeaseConflict),
+            LeaseResult::Rejected(_) => return Err(NativeBridgeError::LeaseRejected),
+        };
+        Ok(Self {
+            client,
+            route,
+            lease_id,
+            last_lease_renewal: Instant::now(),
+        })
+    }
+
+    fn renew_if_due(&mut self) -> Result<(), NativeBridgeError> {
+        if self.last_lease_renewal.elapsed() < LEASE_RENEW_INTERVAL {
+            return Ok(());
+        }
+        let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS)
+            .map_err(|_| NativeBridgeError::InvalidIdentity)?;
+        let result = self
+            .client
+            .renew_lease(self.lease_id.clone(), duration)
+            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+        match result {
+            LeaseResult::Granted(_) => {
+                self.last_lease_renewal = Instant::now();
+                Ok(())
+            }
+            LeaseResult::Conflict(_) => Err(NativeBridgeError::LeaseConflict),
+            LeaseResult::Rejected(_) => Err(NativeBridgeError::LeaseRejected),
+        }
+    }
+}
+
+impl BridgeExchange for NativeBridge {
+    fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
+        if self.renew_if_due().is_err() {
+            return BridgeExchangeResult::NotSent;
+        }
+        let Some(route_token) = self.route.route_token.clone() else {
+            return BridgeExchangeResult::NotSent;
+        };
+        let Ok(report) = NativeReportHex::try_from(encode_hex(&report)) else {
+            return BridgeExchangeResult::NotSent;
+        };
+        let Ok(timeout) = NativeExchangeTimeoutMs::try_from(1_000_u16) else {
+            return BridgeExchangeResult::NotSent;
+        };
+        let Ok(submission) = self.client.prepare_native_exchange(
+            self.lease_id.clone(),
+            route_token,
+            report,
+            timeout,
+        ) else {
+            return BridgeExchangeResult::NotSent;
+        };
+        let Ok(outcome) = self.client.native_transact(&submission) else {
+            return BridgeExchangeResult::MayHaveBeenSent;
+        };
+        match outcome.result {
+            NativeExchangeResult::NotSent(_) => BridgeExchangeResult::NotSent,
+            NativeExchangeResult::MayHaveBeenSent(_) => BridgeExchangeResult::MayHaveBeenSent,
+            NativeExchangeResult::MatchedResponse(matched) => {
+                decode_report(matched.response.as_str()).map_or(
+                    BridgeExchangeResult::MayHaveBeenSent,
+                    BridgeExchangeResult::MatchedResponse,
+                )
+            }
+        }
+    }
+}
+
+impl Drop for NativeBridge {
+    fn drop(&mut self) {
+        let _ = self.client.release_lease(self.lease_id.clone());
+    }
+}
+
+fn configured_stream(socket_path: &Path) -> Result<UnixStream, NativeBridgeError> {
+    let stream =
+        UnixStream::connect(socket_path).map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+    stream
+        .set_read_timeout(Some(SOCKET_TIMEOUT))
+        .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+    stream
+        .set_write_timeout(Some(SOCKET_TIMEOUT))
+        .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
+    Ok(stream)
+}
+
+fn client_config(
+    client_id: ClientId,
+    client_name: ClientName,
+) -> Result<SdkClientConfig, NativeBridgeError> {
+    let version = ProtocolVersion::try_from(CURRENT_PROTOCOL_VERSION)
+        .map_err(|_| NativeBridgeError::InvalidIdentity)?;
+    Ok(SdkClientConfig {
+        client_id,
+        client_name,
+        minimum_version: version,
+        maximum_version: version,
+        required_features: vec![
+            ProtocolFeatureId::try_from(NATIVE_FEATURE)
+                .map_err(|_| NativeBridgeError::InvalidIdentity)?,
+        ],
+        optional_features: Vec::new(),
+    })
+}
+
+fn validate_route(route: &NativeRoute) -> Result<(), NativeBridgeError> {
+    if route.access != NativeRouteAccess::Qualified
+        || route.route_state != RouteState::Available
+        || usize::from(route.report_bytes.get()) != FEATURE_REPORT_BYTES
+        || route.protocol_family.as_str() != "razer-feature-report-v1"
+        || route.route_token.is_none()
+        || route.resource.is_none()
+    {
+        Err(NativeBridgeError::InvalidRoute)
+    } else {
+        Ok(())
+    }
+}
+
+fn encode_hex(report: &[u8; FEATURE_REPORT_BYTES]) -> String {
+    let mut output = String::with_capacity(FEATURE_REPORT_BYTES * 2);
+    for byte in report {
+        use std::fmt::Write as _;
+        let _ = write!(output, "{byte:02x}");
+    }
+    output
+}
+
+fn decode_report(value: &str) -> Option<[u8; FEATURE_REPORT_BYTES]> {
+    if value.len() != FEATURE_REPORT_BYTES * 2 {
+        return None;
+    }
+    let mut report = [0_u8; FEATURE_REPORT_BYTES];
+    for (index, pair) in value.as_bytes().chunks_exact(2).enumerate() {
+        report[index] = (hex_nibble(pair[0])? << 4) | hex_nibble(pair[1])?;
+    }
+    Some(report)
+}
+
+fn hex_nibble(value: u8) -> Option<u8> {
+    match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        _ => None,
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/catalog.rs b/crates/hfx-uhid-relay/src/catalog.rs
new file mode 100644
index 0000000..2e731d7
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/catalog.rs
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_domain::{DeviceKind, NativeProtocolFamily, ProductId, VendorId};
+use serde::Deserialize;
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+use std::fmt;
+
+const CATALOG_JSON: &str =
+    include_str!("../../../integrations/openrazer/native-route/catalog.json");
+const METADATA_JSON: &str = include_str!("../../../integrations/openrazer/metadata.json");
+const EXPECTED_SCHEMA: &str = "hyperflux-openrazer-native-route-catalog-v1";
+const EXPECTED_DESCRIPTOR: &[u8] = &[
+    0x06, 0x00, 0xff, 0x09, 0x01, 0xa1, 0x01, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08, 0x95, 0x5a,
+    0xb1, 0x02, 0xc0,
+];
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeRouteRecord {
+    pub profile_id: String,
+    pub vendor_id: VendorId,
+    pub wireless_product_id: ProductId,
+    pub model_name: String,
+    pub device_kind: DeviceKind,
+    pub driver_family: String,
+    pub source_path: String,
+    pub source_class: String,
+    pub source_sha256: String,
+    pub direct_data_product_ids: Vec<ProductId>,
+    pub event_file_regex: String,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeRouteCatalog {
+    upstream_commit: String,
+    protocol_family: NativeProtocolFamily,
+    descriptor: Vec<u8>,
+    phys_prefix: String,
+    routes: Vec<NativeRouteRecord>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeRouteCatalogError {
+    InvalidJson,
+    InvalidSchema,
+    MetadataDrift,
+    InvalidTransport,
+    InvalidRoute,
+    DuplicateRoute,
+}
+
+impl fmt::Display for NativeRouteCatalogError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidJson => "OpenRazer native-route catalog JSON is invalid",
+            Self::InvalidSchema => "OpenRazer native-route catalog schema is invalid",
+            Self::MetadataDrift => "OpenRazer metadata no longer matches the native-route catalog",
+            Self::InvalidTransport => "OpenRazer native Feature transport is invalid",
+            Self::InvalidRoute => "OpenRazer native route is invalid",
+            Self::DuplicateRoute => "OpenRazer native route identity is duplicated",
+        })
+    }
+}
+
+impl std::error::Error for NativeRouteCatalogError {}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct CatalogDocument {
+    #[serde(rename = "$schema")]
+    schema_ref: String,
+    schema: String,
+    upstream_commit: String,
+    metadata_sha256: String,
+    transport: TransportDocument,
+    routes: Vec<RouteDocument>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct TransportDocument {
+    protocol_family: String,
+    report_bytes: u16,
+    phys_prefix: String,
+    descriptor_hex: String,
+    descriptor_sha256: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct RouteDocument {
+    profile_id: String,
+    vendor_id: u16,
+    wireless_product_id: u16,
+    model_name: String,
+    device_kind: String,
+    driver_family: String,
+    source: SourceDocument,
+    direct_data_product_ids: Vec<u16>,
+    event_file_regex: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct SourceDocument {
+    path: String,
+    class_name: String,
+    sha256: String,
+}
+
+impl NativeRouteCatalog {
+    /// Loads the exact generated catalog embedded in this binary.
+    ///
+    /// # Errors
+    ///
+    /// Fails closed when metadata, transport, or route identity drifts.
+    pub fn load() -> Result<Self, NativeRouteCatalogError> {
+        let document: CatalogDocument =
+            serde_json::from_str(CATALOG_JSON).map_err(|_| NativeRouteCatalogError::InvalidJson)?;
+        if document.schema != EXPECTED_SCHEMA
+            || document.schema_ref != "../../../schemas/openrazer-native-route-catalog.schema.json"
+            || document.upstream_commit.len() != 40
+        {
+            return Err(NativeRouteCatalogError::InvalidSchema);
+        }
+        let metadata_digest = hex_sha256(METADATA_JSON.as_bytes());
+        if document.metadata_sha256 != metadata_digest {
+            return Err(NativeRouteCatalogError::MetadataDrift);
+        }
+        let descriptor = decode_hex(&document.transport.descriptor_hex)
+            .ok_or(NativeRouteCatalogError::InvalidTransport)?;
+        if document.transport.report_bytes != 90
+            || descriptor != EXPECTED_DESCRIPTOR
+            || document.transport.descriptor_sha256 != hex_sha256(&descriptor)
+            || document.transport.phys_prefix != "hyperflux-next/native/v1/"
+        {
+            return Err(NativeRouteCatalogError::InvalidTransport);
+        }
+        let protocol_family = NativeProtocolFamily::try_from(document.transport.protocol_family)
+            .map_err(|_| NativeRouteCatalogError::InvalidTransport)?;
+        let mut identities = BTreeSet::new();
+        let mut profiles = BTreeSet::new();
+        let mut routes = Vec::with_capacity(document.routes.len());
+        for route in document.routes {
+            let device_kind = match route.device_kind.as_str() {
+                "mouse" if route.driver_family == "razermouse" => DeviceKind::Mouse,
+                "keyboard" if route.driver_family == "razerkbd" => DeviceKind::Keyboard,
+                _ => return Err(NativeRouteCatalogError::InvalidRoute),
+            };
+            if route.profile_id.is_empty()
+                || route.model_name.is_empty()
+                || route.model_name.len() >= 128
+                || route.source.path.is_empty()
+                || route.source.class_name.is_empty()
+                || route.source.sha256.len() != 64
+                || route.direct_data_product_ids.is_empty()
+                || route.event_file_regex.is_empty()
+            {
+                return Err(NativeRouteCatalogError::InvalidRoute);
+            }
+            if !identities.insert((route.vendor_id, route.wireless_product_id, device_kind))
+                || !profiles.insert(route.profile_id.clone())
+            {
+                return Err(NativeRouteCatalogError::DuplicateRoute);
+            }
+            let vendor_id = VendorId::try_from(route.vendor_id)
+                .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
+            let wireless_product_id = ProductId::try_from(route.wireless_product_id)
+                .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
+            let direct_data_product_ids = route
+                .direct_data_product_ids
+                .into_iter()
+                .map(|product| {
+                    ProductId::try_from(product).map_err(|_| NativeRouteCatalogError::InvalidRoute)
+                })
+                .collect::<Result<Vec<_>, _>>()?;
+            routes.push(NativeRouteRecord {
+                profile_id: route.profile_id,
+                vendor_id,
+                wireless_product_id,
+                model_name: route.model_name,
+                device_kind,
+                driver_family: route.driver_family,
+                source_path: route.source.path,
+                source_class: route.source.class_name,
+                source_sha256: route.source.sha256,
+                direct_data_product_ids,
+                event_file_regex: route.event_file_regex,
+            });
+        }
+        routes.sort_by_key(|route| {
+            (
+                route.vendor_id,
+                route.wireless_product_id,
+                route.device_kind,
+            )
+        });
+        Ok(Self {
+            upstream_commit: document.upstream_commit,
+            protocol_family,
+            descriptor,
+            phys_prefix: document.transport.phys_prefix,
+            routes,
+        })
+    }
+
+    #[must_use]
+    pub fn route(
+        &self,
+        vendor_id: VendorId,
+        product_id: ProductId,
+        device_kind: DeviceKind,
+    ) -> Option<&NativeRouteRecord> {
+        self.routes.iter().find(|route| {
+            route.vendor_id == vendor_id
+                && route.wireless_product_id == product_id
+                && route.device_kind == device_kind
+        })
+    }
+
+    #[must_use]
+    pub fn routes(&self) -> &[NativeRouteRecord] {
+        &self.routes
+    }
+
+    #[must_use]
+    pub fn descriptor(&self) -> &[u8] {
+        &self.descriptor
+    }
+
+    #[must_use]
+    pub fn protocol_family(&self) -> &NativeProtocolFamily {
+        &self.protocol_family
+    }
+
+    #[must_use]
+    pub fn phys_prefix(&self) -> &str {
+        &self.phys_prefix
+    }
+
+    #[must_use]
+    pub fn upstream_commit(&self) -> &str {
+        &self.upstream_commit
+    }
+}
+
+fn decode_hex(value: &str) -> Option<Vec<u8>> {
+    if !value.len().is_multiple_of(2) || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
+        return None;
+    }
+    value
+        .as_bytes()
+        .chunks_exact(2)
+        .map(|pair| {
+            let high = hex_nibble(pair[0])?;
+            let low = hex_nibble(pair[1])?;
+            Some((high << 4) | low)
+        })
+        .collect()
+}
+
+fn hex_nibble(value: u8) -> Option<u8> {
+    match value {
+        b'0'..=b'9' => Some(value - b'0'),
+        b'a'..=b'f' => Some(value - b'a' + 10),
+        _ => None,
+    }
+}
+
+fn hex_sha256(value: &[u8]) -> String {
+    let digest = Sha256::digest(value);
+    let mut output = String::with_capacity(64);
+    for byte in digest {
+        use std::fmt::Write as _;
+        let _ = write!(output, "{byte:02x}");
+    }
+    output
+}
diff --git a/crates/hfx-uhid-relay/src/endpoint.rs b/crates/hfx-uhid-relay/src/endpoint.rs
new file mode 100644
index 0000000..d97543c
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/endpoint.rs
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::bridge::{BridgeExchange, BridgeExchangeResult};
+use crate::uhid::{
+    FEATURE_REPORT_BYTES, TransportEnvelopeKind, UhidEvent, UhidReply, encode_transport_envelope,
+    is_feature_request,
+};
+use std::fmt;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum FeatureEndpointState {
+    Created,
+    Started,
+    Stopped,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum EndpointError {
+    InvalidState,
+    PendingResponse,
+    InvalidFeatureRequest,
+}
+
+impl fmt::Display for EndpointError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidState => "feature endpoint is not started",
+            Self::PendingResponse => "a native response is still pending",
+            Self::InvalidFeatureRequest => "UHID request is not the exact native Feature report",
+        })
+    }
+}
+
+impl std::error::Error for EndpointError {}
+
+/// One lossless SET-then-GET Feature-report exchange.
+///
+/// `OpenRazer` writes one exact 90-byte Razer request and then reads its matching
+/// response. A transport failure is encoded as an invalid Razer response so a
+/// source-bound `OpenRazer` adapter can retain the bridge's retry certainty.
+pub struct FeatureEndpoint<B> {
+    bridge: B,
+    state: FeatureEndpointState,
+    pending_response: Option<[u8; FEATURE_REPORT_BYTES]>,
+}
+
+impl<B: BridgeExchange> FeatureEndpoint<B> {
+    #[must_use]
+    pub const fn new(bridge: B) -> Self {
+        Self {
+            bridge,
+            state: FeatureEndpointState::Created,
+            pending_response: None,
+        }
+    }
+
+    #[must_use]
+    pub const fn state(&self) -> FeatureEndpointState {
+        self.state
+    }
+
+    #[must_use]
+    pub const fn has_pending_response(&self) -> bool {
+        self.pending_response.is_some()
+    }
+
+    /// Handles a decoded UHID event without exposing input collections.
+    ///
+    /// # Errors
+    ///
+    /// Returns a typed local error for invalid sequencing. Rejected GET/SET
+    /// requests still receive an EIO reply and never reach the bridge.
+    pub fn handle(&mut self, event: UhidEvent) -> Result<Option<UhidReply>, EndpointError> {
+        match event {
+            UhidEvent::Start { flags } => {
+                if flags & 0x04 != 0 {
+                    return Err(EndpointError::InvalidFeatureRequest);
+                }
+                self.state = FeatureEndpointState::Started;
+                Ok(None)
+            }
+            UhidEvent::Stop => {
+                self.state = FeatureEndpointState::Stopped;
+                self.pending_response = None;
+                Ok(None)
+            }
+            UhidEvent::Open | UhidEvent::Close | UhidEvent::Output | UhidEvent::Unknown { .. } => {
+                Ok(None)
+            }
+            UhidEvent::SetReport {
+                id,
+                report_number,
+                report_type,
+                data,
+            } => Ok(Some(self.handle_set(id, report_number, report_type, &data))),
+            UhidEvent::GetReport {
+                id,
+                report_number,
+                report_type,
+            } => Ok(Some(self.handle_get(id, report_number, report_type))),
+        }
+    }
+
+    fn handle_set(
+        &mut self,
+        id: u32,
+        report_number: u8,
+        report_type: u8,
+        data: &[u8],
+    ) -> UhidReply {
+        if self.state != FeatureEndpointState::Started
+            || !is_feature_request(report_number, report_type)
+            || data.len() != FEATURE_REPORT_BYTES
+            || self.pending_response.is_some()
+        {
+            return UhidReply::SetReport { id, success: false };
+        }
+        let mut report = [0_u8; FEATURE_REPORT_BYTES];
+        report.copy_from_slice(data);
+        let response = match self.bridge.exchange(report) {
+            BridgeExchangeResult::MatchedResponse(response) => response,
+            BridgeExchangeResult::NotSent => {
+                encode_transport_envelope(TransportEnvelopeKind::NotSent)
+            }
+            BridgeExchangeResult::MayHaveBeenSent => {
+                encode_transport_envelope(TransportEnvelopeKind::MayHaveBeenSent)
+            }
+        };
+        self.pending_response = Some(response);
+        UhidReply::SetReport { id, success: true }
+    }
+
+    fn handle_get(&mut self, id: u32, report_number: u8, report_type: u8) -> UhidReply {
+        if self.state != FeatureEndpointState::Started
+            || !is_feature_request(report_number, report_type)
+        {
+            return UhidReply::GetReport { id, data: None };
+        }
+        UhidReply::GetReport {
+            id,
+            data: self
+                .pending_response
+                .take()
+                .map(|response| response.to_vec()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::uhid::decode_transport_envelope;
+    use std::collections::VecDeque;
+
+    struct FakeBridge {
+        results: VecDeque<BridgeExchangeResult>,
+        requests: Vec<[u8; FEATURE_REPORT_BYTES]>,
+    }
+
+    impl BridgeExchange for FakeBridge {
+        fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
+            self.requests.push(report);
+            self.results.pop_front().expect("test bridge has a result")
+        }
+    }
+
+    fn endpoint(results: Vec<BridgeExchangeResult>) -> FeatureEndpoint<FakeBridge> {
+        let mut endpoint = FeatureEndpoint::new(FakeBridge {
+            results: results.into(),
+            requests: Vec::new(),
+        });
+        endpoint
+            .handle(UhidEvent::Start { flags: 0 })
+            .expect("endpoint starts");
+        endpoint
+    }
+
+    fn set(id: u32, byte: u8) -> UhidEvent {
+        UhidEvent::SetReport {
+            id,
+            report_number: 0,
+            report_type: 0,
+            data: vec![byte; FEATURE_REPORT_BYTES],
+        }
+    }
+
+    fn get(id: u32) -> UhidEvent {
+        UhidEvent::GetReport {
+            id,
+            report_number: 0,
+            report_type: 0,
+        }
+    }
+
+    #[test]
+    fn matched_response_is_returned_untouched_and_consumed_once() {
+        let expected = [0xa5; FEATURE_REPORT_BYTES];
+        let mut endpoint = endpoint(vec![BridgeExchangeResult::MatchedResponse(expected)]);
+        assert_eq!(
+            endpoint.handle(set(10, 0x42)).expect("set succeeds"),
+            Some(UhidReply::SetReport {
+                id: 10,
+                success: true
+            })
+        );
+        assert_eq!(endpoint.bridge.requests, vec![[0x42; FEATURE_REPORT_BYTES]]);
+        assert_eq!(
+            endpoint.handle(get(11)).expect("get succeeds"),
+            Some(UhidReply::GetReport {
+                id: 11,
+                data: Some(expected.to_vec())
+            })
+        );
+        assert_eq!(
+            endpoint.handle(get(12)).expect("empty get is answered"),
+            Some(UhidReply::GetReport { id: 12, data: None })
+        );
+    }
+
+    #[test]
+    fn transport_certainty_is_preserved_in_the_response_channel() {
+        for (result, expected) in [
+            (
+                BridgeExchangeResult::NotSent,
+                TransportEnvelopeKind::NotSent,
+            ),
+            (
+                BridgeExchangeResult::MayHaveBeenSent,
+                TransportEnvelopeKind::MayHaveBeenSent,
+            ),
+        ] {
+            let mut endpoint = endpoint(vec![result]);
+            endpoint.handle(set(1, 0x11)).expect("set succeeds");
+            let Some(UhidReply::GetReport {
+                data: Some(response),
+                ..
+            }) = endpoint.handle(get(2)).expect("get succeeds")
+            else {
+                panic!("response is present");
+            };
+            assert_eq!(decode_transport_envelope(&response), Some(expected));
+        }
+    }
+
+    #[test]
+    fn invalid_and_overlapping_requests_never_reach_the_bridge() {
+        let mut endpoint = endpoint(vec![BridgeExchangeResult::NotSent]);
+        assert_eq!(
+            endpoint
+                .handle(UhidEvent::SetReport {
+                    id: 1,
+                    report_number: 1,
+                    report_type: 0,
+                    data: vec![0; FEATURE_REPORT_BYTES],
+                })
+                .expect("invalid set is answered"),
+            Some(UhidReply::SetReport {
+                id: 1,
+                success: false
+            })
+        );
+        assert!(endpoint.bridge.requests.is_empty());
+
+        endpoint.handle(set(2, 0x22)).expect("first set succeeds");
+        assert_eq!(
+            endpoint.handle(set(3, 0x33)).expect("overlap is answered"),
+            Some(UhidReply::SetReport {
+                id: 3,
+                success: false
+            })
+        );
+        assert_eq!(endpoint.bridge.requests, vec![[0x22; FEATURE_REPORT_BYTES]]);
+    }
+
+    #[test]
+    fn stop_discards_pending_data_and_blocks_exchange_until_restart() {
+        let mut endpoint = endpoint(vec![BridgeExchangeResult::NotSent]);
+        endpoint.handle(set(1, 0x44)).expect("set succeeds");
+        endpoint.handle(UhidEvent::Stop).expect("stop succeeds");
+        assert_eq!(endpoint.state(), FeatureEndpointState::Stopped);
+        assert!(!endpoint.has_pending_response());
+        assert_eq!(
+            endpoint.handle(get(2)).expect("stopped get is answered"),
+            Some(UhidReply::GetReport { id: 2, data: None })
+        );
+    }
+
+    #[test]
+    fn numbered_feature_start_is_rejected() {
+        let mut endpoint = FeatureEndpoint::new(FakeBridge {
+            results: VecDeque::new(),
+            requests: Vec::new(),
+        });
+        assert_eq!(
+            endpoint.handle(UhidEvent::Start { flags: 0x04 }),
+            Err(EndpointError::InvalidFeatureRequest)
+        );
+        assert_eq!(endpoint.state(), FeatureEndpointState::Created);
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/lib.rs b/crates/hfx-uhid-relay/src/lib.rs
new file mode 100644
index 0000000..e5defe5
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/lib.rs
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+//! Feature-only UHID transport for qualified `HyperFlux` native routes.
+//!
+//! This crate deliberately creates no keyboard, pointer, consumer-control, or
+//! other input collections. `OpenRazer` continues to consume the existing
+//! physical input devices; UHID carries only its 90-byte vendor Feature
+//! transactions through the `HyperFlux` bridge.
+
+mod bridge;
+mod catalog;
+mod endpoint;
+mod runtime;
+mod supervisor;
+mod uhid;
+
+pub use bridge::{
+    BridgeExchange, BridgeExchangeResult, NativeBridge, NativeBridgeError, NativeRouteMonitor,
+};
+pub use catalog::{NativeRouteCatalog, NativeRouteCatalogError, NativeRouteRecord};
+pub use endpoint::{EndpointError, FeatureEndpoint, FeatureEndpointState};
+pub use runtime::{RelayPaths, RelayRuntimeError, run_relay};
+pub use supervisor::{RouteAction, RouteIdentity, RouteSupervisor, RouteSupervisorError};
+pub use uhid::{
+    FEATURE_REPORT_BYTES, HYPERFLUX_PHYS_PREFIX, TRANSPORT_ENVELOPE_MAGIC, TransportEnvelopeKind,
+    UHID_EVENT_BYTES, UhidCodecError, UhidEvent, UhidReply, VirtualDeviceSpec,
+    decode_transport_envelope, encode_transport_envelope,
+};
diff --git a/crates/hfx-uhid-relay/src/main.rs b/crates/hfx-uhid-relay/src/main.rs
new file mode 100644
index 0000000..d0ea09e
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/main.rs
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#![forbid(unsafe_code)]
+
+use hfx_runtime::{PRODUCT_DISPLAY_NAME, PRODUCT_VERSION};
+use hfx_uhid_relay::{RelayPaths, run_relay};
+use signal_hook::{consts::TERM_SIGNALS, flag, low_level};
+use std::path::PathBuf;
+use std::process::ExitCode;
+use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+
+const USAGE: &str =
+    "Usage: hyperflux-next-uhid-relay [--socket ABSOLUTE_PATH] [--uhid ABSOLUTE_PATH]";
+
+#[derive(Debug, Eq, PartialEq)]
+enum Command {
+    Run(RelayPaths),
+    Help,
+    Version,
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("HFX-OPENRAZER-RELAY-001: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), String> {
+    match parse_arguments(std::env::args().skip(1))? {
+        Command::Help => {
+            println!("{PRODUCT_DISPLAY_NAME} OpenRazer relay {PRODUCT_VERSION}\n\n{USAGE}");
+            Ok(())
+        }
+        Command::Version => {
+            println!("{PRODUCT_VERSION}");
+            Ok(())
+        }
+        Command::Run(paths) => run_with_signals(&paths),
+    }
+}
+
+fn run_with_signals(paths: &RelayPaths) -> Result<(), String> {
+    let termination = Arc::new(AtomicBool::new(false));
+    let mut registrations = Vec::new();
+    for signal in TERM_SIGNALS {
+        registrations.push(
+            flag::register(*signal, Arc::clone(&termination))
+                .map_err(|_| "termination signal registration failed".to_owned())?,
+        );
+    }
+    let result = run_relay(paths, termination.as_ref()).map_err(|error| error.to_string());
+    for registration in registrations {
+        let _ = low_level::unregister(registration);
+    }
+    result
+}
+
+fn parse_arguments(arguments: impl IntoIterator<Item = String>) -> Result<Command, String> {
+    let arguments = arguments.into_iter().collect::<Vec<_>>();
+    match arguments.as_slice() {
+        [flag] if flag == "--help" || flag == "-h" => return Ok(Command::Help),
+        [flag] if flag == "--version" => return Ok(Command::Version),
+        _ => {}
+    }
+
+    let mut paths = RelayPaths::linux();
+    let mut socket_seen = false;
+    let mut uhid_seen = false;
+    let mut index = 0;
+    while index < arguments.len() {
+        let flag = &arguments[index];
+        let value = arguments
+            .get(index + 1)
+            .ok_or_else(|| format!("{flag} requires an absolute path\n{USAGE}"))?;
+        let path = PathBuf::from(value);
+        if !path.is_absolute() {
+            return Err(format!("{flag} requires an absolute path\n{USAGE}"));
+        }
+        match flag.as_str() {
+            "--socket" if !socket_seen => {
+                paths.bridge_socket = path;
+                socket_seen = true;
+            }
+            "--uhid" if !uhid_seen => {
+                paths.uhid_device = path;
+                uhid_seen = true;
+            }
+            "--socket" | "--uhid" => {
+                return Err(format!("{flag} may be provided only once\n{USAGE}"));
+            }
+            _ => return Err(format!("unknown option: {flag}\n{USAGE}")),
+        }
+        index += 2;
+    }
+    Ok(Command::Run(paths))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn strings(values: &[&str]) -> Vec<String> {
+        values.iter().map(|value| (*value).to_owned()).collect()
+    }
+
+    #[test]
+    fn defaults_to_production_paths() {
+        assert_eq!(
+            parse_arguments(Vec::new()).expect("arguments parse"),
+            Command::Run(RelayPaths::linux())
+        );
+    }
+
+    #[test]
+    fn accepts_absolute_overrides_in_either_order() {
+        let command = parse_arguments(strings(&[
+            "--uhid",
+            "/tmp/test-uhid",
+            "--socket",
+            "/tmp/test.sock",
+        ]))
+        .expect("arguments parse");
+        assert_eq!(
+            command,
+            Command::Run(RelayPaths {
+                bridge_socket: PathBuf::from("/tmp/test.sock"),
+                uhid_device: PathBuf::from("/tmp/test-uhid"),
+            })
+        );
+    }
+
+    #[test]
+    fn rejects_relative_missing_duplicate_and_unknown_values() {
+        for arguments in [
+            strings(&["--socket", "relative.sock"]),
+            strings(&["--uhid"]),
+            strings(&["--socket", "/a", "--socket", "/b"]),
+            strings(&["--other", "/tmp/value"]),
+        ] {
+            assert!(parse_arguments(arguments).is_err());
+        }
+    }
+
+    #[test]
+    fn help_and_version_are_side_effect_free_commands() {
+        assert_eq!(
+            parse_arguments(strings(&["--help"])).expect("help parses"),
+            Command::Help
+        );
+        assert_eq!(
+            parse_arguments(strings(&["--version"])).expect("version parses"),
+            Command::Version
+        );
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/runtime.rs b/crates/hfx-uhid-relay/src/runtime.rs
new file mode 100644
index 0000000..9d1a88d
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/runtime.rs
@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::{
+    FeatureEndpoint, NativeBridge, NativeRouteCatalog, NativeRouteMonitor, RouteAction,
+    RouteIdentity, RouteSupervisor, UHID_EVENT_BYTES, UhidEvent, UhidReply,
+};
+use hfx_domain::EventBatchLimit;
+use hfx_sdk::EventSubscription;
+use rustix::fs::{OFlags, fcntl_getfl, fcntl_setfl};
+use std::collections::{BTreeMap, VecDeque};
+use std::fmt;
+use std::fs::{File, OpenOptions};
+use std::io::{self, Read, Write};
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::{Duration, Instant};
+
+const WATCH_INTERVAL: Duration = Duration::from_millis(100);
+const IDLE_INTERVAL: Duration = Duration::from_millis(10);
+const MAX_PENDING_REPLIES: usize = 8;
+const WATCH_BATCH_SIZE: u16 = 32;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RelayPaths {
+    pub bridge_socket: PathBuf,
+    pub uhid_device: PathBuf,
+}
+
+impl RelayPaths {
+    #[must_use]
+    pub fn linux() -> Self {
+        Self {
+            bridge_socket: PathBuf::from(hfx_runtime::BRIDGE_SOCKET_PATH),
+            uhid_device: PathBuf::from("/dev/uhid"),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum RelayRuntimeError {
+    Catalog,
+    Bridge,
+    Supervisor,
+    UhidOpen,
+    UhidRead,
+    UhidWrite,
+    UhidCodec,
+    Endpoint,
+    ReplyQueue,
+    InvalidBatchLimit,
+}
+
+impl fmt::Display for RelayRuntimeError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::Catalog => "OpenRazer native-route catalog is invalid",
+            Self::Bridge => "HyperFlux native-route bridge session failed",
+            Self::Supervisor => "native-route supervisor rejected bridge state",
+            Self::UhidOpen => "feature-only UHID endpoint could not be opened",
+            Self::UhidRead => "feature-only UHID event could not be read",
+            Self::UhidWrite => "feature-only UHID reply could not be written",
+            Self::UhidCodec => "feature-only UHID event or reply is invalid",
+            Self::Endpoint => "feature-only UHID request sequence is invalid",
+            Self::ReplyQueue => "feature-only UHID reply queue exceeded its bound",
+            Self::InvalidBatchLimit => "native-route watch batch limit is invalid",
+        })
+    }
+}
+
+impl std::error::Error for RelayRuntimeError {}
+
+struct PendingWrite {
+    bytes: Vec<u8>,
+    offset: usize,
+}
+
+struct RunningEndpoint {
+    file: File,
+    endpoint: FeatureEndpoint<NativeBridge>,
+    pending: VecDeque<PendingWrite>,
+    destroyed: bool,
+}
+
+impl RunningEndpoint {
+    fn create(
+        paths: &RelayPaths,
+        route: hfx_protocol::NativeRoute,
+        device: crate::VirtualDeviceSpec,
+        instance: u32,
+    ) -> Result<Self, RelayRuntimeError> {
+        let bridge = NativeBridge::connect(&paths.bridge_socket, route, instance)
+            .map_err(|_| RelayRuntimeError::Bridge)?;
+        let mut file = open_uhid(&paths.uhid_device)?;
+        write_blocking(&mut file, &UhidReply::Create(device))?;
+        let flags = fcntl_getfl(&file).map_err(|_| RelayRuntimeError::UhidOpen)?;
+        fcntl_setfl(&file, flags | OFlags::NONBLOCK).map_err(|_| RelayRuntimeError::UhidOpen)?;
+        Ok(Self {
+            file,
+            endpoint: FeatureEndpoint::new(bridge),
+            pending: VecDeque::new(),
+            destroyed: false,
+        })
+    }
+
+    fn step(&mut self) -> Result<(), RelayRuntimeError> {
+        self.flush()?;
+        let mut bytes = [0_u8; UHID_EVENT_BYTES];
+        loop {
+            match self.file.read(&mut bytes) {
+                Ok(0) => return Err(RelayRuntimeError::UhidRead),
+                Ok(count) => {
+                    let event = UhidEvent::decode(&bytes[..count])
+                        .map_err(|_| RelayRuntimeError::UhidCodec)?;
+                    if let Some(reply) = self
+                        .endpoint
+                        .handle(event)
+                        .map_err(|_| RelayRuntimeError::Endpoint)?
+                    {
+                        self.enqueue(&reply)?;
+                    }
+                }
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => break,
+                Err(error) if error.kind() == io::ErrorKind::Interrupted => {}
+                Err(_) => return Err(RelayRuntimeError::UhidRead),
+            }
+        }
+        self.flush()
+    }
+
+    fn enqueue(&mut self, reply: &UhidReply) -> Result<(), RelayRuntimeError> {
+        if self.pending.len() >= MAX_PENDING_REPLIES {
+            return Err(RelayRuntimeError::ReplyQueue);
+        }
+        self.pending.push_back(PendingWrite {
+            bytes: reply.encode().map_err(|_| RelayRuntimeError::UhidCodec)?,
+            offset: 0,
+        });
+        Ok(())
+    }
+
+    fn flush(&mut self) -> Result<(), RelayRuntimeError> {
+        while let Some(write) = self.pending.front_mut() {
+            match self.file.write(&write.bytes[write.offset..]) {
+                Ok(0) => return Err(RelayRuntimeError::UhidWrite),
+                Ok(count) => {
+                    write.offset += count;
+                    if write.offset == write.bytes.len() {
+                        self.pending.pop_front();
+                    }
+                }
+                Err(error) if error.kind() == io::ErrorKind::WouldBlock => break,
+                Err(error) if error.kind() == io::ErrorKind::Interrupted => {}
+                Err(_) => return Err(RelayRuntimeError::UhidWrite),
+            }
+        }
+        Ok(())
+    }
+
+    fn destroy(mut self) {
+        self.destroy_inner();
+    }
+
+    fn destroy_inner(&mut self) {
+        if self.destroyed {
+            return;
+        }
+        self.destroyed = true;
+        let _ = self.flush();
+        if let Ok(flags) = fcntl_getfl(&self.file) {
+            let _ = fcntl_setfl(&self.file, flags & !OFlags::NONBLOCK);
+        }
+        let _ = write_blocking(&mut self.file, &UhidReply::Destroy);
+    }
+}
+
+impl Drop for RunningEndpoint {
+    fn drop(&mut self) {
+        self.destroy_inner();
+    }
+}
+
+/// Runs one source-bound `OpenRazer` native-route relay session.
+///
+/// # Errors
+///
+/// Fails closed on bridge, catalog, supervisor, or UHID errors. Dropping the
+/// session destroys every virtual endpoint and releases every route lease.
+pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), RelayRuntimeError> {
+    let catalog = NativeRouteCatalog::load().map_err(|_| RelayRuntimeError::Catalog)?;
+    let mut monitor =
+        NativeRouteMonitor::connect(&paths.bridge_socket).map_err(|_| RelayRuntimeError::Bridge)?;
+    let inventory = monitor.enumerate().map_err(|_| RelayRuntimeError::Bridge)?;
+    let mut supervisor = RouteSupervisor::default();
+    let actions = supervisor
+        .reconcile(&inventory, &catalog)
+        .map_err(|_| RelayRuntimeError::Supervisor)?;
+    let mut endpoints = BTreeMap::new();
+    let mut next_instance = 1_u32;
+    apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+
+    let batch_limit = EventBatchLimit::try_from(WATCH_BATCH_SIZE)
+        .map_err(|_| RelayRuntimeError::InvalidBatchLimit)?;
+    let mut subscription_id = None;
+    let mut cursor = Some(inventory.cursor);
+    let mut next_watch = Instant::now();
+
+    while !termination.load(Ordering::Relaxed) {
+        for endpoint in endpoints.values_mut() {
+            endpoint.step()?;
+        }
+        if Instant::now() >= next_watch {
+            let batch = monitor
+                .watch(EventSubscription {
+                    subscription_id: subscription_id.clone(),
+                    expected_cursor: cursor.clone(),
+                    max_events: batch_limit,
+                })
+                .map_err(|_| RelayRuntimeError::Bridge)?;
+            if batch.cursor_gap {
+                let inventory = monitor.enumerate().map_err(|_| RelayRuntimeError::Bridge)?;
+                let actions = supervisor
+                    .reconcile(&inventory, &catalog)
+                    .map_err(|_| RelayRuntimeError::Supervisor)?;
+                apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+                subscription_id = None;
+                cursor = Some(inventory.cursor);
+            } else {
+                for event in &batch.events {
+                    let actions = supervisor
+                        .apply_event(event, &catalog)
+                        .map_err(|_| RelayRuntimeError::Supervisor)?;
+                    apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+                }
+                subscription_id = Some(batch.subscription_id);
+                cursor = Some(batch.next_cursor);
+            }
+            next_watch = if batch.has_more {
+                Instant::now()
+            } else {
+                Instant::now() + WATCH_INTERVAL
+            };
+        }
+        thread::sleep(IDLE_INTERVAL);
+    }
+    destroy_all(&mut endpoints);
+    Ok(())
+}
+
+fn apply_actions(
+    paths: &RelayPaths,
+    actions: Vec<RouteAction>,
+    endpoints: &mut BTreeMap<RouteIdentity, RunningEndpoint>,
+    next_instance: &mut u32,
+) -> Result<(), RelayRuntimeError> {
+    for action in actions {
+        match action {
+            RouteAction::Stop { identity } => {
+                if let Some(endpoint) = endpoints.remove(&identity) {
+                    endpoint.destroy();
+                }
+            }
+            RouteAction::Start {
+                identity,
+                route,
+                device,
+                ..
+            } => {
+                let instance = *next_instance;
+                *next_instance = next_instance
+                    .checked_add(1)
+                    .ok_or(RelayRuntimeError::Bridge)?;
+                let endpoint = RunningEndpoint::create(paths, *route, *device, instance)?;
+                if let Some(previous) = endpoints.insert(identity, endpoint) {
+                    previous.destroy();
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
+fn destroy_all(endpoints: &mut BTreeMap<RouteIdentity, RunningEndpoint>) {
+    while let Some((_, endpoint)) = endpoints.pop_first() {
+        endpoint.destroy();
+    }
+}
+
+fn open_uhid(path: &Path) -> Result<File, RelayRuntimeError> {
+    OpenOptions::new()
+        .read(true)
+        .write(true)
+        .open(path)
+        .map_err(|_| RelayRuntimeError::UhidOpen)
+}
+
+fn write_blocking(file: &mut File, reply: &UhidReply) -> Result<(), RelayRuntimeError> {
+    let bytes = reply.encode().map_err(|_| RelayRuntimeError::UhidCodec)?;
+    file.write_all(&bytes)
+        .map_err(|_| RelayRuntimeError::UhidWrite)
+}
diff --git a/crates/hfx-uhid-relay/src/supervisor.rs b/crates/hfx-uhid-relay/src/supervisor.rs
new file mode 100644
index 0000000..bde8460
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/supervisor.rs
@@ -0,0 +1,524 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::catalog::{NativeRouteCatalog, NativeRouteRecord};
+use crate::uhid::VirtualDeviceSpec;
+use hfx_domain::{
+    EndpointId, GenerationId, LogicalDeviceId, NativeRouteAccess, NativeRouteEventKind, ReceiverId,
+    ResourceKind, RouteState, SequenceNumber,
+};
+use hfx_protocol::{NativeRoute, NativeRouteEvent, NativeRouteInventory};
+use sha2::{Digest, Sha256};
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+
+#[allow(clippy::struct_field_names)]
+#[derive(Clone, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct RouteIdentity {
+    pub receiver_id: ReceiverId,
+    pub generation_id: GenerationId,
+    pub device_id: LogicalDeviceId,
+    pub endpoint_id: EndpointId,
+}
+
+impl From<&NativeRoute> for RouteIdentity {
+    fn from(route: &NativeRoute) -> Self {
+        Self {
+            receiver_id: route.receiver_id.clone(),
+            generation_id: route.generation_id,
+            device_id: route.device_id.clone(),
+            endpoint_id: route.endpoint_id.clone(),
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum RouteAction {
+    Start {
+        identity: RouteIdentity,
+        route: Box<NativeRoute>,
+        record: Box<NativeRouteRecord>,
+        device: Box<VirtualDeviceSpec>,
+    },
+    Stop {
+        identity: RouteIdentity,
+    },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum RouteSupervisorError {
+    DuplicateRoute,
+    InvalidQualifiedRoute,
+    InvalidDeviceSpec,
+    StaleEvent,
+}
+
+impl fmt::Display for RouteSupervisorError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::DuplicateRoute => "native route inventory contains a duplicate identity",
+            Self::InvalidQualifiedRoute => "qualified native route has invalid write authority",
+            Self::InvalidDeviceSpec => "native route cannot produce a trusted UHID identity",
+            Self::StaleEvent => "native route event is stale or non-contiguous",
+        })
+    }
+}
+
+impl std::error::Error for RouteSupervisorError {}
+
+#[derive(Clone, Debug, Default)]
+pub struct RouteSupervisor {
+    active: BTreeMap<RouteIdentity, NativeRoute>,
+    last_sequence: Option<SequenceNumber>,
+}
+
+impl RouteSupervisor {
+    #[must_use]
+    pub fn active_identities(&self) -> Vec<RouteIdentity> {
+        self.active.keys().cloned().collect()
+    }
+
+    /// Reconciles one complete route inventory into deterministic stop/start
+    /// actions. Candidate and unknown routes remain visible to the bridge but
+    /// never become UHID endpoints.
+    ///
+    /// # Errors
+    ///
+    /// Rejects duplicate identities and malformed qualified write authority.
+    pub fn reconcile(
+        &mut self,
+        inventory: &NativeRouteInventory,
+        catalog: &NativeRouteCatalog,
+    ) -> Result<Vec<RouteAction>, RouteSupervisorError> {
+        let mut seen = BTreeSet::new();
+        let mut desired = BTreeMap::new();
+        for route in &inventory.routes {
+            let identity = RouteIdentity::from(route);
+            if !seen.insert(identity.clone()) {
+                return Err(RouteSupervisorError::DuplicateRoute);
+            }
+            if let Some((record, device)) = eligible_route(route, catalog)? {
+                desired.insert(identity, (route.clone(), record.clone(), device));
+            }
+        }
+
+        let mut actions = Vec::new();
+        for (identity, current) in &self.active {
+            if desired
+                .get(identity)
+                .is_none_or(|(next, _, _)| next != current)
+            {
+                actions.push(RouteAction::Stop {
+                    identity: identity.clone(),
+                });
+            }
+        }
+        for (identity, (route, record, device)) in &desired {
+            if self.active.get(identity) != Some(route) {
+                actions.push(RouteAction::Start {
+                    identity: identity.clone(),
+                    route: Box::new(route.clone()),
+                    record: Box::new(record.clone()),
+                    device: Box::new(device.clone()),
+                });
+            }
+        }
+        self.active = desired
+            .into_iter()
+            .map(|(identity, (route, _, _))| (identity, route))
+            .collect();
+        self.last_sequence = Some(inventory.cursor.sequence);
+        Ok(actions)
+    }
+
+    /// Applies one contiguous route event. Generation replacement removes the
+    /// older endpoint before considering the new route.
+    ///
+    /// # Errors
+    ///
+    /// Rejects stale or skipped event sequences and malformed qualified routes.
+    pub fn apply_event(
+        &mut self,
+        event: &NativeRouteEvent,
+        catalog: &NativeRouteCatalog,
+    ) -> Result<Vec<RouteAction>, RouteSupervisorError> {
+        if let Some(last) = self.last_sequence {
+            let expected = last
+                .get()
+                .checked_add(1)
+                .ok_or(RouteSupervisorError::StaleEvent)?;
+            if event.sequence.get() != expected {
+                return Err(RouteSupervisorError::StaleEvent);
+            }
+        }
+        let identity = RouteIdentity::from(&event.route);
+        let mut actions = Vec::new();
+        match event.kind {
+            NativeRouteEventKind::Unavailable => {
+                stop_route_family(&mut self.active, &event.route, &mut actions);
+            }
+            NativeRouteEventKind::GenerationReplaced => {
+                stop_route_family(&mut self.active, &event.route, &mut actions);
+                start_if_eligible(
+                    &mut self.active,
+                    &event.route,
+                    identity,
+                    catalog,
+                    &mut actions,
+                )?;
+            }
+            NativeRouteEventKind::Available => {
+                if let Some(previous) = self.active.get(&identity)
+                    && previous != &event.route
+                {
+                    self.active.remove(&identity);
+                    actions.push(RouteAction::Stop {
+                        identity: identity.clone(),
+                    });
+                }
+                start_if_eligible(
+                    &mut self.active,
+                    &event.route,
+                    identity,
+                    catalog,
+                    &mut actions,
+                )?;
+            }
+        }
+        self.last_sequence = Some(event.sequence);
+        Ok(actions)
+    }
+}
+
+fn eligible_route<'a>(
+    route: &NativeRoute,
+    catalog: &'a NativeRouteCatalog,
+) -> Result<Option<(&'a NativeRouteRecord, VirtualDeviceSpec)>, RouteSupervisorError> {
+    let Some(record) = catalog.route(route.vendor_id, route.product_id, route.device_kind) else {
+        return Ok(None);
+    };
+    if route.access != NativeRouteAccess::Qualified || route.route_state != RouteState::Available {
+        return Ok(None);
+    }
+    let Some(token) = &route.route_token else {
+        return Err(RouteSupervisorError::InvalidQualifiedRoute);
+    };
+    let Some(resource) = &route.resource else {
+        return Err(RouteSupervisorError::InvalidQualifiedRoute);
+    };
+    if token.as_str().len() != 64
+        || resource.receiver_id != route.receiver_id
+        || resource.generation_id != route.generation_id
+        || resource.device_id != route.device_id
+        || resource.kind != ResourceKind::NativeControl
+        || route.report_bytes.get() != 90
+        || &route.protocol_family != catalog.protocol_family()
+    {
+        return Err(RouteSupervisorError::InvalidQualifiedRoute);
+    }
+    let device = VirtualDeviceSpec::new(
+        record.model_name.clone(),
+        route.vendor_id.get(),
+        route.product_id.get(),
+        catalog.descriptor().to_vec(),
+        &instance_label(route),
+    )
+    .map_err(|_| RouteSupervisorError::InvalidDeviceSpec)?;
+    Ok(Some((record, device)))
+}
+
+fn start_if_eligible(
+    active: &mut BTreeMap<RouteIdentity, NativeRoute>,
+    route: &NativeRoute,
+    identity: RouteIdentity,
+    catalog: &NativeRouteCatalog,
+    actions: &mut Vec<RouteAction>,
+) -> Result<(), RouteSupervisorError> {
+    if let Some((record, device)) = eligible_route(route, catalog)? {
+        active.insert(identity.clone(), route.clone());
+        actions.push(RouteAction::Start {
+            identity,
+            route: Box::new(route.clone()),
+            record: Box::new(record.clone()),
+            device: Box::new(device),
+        });
+    }
+    Ok(())
+}
+
+fn stop_route_family(
+    active: &mut BTreeMap<RouteIdentity, NativeRoute>,
+    route: &NativeRoute,
+    actions: &mut Vec<RouteAction>,
+) {
+    let identities = active
+        .keys()
+        .filter(|identity| {
+            identity.receiver_id == route.receiver_id
+                && identity.device_id == route.device_id
+                && identity.endpoint_id == route.endpoint_id
+        })
+        .cloned()
+        .collect::<Vec<_>>();
+    for identity in identities {
+        active.remove(&identity);
+        actions.push(RouteAction::Stop { identity });
+    }
+}
+
+fn instance_label(route: &NativeRoute) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(b"hyperflux-openrazer-uhid-v1\0");
+    hasher.update(route.receiver_id.as_str().as_bytes());
+    hasher.update(route.generation_id.get().to_le_bytes());
+    hasher.update(route.device_id.as_str().as_bytes());
+    hasher.update(route.endpoint_id.as_str().as_bytes());
+    let digest = hasher.finalize();
+    let mut label = String::from("native-");
+    for byte in &digest[..8] {
+        use std::fmt::Write as _;
+        let _ = write!(label, "{byte:02x}");
+    }
+    label
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        DeviceKind, EventBatchLimit, NativeProtocolFamily, NativeReportByteCount, NativeRouteToken,
+        ProductId, ProjectionRevision, StreamEpoch, StreamId, VendorId,
+    };
+    use hfx_protocol::{EventCursor, ResourceKey};
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test text is valid")
+    }
+
+    fn cursor(sequence: u64) -> EventCursor {
+        EventCursor {
+            stream_id: text::<StreamId>("native-routes-test"),
+            stream_epoch: StreamEpoch::try_from(1_u64).expect("epoch is valid"),
+            projection_revision: ProjectionRevision::try_from(1_u32).expect("revision is valid"),
+            sequence: SequenceNumber::try_from(sequence).expect("sequence is valid"),
+        }
+    }
+
+    fn route(
+        receiver: &str,
+        device: &str,
+        generation: u64,
+        product: u16,
+        kind: DeviceKind,
+        access: NativeRouteAccess,
+        state: RouteState,
+    ) -> NativeRoute {
+        let receiver_id = text::<ReceiverId>(receiver);
+        let generation_id = GenerationId::try_from(generation).expect("generation is valid");
+        let device_id = text::<LogicalDeviceId>(device);
+        let writable = access == NativeRouteAccess::Qualified && state == RouteState::Available;
+        NativeRoute {
+            receiver_id: receiver_id.clone(),
+            generation_id,
+            device_id: device_id.clone(),
+            endpoint_id: text::<EndpointId>("native-control"),
+            device_kind: kind,
+            vendor_id: VendorId::try_from(0x1532_u16).expect("vendor is valid"),
+            product_id: ProductId::try_from(product).expect("product is valid"),
+            route_state: state,
+            access,
+            protocol_family: text::<NativeProtocolFamily>("razer-feature-report-v1"),
+            report_bytes: NativeReportByteCount::try_from(90_u16).expect("size is valid"),
+            route_token: writable
+                .then(|| NativeRouteToken::try_from("a".repeat(64)).expect("token is valid")),
+            resource: writable.then_some(ResourceKey {
+                receiver_id,
+                generation_id,
+                device_id,
+                kind: ResourceKind::NativeControl,
+            }),
+        }
+    }
+
+    fn inventory(sequence: u64, routes: Vec<NativeRoute>) -> NativeRouteInventory {
+        NativeRouteInventory {
+            cursor: cursor(sequence),
+            routes,
+        }
+    }
+
+    #[test]
+    fn candidates_and_unknown_profiles_never_create_endpoints() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mut supervisor = RouteSupervisor::default();
+        let actions = supervisor
+            .reconcile(
+                &inventory(
+                    0,
+                    vec![
+                        route(
+                            "receiver-1",
+                            "mouse-1",
+                            1,
+                            0x00cd,
+                            DeviceKind::Mouse,
+                            NativeRouteAccess::Candidate,
+                            RouteState::Available,
+                        ),
+                        route(
+                            "receiver-1",
+                            "unknown-1",
+                            1,
+                            0xffff,
+                            DeviceKind::Mouse,
+                            NativeRouteAccess::Qualified,
+                            RouteState::Available,
+                        ),
+                    ],
+                ),
+                &catalog,
+            )
+            .expect("inventory reconciles");
+        assert!(actions.is_empty());
+        assert!(supervisor.active_identities().is_empty());
+    }
+
+    #[test]
+    fn identical_models_on_distinct_routes_are_not_deduplicated() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mut supervisor = RouteSupervisor::default();
+        let actions = supervisor
+            .reconcile(
+                &inventory(
+                    1,
+                    vec![
+                        route(
+                            "receiver-1",
+                            "mouse-1",
+                            1,
+                            0x00cd,
+                            DeviceKind::Mouse,
+                            NativeRouteAccess::Qualified,
+                            RouteState::Available,
+                        ),
+                        route(
+                            "receiver-2",
+                            "mouse-2",
+                            7,
+                            0x00cd,
+                            DeviceKind::Mouse,
+                            NativeRouteAccess::Qualified,
+                            RouteState::Available,
+                        ),
+                    ],
+                ),
+                &catalog,
+            )
+            .expect("inventory reconciles");
+        assert_eq!(actions.len(), 2);
+        assert_eq!(supervisor.active_identities().len(), 2);
+    }
+
+    #[test]
+    fn generation_replacement_stops_old_before_starting_new() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mut supervisor = RouteSupervisor::default();
+        supervisor
+            .reconcile(
+                &inventory(
+                    4,
+                    vec![route(
+                        "receiver-1",
+                        "keyboard-1",
+                        1,
+                        0x0296,
+                        DeviceKind::Keyboard,
+                        NativeRouteAccess::Qualified,
+                        RouteState::Available,
+                    )],
+                ),
+                &catalog,
+            )
+            .expect("initial inventory reconciles");
+        let replacement = route(
+            "receiver-1",
+            "keyboard-1",
+            2,
+            0x0296,
+            DeviceKind::Keyboard,
+            NativeRouteAccess::Qualified,
+            RouteState::Available,
+        );
+        let actions = supervisor
+            .apply_event(
+                &NativeRouteEvent {
+                    sequence: SequenceNumber::try_from(5_u64).expect("sequence is valid"),
+                    kind: NativeRouteEventKind::GenerationReplaced,
+                    route: replacement,
+                },
+                &catalog,
+            )
+            .expect("event applies");
+        assert!(matches!(actions.first(), Some(RouteAction::Stop { .. })));
+        assert!(matches!(actions.get(1), Some(RouteAction::Start { .. })));
+        assert_eq!(supervisor.active_identities()[0].generation_id.get(), 2);
+    }
+
+    #[test]
+    fn malformed_authority_and_noncontiguous_events_fail_closed() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mut supervisor = RouteSupervisor::default();
+        let mut malformed = route(
+            "receiver-1",
+            "mouse-1",
+            1,
+            0x00cd,
+            DeviceKind::Mouse,
+            NativeRouteAccess::Qualified,
+            RouteState::Available,
+        );
+        malformed.route_token = None;
+        assert_eq!(
+            supervisor.reconcile(&inventory(2, vec![malformed]), &catalog),
+            Err(RouteSupervisorError::InvalidQualifiedRoute)
+        );
+
+        supervisor
+            .reconcile(&inventory(2, Vec::new()), &catalog)
+            .expect("empty inventory reconciles");
+        let event = NativeRouteEvent {
+            sequence: SequenceNumber::try_from(4_u64).expect("sequence is valid"),
+            kind: NativeRouteEventKind::Available,
+            route: route(
+                "receiver-1",
+                "mouse-1",
+                1,
+                0x00cd,
+                DeviceKind::Mouse,
+                NativeRouteAccess::Qualified,
+                RouteState::Available,
+            ),
+        };
+        assert_eq!(
+            supervisor.apply_event(&event, &catalog),
+            Err(RouteSupervisorError::StaleEvent)
+        );
+    }
+
+    #[test]
+    fn feature_descriptor_has_no_input_or_output_main_items() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let descriptor = catalog.descriptor();
+        assert!(descriptor.windows(2).any(|item| item == [0xb1, 0x02]));
+        assert!(!descriptor.iter().any(|item| matches!(*item, 0x81 | 0x91)));
+    }
+
+    #[test]
+    fn event_batch_limit_type_remains_bounded_for_runtime_use() {
+        assert!(EventBatchLimit::try_from(32_u16).is_ok());
+        assert!(EventBatchLimit::try_from(0_u16).is_err());
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/uhid.rs b/crates/hfx-uhid-relay/src/uhid.rs
new file mode 100644
index 0000000..01d329c
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/uhid.rs
@@ -0,0 +1,326 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use std::fmt;
+
+pub const FEATURE_REPORT_BYTES: usize = 90;
+pub const HYPERFLUX_PHYS_PREFIX: &str = "hyperflux-next/native/v1/";
+pub const TRANSPORT_ENVELOPE_MAGIC: [u8; 8] = *b"HFXNERR1";
+
+const BUS_VIRTUAL: u16 = 0x06;
+const HID_MAX_DESCRIPTOR_SIZE: usize = 4_096;
+const UHID_DATA_MAX: usize = 4_096;
+pub const UHID_EVENT_BYTES: usize = 4_376;
+const UHID_DESTROY: u32 = 1;
+const UHID_START: u32 = 2;
+const UHID_STOP: u32 = 3;
+const UHID_OPEN: u32 = 4;
+const UHID_CLOSE: u32 = 5;
+const UHID_OUTPUT: u32 = 6;
+const UHID_GET_REPORT: u32 = 9;
+const UHID_GET_REPORT_REPLY: u32 = 10;
+const UHID_CREATE2: u32 = 11;
+const UHID_SET_REPORT: u32 = 13;
+const UHID_SET_REPORT_REPLY: u32 = 14;
+const UHID_FEATURE_REPORT: u8 = 0;
+const EIO: u16 = 5;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct VirtualDeviceSpec {
+    pub name: String,
+    pub phys: String,
+    pub vendor_id: u16,
+    pub product_id: u16,
+    pub version: u32,
+    pub country: u32,
+    pub descriptor: Vec<u8>,
+}
+
+impl VirtualDeviceSpec {
+    /// Creates one feature-only virtual transport identity.
+    ///
+    /// # Errors
+    ///
+    /// Rejects strings that do not fit the fixed UHID ABI, embedded NULs,
+    /// invalid descriptors, and an empty instance label.
+    pub fn new(
+        name: String,
+        vendor_id: u16,
+        product_id: u16,
+        descriptor: Vec<u8>,
+        instance_label: &str,
+    ) -> Result<Self, UhidCodecError> {
+        if name.is_empty()
+            || name.len() >= 128
+            || name.as_bytes().contains(&0)
+            || instance_label.is_empty()
+            || instance_label.len() > 24
+            || !instance_label
+                .bytes()
+                .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
+            || descriptor.is_empty()
+            || descriptor.len() > HID_MAX_DESCRIPTOR_SIZE
+        {
+            return Err(UhidCodecError::InvalidDeviceSpec);
+        }
+        let phys = format!("{HYPERFLUX_PHYS_PREFIX}{instance_label}");
+        if phys.len() >= 64 {
+            return Err(UhidCodecError::InvalidDeviceSpec);
+        }
+        Ok(Self {
+            name,
+            phys,
+            vendor_id,
+            product_id,
+            version: 0x0100,
+            country: 0,
+            descriptor,
+        })
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum UhidEvent {
+    Start {
+        flags: u64,
+    },
+    Stop,
+    Open,
+    Close,
+    GetReport {
+        id: u32,
+        report_number: u8,
+        report_type: u8,
+    },
+    SetReport {
+        id: u32,
+        report_number: u8,
+        report_type: u8,
+        data: Vec<u8>,
+    },
+    Output,
+    Unknown {
+        event_type: u32,
+    },
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum UhidReply {
+    Create(VirtualDeviceSpec),
+    Destroy,
+    GetReport { id: u32, data: Option<Vec<u8>> },
+    SetReport { id: u32, success: bool },
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum TransportEnvelopeKind {
+    NotSent,
+    MayHaveBeenSent,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum UhidCodecError {
+    InvalidDeviceSpec,
+    EventTooShort,
+    InvalidEvent,
+    InvalidReply,
+}
+
+impl fmt::Display for UhidCodecError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidDeviceSpec => "virtual HID device specification is invalid",
+            Self::EventTooShort => "UHID event is shorter than its typed payload",
+            Self::InvalidEvent => "UHID event payload is invalid",
+            Self::InvalidReply => "UHID reply payload is invalid",
+        })
+    }
+}
+
+impl std::error::Error for UhidCodecError {}
+
+impl UhidEvent {
+    /// Decodes one kernel UHID event. The kernel may return a short event; only
+    /// bytes required by the selected payload are mandatory.
+    ///
+    /// # Errors
+    ///
+    /// Rejects truncated typed payloads and impossible report lengths.
+    pub fn decode(bytes: &[u8]) -> Result<Self, UhidCodecError> {
+        let event_type = read_u32(bytes, 0).ok_or(UhidCodecError::EventTooShort)?;
+        match event_type {
+            UHID_START => Ok(Self::Start {
+                flags: read_u64(bytes, 4).ok_or(UhidCodecError::EventTooShort)?,
+            }),
+            UHID_STOP => Ok(Self::Stop),
+            UHID_OPEN => Ok(Self::Open),
+            UHID_CLOSE => Ok(Self::Close),
+            UHID_OUTPUT => Ok(Self::Output),
+            UHID_GET_REPORT => {
+                if bytes.len() < 10 {
+                    return Err(UhidCodecError::EventTooShort);
+                }
+                Ok(Self::GetReport {
+                    id: read_u32(bytes, 4).ok_or(UhidCodecError::EventTooShort)?,
+                    report_number: bytes[8],
+                    report_type: bytes[9],
+                })
+            }
+            UHID_SET_REPORT => {
+                if bytes.len() < 12 {
+                    return Err(UhidCodecError::EventTooShort);
+                }
+                let size = usize::from(read_u16(bytes, 10).ok_or(UhidCodecError::EventTooShort)?);
+                if size > UHID_DATA_MAX || bytes.len() < 12 + size {
+                    return Err(UhidCodecError::InvalidEvent);
+                }
+                Ok(Self::SetReport {
+                    id: read_u32(bytes, 4).ok_or(UhidCodecError::EventTooShort)?,
+                    report_number: bytes[8],
+                    report_type: bytes[9],
+                    data: bytes[12..12 + size].to_vec(),
+                })
+            }
+            _ => Ok(Self::Unknown { event_type }),
+        }
+    }
+}
+
+impl UhidReply {
+    /// Encodes one userspace-to-kernel UHID reply with the complete stable ABI
+    /// size. Reserved bytes remain zero.
+    ///
+    /// # Errors
+    ///
+    /// Rejects oversized response payloads or invalid device specifications.
+    pub fn encode(&self) -> Result<Vec<u8>, UhidCodecError> {
+        let mut bytes = vec![0_u8; UHID_EVENT_BYTES];
+        match self {
+            Self::Create(spec) => {
+                validate_spec(spec)?;
+                write_u32(&mut bytes, 0, UHID_CREATE2);
+                write_c_string(&mut bytes[4..132], &spec.name)?;
+                write_c_string(&mut bytes[132..196], &spec.phys)?;
+                write_u16(
+                    &mut bytes,
+                    260,
+                    u16::try_from(spec.descriptor.len())
+                        .map_err(|_| UhidCodecError::InvalidReply)?,
+                );
+                write_u16(&mut bytes, 262, BUS_VIRTUAL);
+                write_u32(&mut bytes, 264, u32::from(spec.vendor_id));
+                write_u32(&mut bytes, 268, u32::from(spec.product_id));
+                write_u32(&mut bytes, 272, spec.version);
+                write_u32(&mut bytes, 276, spec.country);
+                bytes[280..280 + spec.descriptor.len()].copy_from_slice(&spec.descriptor);
+            }
+            Self::Destroy => write_u32(&mut bytes, 0, UHID_DESTROY),
+            Self::GetReport { id, data } => {
+                write_u32(&mut bytes, 0, UHID_GET_REPORT_REPLY);
+                write_u32(&mut bytes, 4, *id);
+                match data {
+                    Some(data) if data.len() <= UHID_DATA_MAX => {
+                        write_u16(&mut bytes, 8, 0);
+                        write_u16(
+                            &mut bytes,
+                            10,
+                            u16::try_from(data.len()).map_err(|_| UhidCodecError::InvalidReply)?,
+                        );
+                        bytes[12..12 + data.len()].copy_from_slice(data);
+                    }
+                    Some(_) => return Err(UhidCodecError::InvalidReply),
+                    None => write_u16(&mut bytes, 8, EIO),
+                }
+            }
+            Self::SetReport { id, success } => {
+                write_u32(&mut bytes, 0, UHID_SET_REPORT_REPLY);
+                write_u32(&mut bytes, 4, *id);
+                write_u16(&mut bytes, 8, if *success { 0 } else { EIO });
+            }
+        }
+        Ok(bytes)
+    }
+}
+
+#[must_use]
+pub fn encode_transport_envelope(kind: TransportEnvelopeKind) -> [u8; FEATURE_REPORT_BYTES] {
+    let mut report = [0_u8; FEATURE_REPORT_BYTES];
+    report[..TRANSPORT_ENVELOPE_MAGIC.len()].copy_from_slice(&TRANSPORT_ENVELOPE_MAGIC);
+    report[8] = 1;
+    report[9] = match kind {
+        TransportEnvelopeKind::NotSent => 1,
+        TransportEnvelopeKind::MayHaveBeenSent => 2,
+    };
+    report[88] = 0x5a;
+    report[89] = 0xa5;
+    report
+}
+
+#[must_use]
+pub fn decode_transport_envelope(report: &[u8]) -> Option<TransportEnvelopeKind> {
+    if report.len() != FEATURE_REPORT_BYTES
+        || report[..TRANSPORT_ENVELOPE_MAGIC.len()] != TRANSPORT_ENVELOPE_MAGIC
+        || report[8] != 1
+        || report[10..88].iter().any(|byte| *byte != 0)
+        || report[88] != 0x5a
+        || report[89] != 0xa5
+    {
+        return None;
+    }
+    match report[9] {
+        1 => Some(TransportEnvelopeKind::NotSent),
+        2 => Some(TransportEnvelopeKind::MayHaveBeenSent),
+        _ => None,
+    }
+}
+
+#[must_use]
+pub const fn is_feature_request(report_number: u8, report_type: u8) -> bool {
+    report_number == 0 && report_type == UHID_FEATURE_REPORT
+}
+
+fn validate_spec(spec: &VirtualDeviceSpec) -> Result<(), UhidCodecError> {
+    if spec.name.is_empty()
+        || spec.name.len() >= 128
+        || spec.name.as_bytes().contains(&0)
+        || !spec.phys.starts_with(HYPERFLUX_PHYS_PREFIX)
+        || spec.phys.len() >= 64
+        || spec.phys.as_bytes().contains(&0)
+        || spec.descriptor.is_empty()
+        || spec.descriptor.len() > HID_MAX_DESCRIPTOR_SIZE
+    {
+        Err(UhidCodecError::InvalidDeviceSpec)
+    } else {
+        Ok(())
+    }
+}
+
+fn write_c_string(target: &mut [u8], value: &str) -> Result<(), UhidCodecError> {
+    if value.len() >= target.len() || value.as_bytes().contains(&0) {
+        return Err(UhidCodecError::InvalidReply);
+    }
+    target[..value.len()].copy_from_slice(value.as_bytes());
+    Ok(())
+}
+
+fn read_u16(bytes: &[u8], offset: usize) -> Option<u16> {
+    let value: [u8; 2] = bytes.get(offset..offset + 2)?.try_into().ok()?;
+    Some(u16::from_ne_bytes(value))
+}
+
+fn read_u32(bytes: &[u8], offset: usize) -> Option<u32> {
+    let value: [u8; 4] = bytes.get(offset..offset + 4)?.try_into().ok()?;
+    Some(u32::from_ne_bytes(value))
+}
+
+fn read_u64(bytes: &[u8], offset: usize) -> Option<u64> {
+    let value: [u8; 8] = bytes.get(offset..offset + 8)?.try_into().ok()?;
+    Some(u64::from_ne_bytes(value))
+}
+
+fn write_u16(bytes: &mut [u8], offset: usize, value: u16) {
+    bytes[offset..offset + 2].copy_from_slice(&value.to_ne_bytes());
+}
+
+fn write_u32(bytes: &mut [u8], offset: usize, value: u32) {
+    bytes[offset..offset + 4].copy_from_slice(&value.to_ne_bytes());
+}
diff --git a/docs/assets/social-preview.png b/docs/assets/social-preview.png
index 871dd08fb1210bbc22f1baf67304afd05b50173c..a473bd3230eb58e42dd5e7d4afcd906fc58a1f35 100644
GIT binary patch
literal 9685
zcmd5?c|4Ts+ka-5tOsqDqS0wz45iS?lJ*j%O(je@C#MLJ&=?+V&Pg?uq*An;qRo<!
zWz3{gP7UcCVl>Q*#1zKJHZ(K5_wzh6Nb2<aeBSr>dH*nT&%IpN_u8-fdHlZ4X~hrf
z<J2Jt`eD_|rRyPx0ET#26%W4FoLSrjK~pZTT57*B<c+Xq&Z#l0bm7{Z!f{Rao{jT6
z1^+-AmBd^esFZRf%FO=}uJCcaa$WJtNAwZv@0M?hH8S}4cG=Q~Y1D1$Hm}__Z8d$+
z7S()@=N{gt3W!IE;~l{l42=MvI8E?@*9RZUX5d4W3_f(2;A5Quv#&?g2S)r>bZNLv
z#xM?o7C}mbsliazSOt;c)`xN%!uMZ}d@l-&%U7ivjtdOAm$F1e?b|$EiG&xCa#L2U
zCZapn)vckdOrSKEZ{2qzOYo0t_=k%g^*Kr~q|4MQT6R@Hf(dD03>jnJ_$`nI88;io
z=`g(st)d8ND5RLe_NkI_&Hmf5O@n8Y54M1f(Tf0P@V(GbFESwy&;?_ZmzOsGrbt$t
zDw+9sDx9RwpAZr2*{Egb089qBO-WYTiSv1?Ms9M0l;lXXej}t^)I$lNGY3R-*T~tL
zVVJ}%LFl>$e`~(vQ;Y*AzNw66*_=sVMdbE9oj%hU-EMEBLutv%hqAaRTmWbiCMv>U
z>@?W1rgql{{V3f?A5wg|!(jxo72oTY(T3xTO5Kjn?kIG$N_6ncRU_s@o4wh8;PnAs
z1tnBfuP-_7iBTsjr$Gm-<k|#GG{~8|Vt#~2GV$!%N2(pwdqc5vo4qY&pfrq5MFR#X
zL_lv_#wxHCQ$F4%c$O2oU{`+0@i?YM4f4qMIj;NAEnv3srahFZ$D~=N{MsNCQQJH?
zQ;15PX{#;%uyGXIzNRNGfN7PvyCWQ5u}^yj-{}ol4c(m|KL&RKrFKXi(K?VKrI;4%
z5n-F#6I+yO*W1%JLhKtDnsGL-K<rj&`KU+Lk2^cR!d4a%_@UB;)YlXf?-t=wQyQ9I
z(n)(0a-`BDtgW5c7uG(D6Fepp(R$~5t_z9r=%ZVlWkF~LtB(>YnMM;lPxK4_rS9YQ
zh)OzVyItzpB5Csm9fh>^3T5&fU%7eYysTmUNNtNcnYgvL^DKqeyE`41|1q}BjwfBP
z79S)jSUsV3c{R7VM#$;V;GgCDNMFz?v%{>{&dqyQ&=r2OMPSWg$}JDvO0GLT2^ZEL
zLGTZScv9X&i2EoQ{cVORyjkuUA+;N>TH-_M&effS!n+>6qgb-7IH7g#8ZU#N``;Eq
z1>!*8gfaAe2Lqo@s_uT#HKXc=Q)I$K*tBm(h{%%^dQ0qdoMc_)irCI@G?V2<*akVQ
z!!)hSd>v=}rnj=@Jm+DbMk_aBmV1W>tdfA2HM@-JC4?;eHA<y5qfe{4*ObZO*vp+X
zQtlG)+L27LueCKS>bwK_YVzYFF3f~QHj7bvY87b*{l<7f=d?w6?6Xw~`8#NTzDfkl
z!;x~H1w7q!^{x_-shKj3ti6D6aMH+W4E6oBLD$Ms@NT0*#=0EmKH6HlwJNCcD7P~<
zx5*(-eIClxU>6H@Z-Rdl1Cso_F`hNGa{&_#S75QMdb!!|@4$Q?4RuZ%hWB2D&-(a{
zm<;E4C}fa(IZEQ_X}M|0IApUjVv6WZ22=Y(tKVC9ZaQ}I({wl2-jxPftH%Pr7RD$D
z@yB0$^JD8Y6efr-9~P$+4ZAm3lp5))VQy~XmpB^+VR{@|4osu6Tmfi+5=d&ymB-Y`
zGkydBs1HD-%cGQ#ra79aNIWPBU8a{h*(FjJnPr(F#+9cdJ9AH#*m%UPH*Gc(&i=Y}
z9=!GeSFxtzs^F=ZQFsNIS7bcJ7Th9$GJPhh3KKlr)&K&zMfa`(g)j!)&`*Fp8wV0(
z>tiKQ29c9U)j%^QD3EBBf%=B(927f*5K<lyuE;KLd`S3noV2z*&SM-ywylQh#+%xn
zS7^ETdBuCNP)$6xcV?7bYHRG=J_}7=TP+1XviCwxJr3$;j$|y1t0F7vBTPf?Ln#aW
ztAn82bx@RDVRDgm*Tqvc<1Us`v(8<Kpq`}G+{l{vdCk$pK+4?;zylZ)C&J?y51P0)
zwmCo={7rbP9aJM**gV)6lz-IWFb_2whEo1!C{Ef~!(JkEE2Z-U`pXDQ>WT=z^tSxM
z*lYD}(}Yn>S%piT$~coT%qbilOi>uMG|*X~dg`|aB5tVxQx?wg|4RhXY&z^3?^?fm
zYIJtb3R%icC956JKqr!K3Tq?og{fvZ5`@-y#M5P>?9e1?Y?J%BR>AytPf`FUu-9zE
zXhlARfpz5-3Izb58Is^9c2QHMY4h6)=1!VcI~tzrQU6T1L7cxUx-WU}g`P7GODbGy
zj7ze90H(oGJc0yK>3}3dJDowD%=fk>|4*8uA`QM?sylGt(?goKK_U&bf&-)B+NPmL
zzPq10Wx&+tak&}$>dq3k1n5l(9@n}5fK9iX>m+I3^_GV`>d7m~6V2^}9WO1MV~Up-
z7MEttfA&&(I&(NjSGWxbPG%L}YUVG&)XImYv)V0!TqjwlPp!J67S+4NJ++6pqha#B
zN7)x6)&`ugk%ze=5Wb`v@>ir!jSKLAmx)AN{;!bfJQFW1{wm#(!^Ddse38U}52@U@
zhCy?>*atlBNsJbeIc4<xpBv1Rf_t^=o=dwQ=2rb0M*k$lft6gnVS+^w#At3X9m9-~
z;@MILuPGP~%-Yg0so9e5X}4`^yZEG+t7Etd%2M8Uq9;FxHyeov4SohybA7j8yE;E6
zLUVngC<;~C&`i|dRbX`l5Q>{sdxU1bs(b0hiA1%SocY%i$lX3a`#!1K6@Hd+{>}XH
zOKeYhpY0smt2!+wHJzwF1?47>VxU^Kz0wznX_))QfNKqm{^g3|{|f4D?O~1P^kvpt
z2x&?6&au)Xbh{*JK?~J|R_P6TodinH-Z!GVEnDO462em}*@8_EuB@;TCtobBwl!(G
zP8}<z(Axw_yi$YA5iFiYLsis@k{#vVBQvj17)7t?mpm&glLcCenyqjYq+}Vx0w-Sb
z;iO#7L+h+$kx*vN>03`0$+A|2^jLf_k_uCu8;Zs5v>O#4xPpWQO0#TJrIp^4E4yqH
zxRQ6y-f1glcXInW-1X?$ug_Ejh&<17C0=Ot8E_=bLP+i$$4pn5V<P5w#&=lBHUVR{
ziE6@+;2%*-)cMj%dJ!cGN$2`QtcRvQz9FtUJpBken*223l52R?@5PpN$*kmaVf2=q
zO8PA!CsgG9W+BY-DC$}gMNeH;^OJDoMiagK=RFRmxsvp7J!0d?n=;a`+2XN&q4c&&
ze)5)alsQ>!s$aQJdC4AD-R_=fezG7TCspZ7_DcBfdr6B*4}2<{nY2i3YqbB^1|8ad
z_5HNW)1jAS#YyW0Dy{59#@pRO=OowCz&q08xXXd+9m$#IPiDMwHjnAC{im)n?(+b_
zJRGYn*4|KD#4@0d%VqZoty0`}v3dhh>ET*8R`Ao_PsP@fpA0m=v>r~`pYt-erA@Qm
z?tYQ|8p+WuJGI+(itfq^9Wn_1%_sH}NyUM<gxu)sncKHaKVZ?I#%D)c3+buOlEmWZ
zfLObR%auQN(T%-`6N1j<uqAgW^lc>4g`VEm0qgfQ_l9PD&1Js4Ef39}=-vDODB=F6
z*Lbymzs5U_V~PrTkEnYJy1>nG-Hzt!0%`BanJ2DrqWt`>74mbaeR>;pvhn(8e>w?9
z+VYW1U=gIos*-h(;cVoNhg=H#7Xo`^G`nkua-LRSaxFHw;97hi>}J~|12DJKx5T7j
zGbqo^#>FNLy5O$@%n{Ozln>}M=mu(lKW|^;+NgzJs2UiJQMsQ3yo9_^H9tM_D-$LF
zijPX9r3K0aVGJfTxoop+Inik7nN}gj9bwv!0O39d*)$8Jg+UPJWcNcL02uSLF$P9Q
z6f#s)Bh9jrGMCN7$bK=Q3rdegQ;6piL=l+mo%f*;em)mm0Y!xBGRRY92gV)|ydQ!$
zm_s*>1-eDmfMK}ciU^5f!1N0^WF2Orf}uhvROjbI#>h5JL9)^y%?;KI#zxsp4iT}H
ziJaejz~2n~0mG&rMh5++P#6=nEKr6zdEsvX5q*+Un>=5`UN>i+ugbnG%PcpgGOK^4
zXg?XxIn!_;i^^xq_C7y3ZL4ZS*3P(1;!nF;HjXD=lkI&|-Ngx9F4UCNR32}_o>;*2
zbZ~L;0X_j(;n{!z0D=DCvIp9^{tY3qE0bNrW5VK2>o89$jkdkquzBTDp^~{@nP1NZ
z&U1l9n4fNtzn`zR0kf<n?)t5rPwD%+j{~m;C6`}r^k-hGT?FvAkZU=zj=B<4Fl{<7
z+msO@MH17|hOSx;$72v%Ih4hVfm#)~uxysU;Bpkv1<W1&^9=qGZ^u5yl{-1Wfb!CQ
z^v@b7JnIM$B*6?$G}!?*PSfOjIUq39l)9@%4XRJ5<X}N<5Qo(58W)Lvr&~uF<GUZ?
zwp*IX!rdGp;zHP59Jxg6{w*2&1I}=6c7~%Qg~%2aD7OX>509C^Y!}^(%9o&lO7K4c
z`o^d{Ek0!m5Tn&PkYdCXuSNibHgx?2i((PJ?Zv_%h&Kzthbmoxf5;CWZbFB|!a)!P
zxr_B`UrHAO74n%UWWonGi`*e?sS%lxM}oa1CLQK|TK<L7XvCEWX*`@RGhBteEKM05
z;@Khy=&`?NM?yd${D68xu0ghI)in5#O5kST-(B4$aeL7!8O4l}>i<!!c6l;vP9q&N
zO!*CE(Ru;0ZLC)3d#bcb5pu0Tkf}{JqO;2j5Tg&iTnv>lwV)}Pcz80r@MOp2#0UQ6
zz$QIP=Ff{>zNXGDnyg_D1%G147BkkUMH~@a=73IB+G+H_k|k~Z<4EUp40%!hO5}2e
zBp7~1$$iKodkLCsP#4nrOF0d3iNQ{dzfdNRFC@nM10D%LG-&|$KQSocK{i!H{9`ol
z0FgNMWHgPSQL4yPmKJidUrZ2y*h1shXU9NR!%`8LcszbQnu!sjBL~tol4kl5AZb;e
zuI1Sjg8&3nK)})t${-ER8}fV%#0Rj)kCzK|$#uxYA)vEeM)K5%$zCv)$v^o6s0MSg
z5vr<K#X#~k!WFp5Kte}10YzZhRG#`~0U<FAm?8j&13G9O!h|R>K~)EM$fcqyD~gE1
zAcOP*s+MkG^nW>fYbX$+0wR?ROdK9m<QjB8D{`L|5JU~%f3yAO>x3aq{r6lu2aXJk
z{^dr1ZbVzC?>;houjSkJ_O&-?e?|?z{JE(A;ai5!4}bf*{4G6QjRv`xqe`Ymb`n&{
zOq}w!M_W8#`M%*tWGW7&vc&@(`9nB#gzsL*rOJAiG7`5JveRGS{!AkJEiShyES4OS
zc6PQ&igbc#X6*&!V^DZVp9{ftJesDE)(L6)(8p-VLmeF^um}hS0`i>Fld1+LkR%7z
zk%`052yko!SVvkx<XF@7{XQ!lc2?NHzpbvy<t(kyGu%y${do_=r)!(J;M4KdTUTj<
zgBoPRs|az>KVp6UK9~fWOpG4VVd747P5~22U~l{~z~kAcQF0{q;P5?D1f~vi)`%qV
zWRqA|K#qmnKNc9<!BjI~dVmL`r-3{LLf{e1v|bU+kj52#ex|ST9<SfzFg!oxO~@7x
zOdJ<YrySN9tyih-4~|qn{d9-L8Wo_|be9C*@Kr+jAaZ|;5T;N>P=EwcC;}awMC*}R
zMI2C}|E@zX+)hzpTZ;|#qzV_tn%F$Uh42kq{pVdO{{|kBF1<h*$cD6g2%~;DiX}OZ
zb1&QsuZlHXa-ut5n{KZsd1>%-K`BK|{S222^n~gZXuJ+`LsZib^mDr-<i1!U{r=A=
zS$IG>eMv9w&!9sUw^=pClqhLu(3Pt}jRBVJ+#Sal<e5F>$vH?O>$l5DxjldoU$H*A
z74yU)j%Q}p1>w^Qn4j><X8ggUd!~xH;YVo&;JG6>anJO#5l+(zhS0gMj+!*U33PS%
z(LGbeDmv0KHe3XPw?YrZkcy6c<kb!yI>)aDubWs+qFiz3Wy#FG1sqzE_<S{YbA9RE
zcORRn57Sd!Sby9PhyM0!5OZCc542=EQL0^fN`KFFl+^8m-RDML6cL2p3l3a4MYX1Q
zM7PmbGdzD!7G`|<>7<*7vxM6vj!y2JFh7dU3vT3Q7ESO<sO??{^bQma>gUjgGvpSO
z!g-vT-;<fY_0+*)N`w>3DM?mxOV(tbf6L1XzOdKrU1`|MZ7spZ1=KBRvax>GZ)m+*
zalfp%Goi;^d~9jYo8N2vmX;jreBFESes}ns#_nl>iRMoV>NULwb45d@pFh8y;NO#o
z{;cQCpXt<<@{4k7F3wP*x7I{-7;hCp%`8U46>*qhfOomifF;WQ<xeMHKcHJL&Xft#
z^@P(y-KRt~dn$#9>UA33%P85_&u~l2El%X7hU<k#UrIk;HN7X*#BSOiV&>c8)bQiG
z%Ih~>Cz-}&aNCtaB=6XC+O_&at9m5Fh{yA~e!QAtRCeA@EUkNezD~fVvKCZc9i%+^
z?ay!t67V)pK5V&|r1vrmJPRocSbhcn@a=8WSqb<W%0h91z`$uqP;O=V+Q@{^uFc?;
z)UgfoD1EDcquDnG&#si5>ohnOxQi|5usv_v{_)x%KK&X)wa^-d+uj@7HN`}3Np}1}
z)~A_v6EkE~RM%no(5YPUjS>Fkf!JGOx$e4d4Sq?Bvt9x5Ts58bILUeXOfGG!DdYV{
zh6cVQ?C(<sB%caVrqv#3MadS)ftQI-sz~eRm3mKv1Km^GLQ`DrZMYk*bK_hSC=AA!
z_t}06p8QlJ(OYA_y*Z6XSRuK8Wq}}#6zocR8<JJGWEjKA-H*RU<^31o0RjcoF?q-g
zKLT|V4Jfp34vhZyYbmJBSS{7>ud2h2K*RCXb^zc*-cEsM_W!LO=xcon29Y0X9Y&#)
zb?$AU`bkP>gl-I?SvTfX)=X{xxSgRJB;FK2qYy*OyKq+%wG$cE`(z#>s*9xbHpN<e
zuJ5ui(W12OHpOJFm!~9W1-+#{)rIC&Bg*l58Q4S3v}<6?mNP1MifoqemD_#9;76k}
zrAL!}B{jF|(@Uh)=EPF2uq+^c0!;-@|Bxr^<Yw;<^`S?+<YEtH1FrE7G|?UBDotwq
z*iqm}D=K?HohwMHHyyW&eGIK3IL$Az0|YY6_AW2P=lmH#ljRYjKNv)la;uNt;}@Fz
zaJ|Pfa~x|de0VR@^~8H3iXp>E@D0+jjRB1MxWwJs8EuqeO}=pS!W+A8$Z`Z8s&{yS
zsd<hJN#j2I+iYQs0h2;p+q{eg3Onl1SVMrtYRJ(ISG}w@g_O^DWl}n)@#Dj4mj+}=
zfUEE!qTP|`+w;;u_5BSqZaZ_V+sC{=F9^s&&YYD0iwXEY6ii4oVJA$2S&UJgA={k%
zz?+hCqrWPyya3nER%ejsa&?$NVnt}{LxbW?Fru~IgaUxSD|jKAW8N#VNuZ0zQsQ%q
zHi&bT%q$MGOtZ>IJ$Ke?tCHk5l5US3PYI$W6?v$?Q}G9JpWnT%`6%zYZ&?Ag%bk5M
z?5rzEOD`xrJvp<w_n`a@Gc;llPBRb)-)_9WCk6(BWncu#Dxm%CJI(h*+VqYH4c12X
Uh4kyle{DglmN_j=Sxi3kKPk?bnE(I)

literal 9679
zcmcgycU)8F-ajW0hM*`aP-M6$wt^rOM5YU^uL|NoG)Pbsu53YO7*Q$Q)@pi1K|~0O
z6?>6Yg@BkL6cGc&I!KU_AWK0YvI2(jKIfdUlv+QZ_r3Rzkmo$(w}0Q??>XVe-FDmN
z&QYHOLD1ao-*4FiL3l94k>zmUYv;c<4MLDk!uBm2_l3UdYOuMmXuArlsi;J~^Ufo6
zzYFBKYm_rsn*yb>W8w_`3*nN7t<uev-xtzl_GG@;e_8XZ_pfcYwCP43%CmYopxbHd
zIF|NpCoPe01BkPlM%@<z9!tqE1Z{w%AczdffM-|{;jae%NE?Db`(%XCV`3XHGP6XM
zX5A#`3fAYdz@I5<OUXWnCMc2F);}in5#P@r`S|eXx%{<uvvFBU=Jxf9%Qtt>%Erb-
zRId}<^-WppJReX`gjBduQp{KTz8G{4XB$}cWm*OUt#Q1jLb-k(J{MA90lP_~-%gN%
zE38Mx8$!6yENE<$VxzP{G9}puRy8kRo2Jj4+dw%CHZE92hLHnt&C8#<sj_egJ%rcL
zJNQ9=7Iip`sKb*M?t|-_a{_iYG<nEFfF3?qI%tC)Im-<8ri1O6Bs@3|GVQ|%pfkRQ
zW93oVav>R1rgt?~J?J`Yc`k$)9dLpa82RCSEWKde+fp%8%~od)vR&u4)KN-9f-0+~
z7*P}vXo^9>Yw6tIEb8?%o1ZTKrRsQmxF?X+36gd8c(wLdV4PncZ?dnC=_~5Ll`O1Q
zaLte1^(}b;Mg)}`rI=NF)AToJD<B-#jLCzj1UY({euGm3+cYl#;~)~Ci}~*H%MlvW
zt?vY7nj|lppa?8S19Ab{y_*4TIf>FLr?rX~>mro5g4tAcX<;}#658~Wd*fJx?s)#;
z-nF}xGLLP3ReGv(Z^MTqsiDxU<Uy|V`MK+ZGdc`1q;n75-M)Z@Qq#GO3Jxg<o{WTw
z2HMk;ZNf%|o2do{{yj#Cs;i6Ml9)k}r;|m(wz3khuIH3>iBY31y-e#O-hkiB!<^>h
z**TugS}x<liUFIk;WqmMzg3>`)(^%z|D;o$$NZaVYYZa#jwX(adVB4=Iq^39k%~v7
zMPpf{#G)u?9no-Y+)_jl#2;r+FM$U}a$0dzKuU3<?S~enCESB!eHRIQMgb3M9NIoi
z^>g9GZ)jj-T_hDQpsfoG5gU!-3Rjvfi4N#dQRv~sSFS0_qTBpdoa(W}33EJ%s>Kpl
z)$5S`#&V!FN`mC^WEIvD+8Xp3aTzdr!+p#e1|uqO&O?o%?DtzC8*xDkNtG8$>wA=(
z8HgLIr7cvI5z;%0hHt$&Pg{4OzVtlRo2f&3K}hqE6R@M_G?J)0wBFL!*{U*X2?$+{
zg)DXo{t&cdH(-J4`Z8nbt1)gv0{h;$g0L}qwM##dEX%-usHLtPQ4j_{ou?%57}qQu
zC6Z~hvuHfQdN}kX2psBia?jz=P>A2TAFfwpts6Jo5AloRBmt(~F+ch;f!3<Td>x@A
zywUk4G-M2-!fV!-2b3L5%ajUj)~^*clC4_wpDy{)Z1`ZB0!JYwSmn({R;JnB{zqkV
z_?HidxV$-R^P2_p-rWr=5P=hp6g<ETLmN}b_1l_X<h_S4^)oi5;7V}8toKq~68xx|
z`UaS;o>gDxZ^s*=5&zZK6TZg693vq&k<2PAu-O(ucsgA^GL=A+;p%vtcRS}<ek<kD
zk<5MXlcado2PX(I{`H$aF6SU3i8mX_)EMQ0EWP-8F%szSSl?qZ`h<y(!FOuB_ediW
zSr{ry;=-G%M}B#A*H5UiWw#pbgmx?dYIMcprzOkrE5H<(SSX2H$a*hip>PkK#UKer
zQKPu}XMO%zwJV-%QQ?jo$Nz+^E5cP-5SnqC-c#ygGZT&lqAQXojEdS2lr!*M_HT6Z
zo}8=r7=oZqcb*tx%LVr6hA9Gfr4a(MO0J-8AzMKGLn(q{hyo=je`vaaGKmTbY9<g0
zEsELlf?*w5VH}4Tbz)?|D~J{pnN-Q2!<W+`r1Nuh>m7&gYK#?@9C$KPXBfeb>w%RE
zj<hAn&a4(N$`wmz2mm->D#*tbcC$`$;WwLLjVPt`?mpf&^I)%I)`PWsg2x6-2E!<?
zVlgSFO3oxE03tv<AY()<<U3N4O`v${1H}%=3t|R>hM?;D)1cH(oJ07|LP>ZCcJBSN
zI4|y1u@;Hhv-YPsv5#^To{YRZ&h#;BIjE(~8m&3dtg5cRh^13EA2SSKi{`4#Ec$W2
zVvSmZlg2DJrBTWUJ*BXKxSOvWqP^Zic30K{oqH4nXQyhzEH-h4Evr;p`o-V%+~Wi^
z#4C>##zxd$#-w-moYcn<D2`PqR6|7wccm2XKO}k@qg~+M=;+?EGD2#1+ui!Y$PO*8
z_j~R9xyH<Z6OTXqd&$k(f@Q$dGlZDTSJa>&Kt5`B(2nGb8;$v_0vw<*)n?7sh)gv(
zQ=>0A^2JgJLgA6uFTH>u%Ae<tasAJ9XsoqTLrrycB-1s{0YB)ha|lRxQ1alW@bgVd
zqE~lp6*tuIepEN=dv4d`z0jn>du8Q_H^J>)rP4w6EWtXNJ3!WJ`sDOI!Cb#x;zA>X
zy)=`Og<co4uKK^RX&JscuH|l5@)Id}ShTX72hw;lXl74>IE}|Oqgy~Wjtnngos$u6
zdLGaQr5;-V|J}h5&GLS6$E9H<f-%$btq^uLa@g!{9T?s|Zj@S?W1pFP{!x1-UrQi_
z?~u@b56c_0kwhV8S|$lM!Il-WthVup91hg(omWZX`GuE9<?n23Kkq@<Wi6!#I{C@-
zNX*YnMv&bA7=*P9nQum(Kfn#O5YJu`4*Me~3^81jv~|FCGwgvhwZZ_MYr>$f<@u|O
zTUH-2qHTR4rAR$r>0?$`Y2VA;Q|#{cn0s>9?~Ib3rj<04!5!B@M~(va1iD)M1H;rw
z4}nYvhX3ox{(MV6?V2)AouzFZ9d=aAEO5RxI(Dx<^P(4zWYtOw>Y;^O66<LDdwFbw
z=TU?p%KeeCeiGx6b@s(B%Z|KlRS|82Cl0E1Wft=LF5B3QW_!F)*NfJ_;-Rf&66e6N
zeG%L}s(wJ^ec>=MUCUwys!CcBGL&i&nLaPIW6kpb{*5S_D5zlkS5{-44@KDP^UPwX
zj+$PX)I-<Wmi3%Yu?m!NjBp<2a0kt+9@x-D73npu6sHdQ_*?p#aKFqIS*?xbE9oN6
zM^y~<iWKk&)r9P(bo7uft=#nO`@sXiaqQ?2vDO^Hpvh`-A62B4qlx+rtyK~MCmeY?
zP}*Nyp?uW-%wlm(eeZL-V+^%zDO-PSX%C{%yVv{ht4Y-7jj;2WWr4Q&yT~;iH76)(
zp6i=-RTIzjH&O;HhIdm|b%ksyrgK8seV3Us+sdBt;`7S7N$KwCzK(=$dp1#eo7G@t
zq~@pMtIcP5L@M-q`$ZpW)qhIo&oeJ2%%}9LywUPn*5@;5%)D%FLoRn2|H;pb5?(xD
z>35m9mK@lKv-0e!6so+rom3H_`S$&Lote>%2Cjq|N1fGb1Mu3cy{iTnItFEvWcn!Z
ztBmYc+EE*8V-CYk2C?8oHc0{<g6j+JW?NWo9?l;y`{xOp1v}ntbb05KPYpd$09{DQ
z>ni;r%#O7;WY4{Xg$iZWk1Syg(!~rq&BSv&K5S2RulQP@^B)YAmUpG;c1EfsLJ;Qw
zy8>@aWFBhVr%@c8+Lbp8Q&{m!uojK}FD(!MNq7d=c%)K&J{!sLGQ#2<o9iXKqS5~5
zx%<>CXa>yam^p6kgH3gW+lHaO{Biu^Ke8Yh7^$OjuJgeM?IA(8YKT)qhv<D0xk^kd
z2%V$Go9%DA`mUw5sRSy3&uXwccs>|-fw?P$z;i|5W};>x2L^cXF#&V1x9n-nn4+@!
zGvITT02+XTv#fa~^+z!(UcShcaURaVTSE4e2?Y=*bsGgg%te_XjKRcNRny8W3DM=`
zyt9TFcZBJr1PFI@6S#=|JWYhktVt0b0x_!eQ3kHEM<#SIp#h`>Vyl`;$bK?`2eDpd
z?!q%f41wt$xtjb?VM$vJpomaiz~XI`utyZ16yYkNQXky}aQG2w226%FN1!Ao17--o
zp=)U_su-%ogy|HPNXUlI0R?Hg<)+&OWupQsN<>6_bxy*sO2177$lwSZ`);X37}TMY
z&O~-2N&)IO>iOeift+lGxN*l9IdvPab^YMOWqo(yR7HcZB=}}gijTHga5N#HX}ijq
zqAcF=msZRqi<gf`|A<aDrHu|=bFe6lqUFC1U&KPQ-M|}sB@=*dKz&mhI)^@}nqqS(
z5KL@v(NXS5;ICxrtd#a|X2mFF6fIVE5VI=T{RHc_;NGIS{A63r`sBLJGQxY}UvK~B
zbkabRu^dD-pkfvz`@XxALj>{W@(*8|(a^qgU|ON7i`}Cg4MHyTdQs%i;GpU>wh}P<
zWk#Jx1@fEM-c-IHQgB^%@+Q<B;#BXK;pq!Bkigcmlk3P-{Ud;suA;zW2Y@w!ywp&w
zGFT2RfuagxrnXM7+q4N#n|N5w-PFcivN8hyPsrK_;?CX4q-4qq++_XRto<Kfe|e9X
zyNtZKEx6zWKj?>1-yM*F$mIJb*mB$@{Bb4)6QVryeMeAXC&V~V0*uNrrg7nj9E5MG
zhi{J5kc&LvX342{krmPru|7fG2~og`SW%e9snbi*#)UR0m81+C11$uspGQyCK65i5
z%SOrYJh*tFH+7Rup9gti8xe_ZJ#wTBaxypGRo;~f0}eb7#Kn>q5%^prD?erWU^hg~
zh`|e4r;$<-;VX_zFd8Y47A|ATd=rS%l^0Z|pIa8U`ZW@(u;tfeia8B8!~>cmJR>w&
zJ2+X0#XPDJm(S>Kri_cQ6=d?wJGe{b1$HZ}DrkBd`7wC^G1kuB{J<b0du_$0`K%O1
zuuh-BUeGPAZx1ej=0!)vy{j@}T7GlH3RMp;Tx+k4G#rQ`L*4-Rs=9tbp$4^_lo9NW
z1jO`^hT6W9WEYa*U=d4qB>k}La)R7Y%#i@!>dAb^PzR_KJRb!S3@{`(1%OaO_LGT?
zz)Ti$4|0zHOhYjSnGlx5qBx8Ym7W4?gefo$CINyD7+C8`uv7wkizh`uLB|$lfT9Mb
zLz@avziX+mL`I_2CliRx4wg%R5!F4@4{sQHq!iSGN_{|8Us5j+v_`lBf|GEL6byjY
zDj1d`yAjNv1C+#MKn<}RaL|-Ss}QCHKsv;9p+}@7TG_)uQ?!IgEH~XQU{6{7^8Ye+
zpOHw2S^=$NU}9Q{J6B{oqr`z2#44D?XrOR|9^eb^e^amj|GKfCx;Rgb{^l-#Zv5i5
z3ElYlhUH^jX799;AA}C5gFA}!?8`HLH~A6`rmQnH`oG%g&FivEt|`um=o$&*)chg%
z^P?KoiG8z=oQR;A1XOBN(UHam2pN$f>r3F50qZ||uI^B?a9mFw>Tlll&-<h+VT50p
z440^JwdEbwqGI<e%gEY|<NF`h$bhs$-&&ppEgxuj!6SfN(C5jyqPG*I3v?nP6Ch#1
zB-$1Nqkw%#vVbaz924AMrMcwU#VbKdOK<Ec=r(eo;kO+k1~pwxssU_o>~T~+3+Uj~
zWZz6DEp-Z3lu*Vh!W{!-0_k4#K=K;aBuZpbL;xvL9yFt5$Yre=katLphVPW|XLg<r
zlH#eZI6Z?pAcB+>jWh*t0+SVQIPd8+f|!z>J0PGnssg|k2Bve4+O>eh6`E<p_T%zJ
z=LYsCrX>*_SCZEgplyd`&<+6UgeOItg%W1JY34%g2TrO1PDtHDw3HK6N?$J45JQpP
zx1JonlM~hSEqQ$~v@LS&#V)14lYY86RDgoh#F<!<@K|-Z*la_OYIcAs&~@`Z2)v62
zCPh4sm;>qVvDc>4{enn3t7Q;tPA>Uxzm)JMq{@LdZ&-FdSN>4Onh;|@&0a1y$iL>t
zCk;_FyzvNrZ-wfLio=seL!$?=H(Hbb!u3wbdvWBY^^|KS40<|Gc0PFkU!w|qI(-BZ
zMKU-0==1;{J>eQTV<hLwf~C>9zZ`*t8o;BgvyT8j$tpVXhngVV9fMp3KrJ&egpDkd
zm8i`6eE~`A9WLWFbZUFO<M4ntpV~+WAQ3LxWM35D6*WGxChEr*e1NwwllUY;UR@F2
zyz3;PmAfz~X;9n@(U0Mbi3+c{0q@K;NzsGWs;#8UQRT`Gbshsj>cxy3gY>Q(RfkS1
z&v_(f_Y1lw#j4t}^!;@tD?V+mfcu3zVQ1P|udw%CVR;%sRFR84+b(0Y?AB<zv1Nvb
z8TpFO;TBFr^`Y*NrHn|Y+|h*wH`3=l1@A^G2U5dQNSkj&bp6r2?uL8m2hV7RV+36-
zXe7RflXQe15Nomu>F*?rQD0ArARNXOj&P7iK`&o@u`Y>g1X@Yx!sxk-1nx%o8k2Fz
zeYRI36ZA+~i&&93vyNlR4i@Kn>t2oZ@#2FoS!Q3{JeUVR5S@|>;=HBr&}xR3doJ19
z;K*Faw5@VtdtVyiCUpMzYFn0BUnbMmxTF7Dhm1t_!Jc9G!Dt(gF1p?tvwc{s9sTgT
z!If!uHJ>Ng430FvOlWTBMY7j((<XEQX+ys~qkU{=;KO5SZpRsP|2EnNN;skVHVw)e
zs!3eT$2E{FM5*mxHO6*yxs*pK^jF@cJpsR*g`RWop~MWS-;62`p!0vXE<IVTD8ANM
z{>;PLT5=Ua(sR;)*h8uTc!BhcadTpx<luLZ*y{J#J6aPxq-{V>_Z__rYYa$!+?F`~
zBY8OsSR$3pFDgts>|}C9UNvlc^Orp_8;q&<++r6d50KVeP-i(9*DzB0+WiX_E~@Ht
zmJ?iS&x}azblgqhUb@X~O(<{dF~EQ5B2?$viN^5H6?HA%g_Qgm<>gVm{tmk#A>J&t
zYiKt#!%EX0)Xbj4=Cfto?AbMydmrT)$lK2s&#BefizlEry?9QQQOO9@`pJSi>*#Y$
z)_=eKnbF@&>zJ@UFjPy4-`IF6GKs{ji?Y%Y{kuCAy#Kq;KGsO>Y`@W6@ISsMd#ot0
ztfBtCroKeo?D0-I-;<eoUmR!;fQndWDaz<BdVKACSGm@}gG3vml~xe5Jas*%mG&}<
z>Lyw;ntF~-Q_G)=MW@>IcYh)!!NtO^kfa2$X`dVCfendf&psYruMIuA)icN;5pT6J
z1{kSyW}Vo)Zam;RKe&^=%SdWP$5=mOCq?}H_ei7mj8+46cU~+8A|L;52;P)~qT)R0
zf#iulGiaqGb=0QANT;;WTle7;MM0GA!*7drHkf+ztMhb4o=gs;v4Wg#7rQT@xHW@%
zLg{WVp;A%MwJvyT)mE_^$7aDkX1Pm9QWWiFbIhK+I$dM3sFBKxPnh^&6Ke;s_!iFb
zJDu8;Rg&I_Yv@%=2X9$@jx+H0Tk{}80@M>pNTY4w%xATSDV%B}>`5;OYa^r)wAi)a
z)oE$n<5?`HAXpE;QrAJ0(b`poQzPG(s=ZG$LT<M&pvK}g(*6xu6Nx1=UD+ZyBCMiO
z_sq9NSwNeg$D>3ZJw9bFx4Oq(SoJ_ZR|$IK_4Bs`y!bI<&^r76UeB^eE)An^-zVaR
z;d(}jvAy*o(remn_B}r;UDtFqwIw0G)HcOi&r_dfL!1C|cp9vO-&CQ`H{GE0e(v9v
jKFXH=|C`2~QSJS0r{3<%_(=oE3T?Nw+mgM>_00bQSx;;#

diff --git a/docs/generated/distributions.md b/docs/generated/distributions.md
index 9dfb4db..1d0cc9a 100644
--- a/docs/generated/distributions.md
+++ b/docs/generated/distributions.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical distribution digest: `78ae1547b6ee94547616dde5884ccb6c7b69ae4c572f957050c43686ff7620e0`.
+Canonical distribution digest: `234a59b415fab7c6d7da979b445cf06e699ce3ff73cf795f7cbcf5947d987a53`.
 
 Every target packages the same `hyperflux-next-linux` canonical staged payload. Distribution wrappers add only native metadata, lifecycle hooks, and Python discovery.
 
@@ -12,6 +12,12 @@ Every target packages the same `hyperflux-next-linux` canonical staged payload.
 | `debian` | `aarch64-unknown-linux-gnu` to `arm64`, `x86_64-unknown-linux-gnu` to `amd64` | `dkms`, `libc6`, `libgcc-s1`, `python3 (>= 3.11)`, `systemd`, `udev` | `openrgb`, `polychromatic`, `python3-dbus`, `python3-gi` |
 | `rpm` | `aarch64-unknown-linux-gnu` to `aarch64`, `x86_64-unknown-linux-gnu` to `x86_64` | `dkms`, `glibc`, `libgcc`, `python3`, `systemd`, `systemd-udev` | `openrgb`, `polychromatic`, `python3-dbus`, `python3-gobject` |
 
+## Package Relationships
+
+- `arch` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+- `debian` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+- `rpm` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+
 ## Lifecycle Contract
 
 - Fresh installation creates conservative read-only configuration and does not enable the bridge.
diff --git a/docs/generated/error-catalog.md b/docs/generated/error-catalog.md
index 6eb38ce..718b961 100644
--- a/docs/generated/error-catalog.md
+++ b/docs/generated/error-catalog.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Catalog source: `dc21516800b761970c0e7c14a030424a56235610f3355f70f70259e2e4843e91`
+Catalog source: `5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066`
 
 This catalog is the single authority for Doctor, services, SDKs, integrations, package hooks, and support bundles. Safe details are an allowlist: raw payloads, serials, host identifiers, private paths, and arbitrary exception or log text are not accepted.
 
@@ -34,6 +34,7 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | [`HFX-INTEGRATION-001`](#hfx-integration-001) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
 | [`HFX-INTERNAL-001`](#hfx-internal-001) | `internal` | `critical` | `never` | `runtime-reported` | `bridge` | `active` |
 | [`HFX-KERNEL-001`](#hfx-kernel-001) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
+| [`HFX-KERNEL-002`](#hfx-kernel-002) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
 | [`HFX-OUTCOME-001`](#hfx-outcome-001) | `outcome` | `warning` | `never` | `not-applicable` | `bridge` | `active` |
 | [`HFX-OUTCOME-002`](#hfx-outcome-002) | `outcome` | `info` | `never` | `not-applicable` | `bridge` | `active` |
 | [`HFX-OWNERSHIP-001`](#hfx-ownership-001) | `ownership` | `warning` | `after-remediation` | `must-be-none` | `bridge` | `active` |
@@ -57,6 +58,7 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | --- | --- | --- | --- |
 | `acquire-new-lease` | Request a new lease for the complete resource set before submitting another operation. | Read the ownership snapshot and confirm the new lease is current. | false |
 | `activate-installed-driver` | Use the platform's documented reboot or receiver-disconnect activation path. | Run Doctor and confirm the loaded and installed driver identities match. | false |
+| `activate-openrazer-route-driver` | Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying. | Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity. | false |
 | `collect-support-bundle` | Preview and create the bounded HyperFlux support bundle for the unresolved internal failure. | Confirm the bundle preview excludes private paths, serials, raw reports, and arbitrary logs. | false |
 | `correct-request` | Correct the named request field and submit a new request with a new request identifier. | Validate the corrected request against the negotiated protocol schema. | false |
 | `disable-unsupported-feature` | Continue without the feature or use a peer that advertises it during negotiation. | Repeat negotiation and inspect the enabled feature set. | false |
@@ -198,6 +200,32 @@ The newly installed driver is not active yet.
 | `installed_abi` | `identifier` | true | max 64 characters | `public` |
 | `loaded_abi` | `identifier` | true | max 64 characters | `public` |
 
+## HFX-KERNEL-002
+
+The OpenRazer route driver is not ready yet.
+
+**Technical cause:** A required OpenRazer native-route kernel module is missing or an older module remains active.
+
+**Class / severity:** `kernel` / `error`
+
+**Retry / side effects:** `after-remediation` / `not-applicable`
+
+**Owner / privacy:** `packaging` / `public`
+
+**Lifecycle:** `active` since `0.0.0-dev.1`
+
+**Safe action (`activate-openrazer-route-driver`):** Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.
+
+**Verify:** Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.
+
+### Safe Details
+
+| Field | Type | Required | Bound | Privacy |
+| --- | --- | --- | --- | --- |
+| `installed_abi` | `identifier` | true | max 64 characters | `public` |
+| `loaded_abi` | `identifier` | true | max 64 characters | `public` |
+| `module` | `identifier` | true | max 64 characters | `public` |
+
 ## HFX-OUTCOME-001
 
 HyperFlux cannot determine the result of this transaction from its current history.
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index e769c06..09076d9 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical manifest digest: `184e6f6d925b3a0aac4aa2fbeae741830e75720f3b7779c562c094b37af01554`.
+Canonical manifest digest: `b939538cfddbc866e5e72213267f29053a34d6eb636264467cea0f69a7bcc750`.
 
 Package: `hyperflux-next-linux` `0.0.0-dev.1` release `1`.
 
@@ -19,13 +19,15 @@ Package hooks prepare system metadata and delegate compatibility decisions to th
 
 ## Build Products
 
-The canonical plan contains `4` required and `3` optional build products.
+The canonical plan contains `6` required and `3` optional build products.
 
 | Component | Kind | Required | Destination or distribution |
 | --- | --- | --- | --- |
 | `bridge-daemon` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-bridge` |
 | `operations-cli` | `cargo-binary` | yes | `/usr/bin/hyperfluxctl` |
 | `activation-utility` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-activate` |
+| `openrazer-native-relay` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-uhid-relay` |
+| `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.1` |
 | `openrgb-native` | `cmake-module` | no | `/usr/lib/openrgb/plugins/hyperflux-next-openrgb.so` |
 | `python-sdk` | `python-project` | yes | `hyperflux-next-sdk` |
 | `polychromatic-native` | `python-project` | no | `hyperflux-next-polychromatic` |
@@ -33,13 +35,14 @@ The canonical plan contains `4` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `172` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `181` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
 | `kernel-source` | 15 | `-` |
 | `dkms-configuration` | 1 | `-` |
 | `bridge-service` | 1 | `-` |
+| `openrazer-native-relay-service` | 1 | `-` |
 | `activation-service` | 1 | `-` |
 | `confirmation-service` | 1 | `-` |
 | `system-users` | 1 | `-` |
@@ -47,14 +50,14 @@ The expanded source payload contains `172` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 59 | `-` |
+| `schemas` | 62 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
-| `integration-authority` | 8 | `-` |
+| `integration-authority` | 12 | `-` |
 | `cpp-sdk-headers` | 30 | `-` |
-| `documentation` | 39 | `-` |
+| `documentation` | 40 | `-` |
 | `readme` | 1 | `-` |
 | `security-policy` | 1 | `-` |
 | `license` | 1 | `-` |
diff --git a/docs/generated/openrazer-native-deployment.md b/docs/generated/openrazer-native-deployment.md
new file mode 100644
index 0000000..a012eaa
--- /dev/null
+++ b/docs/generated/openrazer-native-deployment.md
@@ -0,0 +1,26 @@
+# OpenRazer Native Route Deployment
+
+> Generated by `./hfx generate`. Do not edit manually.
+
+Canonical deployment digest: `8940c61d14a234049e1226d046b0ba41745d5ae69c387ba0c89f02b37c8dcd28`.
+
+## Relay
+
+| Field | Value |
+| --- | --- |
+| Service | `hyperflux-next-openrazer-relay.service` |
+| Executable | `/usr/lib/hyperflux-next/hyperflux-next-uhid-relay` |
+| Bridge socket | `/run/hyperflux-next/bridge.sock` |
+| Exclusive kernel interface | `/dev/uhid` |
+
+The static relay service is pulled in by the bridge service. It runs as root only because `/dev/uhid` remains unavailable to ordinary users, drops every Linux capability, and can access only the bridge socket and UHID device. A read-only preflight refuses to create virtual endpoints while an older transformed driver module remains loaded.
+
+## OpenRazer Driver Replacement
+
+| Field | Value |
+| --- | --- |
+| DKMS identity | `openrazer-driver` `3.12.1` |
+| Source tree | `/usr/src/openrazer-driver-3.12.1` |
+| Modules | `razeraccessory`, `razerkbd`, `razerkraken`, `razermouse` |
+
+The package build applies the source-locked transport patch to the pinned OpenRazer tree, projects only its DKMS build inputs, and verifies every transformed digest. The ordinary BUS_USB tables and direct-device transport remain upstream-owned.
diff --git a/docs/generated/performance-budgets.md b/docs/generated/performance-budgets.md
index 01c7557..82faf84 100644
--- a/docs/generated/performance-budgets.md
+++ b/docs/generated/performance-budgets.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Software-enforced metrics: `9`. Physical qualification metrics: `5`.
+Software-enforced metrics: `10`. Physical qualification metrics: `5`.
 A declared physical budget remains blocked until measured on an exact installed candidate.
 
 | Metric | Maximum | Measurement | Status | Release block |
@@ -15,6 +15,7 @@ A declared physical budget remains blocked until measured on an exact installed
 | `operations-cli-size` Installed operations CLI size | 1e+07 bytes | `artifact-size` | `enforced-software` | no |
 | `activation-utility-size` Installed activation utility size | 1e+07 bytes | `artifact-size` | `enforced-software` | no |
 | `openrgb-module-size` OpenRGB native module size | 4e+06 bytes | `artifact-size` | `enforced-software` | no |
+| `openrazer-native-relay-size` OpenRazer native-route relay size | 8e+06 bytes | `artifact-size` | `enforced-software` | yes |
 | `staged-payload-size` Canonical uncompressed installed payload size | 4.5e+07 bytes | `staged-payload-size` | `enforced-software` | yes |
 | `effect-frame-visible-delay` Visible effect-frame delay at the device | 50 milliseconds | `physical` | `blocked-by-physical-evidence` | yes |
 | `receiver-reconnect-recovery` Qualified controller recovery after receiver reconnect | 2000 milliseconds | `physical` | `blocked-by-physical-evidence` | yes |
@@ -80,6 +81,13 @@ Samples: 1; warmups: 0.
 
 Upstream registry reuse must not silently turn the adapter into an oversized application fork.
 
+### OpenRazer native-route relay size
+
+Source: [`packaging/install.json`](../../packaging/install.json); selector `openrazer-native-relay`.
+Samples: 1; warmups: 0.
+
+The feature-only relay must remain a thin transport process rather than accumulating device semantics.
+
 ### Canonical uncompressed installed payload size
 
 Source: [`packaging/install.json`](../../packaging/install.json); selector `complete-root`.
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index a87f297..546f992 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -7,14 +7,14 @@ Release signing and remote attestations remain unavailable until publication is
 
 ## Inventory
 
-- Workspace crates: 13
+- Workspace crates: 14
 - Checksummed Rust registry packages: 29
 - Repository Python projects: 3
 - Distribution-provided Python packages: 3
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `92006b9561017382240993dd195de5c217e9e6fcc2e3614e6061698fd16b201d`
+- Authority SHA-256: `27d52db25e0d72e5f52359a11aa5cfd97f1bc98f9b4800bc7c02c69b590a8754`
 
 ## License Policy
 
diff --git a/docs/generated/verification.md b/docs/generated/verification.md
index dfffedc..db40c15 100644
--- a/docs/generated/verification.md
+++ b/docs/generated/verification.md
@@ -35,9 +35,10 @@ Every current node is software-only and has zero hardware-write authority.
 | 26 | `openrgb-adapter-contracts` | `integrations` | `none` | `false` | 300s | `rerun` |
 | 27 | `polychromatic-adapter-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
 | 28 | `openrazer-compatibility-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
-| 29 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
-| 30 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
-| 31 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
+| 29 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
+| 30 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
+| 31 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
+| 32 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
 
 ## Dependencies
 
@@ -71,6 +72,7 @@ flowchart LR
     openrgb_adapter_contracts["openrgb-adapter-contracts"]
     polychromatic_adapter_contracts["polychromatic-adapter-contracts"]
     openrazer_compatibility_contracts["openrazer-compatibility-contracts"]
+    openrazer_native_route_contracts["openrazer-native-route-contracts"]
     migration_shadow_contracts["migration-shadow-contracts"]
     openrgb_thread_sanitizer["openrgb-thread-sanitizer"]
     package_contracts["package-contracts"]
@@ -125,6 +127,8 @@ flowchart LR
     python_unit --> polychromatic_adapter_contracts
     openrazer_metadata_contracts --> openrazer_compatibility_contracts
     python_unit --> openrazer_compatibility_contracts
+    openrazer_metadata_contracts --> openrazer_native_route_contracts
+    rust_unit --> openrazer_native_route_contracts
     simulator_contracts --> migration_shadow_contracts
     python_unit --> migration_shadow_contracts
     openrgb_adapter_contracts --> openrgb_thread_sanitizer
diff --git a/errors/catalog.json b/errors/catalog.json
index cf11a49..0a471a5 100644
--- a/errors/catalog.json
+++ b/errors/catalog.json
@@ -16,6 +16,13 @@
       "verification": "Run Doctor and confirm the loaded and installed driver identities match.",
       "automatic": false
     },
+    {
+      "id": "activate-openrazer-route-driver",
+      "title": "Activate the OpenRazer route driver",
+      "safe_action": "Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.",
+      "verification": "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
+      "automatic": false
+    },
     {
       "id": "collect-support-bundle",
       "title": "Collect a privacy-safe support bundle",
@@ -213,6 +220,25 @@
       "privacy": "public",
       "docs_path": "docs/generated/error-catalog.md#hfx-kernel-001"
     },
+    {
+      "code": "HFX-KERNEL-002",
+      "class": "kernel",
+      "severity": "error",
+      "retry_policy": "after-remediation",
+      "side_effect_certainty_policy": "not-applicable",
+      "remediation_id": "activate-openrazer-route-driver",
+      "safe_detail_fields": [
+        {"name": "installed_abi", "type": "identifier", "required": true, "maximum_length": 64, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "Installed OpenRazer module source identity."},
+        {"name": "loaded_abi", "type": "identifier", "required": true, "maximum_length": 64, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "Loaded OpenRazer module source identity or activation state."},
+        {"name": "module", "type": "identifier", "required": true, "maximum_length": 64, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "OpenRazer native-route kernel module name."}
+      ],
+      "lifecycle": {"state": "active", "introduced_in": "0.0.0-dev.1", "deprecated_in": null, "replacement_code": null},
+      "owner": "packaging",
+      "technical_cause": "A required OpenRazer native-route kernel module is missing or an older module remains active.",
+      "user_explanation": "The OpenRazer route driver is not ready yet.",
+      "privacy": "public",
+      "docs_path": "docs/generated/error-catalog.md#hfx-kernel-002"
+    },
     {
       "code": "HFX-OUTCOME-001",
       "class": "outcome",
diff --git a/integrations/openrazer/native-route/catalog.json b/integrations/openrazer/native-route/catalog.json
new file mode 100644
index 0000000..c2df18d
--- /dev/null
+++ b/integrations/openrazer/native-route/catalog.json
@@ -0,0 +1,45 @@
+{
+  "$schema": "../../../schemas/openrazer-native-route-catalog.schema.json",
+  "schema": "hyperflux-openrazer-native-route-catalog-v1",
+  "upstream_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "metadata_sha256": "36a26c62f1992a9f84f7925c9f9a4252e449f966efb61ab6511d08fb2569eee2",
+  "transport": {
+    "protocol_family": "razer-feature-report-v1",
+    "report_bytes": 90,
+    "phys_prefix": "hyperflux-next/native/v1/",
+    "descriptor_hex": "0600ff0901a101150026ff007508955ab102c0",
+    "descriptor_sha256": "c7e08a941d29843614b92bac12957f77d764a3f7a765161bfb2ba2434a76ae74"
+  },
+  "routes": [
+    {
+      "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
+      "vendor_id": 5426,
+      "wireless_product_id": 205,
+      "model_name": "Razer Basilisk V3 Pro 35K (Wireless)",
+      "device_kind": "mouse",
+      "driver_family": "razermouse",
+      "source": {
+        "path": "daemon/openrazer_daemon/hardware/mouse.py",
+        "class_name": "RazerBasiliskV3Pro35KWireless",
+        "sha256": "c36180167f3f07f2299eb2653dd171ce6086a5cb0c30a898d9ee2be3dc3c4c03"
+      },
+      "direct_data_product_ids": [204],
+      "event_file_regex": ".*Razer_Basilisk_V3_Pro_35K_000000000000-if0(1|2)-event-kbd"
+    },
+    {
+      "profile_id": "child.razer.deathstalker-v2-pro-tkl.0296",
+      "vendor_id": 5426,
+      "wireless_product_id": 662,
+      "model_name": "Razer DeathStalker V2 Pro TKL (Wireless)",
+      "device_kind": "keyboard",
+      "driver_family": "razerkbd",
+      "source": {
+        "path": "daemon/openrazer_daemon/hardware/keyboards.py",
+        "class_name": "RazerDeathStalkerV2ProTKLWireless",
+        "sha256": "a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9"
+      },
+      "direct_data_product_ids": [664],
+      "event_file_regex": ".*DSV2Pro_TKL_000000000000-if01-event-mouse"
+    }
+  ]
+}
diff --git a/integrations/openrazer/native-route/deployment.json b/integrations/openrazer/native-route/deployment.json
new file mode 100644
index 0000000..8097d09
--- /dev/null
+++ b/integrations/openrazer/native-route/deployment.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "../../../schemas/openrazer-native-deployment.schema.json",
+  "schema": "hyperflux-openrazer-native-deployment-v1",
+  "relay": {
+    "executable_path": "/usr/lib/hyperflux-next/hyperflux-next-uhid-relay",
+    "service_unit": "hyperflux-next-openrazer-relay.service",
+    "uhid_device": "/dev/uhid",
+    "restart_seconds": 2
+  },
+  "driver": {
+    "dkms_name": "openrazer-driver",
+    "dkms_version": "3.12.1",
+    "source_directory": "/usr/src/openrazer-driver-3.12.1",
+    "modules": ["razeraccessory", "razerkbd", "razerkraken", "razermouse"]
+  }
+}
diff --git a/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
new file mode 100644
index 0000000..50fa072
--- /dev/null
+++ b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
@@ -0,0 +1,538 @@
+From 5849f6da4cebefa90275ad28ce783a48857e3c86 Mon Sep 17 00:00:00 2001
+From: HyperFlux Next Source Transformer <noreply@hyperflux.dev>
+Date: Sat, 25 Jul 2026 12:15:23 +0400
+Subject: [PATCH] Add trusted HyperFlux native HID transport
+
+---
+ driver/razercommon.c       |  88 +++++++++++++++++++++++++++++++
+ driver/razercommon.h       |   7 +++
+ driver/razerkbd_driver.c   | 104 ++++++++++++++++++++++++++-----------
+ driver/razermouse_driver.c |  58 +++++++++++++++++----
+ 4 files changed, 215 insertions(+), 42 deletions(-)
+
+diff --git a/driver/razercommon.c b/driver/razercommon.c
+index fd6e828..5f21721 100644
+--- a/driver/razercommon.c
++++ b/driver/razercommon.c
+@@ -12,6 +12,94 @@
+ 
+ #include "razercommon.h"
+ 
++#define RAZER_HYPERFLUX_PHYS_PREFIX "hyperflux-next/native/v1/"
++
++static const u8 razer_hyperflux_descriptor[] = {
++    0x06, 0x00, 0xff, 0x09, 0x01, 0xa1, 0x01, 0x15, 0x00, 0x26,
++    0xff, 0x00, 0x75, 0x08, 0x95, 0x5a, 0xb1, 0x02, 0xc0,
++};
++
++static const u8 razer_hyperflux_error_magic[] = {
++    'H', 'F', 'X', 'N', 'E', 'R', 'R', '1',
++};
++
++bool razer_is_hyperflux_native(struct hid_device *hdev)
++{
++    const char *instance;
++
++    if (hdev->bus != BUS_VIRTUAL ||
++        hdev->vendor != USB_VENDOR_ID_RAZER ||
++        strncmp(hdev->phys, RAZER_HYPERFLUX_PHYS_PREFIX,
++                sizeof(RAZER_HYPERFLUX_PHYS_PREFIX) - 1) != 0 ||
++        hdev->dev_rsize != sizeof(razer_hyperflux_descriptor) ||
++        !hdev->dev_rdesc ||
++        memcmp(hdev->dev_rdesc, razer_hyperflux_descriptor,
++               sizeof(razer_hyperflux_descriptor)) != 0)
++        return false;
++
++    instance = hdev->phys + sizeof(RAZER_HYPERFLUX_PHYS_PREFIX) - 1;
++    if (!*instance)
++        return false;
++    while (*instance) {
++        if (!(*instance >= 'a' && *instance <= 'z') &&
++            !(*instance >= '0' && *instance <= '9') &&
++            *instance != '-')
++            return false;
++        instance++;
++    }
++    return true;
++}
++
++bool razer_hyperflux_error_is_uncertain(int error)
++{
++    return error == RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
++}
++
++static int razer_decode_hyperflux_error(const struct razer_report *report)
++{
++    const u8 *bytes = (const u8 *)report;
++    size_t index;
++
++    if (memcmp(bytes, razer_hyperflux_error_magic,
++               sizeof(razer_hyperflux_error_magic)) != 0 ||
++        bytes[8] != 1 || bytes[88] != 0x5a || bytes[89] != 0xa5)
++        return 0;
++    for (index = 10; index < 88; index++) {
++        if (bytes[index] != 0)
++            return 0;
++    }
++    if (bytes[9] == 1)
++        return RAZER_HYPERFLUX_TRANSPORT_NOT_SENT;
++    if (bytes[9] == 2)
++        return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
++    return 0;
++}
++
++int razer_get_hyperflux_response(struct hid_device *hdev,
++                                 struct razer_report *request_report,
++                                 struct razer_report *response_report)
++{
++    int result;
++
++    if (!razer_is_hyperflux_native(hdev))
++        return -ENODEV;
++
++    result = hid_hw_raw_request(hdev, 0, (u8 *)request_report,
++                                sizeof(*request_report), HID_FEATURE_REPORT,
++                                HID_REQ_SET_REPORT);
++    if (result != sizeof(*request_report))
++        return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
++
++    memset(response_report, 0, sizeof(*response_report));
++    result = hid_hw_raw_request(hdev, 0, (u8 *)response_report,
++                                sizeof(*response_report), HID_FEATURE_REPORT,
++                                HID_REQ_GET_REPORT);
++    if (result != sizeof(*response_report))
++        return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
++
++    return razer_decode_hyperflux_error(response_report);
++}
++
+ /**
+  * Send USB control report to the keyboard
+  * USUALLY index = 0x02
+diff --git a/driver/razercommon.h b/driver/razercommon.h
+index b469ba1..3275438 100644
+--- a/driver/razercommon.h
++++ b/driver/razercommon.h
+@@ -8,6 +8,7 @@
+ #define DRIVER_RAZERCOMMON_H_
+ 
+ #include <linux/hid.h>
++#include <linux/errno.h>
+ #include <linux/usb/input.h>
+ #include "compat.h"
+ 
+@@ -25,6 +26,9 @@ do { \
+ 
+ #define USB_VENDOR_ID_RAZER 0x1532
+ 
++#define RAZER_HYPERFLUX_TRANSPORT_NOT_SENT          (-EAGAIN)
++#define RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT (-ENOTRECOVERABLE)
++
+ // LED STATE
+ #define OFF 0x00
+ #define ON  0x01
+@@ -152,6 +156,9 @@ int razer_send_argb_msg(struct hid_device *hdev, unsigned char channel, size_t s
+ unsigned char razer_calculate_crc(struct razer_report *report);
+ struct razer_report get_razer_report(unsigned char command_class, unsigned char command_id, unsigned char data_size);
+ void print_erroneous_report(struct hid_device *hdev, struct razer_report* report, const char *message);
++bool razer_is_hyperflux_native(struct hid_device *hdev);
++int razer_get_hyperflux_response(struct hid_device *hdev, struct razer_report *request_report, struct razer_report *response_report);
++bool razer_hyperflux_error_is_uncertain(int error);
+ 
+ /* Borrowed from drivers/hid/usbhid/usbhid.h */
+ #define	hid_to_usb_dev(hid_dev) \
+diff --git a/driver/razerkbd_driver.c b/driver/razerkbd_driver.c
+index f06d5de..b1690d2 100644
+--- a/driver/razerkbd_driver.c
++++ b/driver/razerkbd_driver.c
+@@ -24,6 +24,8 @@
+  */
+ #define DRIVER_DESC "Razer Keyboard Device Driver"
+ 
++static bool razer_kbd_transport_supported(struct hid_device *hdev);
++
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_VERSION(DRIVER_VERSION);
+@@ -318,9 +320,9 @@ static bool is_blade_laptop(struct razer_kbd_device *device)
+ /**
+  * Get request/response indices and timing parameters for the device
+  */
+-static void razer_get_report_params(struct usb_device *usb_dev, uint *report_index, uint *response_index, ulong *wait)
++static void razer_get_report_params(u16 product, uint *report_index, uint *response_index, ulong *wait)
+ {
+-    switch (usb_dev->descriptor.idProduct) {
++    switch (product) {
+     case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_TENKEYLESS:
+     case USB_DEVICE_ID_RAZER_HUNTSMAN_V2:
+     case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_ANALOG:
+@@ -390,11 +392,13 @@ static void razer_get_report_params(struct usb_device *usb_dev, uint *report_ind
+  */
+ static int razer_get_report(struct hid_device *hdev, struct razer_report *request, struct razer_report *response)
+ {
+-    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+     uint report_index, response_index;
+     ulong wait;
+ 
+-    razer_get_report_params(usb_dev, &report_index, &response_index, &wait);
++    if (razer_is_hyperflux_native(hdev))
++        return razer_get_hyperflux_response(hdev, request, response);
++
++    razer_get_report_params(hdev->product, &report_index, &response_index, &wait);
+ 
+     return razer_get_usb_response(hdev, report_index, request, response_index, response, wait);
+ }
+@@ -404,14 +408,19 @@ static int razer_get_report(struct hid_device *hdev, struct razer_report *reques
+  */
+ static int __must_check razer_send_payload_no_response(struct razer_kbd_device *device, struct razer_report *request)
+ {
+-    struct usb_device *usb_dev = hid_to_usb_dev(device->hdev);
+     uint report_index, response_index;
+     ulong wait;
+ 
+     /* Except the caller to have set the transaction_id */
+     WARN_ON(request->transaction_id.id == 0x00);
+ 
+-    razer_get_report_params(usb_dev, &report_index, &response_index, &wait);
++    if (razer_is_hyperflux_native(device->hdev)) {
++        struct razer_report response = {0};
++
++        return razer_get_hyperflux_response(device->hdev, request, &response);
++    }
++
++    razer_get_report_params(device->hdev->product, &report_index, &response_index, &wait);
+ 
+     return razer_send_control_msg(device->hdev, request, sizeof(*request), report_index, wait);
+ }
+@@ -430,6 +439,9 @@ static int __must_check razer_send_payload(struct razer_kbd_device *device, stru
+         mutex_lock(&device->lock);
+         err = razer_get_report(device->hdev, request, response);
+         mutex_unlock(&device->lock);
++        if (razer_is_hyperflux_native(device->hdev) &&
++            razer_hyperflux_error_is_uncertain(err))
++            return err;
+         if (err) {
+             print_erroneous_report(device->hdev, response, "Invalid Report Length");
+             goto retry;
+@@ -440,6 +452,8 @@ static int __must_check razer_send_payload(struct razer_kbd_device *device, stru
+             response->command_class != request->command_class ||
+             response->command_id.id != request->command_id.id) {
+             print_erroneous_report(device->hdev, response, "Response doesn't match request");
++            if (razer_is_hyperflux_native(device->hdev))
++                return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
+             err = -EINVAL;
+             goto retry;
+         }
+@@ -5257,16 +5271,22 @@ static int razer_kbd_input_mapping(struct hid_device *hdev, struct hid_input *hi
+ 
+ static void razer_kbd_init(struct razer_kbd_device *dev, struct hid_device *hdev)
+ {
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+-
+     // Initialise mutex
+     mutex_init(&dev->lock);
+     // Setup values
+     dev->hdev = hdev;
+-    dev->usb_vid = usb_dev->descriptor.idVendor;
+-    dev->usb_pid = usb_dev->descriptor.idProduct;
+-    dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
++    if (razer_is_hyperflux_native(hdev)) {
++        dev->usb_vid = hdev->vendor;
++        dev->usb_pid = hdev->product;
++        dev->usb_interface_protocol = USB_INTERFACE_PROTOCOL_MOUSE;
++    } else {
++        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
++        struct usb_device *usb_dev = hid_to_usb_dev(hdev);
++
++        dev->usb_vid = usb_dev->descriptor.idVendor;
++        dev->usb_pid = usb_dev->descriptor.idProduct;
++        dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
++    }
+ }
+ 
+ /**
+@@ -5275,33 +5295,39 @@ static void razer_kbd_init(struct razer_kbd_device *dev, struct hid_device *hdev
+ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+     int retval = 0;
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
++    struct usb_device *usb_dev = NULL;
+     struct razer_kbd_device *dev = NULL;
+     struct razer_kbd_usb_device_data *usb_dev_data = NULL;
+     int err;
+ 
++    if (!razer_kbd_transport_supported(hdev))
++        return -ENODEV;
++    if (hdev->bus == BUS_USB)
++        usb_dev = hid_to_usb_dev(hdev);
++
+     dev = kzalloc_obj(*dev);
+     if(dev == NULL) {
+         hid_err(hdev, "out of memory\n");
+         return -ENOMEM;
+     }
+ 
+-    // Allocate data in context to the usb device if not already done.
+-    usb_dev_data = dev_get_drvdata(&usb_dev->dev);
+-    if (!usb_dev_data) {
+-        usb_dev_data = devm_kzalloc(&usb_dev->dev, sizeof(struct razer_kbd_usb_device_data), GFP_KERNEL);
+-        if (!usb_dev_data)
+-            return -ENOMEM;
++    // Allocate shared input state only for a physical multi-interface USB device.
++    if (usb_dev) {
++        usb_dev_data = dev_get_drvdata(&usb_dev->dev);
++        if (!usb_dev_data) {
++            usb_dev_data = devm_kzalloc(&usb_dev->dev, sizeof(struct razer_kbd_usb_device_data), GFP_KERNEL);
++            if (!usb_dev_data)
++                return -ENOMEM;
+ 
+-        dev_set_drvdata(&usb_dev->dev, usb_dev_data);
++            dev_set_drvdata(&usb_dev->dev, usb_dev_data);
++        }
+     }
+ 
+     // Init data
+     razer_kbd_init(dev, hdev);
+ 
+     // Other interfaces are actual key-emitting devices
+-    if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE) {
++    if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_MOUSE) {
+         // If the currently bound device is the control (mouse) interface
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_version);
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
+@@ -5312,7 +5338,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
+ 
+-        switch(usb_dev->descriptor.idProduct) {
++        switch(dev->usb_pid) {
+ 
+         case USB_DEVICE_ID_RAZER_NOSTROMO:
+             CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
+@@ -5798,12 +5824,12 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+         // Set device to regular mode, not driver mode
+         // When the daemon discovers the device it will instruct it to enter driver mode
+         // Tartarus Pro resets when it receives this command
+-        if (usb_dev->descriptor.idProduct != USB_DEVICE_ID_RAZER_TARTARUS_PRO) {
++        if (usb_dev && dev->usb_pid != USB_DEVICE_ID_RAZER_TARTARUS_PRO) {
+             err = razer_set_device_mode(dev, 0x00, 0x00);
+             if (err)
+                 return err;
+         }
+-    } else if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
++    } else if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_super);
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_tab);
+         CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_f4);
+@@ -5823,7 +5849,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+     }
+ 
+     // Leave autosuspend on for laptops
+-    if (!is_blade_laptop(dev)) {
++    if (usb_dev && !is_blade_laptop(dev)) {
+         usb_disable_autosuspend(usb_dev);
+     }
+ 
+@@ -5842,13 +5868,11 @@ exit_free:
+ static void razer_kbd_disconnect(struct hid_device *hdev)
+ {
+     struct razer_kbd_device *dev;
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-    struct usb_device *usb_dev = interface_to_usbdev(intf);
+ 
+     dev = hid_get_drvdata(hdev);
+ 
+     // Other interfaces are actual key-emitting devices
+-    if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE) {
++    if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_MOUSE) {
+         // If the currently bound device is the control (mouse) interface
+         device_remove_file(&hdev->dev, &dev_attr_version);
+         device_remove_file(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
+@@ -5859,7 +5883,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+         device_remove_file(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
+         device_remove_file(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
+ 
+-        switch(usb_dev->descriptor.idProduct) {
++        switch(dev->usb_pid) {
+ 
+         case USB_DEVICE_ID_RAZER_NOSTROMO:
+             device_remove_file(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
+@@ -6341,7 +6365,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+             device_remove_file(&hdev->dev, &dev_attr_macro_led_effect);              // Change macro LED effect (static, flashing)
+             break;
+         }
+-    } else if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
++    } else if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
+         device_remove_file(&hdev->dev, &dev_attr_key_super);
+         device_remove_file(&hdev->dev, &dev_attr_key_alt_tab);
+         device_remove_file(&hdev->dev, &dev_attr_key_alt_f4);
+@@ -6498,9 +6522,27 @@ static const struct hid_device_id razer_devices[] = {
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_HUNTSMAN_V3_PRO_8KHZ) },
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2024) },
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2025) },
++    { HID_DEVICE(BUS_VIRTUAL,HID_GROUP_ANY,USB_VENDOR_ID_RAZER,HID_ANY_ID) },
+     { 0 }
+ };
+ 
++static bool razer_kbd_transport_supported(struct hid_device *hdev)
++{
++    const struct hid_device_id *identity;
++
++    if (hdev->bus == BUS_USB)
++        return true;
++    if (!razer_is_hyperflux_native(hdev))
++        return false;
++    for (identity = razer_devices; identity->vendor; identity++) {
++        if (identity->bus == BUS_USB &&
++            identity->vendor == hdev->vendor &&
++            identity->product == hdev->product)
++            return true;
++    }
++    return false;
++}
++
+ MODULE_DEVICE_TABLE(hid, razer_devices);
+ 
+ /**
+diff --git a/driver/razermouse_driver.c b/driver/razermouse_driver.c
+index 8aada2f..637072e 100644
+--- a/driver/razermouse_driver.c
++++ b/driver/razermouse_driver.c
+@@ -22,6 +22,8 @@
+  */
+ #define DRIVER_DESC "Razer Mouse Device Driver"
+ 
++static bool razer_mouse_transport_supported(struct hid_device *hdev);
++
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_VERSION(DRIVER_VERSION);
+@@ -32,6 +34,9 @@ MODULE_LICENSE(DRIVER_LICENSE);
+  */
+ static int razer_get_report(struct hid_device *hdev, struct razer_report *request, struct razer_report *response)
+ {
++    if (razer_is_hyperflux_native(hdev))
++        return razer_get_hyperflux_response(hdev, request, response);
++
+     struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+     unsigned int index = 0;
+     switch (usb_dev->descriptor.idProduct) {
+@@ -124,6 +129,9 @@ static int __must_check razer_send_payload(struct razer_mouse_device *device, st
+         mutex_lock(&device->lock);
+         err = razer_get_report(device->hdev, request, response);
+         mutex_unlock(&device->lock);
++        if (razer_is_hyperflux_native(device->hdev) &&
++            razer_hyperflux_error_is_uncertain(err))
++            return err;
+         if (err) {
+             print_erroneous_report(device->hdev, response, "Invalid Report Length");
+             goto retry;
+@@ -134,6 +142,8 @@ static int __must_check razer_send_payload(struct razer_mouse_device *device, st
+             response->command_class != request->command_class ||
+             response->command_id.id != request->command_id.id) {
+             print_erroneous_report(device->hdev, response, "Response doesn't match request");
++            if (razer_is_hyperflux_native(device->hdev))
++                return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
+             err = -EINVAL;
+             goto retry;
+         }
+@@ -6249,19 +6259,26 @@ static int razer_input_configured(struct hid_device *hdev,
+  */
+ static void razer_mouse_init(struct razer_mouse_device *dev, struct hid_device *hdev)
+ {
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+-
+     unsigned int rand_serial = 0;
+ 
+     // Initialise mutex
+     mutex_init(&dev->lock);
+     // Setup values
+     dev->hdev = hdev;
+-    dev->usb_vid = usb_dev->descriptor.idVendor;
+-    dev->usb_pid = usb_dev->descriptor.idProduct;
+-    dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
+-    dev->usb_interface_subclass = intf->cur_altsetting->desc.bInterfaceSubClass;
++    if (razer_is_hyperflux_native(hdev)) {
++        dev->usb_vid = hdev->vendor;
++        dev->usb_pid = hdev->product;
++        dev->usb_interface_protocol = USB_INTERFACE_PROTOCOL_MOUSE;
++        dev->usb_interface_subclass = 0;
++    } else {
++        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
++        struct usb_device *usb_dev = hid_to_usb_dev(hdev);
++
++        dev->usb_vid = usb_dev->descriptor.idVendor;
++        dev->usb_pid = usb_dev->descriptor.idProduct;
++        dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
++        dev->usb_interface_subclass = intf->cur_altsetting->desc.bInterfaceSubClass;
++    }
+ 
+     // Get a "random" integer
+     get_random_bytes(&rand_serial, sizeof(unsigned int));
+@@ -6298,6 +6315,9 @@ static int razer_mouse_probe(struct hid_device *hdev, const struct hid_device_id
+     struct razer_mouse_device *dev = NULL;
+     unsigned char expected_subclass = 0xFF;
+ 
++    if (!razer_mouse_transport_supported(hdev))
++        return -ENODEV;
++
+     dev = kzalloc_obj(*dev);
+ 
+     if(dev == NULL) {
+@@ -7425,12 +7445,10 @@ exit_free:
+ static void razer_mouse_disconnect(struct hid_device *hdev)
+ {
+     struct razer_mouse_device *dev;
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
+-    struct usb_device *usb_dev = interface_to_usbdev(intf);
+ 
+     dev = hid_get_drvdata(hdev);
+ 
+-    if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE) {
++    if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_MOUSE) {
+         device_remove_file(&hdev->dev, &dev_attr_version);
+         device_remove_file(&hdev->dev, &dev_attr_test);
+         device_remove_file(&hdev->dev, &dev_attr_firmware_version);
+@@ -7438,7 +7456,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
+         device_remove_file(&hdev->dev, &dev_attr_device_serial);
+         device_remove_file(&hdev->dev, &dev_attr_device_mode);
+ 
+-        switch(usb_dev->descriptor.idProduct) {
++        switch(dev->usb_pid) {
+         case USB_DEVICE_ID_RAZER_ABYSSUS_ELITE_DVA_EDITION:
+         case USB_DEVICE_ID_RAZER_ABYSSUS_ESSENTIAL:
+             device_remove_file(&hdev->dev, &dev_attr_poll_rate);
+@@ -8630,9 +8648,27 @@ static const struct hid_device_id razer_devices[] = {
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_VERTICAL_EDITION_WIRED) },
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRED) },
+     { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRELESS) },
++    { HID_DEVICE(BUS_VIRTUAL,HID_GROUP_ANY,USB_VENDOR_ID_RAZER,HID_ANY_ID) },
+     { 0 }
+ };
+ 
++static bool razer_mouse_transport_supported(struct hid_device *hdev)
++{
++    const struct hid_device_id *identity;
++
++    if (hdev->bus == BUS_USB)
++        return true;
++    if (!razer_is_hyperflux_native(hdev))
++        return false;
++    for (identity = razer_devices; identity->vendor; identity++) {
++        if (identity->bus == BUS_USB &&
++            identity->vendor == hdev->vendor &&
++            identity->product == hdev->product)
++            return true;
++    }
++    return false;
++}
++
+ MODULE_DEVICE_TABLE(hid, razer_devices);
+ 
+ /**
+-- 
+2.55.0
+
diff --git a/integrations/openrazer/native-route/transform.json b/integrations/openrazer/native-route/transform.json
new file mode 100644
index 0000000..5e79a2c
--- /dev/null
+++ b/integrations/openrazer/native-route/transform.json
@@ -0,0 +1,35 @@
+{
+  "$schema": "../../../schemas/openrazer-native-transform.schema.json",
+  "schema": "hyperflux-openrazer-native-transform-v1",
+  "upstream": {
+    "id": "openrazer",
+    "repository": "https://github.com/openrazer/openrazer.git",
+    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792"
+  },
+  "patch": {
+    "path": "patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
+    "sha256": "0fdef2ee1e820505a6e8ffd6a6bc18aed82e57bea2527711d710c8a992147ff4"
+  },
+  "files": [
+    {
+      "path": "driver/razercommon.c",
+      "source_sha256": "984c3f95cba20710e84f3eed8a26b1e2eddf0f8b6e5fe8bca51a32166744509e",
+      "transformed_sha256": "e71aa4484904b6422b974f7c14fa9f3d6c20efc9382d59503d420a1ae0e6fa11"
+    },
+    {
+      "path": "driver/razercommon.h",
+      "source_sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65",
+      "transformed_sha256": "7cf36b2058a54bfc0f38c595d83de9a5da425c6aa053e0ddef07ee07ea706888"
+    },
+    {
+      "path": "driver/razerkbd_driver.c",
+      "source_sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df",
+      "transformed_sha256": "f4d1f902ceb0b1b0145dc50139b2c9860584901730af6668697e69877f13918a"
+    },
+    {
+      "path": "driver/razermouse_driver.c",
+      "source_sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff",
+      "transformed_sha256": "4b0de8f5971afa01b06c8fe479b70ef269a6804e7feee80c827389f0f5623d7d"
+    }
+  ]
+}
diff --git a/packaging/distributions.json b/packaging/distributions.json
index 3709b2b..de6d56b 100644
--- a/packaging/distributions.json
+++ b/packaging/distributions.json
@@ -25,7 +25,9 @@
         {"package": "python-dbus", "purpose": "private OpenRazer compatibility service"},
         {"package": "python-gobject", "purpose": "private OpenRazer compatibility event loop"}
       ],
-      "conflicts": ["hyperflux-v2-linux-dkms"],
+      "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
+      "provides": ["openrazer-driver-dkms"],
+      "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python@python_major_minor@/site-packages/hyperflux-next.pth"
     },
     "debian": {
@@ -47,7 +49,9 @@
         {"package": "python3-dbus", "purpose": "private OpenRazer compatibility service"},
         {"package": "python3-gi", "purpose": "private OpenRazer compatibility event loop"}
       ],
-      "conflicts": ["hyperflux-v2-linux-dkms"],
+      "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
+      "provides": ["openrazer-driver-dkms"],
+      "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python3/dist-packages/hyperflux-next.pth"
     },
     "rpm": {
@@ -69,7 +73,9 @@
         {"package": "python3-dbus", "purpose": "private OpenRazer compatibility service"},
         {"package": "python3-gobject", "purpose": "private OpenRazer compatibility event loop"}
       ],
-      "conflicts": ["hyperflux-v2-linux-dkms"],
+      "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
+      "provides": ["openrazer-driver-dkms"],
+      "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python@python_major_minor@/site-packages/hyperflux-next.pth"
     }
   }
diff --git a/packaging/generated/hyperflux-next-bridge.service b/packaging/generated/hyperflux-next-bridge.service
index 674ec9f..b8bb60a 100644
--- a/packaging/generated/hyperflux-next-bridge.service
+++ b/packaging/generated/hyperflux-next-bridge.service
@@ -4,9 +4,9 @@
 Description=HyperFlux Next bridge
 Documentation=man:hyperfluxctl(1)
 Requires=hyperflux-next-activation.service
-Wants=hyperflux-next-confirmation.service
+Wants=hyperflux-next-confirmation.service hyperflux-next-openrazer-relay.service
 After=systemd-udevd.service hyperflux-next-activation.service
-Before=hyperflux-next-confirmation.service
+Before=hyperflux-next-confirmation.service hyperflux-next-openrazer-relay.service
 ConditionPathExists=/etc/hyperflux-next/bridge.json
 
 [Service]
diff --git a/packaging/generated/hyperflux-next-openrazer-relay.service b/packaging/generated/hyperflux-next-openrazer-relay.service
new file mode 100644
index 0000000..4488907
--- /dev/null
+++ b/packaging/generated/hyperflux-next-openrazer-relay.service
@@ -0,0 +1,47 @@
+# Generated by ./hfx generate. Do not edit manually.
+# SPDX-License-Identifier: GPL-2.0-only
+[Unit]
+Description=HyperFlux Next OpenRazer native-route relay
+PartOf=hyperflux-next-bridge.service
+Requires=hyperflux-next-bridge.service
+After=hyperflux-next-bridge.service systemd-udevd.service
+ConditionPathExists=/dev/uhid
+
+[Service]
+Type=simple
+User=root
+Group=root
+ExecStartPre=/usr/lib/hyperflux-next/hyperflux-next-activate check-openrazer-driver
+ExecStart=/usr/lib/hyperflux-next/hyperflux-next-uhid-relay --socket /run/hyperflux-next/bridge.sock --uhid /dev/uhid
+UMask=0077
+Restart=on-failure
+RestartSec=2s
+TimeoutStartSec=10s
+TimeoutStopSec=10s
+LimitNOFILE=64
+TasksMax=32
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+ProtectControlGroups=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectKernelLogs=yes
+ProtectHostname=yes
+ProtectClock=yes
+RestrictAddressFamilies=AF_UNIX
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallFilter=~@mount @module @raw-io @reboot @swap
+CapabilityBoundingSet=
+AmbientCapabilities=
+DevicePolicy=closed
+DeviceAllow=/dev/uhid rw
+ReadOnlyPaths=/usr/lib/hyperflux-next /run/hyperflux-next
+ReadWritePaths=/dev/uhid
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 1bde1bd..2ab571e 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -1,6 +1,6 @@
 {
   "schema": "hyperflux-compiled-install-plan-v1",
-  "install_manifest_sha256": "184e6f6d925b3a0aac4aa2fbeae741830e75720f3b7779c562c094b37af01554",
+  "install_manifest_sha256": "b939538cfddbc866e5e72213267f29053a34d6eb636264467cea0f69a7bcc750",
   "product": {
     "name": "hyperflux-next-linux",
     "version": "0.0.0-dev.1",
@@ -40,6 +40,24 @@
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-activate",
       "mode": "0755"
     },
+    {
+      "id": "openrazer-native-relay",
+      "kind": "cargo-binary",
+      "required": true,
+      "package": "hfx-uhid-relay",
+      "target": "hyperflux-next-uhid-relay",
+      "destination": "/usr/lib/hyperflux-next/hyperflux-next-uhid-relay",
+      "mode": "0755"
+    },
+    {
+      "id": "openrazer-native-driver",
+      "kind": "source-transform",
+      "required": true,
+      "transform": "openrazer-native-route",
+      "destination": "/usr/src/openrazer-driver-3.12.1",
+      "mode": "0644",
+      "capability": "openrazer-source"
+    },
     {
       "id": "openrgb-native",
       "kind": "cmake-module",
@@ -193,6 +211,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "openrazer-native-relay-service",
+      "source": "packaging/generated/hyperflux-next-openrazer-relay.service",
+      "destination": "/usr/lib/systemd/system/hyperflux-next-openrazer-relay.service",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "activation-service",
       "source": "packaging/generated/hyperflux-next-activation.service",
@@ -494,6 +519,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-deployment.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-deployment.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/openrazer-native-method-inventory.schema.json",
@@ -515,6 +547,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-route-catalog.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-route-catalog.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/openrazer-native-transform.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrazer-native-transform.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/package-build-manifest.schema.json",
@@ -767,6 +813,34 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-route/catalog.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-route/catalog.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-route/deployment.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-route/deployment.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "integration-authority",
+      "source": "integrations/openrazer/native-route/transform.json",
+      "destination": "/usr/share/hyperflux-next/integrations/openrazer/native-route/transform.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/generated/domain_json.hpp",
@@ -1208,6 +1282,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "documentation",
+      "source": "docs/generated/openrazer-native-deployment.md",
+      "destination": "/usr/share/doc/hyperflux-next/generated/openrazer-native-deployment.md",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "documentation",
       "source": "docs/generated/performance-budgets.md",
diff --git a/packaging/install.json b/packaging/install.json
index f6385d2..ba08da9 100644
--- a/packaging/install.json
+++ b/packaging/install.json
@@ -35,6 +35,24 @@
       "mode": "0755",
       "required": true
     },
+    {
+      "id": "openrazer-native-relay",
+      "kind": "cargo-binary",
+      "package": "hfx-uhid-relay",
+      "target": "hyperflux-next-uhid-relay",
+      "destination": "@openrazer_relay_executable_path@",
+      "mode": "0755",
+      "required": true
+    },
+    {
+      "id": "openrazer-native-driver",
+      "kind": "source-transform",
+      "transform": "openrazer-native-route",
+      "destination": "@openrazer_dkms_source_directory@",
+      "mode": "0644",
+      "required": true,
+      "capability": "openrazer-source"
+    },
     {
       "id": "openrgb-native",
       "kind": "cmake-module",
@@ -96,6 +114,15 @@
       "preserve": false,
       "include": []
     },
+    {
+      "id": "openrazer-native-relay-service",
+      "kind": "file",
+      "source": "packaging/generated/hyperflux-next-openrazer-relay.service",
+      "destination": "/usr/lib/systemd/system/hyperflux-next-openrazer-relay.service",
+      "mode": "0644",
+      "preserve": false,
+      "include": []
+    },
     {
       "id": "activation-service",
       "kind": "file",
@@ -211,7 +238,13 @@
       "destination": "/usr/share/hyperflux-next/integrations",
       "mode": "0644",
       "preserve": false,
-      "include": ["catalog.json", "openrazer/*.json", "openrazer/compatibility.json"]
+      "include": [
+        "catalog.json",
+        "openrazer/*.json",
+        "openrazer/compatibility.json",
+        "openrazer/native-route/*.json",
+        "openrazer/native-route/patches/*.patch"
+      ]
     },
     {
       "id": "cpp-sdk-headers",
diff --git a/schemas/distribution-packages.schema.json b/schemas/distribution-packages.schema.json
index 78affdc..3982a86 100644
--- a/schemas/distribution-packages.schema.json
+++ b/schemas/distribution-packages.schema.json
@@ -52,6 +52,8 @@
         "dependency_roles",
         "optional_dependencies",
         "conflicts",
+        "provides",
+        "replaces",
         "python_discovery_path"
       ],
       "properties": {
@@ -99,6 +101,18 @@
           "uniqueItems": true,
           "items": {"$ref": "#/$defs/packageName"}
         },
+        "provides": {
+          "type": "array",
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/packageName"}
+        },
+        "replaces": {
+          "type": "array",
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {"$ref": "#/$defs/packageName"}
+        },
         "python_discovery_path": {
           "type": "string",
           "pattern": "^/usr/.+\\.pth$",
diff --git a/schemas/install-manifest.schema.json b/schemas/install-manifest.schema.json
index 4933307..e5320bc 100644
--- a/schemas/install-manifest.schema.json
+++ b/schemas/install-manifest.schema.json
@@ -61,7 +61,8 @@
       "oneOf": [
         {"$ref": "#/$defs/cargoBuild"},
         {"$ref": "#/$defs/cmakeBuild"},
-        {"$ref": "#/$defs/pythonBuild"}
+        {"$ref": "#/$defs/pythonBuild"},
+        {"$ref": "#/$defs/sourceTransformBuild"}
       ]
     },
     "cargoBuild": {
@@ -106,6 +107,28 @@
         "required": {"type": "boolean"}
       }
     },
+    "sourceTransformBuild": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "transform",
+        "destination",
+        "mode",
+        "required",
+        "capability"
+      ],
+      "properties": {
+        "id": {"$ref": "#/$defs/identifier"},
+        "kind": {"const": "source-transform"},
+        "transform": {"$ref": "#/$defs/identifier"},
+        "destination": {"$ref": "#/$defs/destination"},
+        "mode": {"const": "0644"},
+        "required": {"const": true},
+        "capability": {"$ref": "#/$defs/identifier"}
+      }
+    },
     "payload": {
       "type": "object",
       "additionalProperties": false,
diff --git a/schemas/openrazer-native-deployment.schema.json b/schemas/openrazer-native-deployment.schema.json
new file mode 100644
index 0000000..11a2ec5
--- /dev/null
+++ b/schemas/openrazer-native-deployment.schema.json
@@ -0,0 +1,53 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-deployment-v1.json",
+  "title": "HyperFlux OpenRazer native-route deployment",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "relay", "driver"],
+  "properties": {
+    "$schema": {"const": "../../../schemas/openrazer-native-deployment.schema.json"},
+    "schema": {"const": "hyperflux-openrazer-native-deployment-v1"},
+    "relay": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["executable_path", "service_unit", "uhid_device", "restart_seconds"],
+      "properties": {
+        "executable_path": {
+          "type": "string",
+          "pattern": "^/usr/lib/hyperflux-next/[a-z0-9][a-z0-9_.-]{0,95}$"
+        },
+        "service_unit": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9@_.-]{0,95}\\.service$"
+        },
+        "uhid_device": {"const": "/dev/uhid"},
+        "restart_seconds": {"type": "integer", "minimum": 1, "maximum": 60}
+      }
+    },
+    "driver": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["dkms_name", "dkms_version", "source_directory", "modules"],
+      "properties": {
+        "dkms_name": {"const": "openrazer-driver"},
+        "dkms_version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "maxLength": 32
+        },
+        "source_directory": {
+          "type": "string",
+          "pattern": "^/usr/src/openrazer-driver-[0-9]+\\.[0-9]+\\.[0-9]+$"
+        },
+        "modules": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {"type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$"}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/openrazer-native-route-catalog.schema.json b/schemas/openrazer-native-route-catalog.schema.json
new file mode 100644
index 0000000..8b134e7
--- /dev/null
+++ b/schemas/openrazer-native-route-catalog.schema.json
@@ -0,0 +1,62 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-route-catalog-v1.json",
+  "title": "Source-bound OpenRazer native-route catalog",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "upstream_commit", "metadata_sha256", "transport", "routes"],
+  "properties": {
+    "$schema": {"const": "../../../schemas/openrazer-native-route-catalog.schema.json"},
+    "schema": {"const": "hyperflux-openrazer-native-route-catalog-v1"},
+    "upstream_commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "metadata_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "transport": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["protocol_family", "report_bytes", "phys_prefix", "descriptor_hex", "descriptor_sha256"],
+      "properties": {
+        "protocol_family": {"const": "razer-feature-report-v1"},
+        "report_bytes": {"const": 90},
+        "phys_prefix": {"const": "hyperflux-next/native/v1/"},
+        "descriptor_hex": {"type": "string", "pattern": "^[0-9a-f]+$", "minLength": 2, "maxLength": 8192},
+        "descriptor_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    },
+    "routes": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 1024,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["profile_id", "vendor_id", "wireless_product_id", "model_name", "device_kind", "driver_family", "source", "direct_data_product_ids", "event_file_regex"],
+        "properties": {
+          "profile_id": {"type": "string", "minLength": 1, "maxLength": 128},
+          "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+          "wireless_product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+          "model_name": {"type": "string", "minLength": 1, "maxLength": 127},
+          "device_kind": {"enum": ["mouse", "keyboard"]},
+          "driver_family": {"enum": ["razermouse", "razerkbd"]},
+          "source": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["path", "class_name", "sha256"],
+            "properties": {
+              "path": {"type": "string", "minLength": 1, "maxLength": 256},
+              "class_name": {"type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"},
+              "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+            }
+          },
+          "direct_data_product_ids": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 32,
+            "uniqueItems": true,
+            "items": {"type": "integer", "minimum": 0, "maximum": 65535}
+          },
+          "event_file_regex": {"type": "string", "minLength": 1, "maxLength": 256}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/openrazer-native-transform.schema.json b/schemas/openrazer-native-transform.schema.json
new file mode 100644
index 0000000..8444e4c
--- /dev/null
+++ b/schemas/openrazer-native-transform.schema.json
@@ -0,0 +1,46 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-transform-v1.json",
+  "title": "Source-bound OpenRazer native transport transformation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "upstream", "patch", "files"],
+  "properties": {
+    "$schema": {"const": "../../../schemas/openrazer-native-transform.schema.json"},
+    "schema": {"const": "hyperflux-openrazer-native-transform-v1"},
+    "upstream": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "repository", "commit"],
+      "properties": {
+        "id": {"const": "openrazer"},
+        "repository": {"const": "https://github.com/openrazer/openrazer.git"},
+        "commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"}
+      }
+    },
+    "patch": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": {"type": "string", "pattern": "^patches/[A-Za-z0-9._-]+\\.patch$"},
+        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 32,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "source_sha256", "transformed_sha256"],
+        "properties": {
+          "path": {"type": "string", "pattern": "^driver/[A-Za-z0-9._-]+$"},
+          "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+          "transformed_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/package-build-manifest.schema.json b/schemas/package-build-manifest.schema.json
index 4240e1c..dddcaf1 100644
--- a/schemas/package-build-manifest.schema.json
+++ b/schemas/package-build-manifest.schema.json
@@ -53,7 +53,11 @@
         "sbom_sha256",
         "toolchain_pins_sha256",
         "cargo_lock_sha256",
-        "integration_catalog_sha256"
+        "integration_catalog_sha256",
+        "openrazer_native_catalog_sha256",
+        "openrazer_native_transform_sha256",
+        "openrazer_native_deployment_sha256",
+        "openrazer_native_patch_sha256"
       ],
       "properties": {
         "install_manifest_sha256": {"$ref": "#/$defs/digest"},
@@ -62,7 +66,11 @@
         "sbom_sha256": {"$ref": "#/$defs/digest"},
         "toolchain_pins_sha256": {"$ref": "#/$defs/digest"},
         "cargo_lock_sha256": {"$ref": "#/$defs/digest"},
-        "integration_catalog_sha256": {"$ref": "#/$defs/digest"}
+        "integration_catalog_sha256": {"$ref": "#/$defs/digest"},
+        "openrazer_native_catalog_sha256": {"$ref": "#/$defs/digest"},
+        "openrazer_native_transform_sha256": {"$ref": "#/$defs/digest"},
+        "openrazer_native_deployment_sha256": {"$ref": "#/$defs/digest"},
+        "openrazer_native_patch_sha256": {"$ref": "#/$defs/digest"}
       }
     },
     "materials": {
@@ -99,7 +107,7 @@
       "required": ["build_id", "kind", "path", "sha256", "size", "mode"],
       "properties": {
         "build_id": {"$ref": "#/$defs/identifier"},
-        "kind": {"enum": ["cargo-binary", "cmake-module", "python-wheel"]},
+        "kind": {"enum": ["cargo-binary", "cmake-module", "python-wheel", "source-tree"]},
         "path": {"$ref": "#/$defs/relativePath"},
         "sha256": {"$ref": "#/$defs/digest"},
         "size": {"type": "integer", "minimum": 1, "maximum": 1073741824},
diff --git a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
index 919a444..e7ce4d9 100644
--- a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
@@ -22,6 +22,7 @@ enum class ErrorCode
     HfxIntegration001,
     HfxInternal001,
     HfxKernel001,
+    HfxKernel002,
     HfxOutcome001,
     HfxOutcome002,
     HfxOwnership001,
@@ -49,6 +50,7 @@ enum class ErrorCode
         case ErrorCode::HfxIntegration001: return "HFX-INTEGRATION-001";
         case ErrorCode::HfxInternal001: return "HFX-INTERNAL-001";
         case ErrorCode::HfxKernel001: return "HFX-KERNEL-001";
+        case ErrorCode::HfxKernel002: return "HFX-KERNEL-002";
         case ErrorCode::HfxOutcome001: return "HFX-OUTCOME-001";
         case ErrorCode::HfxOutcome002: return "HFX-OUTCOME-002";
         case ErrorCode::HfxOwnership001: return "HFX-OWNERSHIP-001";
@@ -73,6 +75,7 @@ enum class RemediationId
 {
     AcquireNewLease,
     ActivateInstalledDriver,
+    ActivateOpenrazerRouteDriver,
     CollectSupportBundle,
     CorrectRequest,
     DisableUnsupportedFeature,
@@ -96,6 +99,7 @@ enum class RemediationId
     {
         case RemediationId::AcquireNewLease: return "acquire-new-lease";
         case RemediationId::ActivateInstalledDriver: return "activate-installed-driver";
+        case RemediationId::ActivateOpenrazerRouteDriver: return "activate-openrazer-route-driver";
         case RemediationId::CollectSupportBundle: return "collect-support-bundle";
         case RemediationId::CorrectRequest: return "correct-request";
         case RemediationId::DisableUnsupportedFeature: return "disable-unsupported-feature";
@@ -311,15 +315,16 @@ struct ErrorDescriptor
     std::string_view docs_path;
 };
 
-inline constexpr std::string_view error_catalog_sha256 = "dc21516800b761970c0e7c14a030424a56235610f3355f70f70259e2e4843e91";
+inline constexpr std::string_view error_catalog_sha256 = "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066";
 inline constexpr std::size_t max_error_count = 256;
 inline constexpr std::size_t max_remediation_count = 128;
 inline constexpr std::size_t max_safe_detail_fields = 12;
 inline constexpr std::size_t max_safe_detail_length = 256;
 
-inline constexpr std::array<RemediationDescriptor, 17> remediations {{
+inline constexpr std::array<RemediationDescriptor, 18> remediations {{
     {RemediationId::AcquireNewLease, "Acquire a current lease", "Request a new lease for the complete resource set before submitting another operation.", "Read the ownership snapshot and confirm the new lease is current.", false},
     {RemediationId::ActivateInstalledDriver, "Activate the installed driver", "Use the platform's documented reboot or receiver-disconnect activation path.", "Run Doctor and confirm the loaded and installed driver identities match.", false},
+    {RemediationId::ActivateOpenrazerRouteDriver, "Activate the OpenRazer route driver", "Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.", "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.", false},
     {RemediationId::CollectSupportBundle, "Collect a privacy-safe support bundle", "Preview and create the bounded HyperFlux support bundle for the unresolved internal failure.", "Confirm the bundle preview excludes private paths, serials, raw reports, and arbitrary logs.", false},
     {RemediationId::CorrectRequest, "Correct the request", "Correct the named request field and submit a new request with a new request identifier.", "Validate the corrected request against the negotiated protocol schema.", false},
     {RemediationId::DisableUnsupportedFeature, "Disable the unsupported feature", "Continue without the feature or use a peer that advertises it during negotiation.", "Repeat negotiation and inspect the enabled feature set.", false},
@@ -364,106 +369,112 @@ inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_4 {{
     {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Currently loaded kernel interface identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_5 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_5 {{
+    {"installed_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Installed OpenRazer module source identity."},
+    {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Loaded OpenRazer module source identity or activation state."},
+    {"module", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "OpenRazer native-route kernel module name."},
+}};
+
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_6 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity that has no retained or eviction record."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_6 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_7 {{
     {"history_capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured retained outcome capacity."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity whose terminal record aged out."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_7 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_8 {{
     {"owner_name", SafeDetailKind::Text, false, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Current application owner when available."},
     {"resource_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Contended logical resource."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_8_1 {{"expired", "released", "revoked"}};
+inline constexpr std::array<std::string_view, 3> detail_values_9_1 {{"expired", "released", "revoked"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_8 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_9 {{
     {"lease_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Expired or revoked lease identity."},
-    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_8_1, PrivacyClass::Public, "Terminal lease state."},
+    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_9_1, PrivacyClass::Public, "Terminal lease state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_9_0 {{"load", "migrate", "validate"}};
+inline constexpr std::array<std::string_view, 3> detail_values_10_0 {{"load", "migrate", "validate"}};
 
-inline constexpr std::array<std::string_view, 4> detail_values_9_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
+inline constexpr std::array<std::string_view, 4> detail_values_10_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_9 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_9_0, PrivacyClass::Public, "Failed state-read phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_9_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_10 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_0, PrivacyClass::Public, "Failed state-read phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_10_0 {{"commit", "rollback", "snapshot"}};
+inline constexpr std::array<std::string_view, 3> detail_values_11_0 {{"commit", "rollback", "snapshot"}};
 
-inline constexpr std::array<std::string_view, 3> detail_values_10_1 {{"io-failure", "permission-denied", "validation-failed"}};
+inline constexpr std::array<std::string_view, 3> detail_values_11_1 {{"io-failure", "permission-denied", "validation-failed"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_10 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_0, PrivacyClass::Public, "Failed state-write phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_0, PrivacyClass::Public, "Failed state-write phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_12 {{
     {"capability", SafeDetailKind::Identifier, true, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested semantic capability."},
     {"product_id", SafeDetailKind::U16, false, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Observed USB product identifier when available."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_12 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_13 {{
     {"active_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest bound to the active generation."},
     {"catalog_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest from the generated profile catalog."},
     {"profile_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Selected profile identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_13 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_14 {{
     {"client_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the client."},
     {"client_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the client."},
     {"server_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the bridge."},
     {"server_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the bridge."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_14 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_15 {{
     {"feature", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested protocol feature identifier."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_15_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
+inline constexpr std::array<std::string_view, 5> detail_values_16_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_15 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_16 {{
     {"capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured queue capacity."},
-    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_15_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
+    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_16_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_16_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
+inline constexpr std::array<std::string_view, 5> detail_values_17_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_16 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_17 {{
     {"field", SafeDetailKind::Text, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Schema field path without request data."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_16_1, PrivacyClass::Public, "Sanitized validation reason."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_17_1, PrivacyClass::Public, "Sanitized validation reason."},
     {"request_id", SafeDetailKind::Identifier, false, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Request identity when parsing reached it."},
 }};
 
-inline constexpr std::array<std::string_view, 6> detail_values_17_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
+inline constexpr std::array<std::string_view, 6> detail_values_18_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_17 {{
-    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_17_0, PrivacyClass::Public, "Sanitized bridge service state."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_18 {{
+    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_18_0, PrivacyClass::Public, "Sanitized bridge service state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_18_0 {{"device-absent", "session-unavailable", "transport-busy"}};
+inline constexpr std::array<std::string_view, 3> detail_values_19_0 {{"device-absent", "session-unavailable", "transport-busy"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_18 {{
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_18_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_19 {{
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_19_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction that did not begin transport."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_19 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_20 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction whose transport outcome is uncertain."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_20 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_21 {{
     {"delivered_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames terminally delivered before failure."},
     {"total_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames declared by the transaction."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Partially delivered transaction identity."},
 }};
 
-inline constexpr std::array<ErrorDescriptor, 21> errors {{
+inline constexpr std::array<ErrorDescriptor, 22> errors {{
     {
         ErrorCode::HfxDeadline001, ErrorClass::Deadline,
         ErrorSeverity::Warning, RetryPolicy::Never,
@@ -514,11 +525,21 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         "The newly installed driver is not active yet.", PrivacyClass::Public,
         "docs/generated/error-catalog.md#hfx-kernel-001"
     },
+    {
+        ErrorCode::HfxKernel002, ErrorClass::Kernel,
+        ErrorSeverity::Error, RetryPolicy::AfterRemediation,
+        SideEffectCertaintyPolicy::NotApplicable,
+        RemediationId::ActivateOpenrazerRouteDriver, details_5,
+        {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
+        ErrorOwner::Packaging, "A required OpenRazer native-route kernel module is missing or an older module remains active.",
+        "The OpenRazer route driver is not ready yet.", PrivacyClass::Public,
+        "docs/generated/error-catalog.md#hfx-kernel-002"
+    },
     {
         ErrorCode::HfxOutcome001, ErrorClass::Outcome,
         ErrorSeverity::Warning, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_5,
+        RemediationId::ReconcileTransactionState, details_6,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded bridge history has no retained or eviction record for the requested transaction.",
         "HyperFlux cannot determine the result of this transaction from its current history.", PrivacyClass::PublicSummary,
@@ -528,7 +549,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxOutcome002, ErrorClass::Outcome,
         ErrorSeverity::Info, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_6,
+        RemediationId::ReconcileTransactionState, details_7,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The transaction was known, but its terminal result aged out of bounded retained history.",
         "The transaction result is older than the history HyperFlux keeps in memory.", PrivacyClass::PublicSummary,
@@ -538,7 +559,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxOwnership001, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::ReleaseOwner, details_7,
+        RemediationId::ReleaseOwner, details_8,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Another live client owns at least one requested resource.",
         "Another application currently controls this device function.", PrivacyClass::Public,
@@ -548,7 +569,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxOwnership002, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::AcquireNewLease, details_8,
+        RemediationId::AcquireNewLease, details_9,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The lease no longer authorizes the requested resource set.",
         "The application's control lease ended before the operation started.", PrivacyClass::Public,
@@ -558,7 +579,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxPersistence001, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_9,
+        RemediationId::RepairStateStorage, details_10,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Persisted bridge state could not be loaded and validated safely.",
         "HyperFlux could not read its saved state and kept hardware restoration disabled.", PrivacyClass::PublicSummary,
@@ -568,7 +589,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxPersistence002, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_10,
+        RemediationId::RepairStateStorage, details_11,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "A transactional state update could not be committed or rolled back safely.",
         "HyperFlux could not save its latest stable state.", PrivacyClass::PublicSummary,
@@ -578,7 +599,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxProfile001, ErrorClass::Profile,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::QualifyDevice, details_11,
+        RemediationId::QualifyDevice, details_12,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "No evidence-backed profile qualifies the requested device capability.",
         "The device is visible, but this operation is not qualified for it.", PrivacyClass::Public,
@@ -588,7 +609,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxProfile002, ErrorClass::Profile,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::VerifyProfileCatalog, details_12,
+        RemediationId::VerifyProfileCatalog, details_13,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The active profile binding does not match the generated profile catalog.",
         "HyperFlux paused writes because its hardware profile changed.", PrivacyClass::Public,
@@ -598,7 +619,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxProtocol001, ErrorClass::Protocol,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::UpdateProtocolPeer, details_13,
+        RemediationId::UpdateProtocolPeer, details_14,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The client and bridge protocol version ranges do not overlap.",
         "The application and HyperFlux service are not protocol-compatible.", PrivacyClass::Public,
@@ -608,7 +629,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxProtocol002, ErrorClass::Protocol,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::DisableUnsupportedFeature, details_14,
+        RemediationId::DisableUnsupportedFeature, details_15,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request requires a feature that was not enabled during negotiation.",
         "This feature is unavailable with the current application and service combination.", PrivacyClass::Public,
@@ -618,7 +639,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxQueue001, ErrorClass::Queue,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_15,
+        RemediationId::RetryBounded, details_16,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded queue had no admissible capacity before the request deadline.",
         "HyperFlux is temporarily busy and did not start this operation.", PrivacyClass::Public,
@@ -628,7 +649,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxRequest001, ErrorClass::Request,
         ErrorSeverity::Error, RetryPolicy::Never,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::CorrectRequest, details_16,
+        RemediationId::CorrectRequest, details_17,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request violates the negotiated bounded protocol schema.",
         "The application sent a request HyperFlux cannot safely accept.", PrivacyClass::PublicSummary,
@@ -638,7 +659,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxService001, ErrorClass::Service,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::StartBridge, details_17,
+        RemediationId::StartBridge, details_18,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "The compatible bridge service is stopped or is not ready to accept SDK requests.",
         "The HyperFlux service is not ready yet.", PrivacyClass::Public,
@@ -648,7 +669,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxTransport001, ErrorClass::Transport,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_18,
+        RemediationId::RetryBounded, details_19,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport failed before any hardware frame was dispatched.",
         "The receiver was unavailable before HyperFlux sent anything.", PrivacyClass::PublicSummary,
@@ -658,7 +679,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxTransport002, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Possible,
-        RemediationId::LookupTransactionOutcome, details_19,
+        RemediationId::LookupTransactionOutcome, details_20,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport began, but the bridge could not prove whether the receiver accepted a frame.",
         "The operation may have reached the receiver, so HyperFlux will not repeat it automatically.", PrivacyClass::PublicSummary,
@@ -668,7 +689,7 @@ inline constexpr std::array<ErrorDescriptor, 21> errors {{
         ErrorCode::HfxTransport003, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Partial,
-        RemediationId::LookupTransactionOutcome, details_20,
+        RemediationId::LookupTransactionOutcome, details_21,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "At least one declared frame was delivered before a later frame failed.",
         "The operation was only partly delivered and will not be repeated automatically.", PrivacyClass::PublicSummary,
diff --git a/sdk/python/hyperflux_sdk/generated/error_catalog.py b/sdk/python/hyperflux_sdk/generated/error_catalog.py
index 8aa2210..b4c10e2 100644
--- a/sdk/python/hyperflux_sdk/generated/error_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/error_catalog.py
@@ -15,6 +15,7 @@ class ErrorCode(str, Enum):
     HFX_INTEGRATION_001 = "HFX-INTEGRATION-001"
     HFX_INTERNAL_001 = "HFX-INTERNAL-001"
     HFX_KERNEL_001 = "HFX-KERNEL-001"
+    HFX_KERNEL_002 = "HFX-KERNEL-002"
     HFX_OUTCOME_001 = "HFX-OUTCOME-001"
     HFX_OUTCOME_002 = "HFX-OUTCOME-002"
     HFX_OWNERSHIP_001 = "HFX-OWNERSHIP-001"
@@ -36,6 +37,7 @@ class ErrorCode(str, Enum):
 class RemediationId(str, Enum):
     ACQUIRE_NEW_LEASE = "acquire-new-lease"
     ACTIVATE_INSTALLED_DRIVER = "activate-installed-driver"
+    ACTIVATE_OPENRAZER_ROUTE_DRIVER = "activate-openrazer-route-driver"
     COLLECT_SUPPORT_BUNDLE = "collect-support-bundle"
     CORRECT_REQUEST = "correct-request"
     DISABLE_UNSUPPORTED_FEATURE = "disable-unsupported-feature"
@@ -156,7 +158,7 @@ class ErrorDescriptor:
     docs_path: str
 
 
-ERROR_CATALOG_SHA256: Final = "dc21516800b761970c0e7c14a030424a56235610f3355f70f70259e2e4843e91"
+ERROR_CATALOG_SHA256: Final = "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066"
 MAX_ERROR_COUNT: Final = 256
 MAX_REMEDIATION_COUNT: Final = 128
 MAX_SAFE_DETAIL_FIELDS: Final = 12
@@ -177,6 +179,13 @@ class ErrorDescriptor:
         verification="Run Doctor and confirm the loaded and installed driver identities match.",
         automatic=False,
     ),
+    RemediationDescriptor(
+        id=RemediationId.ACTIVATE_OPENRAZER_ROUTE_DRIVER,
+        title="Activate the OpenRazer route driver",
+        safe_action="Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.",
+        verification="Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
+        automatic=False,
+    ),
     RemediationDescriptor(
         id=RemediationId.COLLECT_SUPPORT_BUNDLE,
         title="Collect a privacy-safe support bundle",
@@ -400,6 +409,39 @@ class ErrorDescriptor:
 )
 
 DETAILS_5: Final = (
+    SafeDetailFieldDescriptor(
+        name="installed_abi",
+        kind=SafeDetailKind.IDENTIFIER,
+        required=True,
+        maximum_length=64,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="Installed OpenRazer module source identity.",
+    ),
+    SafeDetailFieldDescriptor(
+        name="loaded_abi",
+        kind=SafeDetailKind.IDENTIFIER,
+        required=True,
+        maximum_length=64,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="Loaded OpenRazer module source identity or activation state.",
+    ),
+    SafeDetailFieldDescriptor(
+        name="module",
+        kind=SafeDetailKind.IDENTIFIER,
+        required=True,
+        maximum_length=64,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer native-route kernel module name.",
+    ),
+)
+
+DETAILS_6: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -412,7 +454,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_6: Final = (
+DETAILS_7: Final = (
     SafeDetailFieldDescriptor(
         name="history_capacity",
         kind=SafeDetailKind.U16,
@@ -435,7 +477,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_7: Final = (
+DETAILS_8: Final = (
     SafeDetailFieldDescriptor(
         name="owner_name",
         kind=SafeDetailKind.TEXT,
@@ -458,7 +500,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_8: Final = (
+DETAILS_9: Final = (
     SafeDetailFieldDescriptor(
         name="lease_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -481,7 +523,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_9: Final = (
+DETAILS_10: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -504,7 +546,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_10: Final = (
+DETAILS_11: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -527,7 +569,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_11: Final = (
+DETAILS_12: Final = (
     SafeDetailFieldDescriptor(
         name="capability",
         kind=SafeDetailKind.IDENTIFIER,
@@ -550,7 +592,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_12: Final = (
+DETAILS_13: Final = (
     SafeDetailFieldDescriptor(
         name="active_digest",
         kind=SafeDetailKind.IDENTIFIER,
@@ -583,7 +625,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_13: Final = (
+DETAILS_14: Final = (
     SafeDetailFieldDescriptor(
         name="client_max_version",
         kind=SafeDetailKind.U16,
@@ -626,7 +668,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_14: Final = (
+DETAILS_15: Final = (
     SafeDetailFieldDescriptor(
         name="feature",
         kind=SafeDetailKind.IDENTIFIER,
@@ -639,7 +681,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_15: Final = (
+DETAILS_16: Final = (
     SafeDetailFieldDescriptor(
         name="capacity",
         kind=SafeDetailKind.U16,
@@ -662,7 +704,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_16: Final = (
+DETAILS_17: Final = (
     SafeDetailFieldDescriptor(
         name="field",
         kind=SafeDetailKind.TEXT,
@@ -695,7 +737,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_17: Final = (
+DETAILS_18: Final = (
     SafeDetailFieldDescriptor(
         name="service_state",
         kind=SafeDetailKind.ENUM,
@@ -708,7 +750,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_18: Final = (
+DETAILS_19: Final = (
     SafeDetailFieldDescriptor(
         name="reason",
         kind=SafeDetailKind.ENUM,
@@ -731,7 +773,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_19: Final = (
+DETAILS_20: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -744,7 +786,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_20: Final = (
+DETAILS_21: Final = (
     SafeDetailFieldDescriptor(
         name="delivered_frames",
         kind=SafeDetailKind.U16,
@@ -878,6 +920,26 @@ class ErrorDescriptor:
         privacy=PrivacyClass.PUBLIC,
         docs_path="docs/generated/error-catalog.md#hfx-kernel-001",
     ),
+    ErrorDescriptor(
+        code=ErrorCode.HFX_KERNEL_002,
+        error_class=ErrorClass.KERNEL,
+        severity=ErrorSeverity.ERROR,
+        retry_policy=RetryPolicy.AFTER_REMEDIATION,
+        side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
+        remediation_id=RemediationId.ACTIVATE_OPENRAZER_ROUTE_DRIVER,
+        safe_detail_fields=DETAILS_5,
+        lifecycle=LifecycleDescriptor(
+            state=ErrorLifecycleState.ACTIVE,
+            introduced_in="0.0.0-dev.1",
+            deprecated_in=None,
+            replacement_code=None,
+        ),
+        owner=ErrorOwner.PACKAGING,
+        technical_cause="A required OpenRazer native-route kernel module is missing or an older module remains active.",
+        user_explanation="The OpenRazer route driver is not ready yet.",
+        privacy=PrivacyClass.PUBLIC,
+        docs_path="docs/generated/error-catalog.md#hfx-kernel-002",
+    ),
     ErrorDescriptor(
         code=ErrorCode.HFX_OUTCOME_001,
         error_class=ErrorClass.OUTCOME,
@@ -885,7 +947,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_5,
+        safe_detail_fields=DETAILS_6,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -905,7 +967,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_6,
+        safe_detail_fields=DETAILS_7,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -925,7 +987,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RELEASE_OWNER,
-        safe_detail_fields=DETAILS_7,
+        safe_detail_fields=DETAILS_8,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -945,7 +1007,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.ACQUIRE_NEW_LEASE,
-        safe_detail_fields=DETAILS_8,
+        safe_detail_fields=DETAILS_9,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -965,7 +1027,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_9,
+        safe_detail_fields=DETAILS_10,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -985,7 +1047,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_10,
+        safe_detail_fields=DETAILS_11,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1005,7 +1067,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.QUALIFY_DEVICE,
-        safe_detail_fields=DETAILS_11,
+        safe_detail_fields=DETAILS_12,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1025,7 +1087,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.VERIFY_PROFILE_CATALOG,
-        safe_detail_fields=DETAILS_12,
+        safe_detail_fields=DETAILS_13,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1045,7 +1107,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.UPDATE_PROTOCOL_PEER,
-        safe_detail_fields=DETAILS_13,
+        safe_detail_fields=DETAILS_14,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1065,7 +1127,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.DISABLE_UNSUPPORTED_FEATURE,
-        safe_detail_fields=DETAILS_14,
+        safe_detail_fields=DETAILS_15,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1085,7 +1147,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_15,
+        safe_detail_fields=DETAILS_16,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1105,7 +1167,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.CORRECT_REQUEST,
-        safe_detail_fields=DETAILS_16,
+        safe_detail_fields=DETAILS_17,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1125,7 +1187,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.START_BRIDGE,
-        safe_detail_fields=DETAILS_17,
+        safe_detail_fields=DETAILS_18,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1145,7 +1207,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_18,
+        safe_detail_fields=DETAILS_19,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1165,7 +1227,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.POSSIBLE,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_19,
+        safe_detail_fields=DETAILS_20,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1185,7 +1247,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.PARTIAL,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_20,
+        safe_detail_fields=DETAILS_21,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
diff --git a/tests/test_distribution_debian.py b/tests/test_distribution_debian.py
index fc86427..17d5c1a 100644
--- a/tests/test_distribution_debian.py
+++ b/tests/test_distribution_debian.py
@@ -85,7 +85,12 @@ def test_control_comes_from_distribution_and_runtime_authorities(self) -> None:
         self.assertIn(f"Maintainer: {DEBIAN_MAINTAINER}\n", control)
         self.assertIn("Depends: dkms, libc6, libgcc-s1, python3 (>= 3.11), systemd, udev\n", control)
         self.assertIn("Suggests: openrgb, polychromatic, python3-dbus, python3-gi\n", control)
-        self.assertIn("Conflicts: hyperflux-v2-linux-dkms\n", control)
+        self.assertIn(
+            "Conflicts: hyperflux-v2-linux-dkms, openrazer-driver-dkms\n",
+            control,
+        )
+        self.assertIn("Provides: openrazer-driver-dkms\n", control)
+        self.assertIn("Replaces: openrazer-driver-dkms\n", control)
         self.assertIn(f"Description: {self.catalog.description}\n", control)
 
     def test_maintainer_scripts_are_posix_and_delegate_lifecycle(self) -> None:
diff --git a/tests/test_install.py b/tests/test_install.py
index 8c1f4ad..8469d14 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -108,9 +108,12 @@ def test_loader_rejects_activation_and_destination_drift(self) -> None:
         cases.append(wrong_schema)
 
         duplicate_distribution = copy.deepcopy(self.value)
-        duplicate_distribution["builds"][5]["distribution"] = duplicate_distribution[
-            "builds"
-        ][4]["distribution"]
+        python_builds = [
+            build
+            for build in duplicate_distribution["builds"]
+            if build["kind"] == "python-project"
+        ]
+        python_builds[1]["distribution"] = python_builds[0]["distribution"]
         cases.append(duplicate_distribution)
 
         for index, value in enumerate(cases):
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index b86be62..0098a35 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -72,6 +72,10 @@ def _artifact_manifest(self, directory: Path) -> Path:
         inputs = _provenance_inputs(ROOT, install, runtime)
         artifacts = []
         for build in install.builds:
+            artifact_kind = {
+                "python-project": "python-wheel",
+                "source-transform": "source-tree",
+            }.get(build.kind, build.kind)
             path = directory / "files" / build.id / (
                 f"{build.id}.whl" if build.kind == "python-project" else build.target or build.id
             )
@@ -79,11 +83,15 @@ def _artifact_manifest(self, directory: Path) -> Path:
             path.write_bytes(f"artifact:{build.id}\n".encode())
             value = {
                 "build_id": build.id,
-                "kind": "python-wheel" if build.kind == "python-project" else build.kind,
+                "kind": artifact_kind,
                 "path": path.relative_to(directory).as_posix(),
                 "sha256": sha256_file(path),
                 "size": path.stat().st_size,
-                "mode": "0644" if build.kind == "python-project" else "0755",
+                "mode": (
+                    "0644"
+                    if build.kind in {"python-project", "source-transform"}
+                    else "0755"
+                ),
             }
             if build.destination is not None:
                 value["destination"] = build.destination
@@ -112,7 +120,7 @@ def _artifact_manifest(self, directory: Path) -> Path:
             },
             "inputs": inputs,
             "materials": _provenance_materials(
-                ROOT, inputs, {"openrgb-source"}
+                ROOT, inputs, {"openrgb-source", "openrazer-source"}
             ),
             "artifacts": artifacts,
             "omitted": [],
@@ -129,7 +137,7 @@ def test_artifact_manifest_binds_every_declared_build(self) -> None:
                 return_value=("a" * 40, 1_700_000_000),
             ):
                 artifacts = load_artifact_set(ROOT, path)
-            self.assertEqual(len(artifacts.artifacts), 7)
+            self.assertEqual(len(artifacts.artifacts), 9)
             self.assertFalse(artifacts.omitted)
 
     def test_artifact_tamper_is_rejected_before_staging(self) -> None:
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index e5cf545..dc3ecca 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -23,6 +23,7 @@
 from .github_sync import verify as verify_github
 from .knowledge import import_upstream_catalogs
 from .openrazer import write_imported_metadata
+from .openrazer_native_route import prepare_openrazer_native_source
 from .package_pipeline import build_artifacts, stage_rootfs
 from .testgraph import format_plan, load_test_catalog
 from .upstreams import prepare_upstreams
@@ -117,6 +118,12 @@ def _parser() -> argparse.ArgumentParser:
     parity.add_argument("--direct-capture", required=True, type=Path)
     parity.add_argument("--receiver-capture", type=Path)
     parity.add_argument("--receiver-result", type=Path)
+    native_openrazer = native_commands.add_parser(
+        "prepare-openrazer",
+        help="prepare the source-bound OpenRazer native transport tree",
+    )
+    native_openrazer.add_argument("--source", required=True, type=Path)
+    native_openrazer.add_argument("--output", required=True, type=Path)
 
     upstream = commands.add_parser("upstream", help="manage immutable upstream checkouts")
     upstream_commands = upstream.add_subparsers(dest="upstream_command", required=True)
@@ -169,6 +176,7 @@ def _parser() -> argparse.ArgumentParser:
         "build", help="build source-bound package artifacts"
     )
     package_build.add_argument("--output", required=True, type=Path)
+    package_build.add_argument("--openrazer-source", required=True, type=Path)
     package_build.add_argument("--openrgb-source", type=Path)
     package_build.add_argument("--source-revision")
     package_stage = package_commands.add_parser(
@@ -311,6 +319,13 @@ def main(arguments: list[str] | None = None) -> int:
                 )
                 print(f"Privacy-safe evidence: {destination}")
                 return 0
+            if args.native_command == "prepare-openrazer":
+                prepared = prepare_openrazer_native_source(
+                    root, args.source, args.output
+                )
+                print(f"Prepared OpenRazer source: {prepared.root}")
+                print(f"Source binding: {prepared.result}")
+                return 0
         if args.command == "upstream":
             prepared = prepare_upstreams(root, args.output)
             for identifier in prepared.fetched:
@@ -365,6 +380,7 @@ def main(arguments: list[str] | None = None) -> int:
         if args.command == "package":
             if args.package_command == "build":
                 capabilities = {}
+                capabilities["openrazer-source"] = args.openrazer_source.resolve()
                 if args.openrgb_source is not None:
                     capabilities["openrgb-source"] = args.openrgb_source.resolve()
                 manifest = build_artifacts(
diff --git a/tools/hfxdev/distribution_debian.py b/tools/hfxdev/distribution_debian.py
index 6520eb8..c6bd17f 100644
--- a/tools/hfxdev/distribution_debian.py
+++ b/tools/hfxdev/distribution_debian.py
@@ -18,6 +18,7 @@
     tree_files,
 )
 from .model import ModelError
+from .openrazer_native_route import load_native_deployment
 
 
 DEBIAN_MAINTAINER = "HyperFlux Next Build System <build@hyperflux.invalid>"
@@ -40,6 +41,8 @@ def _debian_control(context: NativePackageContext) -> str:
     dependencies = ", ".join(context.target.dependencies_for(context.artifacts.python))
     optional = ", ".join(item.package for item in context.target.optional_dependencies)
     conflicts = ", ".join(context.target.conflicts)
+    provides = ", ".join(context.target.provides)
+    replaces = ", ".join(context.target.replaces)
     lines = [
         f"Package: {context.runtime.product.package_name}",
         f"Version: {_debian_version(context.runtime.product.version, context.runtime.product.package_release)}",
@@ -54,6 +57,10 @@ def _debian_control(context: NativePackageContext) -> str:
         lines.append(f"Suggests: {optional}")
     if conflicts:
         lines.append(f"Conflicts: {conflicts}")
+    if provides:
+        lines.append(f"Provides: {provides}")
+    if replaces:
+        lines.append(f"Replaces: {replaces}")
     lines.extend(
         [
             f"Description: {context.catalog.description}",
@@ -77,8 +84,11 @@ def _refresh_system_lines() -> list[str]:
 
 def _debian_scripts(context: NativePackageContext) -> dict[str, str]:
     activation = context.runtime.operations.activation_path
-    module = context.runtime.kernel.dkms_name
-    version = context.runtime.product.version
+    native = load_native_deployment(context.repository_root)
+    modules = (
+        (context.runtime.kernel.dkms_name, context.runtime.product.version),
+        (native.driver.dkms_name, native.driver.dkms_version),
+    )
     postinst = [
         "#!/bin/sh",
         "set -eu",
@@ -89,8 +99,12 @@ def _debian_scripts(context: NativePackageContext) -> dict[str, str]:
         '      echo "HyperFlux Next requires DKMS common.postinst support." >&2',
         "      exit 1",
         "    fi",
-        f"    /usr/lib/dkms/common.postinst {module} {version} /usr/share/hyperflux-next \"\" \"${{2:-}}\"",
     ]
+    postinst.extend(
+        f"    /usr/lib/dkms/common.postinst {module} {version} "
+        f"/usr/share/hyperflux-next \"\" \"${{2:-}}\""
+        for module, version in modules
+    )
     postinst.extend(f"    {line}" for line in _refresh_system_lines())
     postinst.extend(
         [
@@ -134,9 +148,15 @@ def _debian_scripts(context: NativePackageContext) -> dict[str, str]:
                 "",
                 'case "${1:-}" in',
                 "  remove|upgrade|deconfigure|failed-upgrade)",
-                f"    if dkms status -m {module} -v {version} 2>/dev/null | grep -q .; then",
-                f"      dkms remove -m {module} -v {version} --all || true",
-                "    fi",
+                *(
+                    line
+                    for module, version in modules
+                    for line in (
+                        f"    if dkms status -m {module} -v {version} 2>/dev/null | grep -q .; then",
+                        f"      dkms remove -m {module} -v {version} --all || true",
+                        "    fi",
+                    )
+                ),
                 "    ;;",
                 "esac",
                 "exit 0",
diff --git a/tools/hfxdev/distribution_package.py b/tools/hfxdev/distribution_package.py
index fe234c6..3a5702b 100644
--- a/tools/hfxdev/distribution_package.py
+++ b/tools/hfxdev/distribution_package.py
@@ -212,6 +212,8 @@ def _arch_pkgbuild(
             f"depends={_shell_array(list(target.dependencies_for(python_version)))}",
             f"optdepends={_shell_array(optional)}",
             f"conflicts={_shell_array(list(target.conflicts))}",
+            f"provides={_shell_array(list(target.provides))}",
+            f"replaces={_shell_array(list(target.replaces))}",
             "backup=('etc/hyperflux-next/bridge.json')",
             "options=('!strip' '!debug')",
             "install=hyperflux-next.install",
@@ -527,6 +529,8 @@ def _verify_arch_package(
             f"{item.package}: {item.purpose}" for item in target.optional_dependencies
         ),
         "conflict": target.conflicts,
+        "provides": target.provides,
+        "replaces": target.replaces,
         "backup": ("etc/hyperflux-next/bridge.json",),
     }
     for key, expected in repeated.items():
diff --git a/tools/hfxdev/distribution_rpm.py b/tools/hfxdev/distribution_rpm.py
index a44c3fc..d8abb93 100644
--- a/tools/hfxdev/distribution_rpm.py
+++ b/tools/hfxdev/distribution_rpm.py
@@ -18,6 +18,7 @@
     write_payload_tar,
 )
 from .model import ModelError
+from .openrazer_native_route import load_native_deployment
 
 
 RPM_BUILDHOST = "hyperflux.invalid"
@@ -79,13 +80,22 @@ def _refresh_system() -> list[str]:
 
 def _rpm_scripts(context: NativePackageContext) -> dict[str, str]:
     activation = context.runtime.operations.activation_path
-    module = context.runtime.kernel.dkms_name
-    version = context.runtime.product.version
+    native = load_native_deployment(context.repository_root)
+    modules = (
+        (context.runtime.kernel.dkms_name, context.runtime.product.version),
+        (native.driver.dkms_name, native.driver.dkms_version),
+    )
     update_state = context.runtime.update_state_path
     post = [
         "set -eu",
-        f"dkms add -m {module} -v {version} --rpm_safe_upgrade",
-        f"dkms autoinstall -m {module} -v {version}",
+        *(
+            line
+            for module, version in modules
+            for line in (
+                f"dkms add -m {module} -v {version} --rpm_safe_upgrade",
+                f"dkms autoinstall -m {module} -v {version}",
+            )
+        ),
         *_refresh_system(),
         'if [ "$1" -eq 1 ]; then',
         f"  {activation} fresh-install",
@@ -107,7 +117,10 @@ def _rpm_scripts(context: NativePackageContext) -> dict[str, str]:
                 'if [ "$1" -eq 0 ]; then',
                 f"  {activation} pre-remove",
                 "fi",
-                f"dkms remove -m {module} -v {version} --all --rpm_safe_upgrade",
+                *(
+                    f"dkms remove -m {module} -v {version} --all --rpm_safe_upgrade"
+                    for module, version in modules
+                ),
             ]
         ),
         "postun": "\n".join(
@@ -164,6 +177,13 @@ def _rpm_spec(context: NativePackageContext) -> str:
         _plain_rpm_dependency(value, "conflict")
         for value in context.target.conflicts
     ]
+    provides = [
+        _format_rpm_dependency(value, "provide") for value in context.target.provides
+    ]
+    replaces = [
+        _format_rpm_dependency(value, "replacement")
+        for value in context.target.replaces
+    ]
     scripts = _rpm_scripts(context)
     lines = [
         "%global debug_package %{nil}",
@@ -180,6 +200,8 @@ def _rpm_spec(context: NativePackageContext) -> str:
     lines.extend(f"Requires: {value}" for value in dependencies)
     lines.extend(f"Suggests: {value}" for value in optional)
     lines.extend(f"Conflicts: {value}" for value in conflicts)
+    lines.extend(f"Provides: {value}" for value in provides)
+    lines.extend(f"Obsoletes: {value}" for value in replaces)
     lines.extend(
         [
             "",
@@ -403,6 +425,20 @@ def _verify_rpm_package(context: NativePackageContext, package: Path) -> None:
         raise ModelError("RPM package suggestions differ from their authority")
     if set(_rpm_names(package, "CONFLICTNAME")) != set(context.target.conflicts):
         raise ModelError("RPM package conflicts differ from their authority")
+    provided = _rpm_relations(package, "PROVIDE")
+    declared_provides = {
+        _rpm_dependency(value, "provide") for value in context.target.provides
+    }
+    unexpected_provides = {
+        relation
+        for relation in provided - declared_provides
+        if relation[0] != context.runtime.product.package_name
+        and not relation[0].startswith(context.runtime.product.package_name + "(")
+    }
+    if not declared_provides <= provided or unexpected_provides:
+        raise ModelError("RPM package provides differ from their authority")
+    if set(_rpm_names(package, "OBSOLETENAME")) != set(context.target.replaces):
+        raise ModelError("RPM package replacements differ from their authority")
     _verify_rpm_scripts(context, package, _rpm_scripts(context))
 
     file_lines = _rpm_query(
diff --git a/tools/hfxdev/distributions.py b/tools/hfxdev/distributions.py
index 64b4720..14fc623 100644
--- a/tools/hfxdev/distributions.py
+++ b/tools/hfxdev/distributions.py
@@ -39,6 +39,8 @@ class DistributionTarget:
     dependency_roles: dict[str, str]
     optional_dependencies: tuple[OptionalDependency, ...]
     conflicts: tuple[str, ...]
+    provides: tuple[str, ...]
+    replaces: tuple[str, ...]
     python_discovery_path: str
 
     @property
@@ -118,6 +120,8 @@ def _target(target_id: str, value: Any) -> DistributionTarget:
             "dependency_roles",
             "optional_dependencies",
             "conflicts",
+            "provides",
+            "replaces",
             "python_discovery_path",
         },
         f"distribution {target_id}",
@@ -171,6 +175,15 @@ def _target(target_id: str, value: Any) -> DistributionTarget:
     conflicts = tuple(_package(item, f"{target_id} conflict") for item in conflicts_value)
     require_unique(list(conflicts), f"distribution {target_id} conflict")
 
+    relation_values: dict[str, tuple[str, ...]] = {}
+    for relation in ("provides", "replaces"):
+        values = value[relation]
+        if not isinstance(values, list) or len(values) > 16:
+            raise ModelError(f"distribution {target_id}: invalid {relation}")
+        parsed = tuple(_package(item, f"{target_id} {relation}") for item in values)
+        require_unique(list(parsed), f"distribution {target_id} {relation}")
+        relation_values[relation] = parsed
+
     discovery = value["python_discovery_path"]
     if not isinstance(discovery, str) or discovery.count("@python_major_minor@") > 1:
         raise ModelError(f"distribution {target_id}: invalid Python discovery path")
@@ -189,6 +202,8 @@ def _target(target_id: str, value: Any) -> DistributionTarget:
         dependency_roles=dependencies,
         optional_dependencies=tuple(optional),
         conflicts=conflicts,
+        provides=relation_values["provides"],
+        replaces=relation_values["replaces"],
         python_discovery_path=discovery,
     )
 
@@ -231,6 +246,12 @@ def load_distribution_catalog(root: Path) -> DistributionCatalog:
         conflict for target in targets.values() for conflict in target.conflicts
     }:
         raise ModelError("distribution package cannot conflict with itself")
+    if runtime.product.package_name in {
+        relation
+        for target in targets.values()
+        for relation in (*target.provides, *target.replaces)
+    }:
+        raise ModelError("distribution package cannot provide or replace itself")
     return DistributionCatalog(
         source_sha256=sha256_file(path),
         description=description,
diff --git a/tools/hfxdev/generators/distributions.py b/tools/hfxdev/generators/distributions.py
index 39929b0..fe0d174 100644
--- a/tools/hfxdev/generators/distributions.py
+++ b/tools/hfxdev/generators/distributions.py
@@ -32,6 +32,14 @@ def markdown(catalog: DistributionCatalog, runtime: LinuxRuntime) -> str:
         lines.append(
             f"| `{target.id}` | {architectures} | {dependencies} | {optional} |"
         )
+    lines.extend(["", "## Package Relationships", ""])
+    for target in catalog.targets.values():
+        lines.append(
+            f"- `{target.id}` provides "
+            f"{', '.join(f'`{item}`' for item in target.provides) or 'nothing'}; replaces "
+            f"{', '.join(f'`{item}`' for item in target.replaces) or 'nothing'}; and conflicts "
+            f"with {', '.join(f'`{item}`' for item in target.conflicts) or 'nothing'}."
+        )
     lines.extend(
         [
             "",
diff --git a/tools/hfxdev/generators/install.py b/tools/hfxdev/generators/install.py
index 4bf3f98..b57028a 100644
--- a/tools/hfxdev/generators/install.py
+++ b/tools/hfxdev/generators/install.py
@@ -32,6 +32,11 @@ def compiled_plan(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
                 **({"package": build.package} if build.package is not None else {}),
                 **({"target": build.target} if build.target is not None else {}),
                 **({"output": build.output} if build.output is not None else {}),
+                **(
+                    {"transform": build.transform}
+                    if build.transform is not None
+                    else {}
+                ),
                 **(
                     {"destination": build.destination}
                     if build.destination is not None
diff --git a/tools/hfxdev/generators/linux_runtime.py b/tools/hfxdev/generators/linux_runtime.py
index 4d2f863..53a5921 100644
--- a/tools/hfxdev/generators/linux_runtime.py
+++ b/tools/hfxdev/generators/linux_runtime.py
@@ -251,10 +251,13 @@ def dkms_configuration(runtime: LinuxRuntime) -> str:
     )
 
 
-def systemd_service(runtime: LinuxRuntime) -> str:
+def systemd_service(
+    runtime: LinuxRuntime, *, wanted_units: tuple[str, ...] = ()
+) -> str:
     bridge = runtime.bridge
     operations = runtime.operations
     private_directory = PurePosixPath(bridge.executable_path).parent
+    wants = " ".join((operations.confirmation_service_unit, *wanted_units))
     return "\n".join(
         [
             "# Generated by ./hfx generate. Do not edit manually.",
@@ -263,9 +266,9 @@ def systemd_service(runtime: LinuxRuntime) -> str:
             f"Description={runtime.product.display_name} bridge",
             "Documentation=man:hyperfluxctl(1)",
             f"Requires={operations.activation_service_unit}",
-            f"Wants={operations.confirmation_service_unit}",
+            f"Wants={wants}",
             f"After=systemd-udevd.service {operations.activation_service_unit}",
-            f"Before={operations.confirmation_service_unit}",
+            f"Before={wants}",
             f"ConditionPathExists={bridge.configuration_file_path}",
             "",
             "[Service]",
diff --git a/tools/hfxdev/generators/openrazer_native.py b/tools/hfxdev/generators/openrazer_native.py
new file mode 100644
index 0000000..b21c344
--- /dev/null
+++ b/tools/hfxdev/generators/openrazer_native.py
@@ -0,0 +1,131 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import json
+from pathlib import PurePosixPath
+
+from ..linux_runtime import LinuxRuntime
+from ..openrazer_native_route import OpenRazerNativeDeployment
+
+
+def rust_constants(deployment: OpenRazerNativeDeployment) -> str:
+    driver = deployment.driver
+    modules = ", ".join(json.dumps(module) for module in driver.modules)
+    return "\n".join(
+        [
+            "// Generated by ./hfx generate. Do not edit manually.",
+            "// SPDX-License-Identifier: GPL-2.0-only",
+            "",
+            "pub const OPENRAZER_NATIVE_DEPLOYMENT_SHA256: &str =",
+            f"    {json.dumps(deployment.source_sha256)};",
+            f"pub const OPENRAZER_NATIVE_DKMS_NAME: &str = {json.dumps(driver.dkms_name)};",
+            f"pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = {json.dumps(driver.dkms_version)};",
+            "pub const OPENRAZER_NATIVE_DRIVER_MODULES: &[&str] =",
+            f"    &[{modules}];",
+            "",
+        ]
+    )
+
+
+def relay_service(
+    deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime
+) -> str:
+    relay = deployment.relay
+    bridge = runtime.bridge
+    private_directory = PurePosixPath(relay.executable_path).parent
+    return "\n".join(
+        [
+            "# Generated by ./hfx generate. Do not edit manually.",
+            "# SPDX-License-Identifier: GPL-2.0-only",
+            "[Unit]",
+            "Description=HyperFlux Next OpenRazer native-route relay",
+            f"PartOf={bridge.service_unit}",
+            f"Requires={bridge.service_unit}",
+            f"After={bridge.service_unit} systemd-udevd.service",
+            f"ConditionPathExists={relay.uhid_device}",
+            "",
+            "[Service]",
+            "Type=simple",
+            "User=root",
+            "Group=root",
+            f"ExecStartPre={runtime.operations.activation_path} check-openrazer-driver",
+            f"ExecStart={relay.executable_path} --socket {bridge.socket_path} "
+            f"--uhid {relay.uhid_device}",
+            "UMask=0077",
+            "Restart=on-failure",
+            f"RestartSec={relay.restart_seconds}s",
+            "TimeoutStartSec=10s",
+            "TimeoutStopSec=10s",
+            "LimitNOFILE=64",
+            "TasksMax=32",
+            "NoNewPrivileges=yes",
+            "ProtectSystem=strict",
+            "ProtectHome=yes",
+            "PrivateTmp=yes",
+            "ProtectControlGroups=yes",
+            "ProtectKernelTunables=yes",
+            "ProtectKernelModules=yes",
+            "ProtectKernelLogs=yes",
+            "ProtectHostname=yes",
+            "ProtectClock=yes",
+            "RestrictAddressFamilies=AF_UNIX",
+            "RestrictNamespaces=yes",
+            "RestrictRealtime=yes",
+            "RestrictSUIDSGID=yes",
+            "LockPersonality=yes",
+            "MemoryDenyWriteExecute=yes",
+            "SystemCallArchitectures=native",
+            "SystemCallFilter=@system-service",
+            "SystemCallFilter=~@mount @module @raw-io @reboot @swap",
+            "CapabilityBoundingSet=",
+            "AmbientCapabilities=",
+            "DevicePolicy=closed",
+            f"DeviceAllow={relay.uhid_device} rw",
+            f"ReadOnlyPaths={private_directory} {bridge.runtime_directory}",
+            f"ReadWritePaths={relay.uhid_device}",
+            "",
+        ]
+    )
+
+
+def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> str:
+    relay = deployment.relay
+    driver = deployment.driver
+    return "\n".join(
+        [
+            "# OpenRazer Native Route Deployment",
+            "",
+            "> Generated by `./hfx generate`. Do not edit manually.",
+            "",
+            f"Canonical deployment digest: `{deployment.source_sha256}`.",
+            "",
+            "## Relay",
+            "",
+            "| Field | Value |",
+            "| --- | --- |",
+            f"| Service | `{relay.service_unit}` |",
+            f"| Executable | `{relay.executable_path}` |",
+            f"| Bridge socket | `{runtime.bridge.socket_path}` |",
+            f"| Exclusive kernel interface | `{relay.uhid_device}` |",
+            "",
+            "The static relay service is pulled in by the bridge service. It runs as root only "
+            "because `/dev/uhid` remains unavailable to ordinary users, drops every Linux "
+            "capability, and can access only the bridge socket and UHID device. A read-only "
+            "preflight refuses to create virtual endpoints while an older transformed driver "
+            "module remains loaded.",
+            "",
+            "## OpenRazer Driver Replacement",
+            "",
+            "| Field | Value |",
+            "| --- | --- |",
+            f"| DKMS identity | `{driver.dkms_name}` `{driver.dkms_version}` |",
+            f"| Source tree | `{driver.source_directory}` |",
+            f"| Modules | {', '.join(f'`{module}`' for module in driver.modules)} |",
+            "",
+            "The package build applies the source-locked transport patch to the pinned OpenRazer "
+            "tree, projects only its DKMS build inputs, and verifies every transformed digest. "
+            "The ordinary BUS_USB tables and direct-device transport remain upstream-owned.",
+            "",
+        ]
+    )
diff --git a/tools/hfxdev/install.py b/tools/hfxdev/install.py
index 3f9d34d..b5be4db 100644
--- a/tools/hfxdev/install.py
+++ b/tools/hfxdev/install.py
@@ -9,6 +9,7 @@
 
 from .linux_runtime import LinuxRuntime, load_linux_runtime
 from .model import ModelError, load_json, require_unique, sha256_file
+from .openrazer_native_route import load_native_deployment
 
 
 ROOT_KEYS = {"$schema", "schema", "policy", "builds", "payloads"}
@@ -31,6 +32,15 @@
     "capability",
 }
 PYTHON_KEYS = {"id", "kind", "source", "distribution", "required"}
+SOURCE_TRANSFORM_KEYS = {
+    "id",
+    "kind",
+    "transform",
+    "destination",
+    "mode",
+    "required",
+    "capability",
+}
 PAYLOAD_KEYS = {"id", "kind", "source", "destination", "mode", "preserve", "include"}
 IDENTIFIER = re.compile(r"^[a-z][a-z0-9-]{0,63}$")
 DISTRIBUTION = re.compile(r"^[a-z][a-z0-9-]{0,95}$")
@@ -59,6 +69,7 @@ class BuildSpec:
     mode: int | None = None
     distribution: str | None = None
     capability: str | None = None
+    transform: str | None = None
 
 
 @dataclass(frozen=True)
@@ -124,7 +135,14 @@ def _identifier(value: Any, label: str) -> str:
     return value
 
 
-def _relative_path(root: Path, value: Any, label: str, *, directory: bool) -> str:
+def _relative_path(
+    root: Path,
+    value: Any,
+    label: str,
+    *,
+    directory: bool,
+    projected_files: tuple[Path, ...] = (),
+) -> str:
     if not isinstance(value, str) or not value or value.startswith("/"):
         raise ModelError(f"{label}: must be a repository-relative path")
     relative = PurePosixPath(value)
@@ -136,7 +154,8 @@ def _relative_path(root: Path, value: Any, label: str, *, directory: bool) -> st
         cursor /= part
         if cursor.is_symlink():
             raise ModelError(f"{label}: symbolic-link source paths are forbidden")
-    expected = path.is_dir() if directory else path.is_file()
+    projected = path.resolve() in projected_files
+    expected = path.is_dir() if directory else path.is_file() or projected
     if not expected or path.is_symlink():
         kind = "directory" if directory else "file"
         raise ModelError(f"{label}: missing regular {kind} {value}")
@@ -168,7 +187,8 @@ def _mode(value: Any, label: str) -> int:
     return MODES[value]
 
 
-def _tokens(runtime: LinuxRuntime) -> dict[str, str]:
+def _tokens(root: Path, runtime: LinuxRuntime) -> dict[str, str]:
+    openrazer = load_native_deployment(root)
     return {
         "@bridge_executable_path@": runtime.bridge.executable_path,
         "@operations_cli_path@": runtime.operations.cli_path,
@@ -178,6 +198,8 @@ def _tokens(runtime: LinuxRuntime) -> dict[str, str]:
             PurePosixPath(runtime.kernel.source_directory) / "dkms.conf"
         ),
         "@bridge_configuration_file_path@": runtime.bridge.configuration_file_path,
+        "@openrazer_relay_executable_path@": openrazer.relay.executable_path,
+        "@openrazer_dkms_source_directory@": openrazer.driver.source_directory,
     }
 
 
@@ -239,6 +261,23 @@ def _python_build(root: Path, value: dict[str, Any], label: str) -> BuildSpec:
     )
 
 
+def _source_transform_build(
+    value: dict[str, Any], tokens: dict[str, str], label: str
+) -> BuildSpec:
+    _exact(value, SOURCE_TRANSFORM_KEYS, label)
+    if value["required"] is not True:
+        raise ModelError(f"{label}: source transform must be required")
+    return BuildSpec(
+        id=_identifier(value["id"], f"{label} id"),
+        kind="source-transform",
+        required=True,
+        transform=_identifier(value["transform"], f"{label} transform"),
+        destination=_destination(value["destination"], f"{label} destination", tokens),
+        mode=_mode(value["mode"], f"{label} mode"),
+        capability=_identifier(value["capability"], f"{label} capability"),
+    )
+
+
 def _load_builds(
     root: Path, values: list[Any], tokens: dict[str, str]
 ) -> tuple[BuildSpec, ...]:
@@ -253,6 +292,8 @@ def _load_builds(
             builds.append(_cmake_build(root, value, tokens, label))
         elif kind == "python-project":
             builds.append(_python_build(root, value, label))
+        elif kind == "source-transform":
+            builds.append(_source_transform_build(value, tokens, label))
         else:
             raise ModelError(f"{label}: unsupported build kind")
     require_unique([build.id for build in builds], "install build id")
@@ -266,7 +307,10 @@ def _load_builds(
 
 
 def _load_payloads(
-    root: Path, values: list[Any], tokens: dict[str, str]
+    root: Path,
+    values: list[Any],
+    tokens: dict[str, str],
+    projected_files: tuple[Path, ...],
 ) -> tuple[PayloadSpec, ...]:
     payloads: list[PayloadSpec] = []
     for index, item in enumerate(values):
@@ -301,7 +345,11 @@ def _load_payloads(
                 id=_identifier(value["id"], f"{label} id"),
                 kind=kind,
                 source=_relative_path(
-                    root, value["source"], f"{label} source", directory=kind == "tree"
+                    root,
+                    value["source"],
+                    f"{label} source",
+                    directory=kind == "tree",
+                    projected_files=projected_files,
                 ),
                 destination=_destination(
                     value["destination"], f"{label} destination", tokens
@@ -377,6 +425,7 @@ def _expand_payload_files(
 
 
 def _check_cross_contract(
+    root: Path,
     runtime: LinuxRuntime,
     policy: InstallPolicy,
     builds: tuple[BuildSpec, ...],
@@ -405,7 +454,34 @@ def _check_cross_contract(
     if "python-sdk" not in build_by_id or not build_by_id["python-sdk"].required:
         raise ModelError("Python SDK must be a required install build")
 
+    openrazer = load_native_deployment(root)
+    relay = build_by_id.get("openrazer-native-relay")
+    if (
+        relay is None
+        or relay.kind != "cargo-binary"
+        or relay.destination != openrazer.relay.executable_path
+        or not relay.required
+    ):
+        raise ModelError("OpenRazer native relay build does not match its deployment authority")
+    driver = build_by_id.get("openrazer-native-driver")
+    if (
+        driver is None
+        or driver.kind != "source-transform"
+        or driver.transform != "openrazer-native-route"
+        or driver.capability != "openrazer-source"
+        or driver.destination != openrazer.driver.source_directory
+        or not driver.required
+    ):
+        raise ModelError("OpenRazer native driver build does not match its deployment authority")
+
     payload_by_id = {payload.id: payload for payload in payloads}
+    relay_service = payload_by_id.get("openrazer-native-relay-service")
+    if (
+        relay_service is None
+        or relay_service.destination
+        != f"/usr/lib/systemd/system/{openrazer.relay.service_unit}"
+    ):
+        raise ModelError("OpenRazer native relay service is missing from the package")
     configuration = payload_by_id.get("default-configuration")
     if (
         configuration is None
@@ -452,7 +528,8 @@ def load_install_manifest(
     policy = InstallPolicy(**policy_value)
 
     runtime = load_linux_runtime(root)
-    tokens = _tokens(runtime)
+    tokens = _tokens(root, runtime)
+    projected = tuple(file.resolve() for file in projected_files)
     builds = _load_builds(
         root,
         _list(value["builds"], "install builds", minimum=1, maximum=32),
@@ -462,9 +539,10 @@ def load_install_manifest(
         root,
         _list(value["payloads"], "install payloads", minimum=1, maximum=128),
         tokens,
+        projected,
     )
     files = _expand_payload_files(root, payloads, projected_files)
-    _check_cross_contract(runtime, policy, builds, payloads, files)
+    _check_cross_contract(root, runtime, policy, builds, payloads, files)
     return InstallManifest(
         root=root.resolve(),
         source_sha256=sha256_file(path),
diff --git a/tools/hfxdev/openrazer_native_route.py b/tools/hfxdev/openrazer_native_route.py
new file mode 100644
index 0000000..d5e507a
--- /dev/null
+++ b/tools/hfxdev/openrazer_native_route.py
@@ -0,0 +1,381 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import json
+import os
+from pathlib import Path, PurePosixPath
+import re
+import shutil
+import subprocess
+import uuid
+from typing import Any
+
+from .integrations import upstream_index
+from .model import ModelError, load_json, require_unique, sha256_file
+
+
+TRANSFORM_SCHEMA = "hyperflux-openrazer-native-transform-v1"
+DEPLOYMENT_SCHEMA = "hyperflux-openrazer-native-deployment-v1"
+TRANSFORM_KEYS = {"$schema", "schema", "upstream", "patch", "files"}
+DEPLOYMENT_KEYS = {"$schema", "schema", "relay", "driver"}
+RELAY_KEYS = {"executable_path", "service_unit", "uhid_device", "restart_seconds"}
+DRIVER_KEYS = {"dkms_name", "dkms_version", "source_directory", "modules"}
+UPSTREAM_KEYS = {"id", "repository", "commit"}
+PATCH_KEYS = {"path", "sha256"}
+FILE_KEYS = {"path", "source_sha256", "transformed_sha256"}
+
+
+@dataclass(frozen=True)
+class PreparedOpenRazerNativeSource:
+    root: Path
+    result: Path
+    source_commit: str
+    patch_sha256: str
+
+
+@dataclass(frozen=True)
+class OpenRazerRelayDeployment:
+    executable_path: str
+    service_unit: str
+    uhid_device: str
+    restart_seconds: int
+
+
+@dataclass(frozen=True)
+class OpenRazerDriverDeployment:
+    dkms_name: str
+    dkms_version: str
+    source_directory: str
+    modules: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class OpenRazerNativeDeployment:
+    source_sha256: str
+    relay: OpenRazerRelayDeployment
+    driver: OpenRazerDriverDeployment
+
+
+def _exact_keys(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - set(value))
+    extras = sorted(set(value) - expected)
+    if missing:
+        raise ModelError(f"{label}: missing keys: {', '.join(missing)}")
+    if extras:
+        raise ModelError(f"{label}: unsupported keys: {', '.join(extras)}")
+
+
+def _safe_relative_path(value: Any, label: str, *, suffix: str | None = None) -> Path:
+    if not isinstance(value, str) or not value or len(value) > 256:
+        raise ModelError(f"{label}: expected a bounded non-empty path")
+    path = Path(value)
+    if path.is_absolute() or ".." in path.parts or path.as_posix() != value:
+        raise ModelError(f"{label}: path must be canonical and repository-relative")
+    if suffix is not None and path.suffix != suffix:
+        raise ModelError(f"{label}: expected a {suffix} file")
+    return path
+
+
+def _digest(value: Any, label: str) -> str:
+    if (
+        not isinstance(value, str)
+        or len(value) != 64
+        or any(character not in "0123456789abcdef" for character in value)
+    ):
+        raise ModelError(f"{label}: expected a lowercase SHA-256 digest")
+    return value
+
+
+def load_native_transform(root: Path) -> dict[str, Any]:
+    transform = load_json(
+        root / "integrations" / "openrazer" / "native-route" / "transform.json"
+    )
+    _exact_keys(transform, TRANSFORM_KEYS, "OpenRazer native transform")
+    if transform["$schema"] != "../../../schemas/openrazer-native-transform.schema.json":
+        raise ModelError("OpenRazer native transform schema reference is not canonical")
+    if transform["schema"] != TRANSFORM_SCHEMA:
+        raise ModelError("unsupported OpenRazer native transform schema")
+
+    upstream = transform["upstream"]
+    if not isinstance(upstream, dict):
+        raise ModelError("OpenRazer native transform upstream must be an object")
+    _exact_keys(upstream, UPSTREAM_KEYS, "OpenRazer native transform upstream")
+    authority = upstream_index(root).get("openrazer")
+    if authority is None or any(
+        upstream[field] != authority[field] for field in ("id", "repository", "commit")
+    ):
+        raise ModelError("OpenRazer native transform differs from the integration pin")
+
+    patch = transform["patch"]
+    if not isinstance(patch, dict):
+        raise ModelError("OpenRazer native transform patch must be an object")
+    _exact_keys(patch, PATCH_KEYS, "OpenRazer native transform patch")
+    patch_path = _safe_relative_path(patch["path"], "OpenRazer native patch", suffix=".patch")
+    if not patch_path.parts or patch_path.parts[0] != "patches":
+        raise ModelError("OpenRazer native patch must remain below patches/")
+    _digest(patch["sha256"], "OpenRazer native patch digest")
+
+    files = transform["files"]
+    if not isinstance(files, list) or not files or len(files) > 32:
+        raise ModelError("OpenRazer native transform files must be a bounded non-empty list")
+    paths: list[str] = []
+    for index, record in enumerate(files):
+        if not isinstance(record, dict):
+            raise ModelError(f"OpenRazer native transform file {index}: expected an object")
+        _exact_keys(record, FILE_KEYS, f"OpenRazer native transform file {index}")
+        path = _safe_relative_path(record["path"], f"OpenRazer native transform file {index}")
+        if not path.parts or path.parts[0] != "driver":
+            raise ModelError(f"OpenRazer native transform file {index}: path must remain below driver/")
+        _digest(record["source_sha256"], f"OpenRazer native transform file {index} source")
+        _digest(
+            record["transformed_sha256"],
+            f"OpenRazer native transform file {index} transformed",
+        )
+        paths.append(path.as_posix())
+    require_unique(paths, "OpenRazer native transform path")
+    if paths != sorted(paths):
+        raise ModelError("OpenRazer native transform files must be sorted by path")
+    return transform
+
+
+def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
+    path = root / "integrations" / "openrazer" / "native-route" / "deployment.json"
+    value = load_json(path)
+    _exact_keys(value, DEPLOYMENT_KEYS, "OpenRazer native deployment")
+    if value["$schema"] != "../../../schemas/openrazer-native-deployment.schema.json":
+        raise ModelError("OpenRazer native deployment schema reference is not canonical")
+    if value["schema"] != DEPLOYMENT_SCHEMA:
+        raise ModelError("unsupported OpenRazer native deployment schema")
+
+    relay = value["relay"]
+    if not isinstance(relay, dict):
+        raise ModelError("OpenRazer native relay deployment must be an object")
+    _exact_keys(relay, RELAY_KEYS, "OpenRazer native relay deployment")
+    executable = _deployment_path(
+        relay["executable_path"],
+        "OpenRazer native relay executable",
+        ("/", "usr", "lib", "hyperflux-next"),
+    )
+    service = relay["service_unit"]
+    if not isinstance(service, str) or re.fullmatch(
+        r"[a-z][a-z0-9@_.-]{0,95}\.service", service
+    ) is None:
+        raise ModelError("OpenRazer native relay service unit is invalid")
+    if relay["uhid_device"] != "/dev/uhid":
+        raise ModelError("OpenRazer native relay must use the kernel UHID device")
+    restart_seconds = relay["restart_seconds"]
+    if (
+        isinstance(restart_seconds, bool)
+        or not isinstance(restart_seconds, int)
+        or not 1 <= restart_seconds <= 60
+    ):
+        raise ModelError("OpenRazer native relay restart delay is invalid")
+
+    driver = value["driver"]
+    if not isinstance(driver, dict):
+        raise ModelError("OpenRazer native driver deployment must be an object")
+    _exact_keys(driver, DRIVER_KEYS, "OpenRazer native driver deployment")
+    if driver["dkms_name"] != "openrazer-driver":
+        raise ModelError("OpenRazer native DKMS name must preserve the upstream identity")
+    version = driver["dkms_version"]
+    if not isinstance(version, str) or re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version) is None:
+        raise ModelError("OpenRazer native DKMS version is invalid")
+    upstream = upstream_index(root).get("openrazer")
+    if upstream is None or not str(upstream["version"]).startswith(version):
+        raise ModelError("OpenRazer native DKMS version differs from the pinned upstream")
+    source_directory = _deployment_path(
+        driver["source_directory"],
+        "OpenRazer native DKMS source directory",
+        ("/", "usr", "src"),
+    )
+    if source_directory != f"/usr/src/openrazer-driver-{version}":
+        raise ModelError("OpenRazer native DKMS source directory does not derive from its identity")
+    modules = driver["modules"]
+    if (
+        not isinstance(modules, list)
+        or not 1 <= len(modules) <= 16
+        or modules != sorted(modules)
+        or len(set(modules)) != len(modules)
+        or any(
+            not isinstance(module, str)
+            or re.fullmatch(r"[a-z][a-z0-9_-]{0,63}", module) is None
+            for module in modules
+        )
+    ):
+        raise ModelError("OpenRazer native DKMS module inventory is invalid")
+    return OpenRazerNativeDeployment(
+        source_sha256=sha256_file(path),
+        relay=OpenRazerRelayDeployment(
+            executable_path=executable,
+            service_unit=service,
+            uhid_device=relay["uhid_device"],
+            restart_seconds=restart_seconds,
+        ),
+        driver=OpenRazerDriverDeployment(
+            dkms_name=driver["dkms_name"],
+            dkms_version=version,
+            source_directory=source_directory,
+            modules=tuple(modules),
+        ),
+    )
+
+
+def _deployment_path(value: Any, label: str, prefix: tuple[str, ...]) -> str:
+    if not isinstance(value, str) or not value.startswith("/") or value != value.strip():
+        raise ModelError(f"{label}: must be an absolute path")
+    path = PurePosixPath(value)
+    if path.parts[: len(prefix)] != prefix or ".." in path.parts or str(path) != value:
+        raise ModelError(f"{label}: path is outside its deployment boundary")
+    if len(value.encode()) > 240 or any(
+        ord(character) < 32 or ord(character) > 126 for character in value
+    ):
+        raise ModelError(f"{label}: path is not bounded printable ASCII")
+    return value
+
+
+def _git(arguments: list[str], *, cwd: Path) -> str:
+    try:
+        result = subprocess.run(
+            ["git", *arguments],
+            cwd=cwd,
+            check=False,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=60,
+            env={**os.environ, "GIT_TERMINAL_PROMPT": "0"},
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot inspect OpenRazer source: {error}") from error
+    if result.returncode != 0:
+        detail = result.stderr.strip().splitlines()
+        suffix = f": {detail[-1]}" if detail else ""
+        raise ModelError(f"git {' '.join(arguments)} failed{suffix}")
+    return result.stdout.strip()
+
+
+def _validate_source(root: Path, source: Path, transform: dict[str, Any]) -> None:
+    if source.is_symlink() or not source.is_dir() or (source / ".git").is_symlink():
+        raise ModelError("OpenRazer native source is missing or uses a symbolic link")
+    if _git(["rev-parse", "--is-inside-work-tree"], cwd=source) != "true":
+        raise ModelError("OpenRazer native source is not a Git worktree")
+    if _git(["rev-parse", "HEAD"], cwd=source) != transform["upstream"]["commit"]:
+        raise ModelError("OpenRazer native source does not match the pinned commit")
+    if _git(["status", "--porcelain", "--untracked-files=all"], cwd=source):
+        raise ModelError("OpenRazer native source has local modifications")
+    if _git(["remote", "get-url", "origin"], cwd=source) != transform["upstream"]["repository"]:
+        raise ModelError("OpenRazer native source has an unexpected origin")
+
+    native_root = root / "integrations" / "openrazer" / "native-route"
+    patch = native_root / transform["patch"]["path"]
+    if patch.is_symlink() or not patch.is_file():
+        raise ModelError("OpenRazer native patch is missing or symbolic")
+    if sha256_file(patch) != transform["patch"]["sha256"]:
+        raise ModelError("OpenRazer native patch differs from its source lock")
+
+    for record in transform["files"]:
+        path = source / record["path"]
+        if path.is_symlink() or not path.is_file():
+            raise ModelError(f"OpenRazer native source file is missing or symbolic: {record['path']}")
+        if sha256_file(path) != record["source_sha256"]:
+            raise ModelError(f"OpenRazer native source drift: {record['path']}")
+
+
+def _apply_patch(destination: Path, patch: Path) -> None:
+    for check_only in (True, False):
+        arguments = [
+            "patch",
+            "--batch",
+            "--forward",
+            "--fuzz=0",
+            "--no-backup-if-mismatch",
+            "-p1",
+            "-i",
+            str(patch),
+        ]
+        if check_only:
+            arguments.insert(1, "--dry-run")
+        try:
+            result = subprocess.run(
+                arguments,
+                cwd=destination,
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=60,
+                env={**os.environ, "LC_ALL": "C"},
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot apply OpenRazer native patch: {error}") from error
+        if result.returncode != 0:
+            detail = (result.stderr or result.stdout).strip().splitlines()
+            suffix = f": {detail[-1]}" if detail else ""
+            raise ModelError(f"OpenRazer native patch did not apply exactly{suffix}")
+
+
+def prepare_openrazer_native_source(
+    root: Path, source: Path, output: Path
+) -> PreparedOpenRazerNativeSource:
+    root = root.resolve()
+    source = source.expanduser().resolve()
+    output = output.expanduser()
+    if not output.is_absolute():
+        output = root / output
+    output = output.resolve()
+    if output.exists() or output.is_symlink():
+        raise ModelError("OpenRazer native output must not already exist")
+    if output == source or source in output.parents or output in source.parents:
+        raise ModelError("OpenRazer native output must be independent from the source checkout")
+
+    transform = load_native_transform(root)
+    _validate_source(root, source, transform)
+    output.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    temporary = output.parent / f".{output.name}.prepare-{uuid.uuid4().hex}"
+    native_root = root / "integrations" / "openrazer" / "native-route"
+    patch = native_root / transform["patch"]["path"]
+    try:
+        shutil.copytree(
+            source,
+            temporary,
+            symlinks=False,
+            ignore=shutil.ignore_patterns(".git", "*.o", "*.ko", "*.mod", "*.mod.c"),
+        )
+        _apply_patch(temporary, patch)
+        for record in transform["files"]:
+            path = temporary / record["path"]
+            if sha256_file(path) != record["transformed_sha256"]:
+                raise ModelError(f"OpenRazer native transformed output drift: {record['path']}")
+
+        result_path = temporary / "hyperflux-native-transform-result.json"
+        result = {
+            "schema": "hyperflux-openrazer-native-transform-result-v1",
+            "source_commit": transform["upstream"]["commit"],
+            "patch_sha256": transform["patch"]["sha256"],
+            "transformed_files": [
+                {
+                    "path": record["path"],
+                    "sha256": record["transformed_sha256"],
+                }
+                for record in transform["files"]
+            ],
+            "network_access_executed": False,
+            "hardware_queried": False,
+            "hardware_write_executed": False,
+        }
+        result_path.write_text(
+            json.dumps(result, indent=2, sort_keys=True) + "\n", encoding="utf-8"
+        )
+        result_path.chmod(0o600)
+        os.replace(temporary, output)
+    except Exception:
+        shutil.rmtree(temporary, ignore_errors=True)
+        raise
+    return PreparedOpenRazerNativeSource(
+        root=output,
+        result=output / "hyperflux-native-transform-result.json",
+        source_commit=transform["upstream"]["commit"],
+        patch_sha256=transform["patch"]["sha256"],
+    )
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index 4744a85..e1a9bab 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -14,6 +14,7 @@
 import stat
 import subprocess
 import sys
+import tarfile
 from typing import Any
 import zipfile
 
@@ -23,6 +24,11 @@
 from .integrations import load_integration_catalog
 from .linux_runtime import LinuxRuntime, load_linux_runtime
 from .model import ModelError, load_json, require_unique, sha256_file
+from .openrazer_native_route import (
+    load_native_deployment,
+    load_native_transform,
+    prepare_openrazer_native_source,
+)
 from .supply_chain import load_dependency_inventory
 from .toolchains import load_toolchain_pins, verify_current_toolchain
 from .tree_metadata import normalize_tree as _normalize_tree
@@ -418,6 +424,112 @@ def _build_python(
     )
 
 
+def _openrazer_dkms_projection(
+    root: Path,
+    output: Path,
+    environment: dict[str, str],
+    build: BuildSpec,
+    capabilities: dict[str, Path],
+) -> BuiltArtifact:
+    if build.transform != "openrazer-native-route" or build.capability != "openrazer-source":
+        raise ModelError(f"build {build.id}: unsupported source transform")
+    source_value = capabilities.get(build.capability)
+    if source_value is None:
+        raise ModelError(
+            f"build {build.id}: required capability {build.capability} is absent"
+        )
+    source = _pinned_source(root, build.capability, source_value)
+    prepared_path = output / "work" / build.id / "prepared"
+    prepared = prepare_openrazer_native_source(root, source, prepared_path)
+    deployment = load_native_deployment(root)
+    _verify_openrazer_dkms_contract(prepared.root, deployment)
+
+    projection = output / "work" / build.id / "projection"
+    projection.mkdir(parents=True)
+    selected = [
+        (prepared.root / "Makefile", projection / "Makefile"),
+        (
+            prepared.root / "install_files" / "dkms" / "dkms.conf",
+            projection / "dkms.conf",
+        ),
+        (prepared.root / "LICENSE", projection / "LICENSE"),
+        (prepared.root / "driver" / "Makefile", projection / "driver" / "Makefile"),
+    ]
+    selected.extend(
+        (path, projection / "driver" / path.name)
+        for pattern in ("*.c", "*.h")
+        for path in sorted((prepared.root / "driver").glob(pattern))
+    )
+    for source_path, destination in selected:
+        if not source_path.is_file() or source_path.is_symlink():
+            raise ModelError(f"build {build.id}: OpenRazer DKMS source projection is incomplete")
+        destination.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copyfile(source_path, destination, follow_symlinks=False)
+        destination.chmod(0o644)
+    if len(selected) < 8:
+        raise ModelError(f"build {build.id}: OpenRazer DKMS source projection is empty")
+
+    epoch = int(environment["SOURCE_DATE_EPOCH"])
+    archive = output / "work" / build.id / (
+        f"{deployment.driver.dkms_name}-{deployment.driver.dkms_version}.tar"
+    )
+    _write_source_tree_archive(projection, archive, epoch)
+    return _copy_artifact(
+        archive,
+        output,
+        build,
+        kind="source-tree",
+        destination=build.destination,
+        mode=build.mode or 0o644,
+    )
+
+
+def _verify_openrazer_dkms_contract(prepared: Path, deployment: Any) -> None:
+    path = prepared / "install_files" / "dkms" / "dkms.conf"
+    if not path.is_file() or path.is_symlink():
+        raise ModelError("OpenRazer native DKMS configuration is missing")
+    text = path.read_text(encoding="utf-8")
+    name = re.search(r'^PACKAGE_NAME="([^"]+)"$', text, re.MULTILINE)
+    version = re.search(r'^PACKAGE_VERSION="([^"]+)"$', text, re.MULTILINE)
+    modules = tuple(
+        sorted(re.findall(r'^BUILT_MODULE_NAME\[[0-9]+\]="([a-z0-9_-]+)"$', text, re.MULTILINE))
+    )
+    if (
+        name is None
+        or version is None
+        or name.group(1) != deployment.driver.dkms_name
+        or version.group(1) != deployment.driver.dkms_version
+        or modules != deployment.driver.modules
+    ):
+        raise ModelError("OpenRazer native DKMS configuration differs from deployment authority")
+
+
+def _write_source_tree_archive(source: Path, destination: Path, epoch: int) -> None:
+    with tarfile.open(destination, "w", format=tarfile.USTAR_FORMAT) as archive:
+        for path in sorted(source.rglob("*"), key=lambda item: item.relative_to(source).as_posix()):
+            relative = path.relative_to(source).as_posix()
+            if path.is_symlink():
+                raise ModelError("source transform produced a symbolic link")
+            info = tarfile.TarInfo(relative + ("/" if path.is_dir() else ""))
+            info.uid = 0
+            info.gid = 0
+            info.uname = "root"
+            info.gname = "root"
+            info.mtime = epoch
+            if path.is_dir():
+                info.type = tarfile.DIRTYPE
+                info.mode = 0o755
+                archive.addfile(info)
+            elif path.is_file():
+                info.mode = 0o644
+                info.size = path.stat().st_size
+                with path.open("rb") as source_file:
+                    archive.addfile(info, source_file)
+            else:
+                raise ModelError("source transform produced an unsupported filesystem entry")
+    os.utime(destination, (epoch, epoch))
+
+
 def _artifact_json(artifact: BuiltArtifact, root: Path) -> dict[str, Any]:
     value: dict[str, Any] = {
         "build_id": artifact.build_id,
@@ -442,6 +554,10 @@ def _provenance_inputs(
     expected_sbom = spdx_json(inventory)
     if not sbom_path.is_file() or sbom_path.read_text(encoding="utf-8") != expected_sbom:
         raise ModelError("generated SPDX inventory is stale; run ./hfx generate")
+    transform = load_native_transform(root)
+    deployment = load_native_deployment(root)
+    native_root = root / "integrations" / "openrazer" / "native-route"
+    patch = native_root / transform["patch"]["path"]
     return {
         "install_manifest_sha256": install.source_sha256,
         "linux_runtime_sha256": runtime.source_sha256,
@@ -450,6 +566,10 @@ def _provenance_inputs(
         "toolchain_pins_sha256": sha256_file(root / "toolchains" / "pins.json"),
         "cargo_lock_sha256": sha256_file(root / "Cargo.lock"),
         "integration_catalog_sha256": sha256_file(root / "integrations" / "catalog.json"),
+        "openrazer_native_catalog_sha256": sha256_file(native_root / "catalog.json"),
+        "openrazer_native_transform_sha256": sha256_file(native_root / "transform.json"),
+        "openrazer_native_deployment_sha256": deployment.source_sha256,
+        "openrazer_native_patch_sha256": sha256_file(patch),
     }
 
 
@@ -470,6 +590,22 @@ def _provenance_materials(
             "integration_catalog_sha256",
         ),
         "linux-runtime": ("runtime/linux.json", "linux_runtime_sha256"),
+        "openrazer-native-catalog": (
+            "integrations/openrazer/native-route/catalog.json",
+            "openrazer_native_catalog_sha256",
+        ),
+        "openrazer-native-deployment": (
+            "integrations/openrazer/native-route/deployment.json",
+            "openrazer_native_deployment_sha256",
+        ),
+        "openrazer-native-patch": (
+            "integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
+            "openrazer_native_patch_sha256",
+        ),
+        "openrazer-native-transform": (
+            "integrations/openrazer/native-route/transform.json",
+            "openrazer_native_transform_sha256",
+        ),
         "source-sbom": (
             "assurance/generated/hyperflux-next.spdx.json",
             "sbom_sha256",
@@ -532,6 +668,12 @@ def build_artifacts(
                 artifacts.append(artifact)
         elif build.kind == "python-project":
             artifacts.append(_build_python(root, output, environment, build))
+        elif build.kind == "source-transform":
+            artifacts.append(
+                _openrazer_dkms_projection(
+                    root, output, environment, build, capabilities
+                )
+            )
 
     manifest = {
         "$schema": "https://hyperflux.dev/schemas/package-build-manifest-v2.json",
@@ -573,7 +715,7 @@ def _manifest_artifact(root: Path, value: Any, label: str) -> BuiltArtifact:
     kind = value["kind"]
     if not isinstance(build_id, str) or not re.fullmatch(r"[a-z][a-z0-9-]{0,63}", build_id):
         raise ModelError(f"{label}: invalid build id")
-    if kind not in {"cargo-binary", "cmake-module", "python-wheel"}:
+    if kind not in {"cargo-binary", "cmake-module", "python-wheel", "source-tree"}:
         raise ModelError(f"{label}: invalid artifact kind")
     path_value = value["path"]
     if not isinstance(path_value, str) or path_value.startswith("/"):
@@ -737,6 +879,10 @@ def load_artifact_set(root: Path, manifest_path: Path) -> ArtifactSet:
         "toolchain_pins_sha256",
         "cargo_lock_sha256",
         "integration_catalog_sha256",
+        "openrazer_native_catalog_sha256",
+        "openrazer_native_transform_sha256",
+        "openrazer_native_deployment_sha256",
+        "openrazer_native_patch_sha256",
     }:
         raise ModelError("package build inputs are malformed")
     revision = source["revision"]
@@ -800,7 +946,10 @@ def load_artifact_set(root: Path, manifest_path: Path) -> ArtifactSet:
         build = declared.get(artifact.build_id)
         if build is None:
             raise ModelError(f"artifact {artifact.build_id}: build is not declared")
-        expected_kind = "python-wheel" if build.kind == "python-project" else build.kind
+        expected_kind = {
+            "python-project": "python-wheel",
+            "source-transform": "source-tree",
+        }.get(build.kind, build.kind)
         if artifact.kind != expected_kind:
             raise ModelError(f"artifact {artifact.build_id}: kind does not match install contract")
         if artifact.destination != build.destination or artifact.distribution != build.distribution:
@@ -979,6 +1128,63 @@ def _install_wheels(
         )
 
 
+def _install_source_tree(stage_root: Path, artifact: BuiltArtifact) -> None:
+    if artifact.destination is None:
+        raise ModelError(f"artifact {artifact.build_id}: source tree has no destination")
+    destination = _stage_path(stage_root, artifact.destination)
+    if destination.exists() or destination.is_symlink():
+        raise ModelError(f"artifact {artifact.build_id}: source-tree destination collides")
+    try:
+        archive = tarfile.open(artifact.path, mode="r:")
+    except (OSError, tarfile.TarError) as error:
+        raise ModelError(f"artifact {artifact.build_id}: invalid source-tree archive") from error
+    files: set[str] = set()
+    directories: set[str] = set()
+    with archive:
+        members = archive.getmembers()
+        if not 4 <= len(members) <= 1_024:
+            raise ModelError(f"artifact {artifact.build_id}: source-tree member bound failed")
+        if sum(member.size for member in members) > 64 * 1024 * 1024:
+            raise ModelError(f"artifact {artifact.build_id}: source tree exceeds its size bound")
+        names: set[str] = set()
+        for member in members:
+            raw_name = member.name[:-1] if member.name.endswith("/") else member.name
+            relative = PurePosixPath(raw_name)
+            if (
+                not raw_name
+                or raw_name.startswith("/")
+                or ".." in relative.parts
+                or str(relative) != raw_name
+                or raw_name in names
+                or member.pax_headers
+            ):
+                raise ModelError(f"artifact {artifact.build_id}: unsafe source-tree member")
+            names.add(raw_name)
+            target = destination.joinpath(*relative.parts)
+            if member.isdir():
+                if member.mode != 0o755:
+                    raise ModelError(f"artifact {artifact.build_id}: invalid directory mode")
+                target.mkdir(parents=True, exist_ok=False)
+                target.chmod(0o755)
+                directories.add(raw_name)
+                continue
+            if not member.isfile() or member.mode != 0o644:
+                raise ModelError(f"artifact {artifact.build_id}: unsupported source-tree member")
+            source = archive.extractfile(member)
+            if source is None:
+                raise ModelError(f"artifact {artifact.build_id}: source-tree member is unreadable")
+            _write_to_stage(target, source.read(), 0o644)
+            files.add(raw_name)
+    required = {"Makefile", "LICENSE", "dkms.conf", "driver/Makefile"}
+    if (
+        not required <= files
+        or "driver" not in directories
+        or not any(name.startswith("driver/") and name.endswith(".c") for name in files)
+        or not any(name.startswith("driver/") and name.endswith(".h") for name in files)
+    ):
+        raise ModelError(f"artifact {artifact.build_id}: DKMS source tree is incomplete")
+
+
 def _tree_digest(files: list[Path], root: Path) -> str:
     digest = hashlib.sha256()
     for path in sorted(files, key=lambda item: item.relative_to(root).as_posix()):
@@ -1034,6 +1240,9 @@ def stage_rootfs(root: Path, manifest_path: Path, stage_root: Path) -> StageResu
         if artifact.kind == "python-wheel":
             wheels.append(artifact)
             continue
+        if artifact.kind == "source-tree":
+            _install_source_tree(stage_root, artifact)
+            continue
         if artifact.destination is None:
             raise ModelError(f"artifact {artifact.build_id}: missing destination")
         _copy_to_stage(
diff --git a/tools/hfxdev/render.py b/tools/hfxdev/render.py
index 8674bc2..a70fc6e 100644
--- a/tools/hfxdev/render.py
+++ b/tools/hfxdev/render.py
@@ -92,6 +92,11 @@
     udev_rules,
 )
 from .generators.migration import shadow_comparison_markdown
+from .generators.openrazer_native import (
+    markdown as openrazer_native_markdown,
+    relay_service as openrazer_native_relay_service,
+    rust_constants as openrazer_native_rust_constants,
+)
 from .generators.profiles import (
     compiled_json as profile_compiled_json,
     cpp_catalog as profile_cpp_catalog,
@@ -135,6 +140,7 @@
 from .licensing import load_licensing_policy
 from .local_companion import load_local_companion
 from .openrazer import load_imported_metadata
+from .openrazer_native_route import load_native_deployment
 from .performance import load_performance_budgets
 from .profiles import compiled_catalog, composition_fixtures
 from .protocol import load_protocol_registry
@@ -245,6 +251,7 @@ def rendered_files(root: Path) -> dict[Path, str]:
     integrations = compiled_integration_catalog(root)
     openrazer_metadata = load_imported_metadata(root)
     openrazer_compatibility = load_openrazer_compatibility_contract(root)
+    openrazer_native = load_native_deployment(root)
     test_catalog = load_test_catalog(root)
     linux_runtime = load_linux_runtime(root)
     distribution_catalog = load_distribution_catalog(root)
@@ -393,6 +400,13 @@ def rendered_files(root: Path) -> dict[Path, str]:
         root / "generated" / "integrations" / "catalog.json": integration_compiled_json(integrations),
         root / "docs" / "generated" / "integrations.md": integration_markdown(integrations),
         root / "crates" / "hfx-integration-model" / "src" / "generated.rs": integration_rust_catalog(integrations),
+        root
+        / "crates"
+        / "hfx-integration-model"
+        / "src"
+        / "openrazer_native_generated.rs": openrazer_native_rust_constants(
+            openrazer_native
+        ),
         root / "sdk" / "python" / "hyperflux_sdk" / "generated" / "integration_catalog.py": integration_python_catalog(integrations),
         root / "sdk" / "python" / "hyperflux_sdk" / "generated" / "openrazer_metadata.py": python_openrazer_metadata(openrazer_metadata),
         root / "integrations" / "openrazer" / "compatibility" / "hyperflux_openrazer_compat" / "generated_contract.py": python_openrazer_compatibility_contract(openrazer_compatibility),
@@ -401,7 +415,15 @@ def rendered_files(root: Path) -> dict[Path, str]:
         root / "sdk" / "python" / "hyperflux_sdk" / "generated" / "linux_runtime.py": linux_runtime_python_constants(linux_runtime),
         root / "driver" / "kernel" / "hyperflux-next-version.h": kernel_version_header(linux_runtime),
         root / "packaging" / "generated" / "dkms.conf": dkms_configuration(linux_runtime),
-        root / "packaging" / "generated" / "hyperflux-next-bridge.service": systemd_service(linux_runtime),
+        root / "packaging" / "generated" / "hyperflux-next-bridge.service": systemd_service(
+            linux_runtime, wanted_units=(openrazer_native.relay.service_unit,)
+        ),
+        root
+        / "packaging"
+        / "generated"
+        / openrazer_native.relay.service_unit: openrazer_native_relay_service(
+            openrazer_native, linux_runtime
+        ),
         root / "packaging" / "generated" / "hyperflux-next-activation.service": activation_service(linux_runtime),
         root / "packaging" / "generated" / "hyperflux-next-confirmation.service": confirmation_service(linux_runtime),
         root / "packaging" / "generated" / "hyperflux-next.sysusers": sysusers(linux_runtime),
@@ -410,6 +432,12 @@ def rendered_files(root: Path) -> dict[Path, str]:
         root / "packaging" / "generated" / "bridge.json": default_bridge_configuration(linux_runtime),
         root / "packaging" / "generated" / "runtime.env": package_environment(linux_runtime),
         root / "docs" / "generated" / "linux-runtime.md": linux_runtime_markdown(linux_runtime),
+        root
+        / "docs"
+        / "generated"
+        / "openrazer-native-deployment.md": openrazer_native_markdown(
+            openrazer_native, linux_runtime
+        ),
         root / "docs" / "generated" / "distributions.md": distribution_markdown(
             distribution_catalog, linux_runtime
         ),
diff --git a/tools/hfxdev/testgraph.py b/tools/hfxdev/testgraph.py
index 1bc0831..8eb57e1 100644
--- a/tools/hfxdev/testgraph.py
+++ b/tools/hfxdev/testgraph.py
@@ -60,6 +60,7 @@
     "openrgb-adapter-contracts",
     "openrgb-thread-sanitizer",
     "openrazer-metadata-contracts",
+    "openrazer-native-route-contracts",
     "openrazer-compatibility-contracts",
     "polychromatic-adapter-contracts",
     "kernel-profile-contracts",
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 94f6ee3..8dbb432 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -41,6 +41,10 @@
     load_imported_metadata,
     transformed_metadata,
 )
+from .openrazer_native_route import (
+    load_native_deployment,
+    prepare_openrazer_native_source,
+)
 from .openrgb import extract_openrgb_catalog
 from .package_pipeline import build_artifacts, load_artifact_set, stage_rootfs
 from .performance import (
@@ -638,6 +642,99 @@ def _run_openrazer_metadata_contracts(root: Path, _node: TestNode) -> None:
         )
 
 
+def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
+    source = _openrazer_source(root)
+    deployment = load_native_deployment(root)
+    build_directory = root / "build" / "openrazer-native-route-contracts"
+    if build_directory.exists():
+        shutil.rmtree(build_directory)
+    prepared = prepare_openrazer_native_source(root, source, build_directory)
+    if (prepared.result.stat().st_mode & 0o777) != 0o600:
+        raise ModelError("OpenRazer native source binding is not private")
+    result = load_json(prepared.result)
+    if result.get("schema") != "hyperflux-openrazer-native-transform-result-v1":
+        raise ModelError("OpenRazer native source binding schema is invalid")
+    if any(
+        result.get(field) is not False
+        for field in (
+            "network_access_executed",
+            "hardware_queried",
+            "hardware_write_executed",
+        )
+    ):
+        raise ModelError("OpenRazer native source preparation crossed a prohibited boundary")
+    if (prepared.root / ".git").exists():
+        raise ModelError("OpenRazer native source output copied upstream Git metadata")
+
+    common = (prepared.root / "driver" / "razercommon.c").read_text(encoding="utf-8")
+    required_common = (
+        'RAZER_HYPERFLUX_PHYS_PREFIX "hyperflux-next/native/v1/"',
+        "hdev->dev_rsize != sizeof(razer_hyperflux_descriptor)",
+        "hid_hw_raw_request(hdev, 0",
+        "RAZER_HYPERFLUX_TRANSPORT_NOT_SENT",
+        "RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT",
+    )
+    if any(marker not in common for marker in required_common):
+        raise ModelError("OpenRazer native common transport is incomplete")
+    for driver in ("razerkbd_driver.c", "razermouse_driver.c"):
+        source_text = (prepared.root / "driver" / driver).read_text(encoding="utf-8")
+        if source_text.count("HID_DEVICE(BUS_VIRTUAL,HID_GROUP_ANY") != 1:
+            raise ModelError(f"OpenRazer native {driver} has an invalid virtual match boundary")
+        if "identity->bus == BUS_USB" not in source_text:
+            raise ModelError(f"OpenRazer native {driver} no longer reuses its exact USB catalog")
+        if "razer_hyperflux_error_is_uncertain(err)" not in source_text:
+            raise ModelError(f"OpenRazer native {driver} can retry an uncertain transaction")
+
+    service = (
+        root / "packaging" / "generated" / deployment.relay.service_unit
+    ).read_text(encoding="utf-8")
+    runtime = load_linux_runtime(root)
+    required_service = (
+        "User=root",
+        "NoNewPrivileges=yes",
+        "CapabilityBoundingSet=\n",
+        "DevicePolicy=closed",
+        f"DeviceAllow={deployment.relay.uhid_device} rw",
+        f"PartOf={runtime.bridge.service_unit}",
+        f"ExecStartPre={runtime.operations.activation_path} check-openrazer-driver",
+    )
+    if any(marker not in service for marker in required_service):
+        raise ModelError("OpenRazer native relay service sandbox is incomplete")
+    if "PrivateDevices=yes" in service or "SupplementaryGroups=" in service:
+        raise ModelError("OpenRazer native relay exposes a broader device boundary")
+    rust_deployment = (
+        root
+        / "crates"
+        / "hfx-integration-model"
+        / "src"
+        / "openrazer_native_generated.rs"
+    ).read_text(encoding="utf-8")
+    if (
+        deployment.source_sha256 not in rust_deployment
+        or any(
+            f'"{module}"' not in rust_deployment
+            for module in deployment.driver.modules
+        )
+    ):
+        raise ModelError("OpenRazer native Rust deployment projection is incomplete")
+    bridge_service = (
+        root / "packaging" / "generated" / "hyperflux-next-bridge.service"
+    ).read_text(encoding="utf-8")
+    if (
+        deployment.relay.service_unit not in bridge_service
+        or f"Before=" not in bridge_service
+    ):
+        raise ModelError("bridge lifecycle does not pull in the OpenRazer native relay")
+    install = load_install_manifest(root)
+    if (
+        install.build("openrazer-native-driver").destination
+        != deployment.driver.source_directory
+        or install.build("openrazer-native-relay").destination
+        != deployment.relay.executable_path
+    ):
+        raise ModelError("OpenRazer native deployment drifted from package staging")
+
+
 def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
     inputs = load_knowledge_inputs(root)
     catalog = compiled_knowledge_catalog(root)
@@ -1162,7 +1259,10 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
     manifest_path = build_artifacts(
         root,
         workspace / "artifacts",
-        capabilities={"openrgb-source": _openrgb_source(root)},
+        capabilities={
+            "openrgb-source": _openrgb_source(root),
+            "openrazer-source": _openrazer_source(root),
+        },
     )
     artifacts = load_artifact_set(root, manifest_path)
     if artifacts.omitted:
@@ -1257,6 +1357,7 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
     "openrgb-adapter-contracts": _run_openrgb_adapter_contracts,
     "openrgb-thread-sanitizer": _run_openrgb_thread_sanitizer,
     "openrazer-metadata-contracts": _run_openrazer_metadata_contracts,
+    "openrazer-native-route-contracts": _run_openrazer_native_route_contracts,
     "openrazer-compatibility-contracts": _run_openrazer_compatibility_contracts,
     "polychromatic-adapter-contracts": _run_polychromatic_adapter_contracts,
     "kernel-profile-contracts": _run_kernel_profile_contracts,
diff --git a/verification/tests.json b/verification/tests.json
index 61867dc..effca40 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -161,6 +161,32 @@
       "produced_evidence": ["openrazer-metadata-result"],
       "resume_policy": "rerun"
     },
+    {
+      "id": "openrazer-native-route-contracts",
+      "title": "Source-bound OpenRazer native transport and feature-only relay",
+      "owned_domain": "integrations",
+      "lanes": ["full-software"],
+      "runner": "openrazer-native-route-contracts",
+      "required_capabilities": ["openrazer-source"],
+      "hardware_requirement": "none",
+      "writes_hardware": false,
+      "expected_duration_seconds": 2,
+      "timeout_seconds": 60,
+      "dependencies": ["openrazer-metadata-contracts", "rust-unit"],
+      "isolation": "exclusive-process",
+      "cache_inputs": [
+        "Cargo.lock",
+        "Cargo.toml",
+        "crates/hfx-uhid-relay/**/*.rs",
+        "crates/hfx-uhid-relay/Cargo.toml",
+        "integrations/openrazer/native-route/**",
+        "schemas/openrazer-native-*.schema.json",
+        "tools/hfxdev/openrazer_native_route.py",
+        "tools/hfxdev/verify.py"
+      ],
+      "produced_evidence": ["openrazer-native-route-result"],
+      "resume_policy": "rerun"
+    },
     {
       "id": "device-knowledge-contracts",
       "title": "Provenance-bound device knowledge and exact upstream imports",

From a1741e9bb898e5d42c0cfc200e2f6dcd5de42362 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 13:58:28 +0400
Subject: [PATCH 41/67] feat: enforce serial-proven direct route precedence

---
 crates/hfx-uhid-relay/src/bridge.rs   |  27 +-
 crates/hfx-uhid-relay/src/catalog.rs  | 184 +++++++++++++-
 crates/hfx-uhid-relay/src/direct.rs   | 346 ++++++++++++++++++++++++++
 crates/hfx-uhid-relay/src/endpoint.rs |  40 +++
 crates/hfx-uhid-relay/src/lib.rs      |   6 +
 crates/hfx-uhid-relay/src/main.rs     |  14 +-
 crates/hfx-uhid-relay/src/runtime.rs  | 230 +++++++++++++++--
 crates/hfx-uhid-relay/src/serial.rs   | 262 +++++++++++++++++++
 tools/hfxdev/verify.py                | 103 ++++++++
 9 files changed, 1175 insertions(+), 37 deletions(-)
 create mode 100644 crates/hfx-uhid-relay/src/direct.rs
 create mode 100644 crates/hfx-uhid-relay/src/serial.rs

diff --git a/crates/hfx-uhid-relay/src/bridge.rs b/crates/hfx-uhid-relay/src/bridge.rs
index 6f66b94..458ff51 100644
--- a/crates/hfx-uhid-relay/src/bridge.rs
+++ b/crates/hfx-uhid-relay/src/bridge.rs
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::uhid::FEATURE_REPORT_BYTES;
+use crate::{SerialFingerprint, SerialQuerySpec};
 use hfx_domain::{
     ClientId, ClientName, LeaseDurationMs, LeaseId, NativeExchangeTimeoutMs, NativeReportHex,
     NativeRouteAccess, ProtocolFeatureId, ProtocolVersion, RouteState,
@@ -59,6 +60,8 @@ pub struct NativeBridge {
     route: NativeRoute,
     lease_id: LeaseId,
     last_lease_renewal: Instant,
+    serial_query: SerialQuerySpec,
+    observed_serial: Option<SerialFingerprint>,
 }
 
 pub struct NativeRouteMonitor {
@@ -121,6 +124,7 @@ impl NativeBridge {
     pub fn connect(
         socket_path: &Path,
         route: NativeRoute,
+        serial_query: SerialQuerySpec,
         instance: u32,
     ) -> Result<Self, NativeBridgeError> {
         validate_route(&route)?;
@@ -152,9 +156,15 @@ impl NativeBridge {
             route,
             lease_id,
             last_lease_renewal: Instant::now(),
+            serial_query,
+            observed_serial: None,
         })
     }
 
+    pub(crate) fn take_observed_serial(&mut self) -> Option<SerialFingerprint> {
+        self.observed_serial.take()
+    }
+
     fn renew_if_due(&mut self) -> Result<(), NativeBridgeError> {
         if self.last_lease_renewal.elapsed() < LEASE_RENEW_INTERVAL {
             return Ok(());
@@ -184,7 +194,8 @@ impl BridgeExchange for NativeBridge {
         let Some(route_token) = self.route.route_token.clone() else {
             return BridgeExchangeResult::NotSent;
         };
-        let Ok(report) = NativeReportHex::try_from(encode_hex(&report)) else {
+        let wire_request = report;
+        let Ok(report) = NativeReportHex::try_from(encode_hex(&wire_request)) else {
             return BridgeExchangeResult::NotSent;
         };
         let Ok(timeout) = NativeExchangeTimeoutMs::try_from(1_000_u16) else {
@@ -205,10 +216,16 @@ impl BridgeExchange for NativeBridge {
             NativeExchangeResult::NotSent(_) => BridgeExchangeResult::NotSent,
             NativeExchangeResult::MayHaveBeenSent(_) => BridgeExchangeResult::MayHaveBeenSent,
             NativeExchangeResult::MatchedResponse(matched) => {
-                decode_report(matched.response.as_str()).map_or(
-                    BridgeExchangeResult::MayHaveBeenSent,
-                    BridgeExchangeResult::MatchedResponse,
-                )
+                let Some(response) = decode_report(matched.response.as_str()) else {
+                    return BridgeExchangeResult::MayHaveBeenSent;
+                };
+                if let Some(fingerprint) = self
+                    .serial_query
+                    .fingerprint_response(&wire_request, &response)
+                {
+                    self.observed_serial = Some(fingerprint);
+                }
+                BridgeExchangeResult::MatchedResponse(response)
             }
         }
     }
diff --git a/crates/hfx-uhid-relay/src/catalog.rs b/crates/hfx-uhid-relay/src/catalog.rs
index 2e731d7..0abdc81 100644
--- a/crates/hfx-uhid-relay/src/catalog.rs
+++ b/crates/hfx-uhid-relay/src/catalog.rs
@@ -1,15 +1,19 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+use crate::serial::SerialQuerySpec;
 use hfx_domain::{DeviceKind, NativeProtocolFamily, ProductId, VendorId};
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
-use std::collections::BTreeSet;
+use std::collections::{BTreeMap, BTreeSet};
 use std::fmt;
 
 const CATALOG_JSON: &str =
     include_str!("../../../integrations/openrazer/native-route/catalog.json");
 const METADATA_JSON: &str = include_str!("../../../integrations/openrazer/metadata.json");
+const PROBE_CATALOG_JSON: &str =
+    include_str!("../../../integrations/openrazer/native-probe-catalog.json");
 const EXPECTED_SCHEMA: &str = "hyperflux-openrazer-native-route-catalog-v1";
+const EXPECTED_PROBE_SCHEMA: &str = "hyperflux-openrazer-native-probe-catalog-v1";
 const EXPECTED_DESCRIPTOR: &[u8] = &[
     0x06, 0x00, 0xff, 0x09, 0x01, 0xa1, 0x01, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08, 0x95, 0x5a,
     0xb1, 0x02, 0xc0,
@@ -28,6 +32,7 @@ pub struct NativeRouteRecord {
     pub source_sha256: String,
     pub direct_data_product_ids: Vec<ProductId>,
     pub event_file_regex: String,
+    pub serial_query: SerialQuerySpec,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -47,6 +52,7 @@ pub enum NativeRouteCatalogError {
     InvalidTransport,
     InvalidRoute,
     DuplicateRoute,
+    ProbeCatalogDrift,
 }
 
 impl fmt::Display for NativeRouteCatalogError {
@@ -58,6 +64,9 @@ impl fmt::Display for NativeRouteCatalogError {
             Self::InvalidTransport => "OpenRazer native Feature transport is invalid",
             Self::InvalidRoute => "OpenRazer native route is invalid",
             Self::DuplicateRoute => "OpenRazer native route identity is duplicated",
+            Self::ProbeCatalogDrift => {
+                "OpenRazer serial probe no longer matches the native-route catalog"
+            }
         })
     }
 }
@@ -108,6 +117,77 @@ struct SourceDocument {
     sha256: String,
 }
 
+#[derive(Debug, Deserialize)]
+struct ProbeCatalogDocument {
+    schema: String,
+    upstream: ProbeUpstreamDocument,
+    report_size: u16,
+    busy_retry: ProbeBusyRetryDocument,
+    devices: Vec<ProbeDeviceDocument>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeUpstreamDocument {
+    commit: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeBusyRetryDocument {
+    status: u8,
+    maximum_attempts: u8,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeDeviceDocument {
+    profile_id: String,
+    wireless_identity: ProbeIdentityDocument,
+    direct_usb_reference: ProbeIdentityDocument,
+    probes: Vec<ProbeDocument>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeIdentityDocument {
+    vendor_id: u16,
+    product_id: u16,
+    model_name: String,
+    device_kind: String,
+    transport_variant: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeDocument {
+    method: String,
+    privacy: String,
+    driver: ProbeDriverDocument,
+    request: ProbeRequestDocument,
+    response_summary: String,
+    comparison: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeDriverDocument {
+    attribute: String,
+    reader: String,
+    request_owner: String,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProbeRequestDocument {
+    command_class: u8,
+    command_id: u8,
+    data_size: u8,
+    arguments: Vec<u8>,
+    normalized_sha256: String,
+    transaction_id_from_upstream: bool,
+    crc_recomputed_by_upstream: bool,
+}
+
+struct BoundSerialProbe {
+    wireless_identity: ProbeIdentityDocument,
+    direct_usb_reference: ProbeIdentityDocument,
+    query: SerialQuerySpec,
+}
+
 impl NativeRouteCatalog {
     /// Loads the exact generated catalog embedded in this binary.
     ///
@@ -138,6 +218,7 @@ impl NativeRouteCatalog {
         }
         let protocol_family = NativeProtocolFamily::try_from(document.transport.protocol_family)
             .map_err(|_| NativeRouteCatalogError::InvalidTransport)?;
+        let serial_probes = load_serial_probes(&document.upstream_commit)?;
         let mut identities = BTreeSet::new();
         let mut profiles = BTreeSet::new();
         let mut routes = Vec::with_capacity(document.routes.len());
@@ -169,11 +250,16 @@ impl NativeRouteCatalog {
                 .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
             let direct_data_product_ids = route
                 .direct_data_product_ids
-                .into_iter()
+                .iter()
+                .copied()
                 .map(|product| {
                     ProductId::try_from(product).map_err(|_| NativeRouteCatalogError::InvalidRoute)
                 })
                 .collect::<Result<Vec<_>, _>>()?;
+            let serial_probe = serial_probes
+                .get(&route.profile_id)
+                .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
+            validate_probe_identity(&route, device_kind, &direct_data_product_ids, serial_probe)?;
             routes.push(NativeRouteRecord {
                 profile_id: route.profile_id,
                 vendor_id,
@@ -186,8 +272,12 @@ impl NativeRouteCatalog {
                 source_sha256: route.source.sha256,
                 direct_data_product_ids,
                 event_file_regex: route.event_file_regex,
+                serial_query: serial_probe.query.clone(),
             });
         }
+        if routes.len() != serial_probes.len() {
+            return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+        }
         routes.sort_by_key(|route| {
             (
                 route.vendor_id,
@@ -244,6 +334,96 @@ impl NativeRouteCatalog {
     }
 }
 
+fn load_serial_probes(
+    expected_commit: &str,
+) -> Result<BTreeMap<String, BoundSerialProbe>, NativeRouteCatalogError> {
+    let document: ProbeCatalogDocument = serde_json::from_str(PROBE_CATALOG_JSON)
+        .map_err(|_| NativeRouteCatalogError::InvalidJson)?;
+    if document.schema != EXPECTED_PROBE_SCHEMA
+        || document.upstream.commit != expected_commit
+        || document.report_size != 90
+        || document.busy_retry.status != 1
+        || !(1..=5).contains(&document.busy_retry.maximum_attempts)
+    {
+        return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+    }
+    let mut probes = BTreeMap::new();
+    for device in document.devices {
+        let mut serials = device
+            .probes
+            .into_iter()
+            .filter(|probe| probe.method == "get_serial");
+        let serial = serials
+            .next()
+            .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
+        if serials.next().is_some()
+            || serial.privacy != "redacted-equality-only"
+            || serial.driver.attribute != "device_serial"
+            || serial.driver.reader != "razer_attr_read_device_serial"
+            || serial.driver.request_owner != "razer_attr_read_device_serial"
+            || serial.response_summary != "redacted-serial-equality"
+            || serial.comparison != "redacted-equality"
+            || !serial.request.transaction_id_from_upstream
+            || !serial.request.crc_recomputed_by_upstream
+        {
+            return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+        }
+        let query = SerialQuerySpec::new(
+            serial.request.command_class,
+            serial.request.command_id,
+            serial.request.data_size,
+            serial.request.arguments,
+            serial.request.normalized_sha256,
+        )
+        .map_err(|_| NativeRouteCatalogError::ProbeCatalogDrift)?;
+        if probes
+            .insert(
+                device.profile_id,
+                BoundSerialProbe {
+                    wireless_identity: device.wireless_identity,
+                    direct_usb_reference: device.direct_usb_reference,
+                    query,
+                },
+            )
+            .is_some()
+        {
+            return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+        }
+    }
+    Ok(probes)
+}
+
+fn validate_probe_identity(
+    route: &RouteDocument,
+    device_kind: DeviceKind,
+    direct_products: &[ProductId],
+    probe: &BoundSerialProbe,
+) -> Result<(), NativeRouteCatalogError> {
+    let expected_kind = match device_kind {
+        DeviceKind::Mouse => "mouse",
+        DeviceKind::Keyboard => "keyboard",
+        _ => return Err(NativeRouteCatalogError::ProbeCatalogDrift),
+    };
+    let wireless = &probe.wireless_identity;
+    let direct = &probe.direct_usb_reference;
+    if wireless.vendor_id != route.vendor_id
+        || wireless.product_id != route.wireless_product_id
+        || wireless.model_name != route.model_name
+        || wireless.device_kind != expected_kind
+        || wireless.transport_variant != "wireless"
+        || direct.vendor_id != route.vendor_id
+        || direct.device_kind != expected_kind
+        || direct.transport_variant != "wired"
+        || direct.model_name.is_empty()
+        || !direct_products
+            .iter()
+            .any(|product| product.get() == direct.product_id)
+    {
+        return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+    }
+    Ok(())
+}
+
 fn decode_hex(value: &str) -> Option<Vec<u8>> {
     if !value.len().is_multiple_of(2) || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
         return None;
diff --git a/crates/hfx-uhid-relay/src/direct.rs b/crates/hfx-uhid-relay/src/direct.rs
new file mode 100644
index 0000000..e4a91bc
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/direct.rs
@@ -0,0 +1,346 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::catalog::{NativeRouteCatalog, NativeRouteRecord};
+use crate::serial::{SerialFingerprint, fingerprint_serial_bytes};
+use std::collections::{BTreeMap, BTreeSet};
+use std::fmt;
+use std::fs::{self, File};
+use std::io::{self, Read};
+use std::os::unix::fs::MetadataExt;
+use std::path::{Path, PathBuf};
+
+const USB_HID_BUS: u16 = 0x0003;
+const MAX_SERIAL_FILE_BYTES: usize = 256;
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct DirectMatch {
+    profile_id: String,
+    fingerprint: SerialFingerprint,
+}
+
+#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)]
+struct DirectDeviceKey {
+    profile_id: String,
+    path: PathBuf,
+    device: u64,
+    inode: u64,
+}
+
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct DirectRouteSnapshot {
+    profiles: BTreeSet<String>,
+    matches: BTreeSet<DirectMatch>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DirectRouteTransition {
+    Keep,
+    Expose,
+    Suppress,
+}
+
+impl DirectRouteSnapshot {
+    #[must_use]
+    pub fn has_profile_candidate(&self, profile_id: &str) -> bool {
+        self.profiles.contains(profile_id)
+    }
+
+    #[must_use]
+    pub fn suppresses(&self, profile_id: &str, fingerprint: &SerialFingerprint) -> bool {
+        self.matches.contains(&DirectMatch {
+            profile_id: profile_id.to_owned(),
+            fingerprint: fingerprint.clone(),
+        })
+    }
+
+    #[must_use]
+    pub fn transition(
+        &self,
+        profile_id: &str,
+        fingerprint: Option<&SerialFingerprint>,
+        exposed: bool,
+    ) -> DirectRouteTransition {
+        let suppressed =
+            fingerprint.is_some_and(|fingerprint| self.suppresses(profile_id, fingerprint));
+        match (exposed, suppressed) {
+            (true, true) => DirectRouteTransition::Suppress,
+            (false, false) => DirectRouteTransition::Expose,
+            (true, false) | (false, true) => DirectRouteTransition::Keep,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct DirectRouteScanner {
+    driver_root: PathBuf,
+    fingerprints: BTreeMap<DirectDeviceKey, SerialFingerprint>,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum DirectRouteScanError {
+    DriverDirectory,
+}
+
+impl fmt::Display for DirectRouteScanError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("direct USB route state could not be read")
+    }
+}
+
+impl std::error::Error for DirectRouteScanError {}
+
+impl DirectRouteScanner {
+    #[must_use]
+    pub fn new(driver_root: PathBuf) -> Self {
+        Self {
+            driver_root,
+            fingerprints: BTreeMap::new(),
+        }
+    }
+
+    /// Scans only exact direct-USB identities from the source-bound catalog.
+    /// A data route is not considered a match until `OpenRazer`'s physically
+    /// queried `device_serial` attribute is non-empty.
+    ///
+    /// # Errors
+    ///
+    /// Returns a bounded scanner error for an unreadable existing driver
+    /// directory. A driver that is not loaded is an empty, valid snapshot.
+    pub fn scan(
+        &mut self,
+        catalog: &NativeRouteCatalog,
+    ) -> Result<DirectRouteSnapshot, DirectRouteScanError> {
+        let mut snapshot = DirectRouteSnapshot::default();
+        let mut next_fingerprints = BTreeMap::new();
+        for record in catalog.routes() {
+            self.scan_record(record, &mut snapshot, &mut next_fingerprints)?;
+        }
+        self.fingerprints = next_fingerprints;
+        Ok(snapshot)
+    }
+
+    fn scan_record(
+        &self,
+        record: &NativeRouteRecord,
+        snapshot: &mut DirectRouteSnapshot,
+        next_fingerprints: &mut BTreeMap<DirectDeviceKey, SerialFingerprint>,
+    ) -> Result<(), DirectRouteScanError> {
+        let directory = self.driver_root.join(&record.driver_family);
+        let entries = match fs::read_dir(directory) {
+            Ok(entries) => entries,
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(()),
+            Err(_) => return Err(DirectRouteScanError::DriverDirectory),
+        };
+        for entry in entries {
+            let entry = entry.map_err(|_| DirectRouteScanError::DriverDirectory)?;
+            let Some(name) = entry.file_name().to_str().map(str::to_owned) else {
+                continue;
+            };
+            let Some((bus, vendor, product)) = parse_hid_identity(&name) else {
+                continue;
+            };
+            if bus != USB_HID_BUS
+                || vendor != record.vendor_id.get()
+                || !record
+                    .direct_data_product_ids
+                    .iter()
+                    .any(|candidate| candidate.get() == product)
+            {
+                continue;
+            }
+            snapshot.profiles.insert(record.profile_id.clone());
+            let serial_path = entry.path().join("device_serial");
+            let Some(key) = direct_device_key(record, &entry.path(), &serial_path) else {
+                continue;
+            };
+            let fingerprint = self.fingerprints.get(&key).cloned().or_else(|| {
+                read_serial(&serial_path).and_then(|serial| fingerprint_serial_bytes(&serial))
+            });
+            let Some(fingerprint) = fingerprint else {
+                continue;
+            };
+            next_fingerprints.insert(key, fingerprint.clone());
+            snapshot.matches.insert(DirectMatch {
+                profile_id: record.profile_id.clone(),
+                fingerprint,
+            });
+        }
+        Ok(())
+    }
+}
+
+fn direct_device_key(
+    record: &NativeRouteRecord,
+    entry_path: &Path,
+    serial_path: &Path,
+) -> Option<DirectDeviceKey> {
+    let metadata = fs::metadata(serial_path).ok()?;
+    Some(DirectDeviceKey {
+        profile_id: record.profile_id.clone(),
+        path: fs::canonicalize(entry_path).unwrap_or_else(|_| entry_path.to_owned()),
+        device: metadata.dev(),
+        inode: metadata.ino(),
+    })
+}
+
+fn parse_hid_identity(name: &str) -> Option<(u16, u16, u16)> {
+    let prefix = name.split_once('.')?.0;
+    let mut fields = prefix.split(':');
+    let bus = u16::from_str_radix(fields.next()?, 16).ok()?;
+    let vendor = u16::from_str_radix(fields.next()?, 16).ok()?;
+    let product = u16::from_str_radix(fields.next()?, 16).ok()?;
+    fields.next().is_none().then_some((bus, vendor, product))
+}
+
+fn read_serial(path: &Path) -> Option<Vec<u8>> {
+    let file = File::open(path).ok()?;
+    let mut value = Vec::new();
+    let limit = u64::try_from(MAX_SERIAL_FILE_BYTES).ok()?.checked_add(1)?;
+    file.take(limit).read_to_end(&mut value).ok()?;
+    (value.len() <= MAX_SERIAL_FILE_BYTES).then_some(value)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::os::unix::fs::symlink;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static TEST_ID: AtomicU64 = AtomicU64::new(1);
+
+    struct TempTree(PathBuf);
+
+    impl TempTree {
+        fn create() -> Self {
+            let id = TEST_ID.fetch_add(1, Ordering::Relaxed);
+            let path = std::env::temp_dir().join(format!(
+                "hyperflux-direct-route-{}-{id}",
+                std::process::id()
+            ));
+            fs::create_dir_all(&path).expect("temporary tree is created");
+            Self(path)
+        }
+
+        fn device(&self, driver: &str, identity: &str, serial: Option<&[u8]>) {
+            let path = self.0.join(driver).join(identity);
+            fs::create_dir_all(&path).expect("device directory is created");
+            if let Some(serial) = serial {
+                fs::write(path.join("device_serial"), serial).expect("serial fixture is written");
+            }
+        }
+
+        fn linked_device(&self, driver: &str, identity: &str, serial: &[u8]) {
+            let target = self.0.join("physical").join(identity);
+            fs::create_dir_all(&target).expect("physical fixture is created");
+            fs::write(target.join("device_serial"), serial).expect("serial fixture is written");
+            let link = self.0.join(driver).join(identity);
+            fs::create_dir_all(link.parent().expect("driver directory exists"))
+                .expect("driver directory is created");
+            symlink(target, link).expect("driver symlink is created");
+        }
+    }
+
+    impl Drop for TempTree {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    #[test]
+    fn exact_usb_pid_and_nonempty_physical_serial_are_both_required() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let tree = TempTree::create();
+        tree.linked_device("razermouse", "0003:1532:00CC.0001", b"MOUSE-A\n");
+        tree.device("razermouse", "0003:1532:00CD.0002", Some(b"MOUSE-B\n"));
+        tree.device("razerkbd", "0006:1532:0298.0003", Some(b"KEYBOARD-A\n"));
+        tree.device("razerkbd", "0003:1532:0298.0004", Some(b"\n"));
+
+        let snapshot = DirectRouteScanner::new(tree.0.clone())
+            .scan(&catalog)
+            .expect("fixture scans");
+        let mouse = fingerprint_serial_bytes(b"MOUSE-A").expect("mouse fingerprint exists");
+        let keyboard =
+            fingerprint_serial_bytes(b"KEYBOARD-A").expect("keyboard fingerprint exists");
+        assert!(snapshot.has_profile_candidate("child.razer.basilisk-v3-pro-35k.00cd"));
+        assert!(snapshot.suppresses("child.razer.basilisk-v3-pro-35k.00cd", &mouse));
+        assert!(!snapshot.suppresses("child.razer.deathstalker-v2-pro-tkl.0296", &keyboard));
+    }
+
+    #[test]
+    fn absent_data_route_is_not_inferred_from_a_power_cable() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let tree = TempTree::create();
+        let snapshot = DirectRouteScanner::new(tree.0.clone())
+            .scan(&catalog)
+            .expect("empty fixture scans");
+        assert!(snapshot.profiles.is_empty());
+        assert!(snapshot.matches.is_empty());
+    }
+
+    #[test]
+    fn same_model_is_not_enough_without_serial_equality() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let tree = TempTree::create();
+        tree.device("razerkbd", "0003:1532:0298.0001", Some(b"KEYBOARD-A\n"));
+        let snapshot = DirectRouteScanner::new(tree.0.clone())
+            .scan(&catalog)
+            .expect("fixture scans");
+        let other = fingerprint_serial_bytes(b"KEYBOARD-B").expect("fingerprint exists");
+        assert!(snapshot.has_profile_candidate("child.razer.deathstalker-v2-pro-tkl.0296"));
+        assert!(!snapshot.suppresses("child.razer.deathstalker-v2-pro-tkl.0296", &other));
+    }
+
+    #[test]
+    fn exact_direct_appearance_and_removal_have_inverse_transitions() {
+        let profile = "child.razer.basilisk-v3-pro-35k.00cd";
+        let fingerprint = fingerprint_serial_bytes(b"MOUSE-A").expect("fingerprint exists");
+        let mut snapshot = DirectRouteSnapshot::default();
+        snapshot.matches.insert(DirectMatch {
+            profile_id: profile.to_owned(),
+            fingerprint: fingerprint.clone(),
+        });
+        assert_eq!(
+            snapshot.transition(profile, Some(&fingerprint), true),
+            DirectRouteTransition::Suppress
+        );
+        assert_eq!(
+            DirectRouteSnapshot::default().transition(profile, Some(&fingerprint), false),
+            DirectRouteTransition::Expose
+        );
+        assert_eq!(
+            snapshot.transition(profile, None, true),
+            DirectRouteTransition::Keep
+        );
+    }
+
+    #[test]
+    fn physical_serial_is_queried_once_per_concrete_sysfs_object() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let tree = TempTree::create();
+        let profile = "child.razer.basilisk-v3-pro-35k.00cd";
+        let identity = "0003:1532:00CC.0001";
+        tree.device("razermouse", identity, Some(b"MOUSE-A\n"));
+        let serial_path = tree
+            .0
+            .join("razermouse")
+            .join(identity)
+            .join("device_serial");
+        let mut scanner = DirectRouteScanner::new(tree.0.clone());
+        let first = scanner.scan(&catalog).expect("first scan succeeds");
+        let serial_a = fingerprint_serial_bytes(b"MOUSE-A").expect("fingerprint exists");
+        let serial_b = fingerprint_serial_bytes(b"MOUSE-B").expect("fingerprint exists");
+        assert!(first.suppresses(profile, &serial_a));
+
+        fs::write(&serial_path, b"MOUSE-B\n").expect("fixture content changes");
+        let cached = scanner.scan(&catalog).expect("cached scan succeeds");
+        assert!(cached.suppresses(profile, &serial_a));
+        assert!(!cached.suppresses(profile, &serial_b));
+
+        fs::remove_dir_all(tree.0.join("razermouse").join(identity))
+            .expect("old sysfs object is removed");
+        tree.device("razermouse", "0003:1532:00CC.0002", Some(b"MOUSE-B\n"));
+        let replaced = scanner.scan(&catalog).expect("replacement scan succeeds");
+        assert!(!replaced.suppresses(profile, &serial_a));
+        assert!(replaced.suppresses(profile, &serial_b));
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/endpoint.rs b/crates/hfx-uhid-relay/src/endpoint.rs
index d97543c..1b35d46 100644
--- a/crates/hfx-uhid-relay/src/endpoint.rs
+++ b/crates/hfx-uhid-relay/src/endpoint.rs
@@ -64,6 +64,22 @@ impl<B: BridgeExchange> FeatureEndpoint<B> {
         self.pending_response.is_some()
     }
 
+    pub(crate) fn bridge_mut(&mut self) -> &mut B {
+        &mut self.bridge
+    }
+
+    /// Performs one relay-owned read-only management exchange only when no
+    /// `OpenRazer` response is pending. This keeps direct-route identity probing
+    /// serialized with the same native-control lease as normal Feature traffic.
+    pub fn management_exchange(
+        &mut self,
+        report: [u8; FEATURE_REPORT_BYTES],
+    ) -> Option<BridgeExchangeResult> {
+        self.pending_response
+            .is_none()
+            .then(|| self.bridge.exchange(report))
+    }
+
     /// Handles a decoded UHID event without exposing input collections.
     ///
     /// # Errors
@@ -297,4 +313,28 @@ mod tests {
         );
         assert_eq!(endpoint.state(), FeatureEndpointState::Created);
     }
+
+    #[test]
+    fn management_exchange_never_interleaves_with_a_pending_openrazer_response() {
+        let expected = [0x55; FEATURE_REPORT_BYTES];
+        let mut endpoint = endpoint(vec![
+            BridgeExchangeResult::MatchedResponse(expected),
+            BridgeExchangeResult::NotSent,
+        ]);
+        endpoint.handle(set(1, 0x11)).expect("set succeeds");
+        assert_eq!(
+            endpoint.management_exchange([0x22; FEATURE_REPORT_BYTES]),
+            None
+        );
+        assert_eq!(endpoint.bridge.requests, vec![[0x11; FEATURE_REPORT_BYTES]]);
+        endpoint.handle(get(2)).expect("get consumes response");
+        assert_eq!(
+            endpoint.management_exchange([0x22; FEATURE_REPORT_BYTES]),
+            Some(BridgeExchangeResult::NotSent)
+        );
+        assert_eq!(
+            endpoint.bridge.requests,
+            vec![[0x11; FEATURE_REPORT_BYTES], [0x22; FEATURE_REPORT_BYTES]]
+        );
+    }
 }
diff --git a/crates/hfx-uhid-relay/src/lib.rs b/crates/hfx-uhid-relay/src/lib.rs
index e5defe5..346a560 100644
--- a/crates/hfx-uhid-relay/src/lib.rs
+++ b/crates/hfx-uhid-relay/src/lib.rs
@@ -9,8 +9,10 @@
 
 mod bridge;
 mod catalog;
+mod direct;
 mod endpoint;
 mod runtime;
+mod serial;
 mod supervisor;
 mod uhid;
 
@@ -18,8 +20,12 @@ pub use bridge::{
     BridgeExchange, BridgeExchangeResult, NativeBridge, NativeBridgeError, NativeRouteMonitor,
 };
 pub use catalog::{NativeRouteCatalog, NativeRouteCatalogError, NativeRouteRecord};
+pub use direct::{
+    DirectRouteScanError, DirectRouteScanner, DirectRouteSnapshot, DirectRouteTransition,
+};
 pub use endpoint::{EndpointError, FeatureEndpoint, FeatureEndpointState};
 pub use runtime::{RelayPaths, RelayRuntimeError, run_relay};
+pub use serial::{SerialFingerprint, SerialQueryError, SerialQuerySpec, fingerprint_serial_bytes};
 pub use supervisor::{RouteAction, RouteIdentity, RouteSupervisor, RouteSupervisorError};
 pub use uhid::{
     FEATURE_REPORT_BYTES, HYPERFLUX_PHYS_PREFIX, TRANSPORT_ENVELOPE_MAGIC, TransportEnvelopeKind,
diff --git a/crates/hfx-uhid-relay/src/main.rs b/crates/hfx-uhid-relay/src/main.rs
index d0ea09e..571f36b 100644
--- a/crates/hfx-uhid-relay/src/main.rs
+++ b/crates/hfx-uhid-relay/src/main.rs
@@ -10,8 +10,7 @@ use std::process::ExitCode;
 use std::sync::Arc;
 use std::sync::atomic::AtomicBool;
 
-const USAGE: &str =
-    "Usage: hyperflux-next-uhid-relay [--socket ABSOLUTE_PATH] [--uhid ABSOLUTE_PATH]";
+const USAGE: &str = "Usage: hyperflux-next-uhid-relay [--socket ABSOLUTE_PATH] [--uhid ABSOLUTE_PATH] [--hid-driver-root ABSOLUTE_PATH]";
 
 #[derive(Debug, Eq, PartialEq)]
 enum Command {
@@ -71,6 +70,7 @@ fn parse_arguments(arguments: impl IntoIterator<Item = String>) -> Result<Comman
     let mut paths = RelayPaths::linux();
     let mut socket_seen = false;
     let mut uhid_seen = false;
+    let mut hid_driver_root_seen = false;
     let mut index = 0;
     while index < arguments.len() {
         let flag = &arguments[index];
@@ -90,7 +90,11 @@ fn parse_arguments(arguments: impl IntoIterator<Item = String>) -> Result<Comman
                 paths.uhid_device = path;
                 uhid_seen = true;
             }
-            "--socket" | "--uhid" => {
+            "--hid-driver-root" if !hid_driver_root_seen => {
+                paths.hid_driver_root = path;
+                hid_driver_root_seen = true;
+            }
+            "--socket" | "--uhid" | "--hid-driver-root" => {
                 return Err(format!("{flag} may be provided only once\n{USAGE}"));
             }
             _ => return Err(format!("unknown option: {flag}\n{USAGE}")),
@@ -121,6 +125,8 @@ mod tests {
         let command = parse_arguments(strings(&[
             "--uhid",
             "/tmp/test-uhid",
+            "--hid-driver-root",
+            "/tmp/test-hid-drivers",
             "--socket",
             "/tmp/test.sock",
         ]))
@@ -130,6 +136,7 @@ mod tests {
             Command::Run(RelayPaths {
                 bridge_socket: PathBuf::from("/tmp/test.sock"),
                 uhid_device: PathBuf::from("/tmp/test-uhid"),
+                hid_driver_root: PathBuf::from("/tmp/test-hid-drivers"),
             })
         );
     }
@@ -140,6 +147,7 @@ mod tests {
             strings(&["--socket", "relative.sock"]),
             strings(&["--uhid"]),
             strings(&["--socket", "/a", "--socket", "/b"]),
+            strings(&["--hid-driver-root", "/a", "--hid-driver-root", "/b"]),
             strings(&["--other", "/tmp/value"]),
         ] {
             assert!(parse_arguments(arguments).is_err());
diff --git a/crates/hfx-uhid-relay/src/runtime.rs b/crates/hfx-uhid-relay/src/runtime.rs
index 9d1a88d..0612e92 100644
--- a/crates/hfx-uhid-relay/src/runtime.rs
+++ b/crates/hfx-uhid-relay/src/runtime.rs
@@ -1,10 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 use crate::{
-    FeatureEndpoint, NativeBridge, NativeRouteCatalog, NativeRouteMonitor, RouteAction,
-    RouteIdentity, RouteSupervisor, UHID_EVENT_BYTES, UhidEvent, UhidReply,
+    BridgeExchangeResult, DirectRouteScanner, DirectRouteSnapshot, DirectRouteTransition,
+    FeatureEndpoint, NativeBridge, NativeRouteCatalog, NativeRouteMonitor, NativeRouteRecord,
+    RouteAction, RouteIdentity, RouteSupervisor, SerialFingerprint, SerialQuerySpec,
+    UHID_EVENT_BYTES, UhidEvent, UhidReply, VirtualDeviceSpec,
 };
 use hfx_domain::EventBatchLimit;
+use hfx_protocol::NativeRoute;
 use hfx_sdk::EventSubscription;
 use rustix::fs::{OFlags, fcntl_getfl, fcntl_setfl};
 use std::collections::{BTreeMap, VecDeque};
@@ -17,6 +20,8 @@ use std::thread;
 use std::time::{Duration, Instant};
 
 const WATCH_INTERVAL: Duration = Duration::from_millis(100);
+const DIRECT_SCAN_INTERVAL: Duration = Duration::from_millis(250);
+const SERIAL_QUERY_INTERVAL: Duration = Duration::from_secs(1);
 const IDLE_INTERVAL: Duration = Duration::from_millis(10);
 const MAX_PENDING_REPLIES: usize = 8;
 const WATCH_BATCH_SIZE: u16 = 32;
@@ -25,6 +30,7 @@ const WATCH_BATCH_SIZE: u16 = 32;
 pub struct RelayPaths {
     pub bridge_socket: PathBuf,
     pub uhid_device: PathBuf,
+    pub hid_driver_root: PathBuf,
 }
 
 impl RelayPaths {
@@ -33,6 +39,7 @@ impl RelayPaths {
         Self {
             bridge_socket: PathBuf::from(hfx_runtime::BRIDGE_SOCKET_PATH),
             uhid_device: PathBuf::from("/dev/uhid"),
+            hid_driver_root: PathBuf::from("/sys/bus/hid/drivers"),
         }
     }
 }
@@ -85,12 +92,9 @@ struct RunningEndpoint {
 impl RunningEndpoint {
     fn create(
         paths: &RelayPaths,
-        route: hfx_protocol::NativeRoute,
-        device: crate::VirtualDeviceSpec,
-        instance: u32,
+        bridge: NativeBridge,
+        device: VirtualDeviceSpec,
     ) -> Result<Self, RelayRuntimeError> {
-        let bridge = NativeBridge::connect(&paths.bridge_socket, route, instance)
-            .map_err(|_| RelayRuntimeError::Bridge)?;
         let mut file = open_uhid(&paths.uhid_device)?;
         write_blocking(&mut file, &UhidReply::Create(device))?;
         let flags = fcntl_getfl(&file).map_err(|_| RelayRuntimeError::UhidOpen)?;
@@ -103,6 +107,24 @@ impl RunningEndpoint {
         })
     }
 
+    fn query_serial(&mut self, query: &SerialQuerySpec) -> Option<SerialFingerprint> {
+        let request = query.request();
+        let fingerprint = match self.endpoint.management_exchange(request)? {
+            BridgeExchangeResult::MatchedResponse(response) => {
+                query.fingerprint_response(&request, &response)
+            }
+            BridgeExchangeResult::NotSent | BridgeExchangeResult::MayHaveBeenSent => None,
+        };
+        self.endpoint
+            .bridge_mut()
+            .take_observed_serial()
+            .or(fingerprint)
+    }
+
+    fn take_observed_serial(&mut self) -> Option<SerialFingerprint> {
+        self.endpoint.bridge_mut().take_observed_serial()
+    }
+
     fn step(&mut self) -> Result<(), RelayRuntimeError> {
         self.flush()?;
         let mut bytes = [0_u8; UHID_EVENT_BYTES];
@@ -174,6 +196,113 @@ impl RunningEndpoint {
     }
 }
 
+struct ManagedRoute {
+    route: NativeRoute,
+    record: NativeRouteRecord,
+    device: VirtualDeviceSpec,
+    serial_fingerprint: Option<SerialFingerprint>,
+    endpoint: Option<RunningEndpoint>,
+    next_serial_query: Instant,
+}
+
+impl ManagedRoute {
+    fn start(
+        paths: &RelayPaths,
+        route: NativeRoute,
+        record: NativeRouteRecord,
+        device: VirtualDeviceSpec,
+        direct: &DirectRouteSnapshot,
+        instance: u32,
+    ) -> Result<Self, RelayRuntimeError> {
+        let mut bridge = NativeBridge::connect(
+            &paths.bridge_socket,
+            route.clone(),
+            record.serial_query.clone(),
+            instance,
+        )
+        .map_err(|_| RelayRuntimeError::Bridge)?;
+        let queried_serial = direct
+            .has_profile_candidate(&record.profile_id)
+            .then(|| record.serial_query.query(&mut bridge))
+            .flatten();
+        let serial_fingerprint = bridge.take_observed_serial().or(queried_serial);
+        let suppressed = serial_fingerprint
+            .as_ref()
+            .is_some_and(|fingerprint| direct.suppresses(&record.profile_id, fingerprint));
+        let endpoint = if suppressed {
+            None
+        } else {
+            Some(RunningEndpoint::create(paths, bridge, device.clone())?)
+        };
+        Ok(Self {
+            route,
+            record,
+            device,
+            serial_fingerprint,
+            endpoint,
+            next_serial_query: Instant::now() + SERIAL_QUERY_INTERVAL,
+        })
+    }
+
+    fn step(&mut self) -> Result<(), RelayRuntimeError> {
+        if let Some(endpoint) = &mut self.endpoint {
+            endpoint.step()?;
+            if self.serial_fingerprint.is_none() {
+                self.serial_fingerprint = endpoint.take_observed_serial();
+            }
+        }
+        Ok(())
+    }
+
+    fn refresh_direct(
+        &mut self,
+        paths: &RelayPaths,
+        direct: &DirectRouteSnapshot,
+        next_instance: &mut u32,
+    ) -> Result<(), RelayRuntimeError> {
+        if self.serial_fingerprint.is_none()
+            && direct.has_profile_candidate(&self.record.profile_id)
+            && Instant::now() >= self.next_serial_query
+        {
+            if let Some(endpoint) = &mut self.endpoint {
+                self.serial_fingerprint = endpoint.query_serial(&self.record.serial_query);
+            }
+            self.next_serial_query = Instant::now() + SERIAL_QUERY_INTERVAL;
+        }
+
+        match direct.transition(
+            &self.record.profile_id,
+            self.serial_fingerprint.as_ref(),
+            self.endpoint.is_some(),
+        ) {
+            DirectRouteTransition::Suppress => {
+                if let Some(endpoint) = self.endpoint.take() {
+                    endpoint.destroy();
+                }
+            }
+            DirectRouteTransition::Expose => {
+                let instance = take_instance(next_instance)?;
+                let bridge = NativeBridge::connect(
+                    &paths.bridge_socket,
+                    self.route.clone(),
+                    self.record.serial_query.clone(),
+                    instance,
+                )
+                .map_err(|_| RelayRuntimeError::Bridge)?;
+                self.endpoint = Some(RunningEndpoint::create(paths, bridge, self.device.clone())?);
+            }
+            DirectRouteTransition::Keep => {}
+        }
+        Ok(())
+    }
+
+    fn destroy(mut self) {
+        if let Some(endpoint) = self.endpoint.take() {
+            endpoint.destroy();
+        }
+    }
+}
+
 impl Drop for RunningEndpoint {
     fn drop(&mut self) {
         self.destroy_inner();
@@ -188,6 +317,8 @@ impl Drop for RunningEndpoint {
 /// session destroys every virtual endpoint and releases every route lease.
 pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), RelayRuntimeError> {
     let catalog = NativeRouteCatalog::load().map_err(|_| RelayRuntimeError::Catalog)?;
+    let mut direct_scanner = DirectRouteScanner::new(paths.hid_driver_root.clone());
+    let mut direct_snapshot = direct_scanner.scan(&catalog).unwrap_or_default();
     let mut monitor =
         NativeRouteMonitor::connect(&paths.bridge_socket).map_err(|_| RelayRuntimeError::Bridge)?;
     let inventory = monitor.enumerate().map_err(|_| RelayRuntimeError::Bridge)?;
@@ -195,19 +326,33 @@ pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), Rel
     let actions = supervisor
         .reconcile(&inventory, &catalog)
         .map_err(|_| RelayRuntimeError::Supervisor)?;
-    let mut endpoints = BTreeMap::new();
+    let mut routes = BTreeMap::new();
     let mut next_instance = 1_u32;
-    apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+    apply_actions(
+        paths,
+        actions,
+        &mut routes,
+        &direct_snapshot,
+        &mut next_instance,
+    )?;
 
     let batch_limit = EventBatchLimit::try_from(WATCH_BATCH_SIZE)
         .map_err(|_| RelayRuntimeError::InvalidBatchLimit)?;
     let mut subscription_id = None;
     let mut cursor = Some(inventory.cursor);
     let mut next_watch = Instant::now();
+    let mut next_direct_scan = Instant::now() + DIRECT_SCAN_INTERVAL;
 
     while !termination.load(Ordering::Relaxed) {
-        for endpoint in endpoints.values_mut() {
-            endpoint.step()?;
+        for route in routes.values_mut() {
+            route.step()?;
+        }
+        if Instant::now() >= next_direct_scan {
+            if let Ok(snapshot) = direct_scanner.scan(&catalog) {
+                direct_snapshot = snapshot;
+                refresh_direct_routes(paths, &mut routes, &direct_snapshot, &mut next_instance)?;
+            }
+            next_direct_scan = Instant::now() + DIRECT_SCAN_INTERVAL;
         }
         if Instant::now() >= next_watch {
             let batch = monitor
@@ -222,7 +367,13 @@ pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), Rel
                 let actions = supervisor
                     .reconcile(&inventory, &catalog)
                     .map_err(|_| RelayRuntimeError::Supervisor)?;
-                apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+                apply_actions(
+                    paths,
+                    actions,
+                    &mut routes,
+                    &direct_snapshot,
+                    &mut next_instance,
+                )?;
                 subscription_id = None;
                 cursor = Some(inventory.cursor);
             } else {
@@ -230,7 +381,13 @@ pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), Rel
                     let actions = supervisor
                         .apply_event(event, &catalog)
                         .map_err(|_| RelayRuntimeError::Supervisor)?;
-                    apply_actions(paths, actions, &mut endpoints, &mut next_instance)?;
+                    apply_actions(
+                        paths,
+                        actions,
+                        &mut routes,
+                        &direct_snapshot,
+                        &mut next_instance,
+                    )?;
                 }
                 subscription_id = Some(batch.subscription_id);
                 cursor = Some(batch.next_cursor);
@@ -243,35 +400,34 @@ pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), Rel
         }
         thread::sleep(IDLE_INTERVAL);
     }
-    destroy_all(&mut endpoints);
+    destroy_all(&mut routes);
     Ok(())
 }
 
 fn apply_actions(
     paths: &RelayPaths,
     actions: Vec<RouteAction>,
-    endpoints: &mut BTreeMap<RouteIdentity, RunningEndpoint>,
+    routes: &mut BTreeMap<RouteIdentity, ManagedRoute>,
+    direct: &DirectRouteSnapshot,
     next_instance: &mut u32,
 ) -> Result<(), RelayRuntimeError> {
     for action in actions {
         match action {
             RouteAction::Stop { identity } => {
-                if let Some(endpoint) = endpoints.remove(&identity) {
-                    endpoint.destroy();
+                if let Some(route) = routes.remove(&identity) {
+                    route.destroy();
                 }
             }
             RouteAction::Start {
                 identity,
                 route,
+                record,
                 device,
-                ..
             } => {
-                let instance = *next_instance;
-                *next_instance = next_instance
-                    .checked_add(1)
-                    .ok_or(RelayRuntimeError::Bridge)?;
-                let endpoint = RunningEndpoint::create(paths, *route, *device, instance)?;
-                if let Some(previous) = endpoints.insert(identity, endpoint) {
+                let instance = take_instance(next_instance)?;
+                let managed =
+                    ManagedRoute::start(paths, *route, *record, *device, direct, instance)?;
+                if let Some(previous) = routes.insert(identity, managed) {
                     previous.destroy();
                 }
             }
@@ -280,9 +436,29 @@ fn apply_actions(
     Ok(())
 }
 
-fn destroy_all(endpoints: &mut BTreeMap<RouteIdentity, RunningEndpoint>) {
-    while let Some((_, endpoint)) = endpoints.pop_first() {
-        endpoint.destroy();
+fn refresh_direct_routes(
+    paths: &RelayPaths,
+    routes: &mut BTreeMap<RouteIdentity, ManagedRoute>,
+    direct: &DirectRouteSnapshot,
+    next_instance: &mut u32,
+) -> Result<(), RelayRuntimeError> {
+    for route in routes.values_mut() {
+        route.refresh_direct(paths, direct, next_instance)?;
+    }
+    Ok(())
+}
+
+fn take_instance(next_instance: &mut u32) -> Result<u32, RelayRuntimeError> {
+    let instance = *next_instance;
+    *next_instance = next_instance
+        .checked_add(1)
+        .ok_or(RelayRuntimeError::Bridge)?;
+    Ok(instance)
+}
+
+fn destroy_all(routes: &mut BTreeMap<RouteIdentity, ManagedRoute>) {
+    while let Some((_, route)) = routes.pop_first() {
+        route.destroy();
     }
 }
 
diff --git a/crates/hfx-uhid-relay/src/serial.rs b/crates/hfx-uhid-relay/src/serial.rs
new file mode 100644
index 0000000..c4ec113
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/serial.rs
@@ -0,0 +1,262 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::bridge::{BridgeExchange, BridgeExchangeResult};
+use crate::uhid::FEATURE_REPORT_BYTES;
+use sha2::{Digest, Sha256};
+use std::fmt;
+
+const SUCCESS_STATUS: u8 = 0x02;
+const ARGUMENT_OFFSET: usize = 8;
+const CRC_OFFSET: usize = 88;
+const RESERVED_OFFSET: usize = 89;
+const MAX_ARGUMENT_BYTES: usize = CRC_OFFSET - ARGUMENT_OFFSET;
+const FINGERPRINT_DOMAIN: &[u8] = b"hyperflux-native-serial-fingerprint-v1\0";
+
+/// A non-reversible, process-local comparison value. The source serial is
+/// never retained after construction and this type deliberately redacts its
+/// `Debug` representation.
+#[derive(Clone, Eq, Hash, Ord, PartialEq, PartialOrd)]
+pub struct SerialFingerprint([u8; 32]);
+
+impl fmt::Debug for SerialFingerprint {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("SerialFingerprint(<redacted>)")
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct SerialQuerySpec {
+    command_class: u8,
+    command_id: u8,
+    data_size: u8,
+    arguments: Vec<u8>,
+    normalized_sha256: String,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum SerialQueryError {
+    InvalidDataSize,
+    InvalidArguments,
+    InvalidDigest,
+}
+
+impl fmt::Display for SerialQueryError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidDataSize => "serial query data size is outside the Razer report",
+            Self::InvalidArguments => "serial query arguments do not match its data size",
+            Self::InvalidDigest => "serial query no longer matches its source-bound digest",
+        })
+    }
+}
+
+impl std::error::Error for SerialQueryError {}
+
+impl SerialQuerySpec {
+    /// Creates one source-bound read-only serial query.
+    ///
+    /// # Errors
+    ///
+    /// Rejects an invalid report shape or a normalized request digest that no
+    /// longer matches the upstream-derived catalog.
+    pub fn new(
+        command_class: u8,
+        command_id: u8,
+        data_size: u8,
+        arguments: Vec<u8>,
+        normalized_sha256: String,
+    ) -> Result<Self, SerialQueryError> {
+        if usize::from(data_size) > MAX_ARGUMENT_BYTES {
+            return Err(SerialQueryError::InvalidDataSize);
+        }
+        if arguments.len() != usize::from(data_size) {
+            return Err(SerialQueryError::InvalidArguments);
+        }
+        let query = Self {
+            command_class,
+            command_id,
+            data_size,
+            arguments,
+            normalized_sha256,
+        };
+        if query.normalized_sha256.len() != 64
+            || query.normalized_sha256 != hex_sha256(&query.normalized_request())
+        {
+            return Err(SerialQueryError::InvalidDigest);
+        }
+        Ok(query)
+    }
+
+    #[must_use]
+    pub fn request(&self) -> [u8; FEATURE_REPORT_BYTES] {
+        let mut report = self.normalized_request();
+        report[CRC_OFFSET] = report_crc(&report);
+        report
+    }
+
+    fn normalized_request(&self) -> [u8; FEATURE_REPORT_BYTES] {
+        let mut report = [0_u8; FEATURE_REPORT_BYTES];
+        report[5] = self.data_size;
+        report[6] = self.command_class;
+        report[7] = self.command_id;
+        let end = ARGUMENT_OFFSET + self.arguments.len();
+        report[ARGUMENT_OFFSET..end].copy_from_slice(&self.arguments);
+        report
+    }
+
+    #[must_use]
+    pub fn fingerprint_response(
+        &self,
+        request: &[u8; FEATURE_REPORT_BYTES],
+        response: &[u8; FEATURE_REPORT_BYTES],
+    ) -> Option<SerialFingerprint> {
+        if response[0] != SUCCESS_STATUS
+            || response[1] != request[1]
+            || response[2..4] != request[2..4]
+            || response[5] != self.data_size
+            || response[6] != self.command_class
+            || response[7] != self.command_id
+            || response[CRC_OFFSET] != report_crc(response)
+            || response[RESERVED_OFFSET] != 0
+        {
+            return None;
+        }
+        let end = ARGUMENT_OFFSET + usize::from(self.data_size);
+        fingerprint_serial_bytes(&response[ARGUMENT_OFFSET..end])
+    }
+
+    #[must_use]
+    pub fn query<B: BridgeExchange>(&self, bridge: &mut B) -> Option<SerialFingerprint> {
+        let request = self.request();
+        match bridge.exchange(request) {
+            BridgeExchangeResult::MatchedResponse(response) => {
+                self.fingerprint_response(&request, &response)
+            }
+            BridgeExchangeResult::NotSent | BridgeExchangeResult::MayHaveBeenSent => None,
+        }
+    }
+}
+
+#[must_use]
+pub fn fingerprint_serial_bytes(value: &[u8]) -> Option<SerialFingerprint> {
+    let value = trim_serial(value);
+    if value.is_empty() || value.len() > MAX_ARGUMENT_BYTES || value.contains(&0) {
+        return None;
+    }
+    let mut hasher = Sha256::new();
+    hasher.update(FINGERPRINT_DOMAIN);
+    hasher.update(value);
+    Some(SerialFingerprint(hasher.finalize().into()))
+}
+
+fn trim_serial(mut value: &[u8]) -> &[u8] {
+    while value
+        .first()
+        .is_some_and(|byte| *byte == 0 || byte.is_ascii_whitespace())
+    {
+        value = &value[1..];
+    }
+    while value
+        .last()
+        .is_some_and(|byte| *byte == 0 || byte.is_ascii_whitespace())
+    {
+        value = &value[..value.len() - 1];
+    }
+    value
+}
+
+fn report_crc(report: &[u8; FEATURE_REPORT_BYTES]) -> u8 {
+    report[2..CRC_OFFSET]
+        .iter()
+        .copied()
+        .fold(0_u8, |value, byte| value ^ byte)
+}
+
+fn hex_sha256(value: &[u8]) -> String {
+    let digest = Sha256::digest(value);
+    let mut output = String::with_capacity(64);
+    for byte in digest {
+        use std::fmt::Write as _;
+        let _ = write!(output, "{byte:02x}");
+    }
+    output
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    struct FakeBridge(BridgeExchangeResult);
+
+    impl BridgeExchange for FakeBridge {
+        fn exchange(&mut self, _report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
+            self.0
+        }
+    }
+
+    fn query() -> SerialQuerySpec {
+        SerialQuerySpec::new(
+            0,
+            0x82,
+            22,
+            vec![0; 22],
+            "1ee6772a2962f0e212d4db1ce62dfc328155bb7e508a50940059c1a89e1afcaf".to_owned(),
+        )
+        .expect("source-bound serial query is valid")
+    }
+
+    fn response(query: &SerialQuerySpec, serial: &[u8]) -> [u8; FEATURE_REPORT_BYTES] {
+        let request = query.request();
+        let mut response = request;
+        response[0] = SUCCESS_STATUS;
+        response[ARGUMENT_OFFSET..ARGUMENT_OFFSET + serial.len()].copy_from_slice(serial);
+        response[CRC_OFFSET] = report_crc(&response);
+        response
+    }
+
+    #[test]
+    fn source_bound_request_matches_the_imported_digest() {
+        let query = query();
+        assert_eq!(
+            hex_sha256(&query.normalized_request()),
+            "1ee6772a2962f0e212d4db1ce62dfc328155bb7e508a50940059c1a89e1afcaf"
+        );
+        assert_eq!(query.request()[CRC_OFFSET], 0x94);
+    }
+
+    #[test]
+    fn direct_and_receiver_serials_share_only_a_redacted_fingerprint() {
+        let query = query();
+        let response = response(&query, b"SERIAL-EXAMPLE");
+        let from_route = query
+            .fingerprint_response(&query.request(), &response)
+            .expect("response contains a serial");
+        let from_sysfs =
+            fingerprint_serial_bytes(b"SERIAL-EXAMPLE\n").expect("sysfs serial is normalized");
+        assert_eq!(from_route, from_sysfs);
+        assert_eq!(format!("{from_route:?}"), "SerialFingerprint(<redacted>)");
+    }
+
+    #[test]
+    fn malformed_empty_and_transport_failure_results_are_not_identities() {
+        let query = query();
+        let empty = response(&query, &[0; 22]);
+        assert!(
+            query
+                .fingerprint_response(&query.request(), &empty)
+                .is_none()
+        );
+
+        let mut malformed = response(&query, b"SERIAL-EXAMPLE");
+        malformed[7] ^= 1;
+        malformed[CRC_OFFSET] = report_crc(&malformed);
+        assert!(
+            query
+                .fingerprint_response(&query.request(), &malformed)
+                .is_none()
+        );
+
+        let mut bridge = FakeBridge(BridgeExchangeResult::NotSent);
+        assert!(query.query(&mut bridge).is_none());
+    }
+}
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 8dbb432..ed84632 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ast
 import json
 import os
 from pathlib import Path, PurePosixPath
@@ -666,6 +667,58 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
     if (prepared.root / ".git").exists():
         raise ModelError("OpenRazer native source output copied upstream Git metadata")
 
+    route_catalog = load_json(
+        root / "integrations" / "openrazer" / "native-route" / "catalog.json"
+    )
+    metadata = load_imported_metadata(root)
+    probes = load_native_probe_catalog(root)
+    metadata_by_profile = {device["profile_id"]: device for device in metadata["devices"]}
+    probes_by_profile = {device["profile_id"]: device for device in probes["devices"]}
+    for route in route_catalog["routes"]:
+        profile_id = route["profile_id"]
+        device = metadata_by_profile.get(profile_id)
+        probe_device = probes_by_profile.get(profile_id)
+        if device is None or probe_device is None:
+            raise ModelError(f"OpenRazer native route {profile_id} lacks an upstream binding")
+        if route["source"] != device["source"]:
+            raise ModelError(f"OpenRazer native route {profile_id} source binding drifted")
+        identity = device["identity"]
+        if any(
+            route[field] != identity[field]
+            for field in ("vendor_id", "model_name", "device_kind")
+        ) or route["wireless_product_id"] != identity["product_id"]:
+            raise ModelError(f"OpenRazer native route {profile_id} identity drifted")
+        direct = probe_device["direct_usb_reference"]
+        if (
+            direct["vendor_id"] != route["vendor_id"]
+            or direct["device_kind"] != route["device_kind"]
+            or direct["product_id"] not in route["direct_data_product_ids"]
+            or route["wireless_product_id"] in route["direct_data_product_ids"]
+        ):
+            raise ModelError(f"OpenRazer native route {profile_id} direct precedence drifted")
+        serials = [probe for probe in probe_device["probes"] if probe["method"] == "get_serial"]
+        if len(serials) != 1 or any(
+            (
+                serials[0]["privacy"] != "redacted-equality-only",
+                serials[0]["driver"]["attribute"] != "device_serial",
+                serials[0]["response_summary"] != "redacted-serial-equality",
+                serials[0]["comparison"] != "redacted-equality",
+            )
+        ):
+            raise ModelError(f"OpenRazer native route {profile_id} serial proof drifted")
+        source_path = source / route["source"]["path"]
+        effective_regex = _openrazer_effective_event_regex(
+            source_path, route["source"]["class_name"]
+        )
+        if effective_regex != route["event_file_regex"]:
+            raise ModelError(f"OpenRazer native route {profile_id} event matcher drifted")
+        try:
+            re.compile(effective_regex)
+        except re.error as error:
+            raise ModelError(
+                f"OpenRazer native route {profile_id} event matcher is invalid: {error}"
+            ) from error
+
     common = (prepared.root / "driver" / "razercommon.c").read_text(encoding="utf-8")
     required_common = (
         'RAZER_HYPERFLUX_PHYS_PREFIX "hyperflux-next/native/v1/"',
@@ -735,6 +788,56 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
         raise ModelError("OpenRazer native deployment drifted from package staging")
 
 
+def _openrazer_effective_event_regex(source: Path, class_name: str) -> str:
+    try:
+        tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+    except (OSError, SyntaxError) as error:
+        raise ModelError(f"cannot parse OpenRazer event matcher source: {error}") from error
+    classes = {
+        node.name: node
+        for node in tree.body
+        if isinstance(node, ast.ClassDef)
+    }
+
+    def resolve(name: str, visited: set[str]) -> str | None:
+        if name in visited:
+            raise ModelError("OpenRazer event matcher inheritance contains a cycle")
+        node = classes.get(name)
+        if node is None:
+            return None
+        visited = {*visited, name}
+        for statement in node.body:
+            if not isinstance(statement, ast.Assign) or not any(
+                isinstance(target, ast.Name) and target.id == "EVENT_FILE_REGEX"
+                for target in statement.targets
+            ):
+                continue
+            value = statement.value
+            if (
+                isinstance(value, ast.Call)
+                and isinstance(value.func, ast.Attribute)
+                and isinstance(value.func.value, ast.Name)
+                and value.func.value.id == "re"
+                and value.func.attr == "compile"
+                and len(value.args) == 1
+                and isinstance(value.args[0], ast.Constant)
+                and isinstance(value.args[0].value, str)
+            ):
+                return value.args[0].value
+            raise ModelError(f"OpenRazer class {name} has an unsupported event matcher")
+        for base in node.bases:
+            if isinstance(base, ast.Name):
+                inherited = resolve(base.id, visited)
+                if inherited is not None:
+                    return inherited
+        return None
+
+    result = resolve(class_name, set())
+    if result is None:
+        raise ModelError(f"OpenRazer class {class_name} has no effective event matcher")
+    return result
+
+
 def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
     inputs = load_knowledge_inputs(root)
     catalog = compiled_knowledge_catalog(root)

From ea04da73c0e9aaf9858a8fa8c78dee5107353d8f Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 16:04:53 +0400
Subject: [PATCH 42/67] feat: add source-bound OpenRGB native route

---
 docs/assets/social-preview.png                | Bin 9685 -> 9683 bytes
 docs/generated/installation.md                |   6 +-
 docs/generated/verification.md                |  11 +-
 integrations/openrgb/CMakeLists.txt           | 394 +++++++++++++-
 .../openrgb/native_plugin_application.hpp     |  98 ++++
 .../openrgb/native_route_session.hpp          |  68 +++
 .../hyperflux/openrgb/native_route_worker.hpp | 110 ++++
 .../hyperflux/openrgb/plugin_view_model.hpp   |  10 +
 .../openrgb/razer_feature_transport.hpp       |  57 ++
 .../openrgb/upstream_razer_coordinator.hpp    | 106 ++++
 .../openrgb/upstream_razer_registry.hpp       | 158 ++++++
 ...Add-HyperFlux-feature-transport-seam.patch | 118 +++++
 .../openrgb/native-route/transform.json       |  25 +
 .../openrgb/src/native_plugin_application.cpp | 371 +++++++++++++
 .../openrgb/src/native_route_session.cpp      | 309 +++++++++++
 .../openrgb/src/native_route_worker.cpp       | 421 +++++++++++++++
 integrations/openrgb/src/openrgb_plugin.cpp   |  14 +
 .../openrgb/src/plugin_view_model.cpp         |  96 ++++
 .../openrgb/src/razer_feature_transport.cpp   |  64 +++
 .../src/upstream_razer_coordinator.cpp        | 400 ++++++++++++++
 .../openrgb/src/upstream_razer_registry.cpp   | 488 +++++++++++++++++
 packaging/generated/install-plan.json         |  21 +
 schemas/openrgb-native-transform.schema.json  |  49 ++
 schemas/package-build-manifest.schema.json    |   8 +-
 sdk/cpp/CMakeLists.txt                        |   3 +
 sdk/cpp/include/hyperflux/sdk.hpp             |   2 +
 .../include/hyperflux/sdk/native_channel.hpp  |  50 ++
 .../include/hyperflux/sdk/native_client.hpp   | 133 +++++
 sdk/cpp/src/native_channel.cpp                | 462 ++++++++++++++++
 sdk/cpp/src/native_client.cpp                 | 412 +++++++++++++++
 ...rgb_native_plugin_application_contract.cpp | 495 ++++++++++++++++++
 ...rgb_native_razer_presentation_contract.cpp | 163 ++++++
 ...openrgb_native_razer_upstream_contract.cpp | 137 +++++
 .../openrgb_native_route_session_contract.cpp | 359 +++++++++++++
 .../openrgb_native_route_worker_contract.cpp  | 342 ++++++++++++
 .../openrgb_plugin_view_model_contract.cpp    |  47 ++
 ...enrgb_razer_feature_transport_contract.cpp | 100 ++++
 ...gb_upstream_razer_coordinator_contract.cpp | 384 ++++++++++++++
 ...enrgb_upstream_razer_registry_contract.cpp | 305 +++++++++++
 tests/cpp/sdk_native_client_contract.cpp      | 330 ++++++++++++
 tests/test_package_pipeline.py                |  58 ++
 tests/test_verify.py                          |  31 +-
 tools/hfxdev/cli.py                           |  14 +
 tools/hfxdev/openrgb_native_route.py          | 248 +++++++++
 tools/hfxdev/package_pipeline.py              |  48 +-
 tools/hfxdev/testgraph.py                     |   1 +
 tools/hfxdev/verify.py                        |  42 ++
 verification/tests.json                       |  33 +-
 48 files changed, 7581 insertions(+), 20 deletions(-)
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/native_plugin_application.hpp
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/native_route_session.hpp
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/native_route_worker.hpp
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/upstream_razer_coordinator.hpp
 create mode 100644 integrations/openrgb/include/hyperflux/openrgb/upstream_razer_registry.hpp
 create mode 100644 integrations/openrgb/native-route/patches/0001-Add-HyperFlux-feature-transport-seam.patch
 create mode 100644 integrations/openrgb/native-route/transform.json
 create mode 100644 integrations/openrgb/src/native_plugin_application.cpp
 create mode 100644 integrations/openrgb/src/native_route_session.cpp
 create mode 100644 integrations/openrgb/src/native_route_worker.cpp
 create mode 100644 integrations/openrgb/src/razer_feature_transport.cpp
 create mode 100644 integrations/openrgb/src/upstream_razer_coordinator.cpp
 create mode 100644 integrations/openrgb/src/upstream_razer_registry.cpp
 create mode 100644 schemas/openrgb-native-transform.schema.json
 create mode 100644 sdk/cpp/include/hyperflux/sdk/native_channel.hpp
 create mode 100644 sdk/cpp/include/hyperflux/sdk/native_client.hpp
 create mode 100644 sdk/cpp/src/native_channel.cpp
 create mode 100644 sdk/cpp/src/native_client.cpp
 create mode 100644 tests/cpp/openrgb_native_plugin_application_contract.cpp
 create mode 100644 tests/cpp/openrgb_native_razer_presentation_contract.cpp
 create mode 100644 tests/cpp/openrgb_native_razer_upstream_contract.cpp
 create mode 100644 tests/cpp/openrgb_native_route_session_contract.cpp
 create mode 100644 tests/cpp/openrgb_native_route_worker_contract.cpp
 create mode 100644 tests/cpp/openrgb_razer_feature_transport_contract.cpp
 create mode 100644 tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
 create mode 100644 tests/cpp/openrgb_upstream_razer_registry_contract.cpp
 create mode 100644 tests/cpp/sdk_native_client_contract.cpp
 create mode 100644 tools/hfxdev/openrgb_native_route.py

diff --git a/docs/assets/social-preview.png b/docs/assets/social-preview.png
index a473bd3230eb58e42dd5e7d4afcd906fc58a1f35..060cf886fa3adc81a200c39a09da7c66b293ebc7 100644
GIT binary patch
delta 2143
zcmZ`)YgAKL7CuP`I3x<{*rbvoOhp&AAQ_Yf<Yj$LhYEvChbWLlSPgAON}-@~4L3@C
zRfJ*&D9QvDh{R$GRC$|6S4UC=364NO(4Z1&6Ot$y5=#io$qi82)w#d++WYLizy0m+
zoZBC9KjMq^xJwOQ)oY!+3N{)goF2iwwMppv+^^Pii>B5TeS4AWP!C>_F~TV_4?fWk
zPj!{yncyi%0J*>sM_$Iky~$rG!&9{pHU~T#a31>dro8yu0Rf)Og~?1dp6cM|!H*?J
z;_^Uf2k!(h9mu!>OyB(l)~p8|xHeeJUI**uZf|F=K;qCUNSy1Napd{tuM6gARFp+$
zsD1YYg-d(7R;5$4wZ5Apc2=iIEhhsB3{3zZw#8Fn%?62s-!e`(AVE+|pb()Gb9nG^
z@YHq~hn+j7SIKOd*rZI5#QOuxOx_?GQ4c!(nB@PSK9N^+WrD6JB@(<Dn%u$^^mo|!
zgzvkgtE)_KispgNm)d=8<Tfr_npV_q<D?SbqQ~Gt1hy;;1>|Xw68prq4cL(V0(Fs$
zrJ?v$)n3!qF%fcRhHzHv@O4Z{d#QQF&suHJ1})lm>X40^xs%t%atp_N7uN<$@5c6o
z%?}s4z%ktQK*_H*jM22PQdj^xDjOs$lTG8bBv%=KsZ}ol^FGYliiMXtVbZ+sSC)g{
zD8ScCpbuJt3$N`$8T>SW8=x@ReBek62X;$%_l$y_x~cW9+NVyceWc9L*UpTmgb5$T
zr6X}gVRaYfH_Z1sBrG36(==|Uv{Z$#8-`m|LAp=a>adNP09}C`m)+^Wl~8WhsRuKI
zOfM#QK6lKUtodG*O$v>6OBQdJ4jEQ$u5=kd`e>#c)ip%vj+7lcE!gbohK`ovTT-2r
zlh2fs+&~T8U=8%y_Ak?0mrZqw=a+<!L1I&8VVE)SP^;?1OVh#cOtH7l<p+hYYmD?)
zBF_{fZmZOXHfBjzZgm@owP+ikSZ<4+mUr`d$d+RN>)RpEPykTAOz`@m1?BrDUqO+n
zQ5f)Kf)Z3IVhptxuas#W(<a!#jkjE!M`xz`|7=?ji6fwUzJd-S)j+>m7EKYHeX#$Z
zDy6Ah&bnDOcC3i@ZNc(Uamfx5ve)o%lIr9dJ?y8EOeehb`KaRnw`xq<G*c$x^?mLy
zo%X&IT@rh)?N)qGw!&ppCrC1fo-QVBP#e%0;{Cz%{GP0L<7P*U1+j7Y<w<6r@%UV<
zzikFVi^s~CGQ|16<eH@Sg)D~AySFN`>(xx>-p^|!*N-}XYS4`!!eqws{-0R#P-6D8
zp*Zy)e|$Ca-h}lH&rru}s)l$&%s?`ur}SX?eG7BCTYhF?wl%1cnD%q*gOZzeo=BXJ
zH9p$fna{dSW{kh*FYpY_qk^@vXhi~~!v+VVbntT9LWa%voQ6C8F@0x3N|inlAYokb
zOl6GKci9%>u5H|w`u$Sn6A_NKHAy!dh^|O(55E^&cM9|z6W<x9x26)Ojz*o!W~Uz0
zTW9xGs3dB#_EQ7f?`~Sd_c;`rt~u*j+4pTDhg;7+9m;nh)(g_sQCTPaU#lSeR?AS;
z{3+tRzW<LkK*7`xqf0ILAUL^VKFktCc^(q%z|jP~)IxOp#dDo*ud=z-EY^k9j79f{
zOp3-?M=p2EGpq;t9>#Wt=y_w&!%qC1(Brd{|DHm{<^*_9|6(L&HlqoB5L{5BZ~UR`
zf^OV>s;xxI3K3>X$Ay6kwYh)x%Ota#m33ZhrZz6O^GXGa6f=R@W%MH2qC0ZASRP=^
zP#h0Nnxnc7X9v53j;jWf5>Z`MH%!e2BGP8FB4w`YRL=0%=73Ieo=AS*5)k4Z)n)1|
zD=(IQ@Z~`_XKZzTU{O@_7lQyF$+V$zthsfdaABvvpg@_RZnf-2g2NmBd`p5u?N~tO
za6NCEoHbHwr4!QfKz<u_U#GR0opUv$`;LL`&u@;J$h&mGG%iFvML7zwKESH4l@qHI
zo1?hEzzc4m_^h^FNhl^V_CjM9lr*{~@`Uj5-ycWUgf|Dv;RNaIQk#iV0GBi>t|0~y
zvrmIig?Ddh&6VAUjomR7al)=4Thf+vJ7<pA&uKxSNArR2++X{iei$g;4+wud;t_Xb
zQx%+V54^G3w}J9u`{J<JuhI^w%uQC(Ji+r6U9@bH%DZ10*yf|AN3j!!HSSRlwJT(U
zWMApvzKHdE5`IWF7{6-2@{g2>{t%%%>ixw!8I-s2$&Lm}&iS^z7Sj-N@W$jjsjZCo
zzS|v@1L+p6*Zk$7E&(c_JHIR7;I;_Dz5Yb4=$*rTv^uXh%Vqt40Q}zB6}j`9w>c;O
E2mOJc{r~^~

delta 2054
zcmaJ?YgAKL7QP7tsL7&~sU*QDFk-7zk_eW88bzzZ_yA?01?82N8L|}Q5he&+LasW+
zv9_f4Dzt+Hgc%;K3MryPBoCKuof058i4X?}D8$e}2pE$XuEDtp(K>6j{kPXSXYccU
z-~RSF%02h?d>)LsC|vVTe@_mdZjvx7;Jf~rTQB_Ss5HlNI9#{z$?ikD2-su*&!p7j
znLaWs2}AH=V%9?i5Ea@6oB}-D+W|iry7Z}e4Z7flo~_vl&r-;Le8;01hyem7B+Lsy
z`n)7C8sgG@U&+NY(Nqt#6prpafTMe%)giPLmgG5wB~9;nSsN}`LE&}D&v_5DnZEt&
z$oC6h%jLdo;`BFEs4>^gS?~=s>y?cELvv~g9sx^ophvHaLCIXEIcYeUtw!%3tVVg{
zXPxXxtK>pkA`-RK!6fP43pXj7pvEnvA1$8Ce-S2pjuHr0QM~uM^3V6AQR=Puq^`5(
zd$d$7m4zP{A-=Le2-gn$fDxf&mrx`F6F{1S-%Ajg+}B+61L3<XNIdG9|M=R=*(&k&
zMa*}clY_1D(O&TMGc%{Qo}*{~!KC@HLdp!WF@wAC&gQt3e8Z(6iuPA};}qSYz>?S~
zG&)+q(MCGm0$|%EvIVR=9X70F@Wuh`Wm>xgzz`xK;J2e`{EKtH99^a@Rhh;+Bkw@U
zR>+JSBnCnlPajvrGCeR=*X+(MERjzeMOJh6MI_{T)G)u<S~a5iK&$v>a(;$;P1u$s
z|HqYb;BMX{t0rltX!b@tIFe*joDsz#69rIu*om)<I74<+QEerc0cM<iEZ!~6Jkw(6
zSa|QVw2TBqW3irXF|T^}w0P{eUekGJ6-)5o>3%pbfXpjy0<I3<>g=|4b|0!N?FD)9
z^7v+ZUz2@0yt|1N34M7iZBkLze|YwIpoE*;ZeO0)(C9r7dqvr67TChA6+3MIJu{lO
zqp!kzZ?W{s)A9}ar*9Y5h2NHF3EBHm#T^!M&5A2>v~Jvl%eU2`8x%j8cI@4dc+1s4
zyU&R*6oj}h)OZRT$>VnRLNGmu#6u5R($_(Vd%o)X;D#bUt+msx6A}$;OVZbzp2>78
zHfnwJ=}Pbh;|I(RRm7*FwsK<m*}n^`?yt4Ag+{-9G@$cgZ(I2%St{+p1}d$(Lt}C)
zMkdu_{w3|nT{a|ucWa~N_w^ksl~vK!XA}3TCUk19JZh*OK&LVp_{d2?-1;*UbWtb3
zZod6f@>k8o{<39HT9oXVTI{ult+aOp*imqkRiGosZ|8`Hg!@hiN-Q5l;YuqKH-gW1
z|Bb&*e|-HAa^6g?EX-2to@}YwVw%6?ph?Bem0?mBFId)uF6o6;*ObZ^LZX8@>|Cdg
zW!*rf$lB<UuPP+U;Kcy{Y(^|FmO@A%4!7JS$u#^!H0jg<DIVKbcDIsD%^5UyMji!X
z`;w8O{<_=usrxr7vV)+)^tQ((S5vla)+9D)s#64@RQl%Bjl8Ja?~NkFz2T`d?PIuD
z<VtOnuAO>3h5E4g`owm$g)lXU=sv#Ja|&(>%7%0O!`_l%+><kyTnv_!4`6;ZIwxEO
zuP3wNIkFeLmF&ZFrvm`sHD1Cf13{(v*eo{>QLHODz~M9WT|=X9ndVcaejMvTHXjTq
zQCTqcb+6Y+83pzXBR2_Aw1N!l`R5l6brFh*RxmV-m5Fr4if6TLNqp9*v5VDTXybN9
zKT_Lcq(dJWH^&@vAV=-vvGs)yd1z1VZvP6-MMj&n!oFuC;Q<PbLCLOJ#rK4SKi#yO
zH8+lw<cN9w8l%A;KKz`0X{=~k92e%cT0j3p634%z{FWQ0Yu3{Iv(yz1BQr4s=kx6h
zT?PlxmpIkJa$KG-<pjI>NkUQZUXH`G`&<t3Ru5skoOmmwD{eF*XRKdHv>xU40+iKI
zBemiHTdJ+DJMwzRW3ZPnZus4%#;itrmoCHW>#@SNn{iS^U$CuJZGg!#Fks)zPPy|#
zLJ=)}4Jd2Wy~Q6V*0UlH7OU0`geo@Z=dbZbk{&r?9CROBY&>!z{)8Y1QWP%x%cFIz
z3BwH2n^RRf_H{?nXQ@k?VbJg6XKsSkkX-6(E<PNe=O+VHEB`%M+p`wJ%_X2yDDshU
ztkf4|0S9|02y|LJ=Cq+8ihMFl(qr5ZzKCoVh^@=P8qu9ZtH_NWaY|0RuJZjcf%y17
z(ygbqE?)t1_|11RmQ8x*qwei~x_{>5v4&iwglkDxUoQJ1h3ZY@2!$=3Ba5Z4xg_;?
p1t|Q0v=Ww)aqs{MBCdVH!^;n-zZ5p$Q11b|cE<0x`abjI{{WLDf&%~m

diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 09076d9..be109cd 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -35,7 +35,7 @@ The canonical plan contains `6` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `181` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `184` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -50,13 +50,13 @@ The expanded source payload contains `181` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 62 | `-` |
+| `schemas` | 63 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
 | `integration-authority` | 12 | `-` |
-| `cpp-sdk-headers` | 30 | `-` |
+| `cpp-sdk-headers` | 32 | `-` |
 | `documentation` | 40 | `-` |
 | `readme` | 1 | `-` |
 | `security-policy` | 1 | `-` |
diff --git a/docs/generated/verification.md b/docs/generated/verification.md
index db40c15..5e5760a 100644
--- a/docs/generated/verification.md
+++ b/docs/generated/verification.md
@@ -37,8 +37,9 @@ Every current node is software-only and has zero hardware-write authority.
 | 28 | `openrazer-compatibility-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
 | 29 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
 | 30 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
-| 31 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
-| 32 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
+| 31 | `openrgb-native-route-contracts` | `integrations` | `none` | `false` | 360s | `rerun` |
+| 32 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
+| 33 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
 
 ## Dependencies
 
@@ -74,6 +75,7 @@ flowchart LR
     openrazer_compatibility_contracts["openrazer-compatibility-contracts"]
     openrazer_native_route_contracts["openrazer-native-route-contracts"]
     migration_shadow_contracts["migration-shadow-contracts"]
+    openrgb_native_route_contracts["openrgb-native-route-contracts"]
     openrgb_thread_sanitizer["openrgb-thread-sanitizer"]
     package_contracts["package-contracts"]
     foundation_contracts --> schema_contracts
@@ -131,9 +133,10 @@ flowchart LR
     rust_unit --> openrazer_native_route_contracts
     simulator_contracts --> migration_shadow_contracts
     python_unit --> migration_shadow_contracts
-    openrgb_adapter_contracts --> openrgb_thread_sanitizer
+    openrgb_adapter_contracts --> openrgb_native_route_contracts
+    openrgb_native_route_contracts --> openrgb_thread_sanitizer
     kernel_profile_contracts --> package_contracts
-    openrgb_adapter_contracts --> package_contracts
+    openrgb_native_route_contracts --> package_contracts
     polychromatic_adapter_contracts --> package_contracts
     openrazer_compatibility_contracts --> package_contracts
     rust_unit --> package_contracts
diff --git a/integrations/openrgb/CMakeLists.txt b/integrations/openrgb/CMakeLists.txt
index 757f40d..9956eb9 100644
--- a/integrations/openrgb/CMakeLists.txt
+++ b/integrations/openrgb/CMakeLists.txt
@@ -72,7 +72,9 @@ function(hfx_openrgb_enable_thread_sanitizer target)
         message(FATAL_ERROR "HFX_OPENRGB_THREAD_SANITIZER requires Clang or GCC")
     endif()
     target_compile_options(${target} PRIVATE -fsanitize=thread -fno-omit-frame-pointer -g)
-    target_link_options(${target} PRIVATE -fsanitize=thread)
+    # Static libraries carry instrumented objects but do not perform a link of
+    # their own. Export the runtime requirement to every final consumer.
+    target_link_options(${target} PUBLIC -fsanitize=thread)
 endfunction()
 
 if(NOT TARGET hyperflux_sdk)
@@ -114,6 +116,14 @@ if(NOT HFX_OPENRGB_SOURCE_DIR AND DEFINED ENV{HFX_OPENRGB_SOURCE_DIR})
     set(HFX_OPENRGB_SOURCE_DIR "$ENV{HFX_OPENRGB_SOURCE_DIR}")
 endif()
 
+set(
+    HFX_OPENRGB_NATIVE_SOURCE_DIR ""
+    CACHE PATH "Source-bound OpenRGB tree with the HyperFlux feature transport seam"
+)
+if(NOT HFX_OPENRGB_NATIVE_SOURCE_DIR AND DEFINED ENV{HFX_OPENRGB_NATIVE_SOURCE_DIR})
+    set(HFX_OPENRGB_NATIVE_SOURCE_DIR "$ENV{HFX_OPENRGB_NATIVE_SOURCE_DIR}")
+endif()
+
 if(HFX_OPENRGB_SOURCE_DIR)
     find_package(Qt5 5.15 REQUIRED COMPONENTS Core Gui Widgets)
 
@@ -131,6 +141,164 @@ if(HFX_OPENRGB_SOURCE_DIR)
         message(FATAL_ERROR "OpenRGB source revision does not match the integration catalog")
     endif()
 
+    if(HFX_OPENRGB_NATIVE_SOURCE_DIR)
+        file(
+            READ
+            "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/hyperflux-native-transform-result.json"
+            HFX_OPENRGB_NATIVE_TRANSFORM_JSON
+        )
+        string(
+            JSON HFX_OPENRGB_NATIVE_TRANSFORM_SCHEMA
+            GET "${HFX_OPENRGB_NATIVE_TRANSFORM_JSON}" schema
+        )
+        string(
+            JSON HFX_OPENRGB_NATIVE_SOURCE_REVISION
+            GET "${HFX_OPENRGB_NATIVE_TRANSFORM_JSON}" source_commit
+        )
+        if(NOT HFX_OPENRGB_NATIVE_TRANSFORM_SCHEMA STREQUAL
+            "hyperflux-openrgb-native-transform-result-v1")
+            message(FATAL_ERROR "OpenRGB native source binding schema is invalid")
+        endif()
+        if(NOT HFX_OPENRGB_NATIVE_SOURCE_REVISION STREQUAL
+            "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0")
+            message(FATAL_ERROR "OpenRGB native source binding has the wrong revision")
+        endif()
+
+        add_library(
+            hyperflux_openrgb_razer_feature_transport
+            STATIC
+                src/native_route_session.cpp
+                src/native_route_worker.cpp
+                src/razer_feature_transport.cpp
+        )
+        set_target_properties(
+            hyperflux_openrgb_razer_feature_transport
+            PROPERTIES POSITION_INDEPENDENT_CODE ON
+        )
+        target_compile_features(
+            hyperflux_openrgb_razer_feature_transport PUBLIC cxx_std_20
+        )
+        target_include_directories(
+            hyperflux_openrgb_razer_feature_transport
+            PUBLIC
+                "${CMAKE_CURRENT_SOURCE_DIR}/include"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/RGBController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/KeyboardLayoutManager"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/dependencies/json"
+                "/usr/include/hidapi"
+        )
+        hfx_openrgb_enable_thread_sanitizer(hyperflux_openrgb_razer_feature_transport)
+        target_link_libraries(
+            hyperflux_openrgb_razer_feature_transport
+            PUBLIC hyperflux_sdk
+        )
+        if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+            target_compile_options(
+                hyperflux_openrgb_razer_feature_transport
+                PRIVATE -Wall -Wextra -Werror -pedantic
+            )
+        endif()
+
+        find_library(
+            HFX_HIDAPI_LIBRARY
+            NAMES hidapi-hidraw hidapi-libusb
+            REQUIRED
+        )
+        add_library(
+            hyperflux_openrgb_upstream_log
+            STATIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/LogManager.cpp"
+        )
+        set_target_properties(
+            hyperflux_openrgb_upstream_log
+            PROPERTIES
+                POSITION_INDEPENDENT_CODE ON
+                CXX_STANDARD 17
+                CXX_STANDARD_REQUIRED ON
+                CXX_EXTENSIONS OFF
+        )
+        target_include_directories(
+            hyperflux_openrgb_upstream_log
+            PUBLIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/dependencies/json"
+        )
+        target_compile_definitions(
+            hyperflux_openrgb_upstream_log
+            PRIVATE
+                VERSION_STRING="1.0rc3"
+                GIT_COMMIT_ID="6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0"
+                GIT_COMMIT_DATE="source-bound"
+        )
+        add_library(
+            hyperflux_openrgb_upstream_device_guard
+            STATIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop/DeviceGuard.cpp"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop/DeviceGuardLock.cpp"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop/DeviceGuardManager.cpp"
+        )
+        set_target_properties(
+            hyperflux_openrgb_upstream_device_guard
+            PROPERTIES POSITION_INDEPENDENT_CODE ON
+        )
+        target_compile_features(
+            hyperflux_openrgb_upstream_device_guard PUBLIC cxx_std_20
+        )
+        target_include_directories(
+            hyperflux_openrgb_upstream_device_guard
+            PUBLIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop"
+        )
+        target_link_libraries(
+            hyperflux_openrgb_upstream_device_guard
+            PUBLIC Threads::Threads
+        )
+        add_library(
+            hyperflux_openrgb_native_razer_upstream
+            STATIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController/RazerController.cpp"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerDeviceGuard.cpp"
+        )
+        set_target_properties(
+            hyperflux_openrgb_native_razer_upstream
+            PROPERTIES POSITION_INDEPENDENT_CODE ON
+        )
+        target_compile_features(
+            hyperflux_openrgb_native_razer_upstream PUBLIC cxx_std_20
+        )
+        target_include_directories(
+            hyperflux_openrgb_native_razer_upstream
+            PUBLIC
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/RGBController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/KeyboardLayoutManager"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/dependencies/json"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop"
+                "/usr/include/hidapi"
+        )
+        target_link_libraries(
+            hyperflux_openrgb_native_razer_upstream
+            PUBLIC
+                hyperflux_openrgb_razer_feature_transport
+                hyperflux_openrgb_razer_registry
+                hyperflux_openrgb_upstream_device_guard
+                "${HFX_HIDAPI_LIBRARY}"
+        )
+        if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+            target_compile_options(
+                hyperflux_openrgb_native_razer_upstream
+                PRIVATE -Wall -Wextra -Werror -pedantic
+            )
+        endif()
+    endif()
+
     add_library(
         hyperflux_openrgb_pinned_upstream
         OBJECT
@@ -231,6 +399,51 @@ if(HFX_OPENRGB_SOURCE_DIR)
         )
     endif()
 
+    if(TARGET hyperflux_openrgb_native_razer_upstream)
+        add_library(
+            hyperflux_openrgb_upstream_razer_registry
+            STATIC
+                src/upstream_razer_registry.cpp
+                src/upstream_razer_coordinator.cpp
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController/RGBController_Razer.cpp"
+        )
+        set_target_properties(
+            hyperflux_openrgb_upstream_razer_registry
+            PROPERTIES POSITION_INDEPENDENT_CODE ON
+        )
+        target_compile_features(
+            hyperflux_openrgb_upstream_razer_registry PUBLIC cxx_std_20
+        )
+        target_include_directories(
+            hyperflux_openrgb_upstream_razer_registry
+            PUBLIC
+                "${CMAKE_CURRENT_SOURCE_DIR}/include"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/RGBController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/KeyboardLayoutManager"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/dependencies/json"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/interop"
+        )
+        target_link_libraries(
+            hyperflux_openrgb_upstream_razer_registry
+            PUBLIC
+                hyperflux_openrgb_native_razer_upstream
+                hyperflux_openrgb_native_controller
+                hyperflux_openrgb_upstream_log
+        )
+        hfx_openrgb_enable_thread_sanitizer(
+            hyperflux_openrgb_upstream_razer_registry
+        )
+        if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+            target_compile_options(
+                hyperflux_openrgb_upstream_razer_registry
+                PRIVATE -Wall -Wextra -Werror -pedantic
+            )
+        endif()
+    endif()
+
     configure_file(
         "${CMAKE_CURRENT_SOURCE_DIR}/hyperflux-next-openrgb.json.in"
         "${HFX_OPENRGB_GENERATED_INCLUDE_DIR}/hyperflux-next-openrgb.json"
@@ -244,6 +457,21 @@ if(HFX_OPENRGB_SOURCE_DIR)
             src/plugin_view_model.cpp
             src/qt_dispatcher.cpp
     )
+    if(TARGET hyperflux_openrgb_upstream_razer_registry)
+        target_sources(
+            hyperflux_openrgb_qt_shell
+            PRIVATE src/native_plugin_application.cpp
+        )
+        target_compile_definitions(
+            hyperflux_openrgb_qt_shell
+            PUBLIC HFX_OPENRGB_NATIVE_ROUTE_ENABLED=1
+        )
+    else()
+        target_compile_definitions(
+            hyperflux_openrgb_qt_shell
+            PUBLIC HFX_OPENRGB_NATIVE_ROUTE_ENABLED=0
+        )
+    endif()
     set_target_properties(
         hyperflux_openrgb_qt_shell
         PROPERTIES POSITION_INDEPENDENT_CODE ON
@@ -263,6 +491,12 @@ if(HFX_OPENRGB_SOURCE_DIR)
         hyperflux_openrgb_qt_shell
         PUBLIC hyperflux_openrgb_native_controller Qt5::Core
     )
+    if(TARGET hyperflux_openrgb_upstream_razer_registry)
+        target_link_libraries(
+            hyperflux_openrgb_qt_shell
+            PUBLIC hyperflux_openrgb_upstream_razer_registry
+        )
+    endif()
     hfx_openrgb_enable_thread_sanitizer(hyperflux_openrgb_qt_shell)
     if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
         target_compile_options(
@@ -337,6 +571,164 @@ if(HFX_OPENRGB_SOURCE_DIR)
     endif()
 
     if(BUILD_TESTING)
+        if(TARGET hyperflux_openrgb_razer_feature_transport)
+            add_executable(
+                openrgb-razer-feature-transport-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_razer_feature_transport_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-razer-feature-transport-contract
+                PRIVATE hyperflux_openrgb_razer_feature_transport
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-razer-feature-transport-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-razer-feature-transport-contract
+                COMMAND openrgb-razer-feature-transport-contract
+            )
+
+            add_executable(
+                openrgb-native-route-session-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_native_route_session_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-native-route-session-contract
+                PRIVATE hyperflux_openrgb_razer_feature_transport
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-native-route-session-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-native-route-session-contract
+                COMMAND openrgb-native-route-session-contract
+            )
+
+            add_executable(
+                openrgb-native-route-worker-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_native_route_worker_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-native-route-worker-contract
+                PRIVATE hyperflux_openrgb_razer_feature_transport Threads::Threads
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-native-route-worker-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-native-route-worker-contract
+                COMMAND openrgb-native-route-worker-contract
+            )
+
+            add_executable(
+                openrgb-native-razer-upstream-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_native_razer_upstream_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-native-razer-upstream-contract
+                PRIVATE hyperflux_openrgb_native_razer_upstream
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-native-razer-upstream-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-native-razer-upstream-contract
+                COMMAND openrgb-native-razer-upstream-contract
+            )
+
+            add_executable(
+                openrgb-native-razer-presentation-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_native_razer_presentation_contract.cpp"
+                "${HFX_OPENRGB_NATIVE_SOURCE_DIR}/Controllers/RazerController/RazerController/RGBController_Razer.cpp"
+            )
+            target_link_libraries(
+                openrgb-native-razer-presentation-contract
+                PRIVATE
+                    hyperflux_openrgb_native_razer_upstream
+                    hyperflux_openrgb_native_controller
+                    hyperflux_openrgb_upstream_log
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-native-razer-presentation-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-native-razer-presentation-contract
+                COMMAND openrgb-native-razer-presentation-contract
+            )
+
+            add_executable(
+                openrgb-upstream-razer-registry-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_upstream_razer_registry_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-upstream-razer-registry-contract
+                PRIVATE hyperflux_openrgb_upstream_razer_registry
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-upstream-razer-registry-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-upstream-razer-registry-contract
+                COMMAND openrgb-upstream-razer-registry-contract
+            )
+
+            add_executable(
+                openrgb-upstream-razer-coordinator-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-upstream-razer-coordinator-contract
+                PRIVATE hyperflux_openrgb_upstream_razer_registry Threads::Threads
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-upstream-razer-coordinator-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-upstream-razer-coordinator-contract
+                COMMAND openrgb-upstream-razer-coordinator-contract
+            )
+
+            add_executable(
+                openrgb-native-plugin-application-contract
+                "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_native_plugin_application_contract.cpp"
+            )
+            target_link_libraries(
+                openrgb-native-plugin-application-contract
+                PRIVATE hyperflux_openrgb_qt_shell
+            )
+            if(CMAKE_CXX_COMPILER_ID MATCHES "Clang|GNU")
+                target_compile_options(
+                    openrgb-native-plugin-application-contract
+                    PRIVATE -Wall -Wextra -Werror -pedantic
+                )
+            endif()
+            add_test(
+                NAME openrgb-native-plugin-application-contract
+                COMMAND openrgb-native-plugin-application-contract
+            )
+        endif()
+
         add_executable(
             openrgb-razer-registry-contract
             "${CMAKE_CURRENT_SOURCE_DIR}/../../tests/cpp/openrgb_razer_registry_contract.cpp"
diff --git a/integrations/openrgb/include/hyperflux/openrgb/native_plugin_application.hpp b/integrations/openrgb/include/hyperflux/openrgb/native_plugin_application.hpp
new file mode 100644
index 0000000..73b2d1d
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/native_plugin_application.hpp
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "plugin_application.hpp"
+#include "upstream_razer_coordinator.hpp"
+
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <vector>
+
+class ResourceManagerInterface;
+
+namespace hyperflux::openrgb::native
+{
+
+class NativePluginHost : public UpstreamPluginHost
+{
+public:
+    ~NativePluginHost() override = default;
+
+    virtual void register_detection_start(
+        DetectionCallback callback, void* context) noexcept = 0;
+    virtual void register_detection_end(
+        DetectionCallback callback, void* context) noexcept = 0;
+    virtual void unregister_detection_start(
+        DetectionCallback callback, void* context) noexcept = 0;
+    virtual void unregister_detection_end(
+        DetectionCallback callback, void* context) noexcept = 0;
+    virtual void wait_for_detection() noexcept = 0;
+};
+
+struct NativePluginApplicationStatus
+{
+    bool loaded = false;
+    UpstreamRazerCoordinatorStatus coordinator;
+};
+
+struct NativePluginRuntimeFactories
+{
+    NativeDiscoveryClientFactory discovery;
+    NativeFeatureExchangeFactory exchange;
+};
+
+[[nodiscard]] NativePluginRuntimeFactories default_native_plugin_runtime_factories();
+
+/// Production OpenRGB application path using upstream Razer controllers.
+///
+/// The existing semantic-lighting application remains compiled as an explicit
+/// rollback implementation and is never started alongside this native path.
+class OpenRgbNativePluginApplication final
+{
+public:
+    OpenRgbNativePluginApplication();
+    explicit OpenRgbNativePluginApplication(std::function<void()> on_state_changed);
+    OpenRgbNativePluginApplication(
+        NativePluginRuntimeFactories factories,
+        UpstreamRazerCoordinatorConfig coordinator_config);
+    OpenRgbNativePluginApplication(const OpenRgbNativePluginApplication&) = delete;
+    OpenRgbNativePluginApplication& operator=(const OpenRgbNativePluginApplication&) = delete;
+    ~OpenRgbNativePluginApplication();
+
+    [[nodiscard]] sdk::Result<void> load(ResourceManagerInterface* manager);
+    [[nodiscard]] sdk::Result<void> load(std::unique_ptr<NativePluginHost> host);
+    void unload() noexcept;
+    void request_rescan() noexcept;
+
+    [[nodiscard]] NativePluginApplicationStatus status() const;
+    [[nodiscard]] std::vector<UpstreamRazerControllerSummary> controllers() const;
+
+private:
+    enum class State
+    {
+        Unloaded,
+        Loading,
+        Loaded,
+        Unloading,
+    };
+
+    static void detection_started_callback(void* context) noexcept;
+    static void detection_finished_callback(void* context) noexcept;
+    void detection_started() noexcept;
+    void detection_finished() noexcept;
+    void reset_loading_state() noexcept;
+
+    NativePluginRuntimeFactories factories_;
+    UpstreamRazerCoordinatorConfig coordinator_config_;
+    std::unique_ptr<NativePluginHost> host_;
+    std::unique_ptr<class QtApplicationDispatcher> dispatcher_;
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator_;
+    mutable std::mutex lifecycle_mutex_;
+    State state_ = State::Unloaded;
+    bool callbacks_registered_ = false;
+    bool callbacks_enabled_ = false;
+};
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/native_route_session.hpp b/integrations/openrgb/include/hyperflux/openrgb/native_route_session.hpp
new file mode 100644
index 0000000..20a2439
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/native_route_session.hpp
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "razer_feature_transport.hpp"
+
+#include <hyperflux/sdk.hpp>
+
+#include <chrono>
+#include <functional>
+#include <memory>
+
+namespace hyperflux::openrgb::native
+{
+
+struct NativeRouteIdentity
+{
+    ReceiverId receiver_id;
+    GenerationId generation_id;
+    LogicalDeviceId device_id;
+    EndpointId endpoint_id;
+    DeviceKind device_kind;
+    VendorId vendor_id;
+    ProductId product_id;
+
+    friend bool operator==(const NativeRouteIdentity&, const NativeRouteIdentity&) = default;
+};
+
+[[nodiscard]] NativeRouteIdentity native_route_identity(const v7::NativeRoute& route);
+
+class SdkNativeFeatureExchange final : public NativeFeatureExchange
+{
+public:
+    using Clock = std::function<std::chrono::steady_clock::time_point()>;
+
+    SdkNativeFeatureExchange(const SdkNativeFeatureExchange&) = delete;
+    SdkNativeFeatureExchange& operator=(const SdkNativeFeatureExchange&) = delete;
+    ~SdkNativeFeatureExchange() override;
+
+    [[nodiscard]] static sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>> connect_unix(
+        const sdk::UnixChannelConfig& channel_config,
+        const NativeRouteIdentity& expected_route);
+
+    [[nodiscard]] static sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>> create(
+        std::unique_ptr<sdk::NativeClientApi> client,
+        const NativeRouteIdentity& expected_route,
+        Clock clock = [] { return std::chrono::steady_clock::now(); });
+
+    [[nodiscard]] NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t, razer_native_report_bytes>& request) override;
+
+private:
+    SdkNativeFeatureExchange(
+        std::unique_ptr<sdk::NativeClientApi> client,
+        v7::NativeRoute route,
+        LeaseId lease_id,
+        Clock clock);
+
+    [[nodiscard]] bool renew_if_due();
+
+    std::unique_ptr<sdk::NativeClientApi> client_;
+    v7::NativeRoute route_;
+    LeaseId lease_id_;
+    Clock clock_;
+    std::chrono::steady_clock::time_point renew_due_;
+};
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/native_route_worker.hpp b/integrations/openrgb/include/hyperflux/openrgb/native_route_worker.hpp
new file mode 100644
index 0000000..ca0b056
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/native_route_worker.hpp
@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include <hyperflux/sdk.hpp>
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <thread>
+#include <vector>
+
+namespace hyperflux::openrgb::native
+{
+
+enum class NativeRouteWorkerState
+{
+    Created,
+    Starting,
+    Running,
+    Recovering,
+    Stopping,
+    Stopped,
+    Failed,
+};
+
+struct NativeRouteWorkerConfig
+{
+    std::uint32_t poll_interval_ms = 50;
+    std::uint32_t reconnect_initial_ms = 25;
+    std::uint32_t reconnect_max_ms = 2'000;
+    std::uint16_t max_events = 64;
+};
+
+struct NativeRouteSnapshot
+{
+    v7::EventCursor cursor;
+    std::vector<v7::NativeRoute> routes;
+
+    friend bool operator==(const NativeRouteSnapshot&, const NativeRouteSnapshot&) = default;
+};
+
+struct NativeRouteWorkerCallbacks
+{
+    std::function<void(NativeRouteSnapshot)> on_snapshot;
+    std::function<void(sdk::Error)> on_error;
+};
+
+using NativeDiscoveryClientFactory =
+    std::function<sdk::Result<std::unique_ptr<sdk::NativeClientApi>>() >;
+
+[[nodiscard]] NativeDiscoveryClientFactory make_unix_native_discovery_factory(
+    sdk::UnixChannelConfig channel_config);
+
+/// Serialized protocol-v7 discovery owner.
+///
+/// Route events are hints. Every event or cursor gap is reconciled from one
+/// complete native-enumerate projection before the application sees it.
+class NativeRouteWorker
+{
+public:
+    NativeRouteWorker(const NativeRouteWorker&) = delete;
+    NativeRouteWorker& operator=(const NativeRouteWorker&) = delete;
+    ~NativeRouteWorker();
+
+    [[nodiscard]] static sdk::Result<std::unique_ptr<NativeRouteWorker>> create(
+        NativeDiscoveryClientFactory factory,
+        NativeRouteWorkerConfig config = {},
+        NativeRouteWorkerCallbacks callbacks = {});
+
+    [[nodiscard]] sdk::Result<void> start();
+    void stop() noexcept;
+    void request_rescan() noexcept;
+
+    [[nodiscard]] NativeRouteWorkerState state() const noexcept;
+    [[nodiscard]] std::optional<NativeRouteSnapshot> snapshot() const;
+    [[nodiscard]] std::optional<sdk::Error> last_error() const;
+
+private:
+    NativeRouteWorker(
+        NativeDiscoveryClientFactory factory,
+        NativeRouteWorkerConfig config,
+    NativeRouteWorkerCallbacks callbacks);
+
+    void run() noexcept;
+    [[nodiscard]] bool wait_interruptible(std::uint32_t delay_ms) noexcept;
+    void recover(sdk::Error error, std::uint32_t& delay_ms) noexcept;
+    [[nodiscard]] bool publish(NativeRouteSnapshot snapshot) noexcept;
+    void fail_unexpected(const char* operation, const char* detail = nullptr) noexcept;
+    [[nodiscard]] bool should_stop() const noexcept;
+
+    NativeDiscoveryClientFactory factory_;
+    NativeRouteWorkerConfig config_;
+    NativeRouteWorkerCallbacks callbacks_;
+
+    mutable std::mutex mutex_;
+    std::condition_variable wake_;
+    std::thread thread_;
+    NativeRouteWorkerState state_ = NativeRouteWorkerState::Created;
+    bool stop_requested_ = false;
+    bool rescan_requested_ = false;
+    std::optional<NativeRouteSnapshot> snapshot_;
+    std::optional<sdk::Error> last_error_;
+};
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/plugin_view_model.hpp b/integrations/openrgb/include/hyperflux/openrgb/plugin_view_model.hpp
index ee2c431..5762384 100644
--- a/integrations/openrgb/include/hyperflux/openrgb/plugin_view_model.hpp
+++ b/integrations/openrgb/include/hyperflux/openrgb/plugin_view_model.hpp
@@ -4,6 +4,10 @@
 
 #include "plugin_application.hpp"
 
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+#include "native_plugin_application.hpp"
+#endif
+
 #include <optional>
 #include <string>
 #include <vector>
@@ -55,4 +59,10 @@ struct PluginInformationViewModel
     const std::vector<InventoryReceiverModel>& inventory,
     const std::vector<ControllerModel>& controllers);
 
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+[[nodiscard]] PluginInformationViewModel make_plugin_information_view_model(
+    const NativePluginApplicationStatus& status,
+    const std::vector<UpstreamRazerControllerSummary>& controllers);
+#endif
+
 } // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp b/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
new file mode 100644
index 0000000..7965916
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
@@ -0,0 +1,57 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "RazerController.h"
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <mutex>
+
+namespace hyperflux::openrgb::native
+{
+
+inline constexpr std::size_t razer_hid_report_bytes = 91;
+inline constexpr std::size_t razer_native_report_bytes = 90;
+
+enum class NativeExchangeCertainty
+{
+    NotSent,
+    MayHaveBeenSent,
+    MatchedResponse,
+};
+
+struct NativeFeatureExchangeResult
+{
+    NativeExchangeCertainty certainty;
+    std::array<std::uint8_t, razer_native_report_bytes> response {};
+};
+
+class NativeFeatureExchange
+{
+public:
+    virtual ~NativeFeatureExchange() = default;
+
+    [[nodiscard]] virtual NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t, razer_native_report_bytes>& request) = 0;
+};
+
+/// HIDAPI-compatible facade over one atomic HyperFlux native exchange.
+class HyperFluxRazerFeatureTransport final : public RazerFeatureTransport
+{
+public:
+    explicit HyperFluxRazerFeatureTransport(NativeFeatureExchange& exchange) noexcept;
+
+    int GetFeatureReport(unsigned char* report, size_t size) override;
+    int SendFeatureReport(const unsigned char* report, size_t size) override;
+    int SendArgbFeatureReport(const unsigned char* report, size_t size) override;
+
+private:
+    NativeFeatureExchange* exchange_;
+    std::array<std::uint8_t, razer_native_report_bytes> pending_response_ {};
+    bool response_pending_ = false;
+    std::mutex mutex_;
+};
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_coordinator.hpp b/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_coordinator.hpp
new file mode 100644
index 0000000..957b04b
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_coordinator.hpp
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "native_route_worker.hpp"
+#include "plugin_coordinator.hpp"
+#include "upstream_razer_registry.hpp"
+
+#include <cstddef>
+#include <exception>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <string_view>
+#include <vector>
+
+class RGBController;
+
+namespace hyperflux::openrgb::native
+{
+
+class UpstreamPluginHost : public UpstreamControllerHost
+{
+public:
+    ~UpstreamPluginHost() override = default;
+    [[nodiscard]] virtual std::vector<RGBController*> controllers() const = 0;
+};
+
+struct UpstreamRazerCoordinatorConfig
+{
+    NativeRouteWorkerConfig worker {};
+    std::function<void()> on_state_changed;
+};
+
+struct UpstreamRazerCoordinatorStatus
+{
+    NativeRouteWorkerState worker_state = NativeRouteWorkerState::Created;
+    bool started = false;
+    bool stopped = false;
+    bool detection_suspended = false;
+    std::size_t controllers = 0;
+    std::size_t registered_controllers = 0;
+    std::size_t direct_suppressed_controllers = 0;
+    std::optional<sdk::Error> last_error;
+};
+
+class UpstreamRazerPluginCoordinator final
+    : public std::enable_shared_from_this<UpstreamRazerPluginCoordinator>
+{
+public:
+    UpstreamRazerPluginCoordinator(const UpstreamRazerPluginCoordinator&) = delete;
+    UpstreamRazerPluginCoordinator& operator=(const UpstreamRazerPluginCoordinator&) = delete;
+    ~UpstreamRazerPluginCoordinator();
+
+    [[nodiscard]] static sdk::Result<std::shared_ptr<UpstreamRazerPluginCoordinator>>
+    create(
+        UpstreamPluginHost& host,
+        ApplicationDispatcher& dispatcher,
+        NativeDiscoveryClientFactory discovery_factory,
+        NativeFeatureExchangeFactory exchange_factory,
+        UpstreamRazerCoordinatorConfig config = {});
+
+    [[nodiscard]] sdk::Result<void> start();
+    void detection_started() noexcept;
+    void detection_finished() noexcept;
+    void shutdown() noexcept;
+    void request_rescan() noexcept;
+
+    [[nodiscard]] UpstreamRazerCoordinatorStatus status() const;
+    [[nodiscard]] std::vector<UpstreamRazerControllerSummary> controllers() const;
+
+private:
+    UpstreamRazerPluginCoordinator(
+        UpstreamPluginHost& host,
+        ApplicationDispatcher& dispatcher,
+        UpstreamRazerCoordinatorConfig config) noexcept;
+
+    void queue_snapshot(NativeRouteSnapshot snapshot) noexcept;
+    void apply_snapshot(NativeRouteSnapshot snapshot) noexcept;
+    void queue_error(sdk::Error error) noexcept;
+    void record_error(sdk::Error error) noexcept;
+    void record_exception(std::string_view operation) noexcept;
+    void record_exception(std::string_view operation, const std::exception& error) noexcept;
+    void refresh_registry_state();
+    void notify_state_changed() noexcept;
+
+    UpstreamPluginHost* host_;
+    ApplicationDispatcher* dispatcher_;
+    std::unique_ptr<NativeRouteWorker> worker_;
+    std::unique_ptr<UpstreamRazerControllerFactory> factory_;
+    std::unique_ptr<UpstreamRazerControllerRegistry> registry_;
+
+    mutable std::mutex state_mutex_;
+    bool started_ = false;
+    bool stopped_ = false;
+    bool detection_suspended_ = false;
+    std::size_t controller_count_ = 0;
+    std::size_t registered_controller_count_ = 0;
+    std::size_t direct_suppressed_controller_count_ = 0;
+    std::optional<sdk::Error> last_error_;
+    std::vector<UpstreamRazerControllerSummary> controllers_;
+    std::function<void()> on_state_changed_;
+};
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_registry.hpp b/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_registry.hpp
new file mode 100644
index 0000000..47f5154
--- /dev/null
+++ b/integrations/openrgb/include/hyperflux/openrgb/upstream_razer_registry.hpp
@@ -0,0 +1,158 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "native_route_session.hpp"
+
+#include <hyperflux/sdk.hpp>
+
+#include <cstddef>
+#include <functional>
+#include <map>
+#include <memory>
+#include <set>
+#include <string>
+#include <string_view>
+#include <vector>
+
+class RGBController;
+
+namespace hyperflux::openrgb::native
+{
+
+class UpstreamRazerControllerInstance
+{
+public:
+    UpstreamRazerControllerInstance(const UpstreamRazerControllerInstance&) = delete;
+    UpstreamRazerControllerInstance& operator=(const UpstreamRazerControllerInstance&) = delete;
+    ~UpstreamRazerControllerInstance();
+
+    [[nodiscard]] RGBController& controller() noexcept;
+    [[nodiscard]] const RGBController& controller() const noexcept;
+    [[nodiscard]] const v7::NativeRoute& route() const noexcept;
+    [[nodiscard]] std::string_view serial() const noexcept;
+
+private:
+    friend class UpstreamRazerControllerFactory;
+
+    UpstreamRazerControllerInstance(
+        v7::NativeRoute route,
+        std::unique_ptr<NativeFeatureExchange> exchange,
+        std::unique_ptr<RGBController> controller);
+
+    v7::NativeRoute route_;
+    std::unique_ptr<NativeFeatureExchange> exchange_;
+    std::unique_ptr<RGBController> controller_;
+};
+
+using NativeFeatureExchangeFactory = std::function<
+    sdk::Result<std::unique_ptr<NativeFeatureExchange>>(const NativeRouteIdentity&)>;
+
+[[nodiscard]] NativeFeatureExchangeFactory make_unix_native_feature_exchange_factory(
+    sdk::UnixChannelConfig channel_config);
+
+class UpstreamRazerControllerFactory
+{
+public:
+    explicit UpstreamRazerControllerFactory(NativeFeatureExchangeFactory exchange_factory);
+
+    [[nodiscard]] sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>> create(
+        const v7::NativeRoute& route) const;
+
+private:
+    NativeFeatureExchangeFactory exchange_factory_;
+};
+
+class UpstreamControllerHost
+{
+public:
+    virtual ~UpstreamControllerHost() = default;
+    virtual void register_controller(RGBController& controller) noexcept = 0;
+    virtual void unregister_controller(RGBController& controller) noexcept = 0;
+};
+
+struct UpstreamRegistryUpdate
+{
+    std::size_t added = 0;
+    std::size_t removed = 0;
+    std::size_t replaced = 0;
+    std::size_t retained = 0;
+    std::size_t newly_suppressed = 0;
+    std::size_t newly_restored = 0;
+    std::size_t registered = 0;
+
+    friend bool operator==(const UpstreamRegistryUpdate&, const UpstreamRegistryUpdate&) = default;
+};
+
+struct UpstreamRazerControllerSummary
+{
+    std::string stable_id;
+    std::string name;
+    DeviceKind device_kind;
+    ProductId product_id;
+    bool registered;
+    bool direct_suppressed;
+
+    friend bool operator==(
+        const UpstreamRazerControllerSummary&,
+        const UpstreamRazerControllerSummary&) = default;
+};
+
+/// Owns only receiver-routed upstream controllers created by HyperFlux.
+///
+/// Direct-route precedence is deliberately serial-only. Callers provide
+/// nonempty serials that OpenRGB physically queried from direct local HID
+/// controllers; PID, name and device kind never participate in suppression.
+class UpstreamRazerControllerRegistry
+{
+public:
+    UpstreamRazerControllerRegistry(
+        UpstreamControllerHost& host,
+        UpstreamRazerControllerFactory& factory) noexcept;
+    UpstreamRazerControllerRegistry(const UpstreamRazerControllerRegistry&) = delete;
+    UpstreamRazerControllerRegistry& operator=(const UpstreamRazerControllerRegistry&) = delete;
+    ~UpstreamRazerControllerRegistry();
+
+    [[nodiscard]] sdk::Result<UpstreamRegistryUpdate> apply_routes(
+        std::vector<v7::NativeRoute> routes);
+    [[nodiscard]] UpstreamRegistryUpdate apply_direct_serials(
+        std::vector<std::string> physically_queried_serials);
+    void suspend_for_detection() noexcept;
+    void resume_after_detection() noexcept;
+    void shutdown() noexcept;
+
+    [[nodiscard]] std::size_t size() const noexcept;
+    [[nodiscard]] std::size_t registered_count() const noexcept;
+    [[nodiscard]] std::size_t suppressed_count() const noexcept;
+    [[nodiscard]] bool suspended() const noexcept;
+    [[nodiscard]] std::vector<std::string> serials() const;
+    [[nodiscard]] std::vector<UpstreamRazerControllerSummary> summaries() const;
+    [[nodiscard]] std::uintptr_t controller_identity(std::string_view stable_id) const noexcept;
+
+private:
+    struct Entry
+    {
+        std::unique_ptr<UpstreamRazerControllerInstance> instance;
+        bool registered = false;
+        bool direct_suppressed = false;
+    };
+
+    [[nodiscard]] static std::string stable_id(const v7::NativeRoute& route);
+    [[nodiscard]] bool should_suppress(const Entry& entry) const;
+    void reconcile_registration(Entry& entry, UpstreamRegistryUpdate& update);
+    [[nodiscard]] std::size_t registered_count_internal() const noexcept;
+
+    UpstreamControllerHost* host_;
+    UpstreamRazerControllerFactory* factory_;
+    std::map<std::string, Entry, std::less<>> entries_;
+    std::set<std::string, std::less<>> direct_serials_;
+    bool suspended_ = false;
+    bool stopped_ = false;
+};
+
+[[nodiscard]] bool is_eligible_upstream_razer_route(const v7::NativeRoute& route) noexcept;
+[[nodiscard]] std::string canonical_queried_serial(std::string_view serial);
+[[nodiscard]] std::vector<std::string> collect_direct_razer_serials(
+    const std::vector<RGBController*>& controllers);
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/native-route/patches/0001-Add-HyperFlux-feature-transport-seam.patch b/integrations/openrgb/native-route/patches/0001-Add-HyperFlux-feature-transport-seam.patch
new file mode 100644
index 0000000..8b1e4a3
--- /dev/null
+++ b/integrations/openrgb/native-route/patches/0001-Add-HyperFlux-feature-transport-seam.patch
@@ -0,0 +1,118 @@
+diff --git a/Controllers/RazerController/RazerController/RazerController.cpp b/Controllers/RazerController/RazerController/RazerController.cpp
+index 0611e76..b9db80a 100644
+--- a/Controllers/RazerController/RazerController/RazerController.cpp
++++ b/Controllers/RazerController/RazerController/RazerController.cpp
+@@ -10,6 +10,7 @@
+ \*---------------------------------------------------------*/
+ 
+ #include <string.h>
++#include <utility>
+ #include "RazerController.h"
+ #include "RazerDevices.h"
+ #include "LogManager.h"
+@@ -17,8 +18,14 @@
+ 
+ using namespace std::chrono_literals;
+ 
+-RazerController::RazerController(hid_device* dev_handle, hid_device* dev_argb_handle, const char* path, unsigned short pid, std::string dev_name)
++RazerController::RazerController(hid_device* dev_handle,
++                                 hid_device* dev_argb_handle,
++                                 const char* path,
++                                 unsigned short pid,
++                                 std::string dev_name,
++                                 std::unique_ptr<RazerFeatureTransport> feature_transport_arg)
+ {
++    feature_transport = std::move(feature_transport_arg);
+     dev               = dev_handle;
+     dev_argb          = dev_argb_handle;
+     dev_pid           = pid;
+@@ -204,7 +211,10 @@ RazerController::~RazerController()
+         keepalive_thread->join();
+     }
+ 
+-    hid_close(dev);
++    if(dev != nullptr)
++    {
++        hid_close(dev);
++    }
+     delete guard_manager_ptr;
+ }
+ 
+@@ -1894,6 +1904,10 @@ bool RazerController::SupportsWave()
+ 
+ int RazerController::razer_usb_receive(razer_report* report)
+ {
++    if(feature_transport != nullptr)
++    {
++        return feature_transport->GetFeatureReport((unsigned char*)report, sizeof(*report));
++    }
+     return hid_get_feature_report(dev, (unsigned char*)report, sizeof(*report));
+ }
+ 
+@@ -1903,11 +1917,19 @@ int RazerController::razer_usb_send(razer_report* report)
+     report->crc = razer_calculate_crc(report);
+ 
+     DeviceGuardLock _ = guard_manager_ptr->AwaitExclusiveAccess();
++    if(feature_transport != nullptr)
++    {
++        return feature_transport->SendFeatureReport((unsigned char*)report, sizeof(*report));
++    }
+     return hid_send_feature_report(dev, (unsigned char*)report, sizeof(*report));
+ }
+ 
+ int RazerController::razer_usb_send_argb(razer_argb_report* report)
+ {
+     DeviceGuardLock _ = guard_manager_ptr->AwaitExclusiveAccess();
++    if(feature_transport != nullptr)
++    {
++        return feature_transport->SendArgbFeatureReport((unsigned char*)report, sizeof(*report));
++    }
+     return hid_send_feature_report(dev_argb, (unsigned char*)report, sizeof(*report));
+ }
+diff --git a/Controllers/RazerController/RazerController/RazerController.h b/Controllers/RazerController/RazerController/RazerController.h
+index 01678ad..5550bdf 100644
+--- a/Controllers/RazerController/RazerController/RazerController.h
++++ b/Controllers/RazerController/RazerController/RazerController.h
+@@ -11,6 +11,7 @@
+ 
+ #include <atomic>
+ #include <chrono>
++#include <memory>
+ #include <string>
+ #include <thread>
+ #include <hidapi.h>
+@@ -218,10 +219,25 @@ PACK(struct razer_argb_report
+     unsigned char color_data[315];
+ });
+ 
++class RazerFeatureTransport
++{
++public:
++    virtual ~RazerFeatureTransport() = default;
++
++    virtual int GetFeatureReport(unsigned char* report, size_t size) = 0;
++    virtual int SendFeatureReport(const unsigned char* report, size_t size) = 0;
++    virtual int SendArgbFeatureReport(const unsigned char* report, size_t size) = 0;
++};
++
+ class RazerController
+ {
+ public:
+-    RazerController(hid_device* dev_handle, hid_device* dev_argb_handle, const char* path, unsigned short pid, std::string dev_name);
++    RazerController(hid_device* dev_handle,
++                    hid_device* dev_argb_handle,
++                    const char* path,
++                    unsigned short pid,
++                    std::string dev_name,
++                    std::unique_ptr<RazerFeatureTransport> feature_transport_arg = {});
+     ~RazerController();
+ 
+     unsigned int            GetDeviceIndex();
+@@ -258,6 +272,7 @@ private:
+     hid_device*             dev;
+     hid_device*             dev_argb;
+     unsigned short          dev_pid;
++    std::unique_ptr<RazerFeatureTransport> feature_transport;
+ 
+     /*---------------------------------------------------------*\
+     | Device-specific protocol settings                         |
diff --git a/integrations/openrgb/native-route/transform.json b/integrations/openrgb/native-route/transform.json
new file mode 100644
index 0000000..1611078
--- /dev/null
+++ b/integrations/openrgb/native-route/transform.json
@@ -0,0 +1,25 @@
+{
+  "$schema": "../../../schemas/openrgb-native-transform.schema.json",
+  "schema": "hyperflux-openrgb-native-transform-v1",
+  "upstream": {
+    "id": "openrgb",
+    "repository": "https://github.com/CalcProgrammer1/OpenRGB.git",
+    "commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0"
+  },
+  "patch": {
+    "path": "patches/0001-Add-HyperFlux-feature-transport-seam.patch",
+    "sha256": "98d7eebcb93c9e7a3f63b51cc07c7cbcc7f307167d2e44ce68c4ea637bd9c2c6"
+  },
+  "files": [
+    {
+      "path": "Controllers/RazerController/RazerController/RazerController.cpp",
+      "source_sha256": "cf5cd98f56a750f9d7f26828bd935f674fea1627be52971f703ed893ad7fb1c6",
+      "transformed_sha256": "166e71fb66ae0b7da13f216fe02e3a64921ce4c6b4384fdeda82c31b2e694b4d"
+    },
+    {
+      "path": "Controllers/RazerController/RazerController/RazerController.h",
+      "source_sha256": "e05415d4982bb63bd475884d288a6f898c1486d85d38efa62318e2ac1f170c90",
+      "transformed_sha256": "0ecd93121abbdd41e346842a1afc12fc20d9598b2a2dba8ab8e3fe6ee3c70dd5"
+    }
+  ]
+}
diff --git a/integrations/openrgb/src/native_plugin_application.cpp b/integrations/openrgb/src/native_plugin_application.cpp
new file mode 100644
index 0000000..a65db39
--- /dev/null
+++ b/integrations/openrgb/src/native_plugin_application.cpp
@@ -0,0 +1,371 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_plugin_application.hpp>
+#include <hyperflux/openrgb/plugin_runtime.hpp>
+
+#include "qt_dispatcher.hpp"
+
+#include "ResourceManagerInterface.h"
+
+#include <exception>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+
+namespace hyperflux::openrgb::native
+{
+namespace
+{
+
+sdk::Error application_error(std::string message)
+{
+    return {
+        sdk::ErrorCode::RuntimeConfiguration,
+        std::move(message),
+        "HFX-NATIVE-OPENRGB-004",
+    };
+}
+
+sdk::UnixChannelConfig native_channel_config()
+{
+    const auto runtime = default_production_runtime_config();
+    return {
+        runtime.socket_path,
+        runtime.timeout_ms,
+        std::nullopt,
+        runtime.expected_peer_user.empty()
+            ? std::nullopt
+            : std::optional<std::string>(runtime.expected_peer_user),
+    };
+}
+
+class ResourceManagerNativePluginHost final : public NativePluginHost
+{
+public:
+    explicit ResourceManagerNativePluginHost(ResourceManagerInterface& manager) noexcept
+        : manager_(&manager)
+    {
+    }
+
+    void register_controller(RGBController& controller) noexcept override
+    {
+        manager_->RegisterRGBController(&controller);
+    }
+
+    void unregister_controller(RGBController& controller) noexcept override
+    {
+        manager_->UnregisterRGBController(&controller);
+    }
+
+    std::vector<RGBController*> controllers() const override
+    {
+        return manager_->GetRGBControllers();
+    }
+
+    void register_detection_start(
+        DetectionCallback callback, void* context) noexcept override
+    {
+        manager_->RegisterDetectionStartCallback(callback, context);
+    }
+
+    void register_detection_end(
+        DetectionCallback callback, void* context) noexcept override
+    {
+        manager_->RegisterDetectionEndCallback(callback, context);
+    }
+
+    void unregister_detection_start(
+        DetectionCallback callback, void* context) noexcept override
+    {
+        manager_->UnregisterDetectionStartCallback(callback, context);
+    }
+
+    void unregister_detection_end(
+        DetectionCallback callback, void* context) noexcept override
+    {
+        manager_->UnregisterDetectionEndCallback(callback, context);
+    }
+
+    void wait_for_detection() noexcept override
+    {
+        manager_->WaitForDeviceDetection();
+    }
+
+private:
+    ResourceManagerInterface* manager_;
+};
+
+} // namespace
+
+NativePluginRuntimeFactories default_native_plugin_runtime_factories()
+{
+    const auto channel = native_channel_config();
+    return {
+        make_unix_native_discovery_factory(channel),
+        make_unix_native_feature_exchange_factory(channel),
+    };
+}
+
+OpenRgbNativePluginApplication::OpenRgbNativePluginApplication()
+    : OpenRgbNativePluginApplication(
+          default_native_plugin_runtime_factories(),
+          UpstreamRazerCoordinatorConfig {})
+{
+}
+
+OpenRgbNativePluginApplication::OpenRgbNativePluginApplication(
+    std::function<void()> on_state_changed)
+    : OpenRgbNativePluginApplication()
+{
+    coordinator_config_.on_state_changed = std::move(on_state_changed);
+}
+
+OpenRgbNativePluginApplication::OpenRgbNativePluginApplication(
+    NativePluginRuntimeFactories factories,
+    UpstreamRazerCoordinatorConfig coordinator_config)
+    : factories_(std::move(factories)),
+      coordinator_config_(std::move(coordinator_config))
+{
+}
+
+OpenRgbNativePluginApplication::~OpenRgbNativePluginApplication()
+{
+    unload();
+}
+
+sdk::Result<void> OpenRgbNativePluginApplication::load(ResourceManagerInterface* manager)
+{
+    if(manager == nullptr)
+    {
+        return sdk::Result<void>::failure(
+            application_error("OpenRGB native plugin requires a resource manager"));
+    }
+    return load(std::make_unique<ResourceManagerNativePluginHost>(*manager));
+}
+
+sdk::Result<void> OpenRgbNativePluginApplication::load(
+    std::unique_ptr<NativePluginHost> host)
+{
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        if(state_ != State::Unloaded)
+        {
+            return sdk::Result<void>::failure(
+                application_error("OpenRGB native plugin is already loaded"));
+        }
+        if(host == nullptr || !factories_.discovery || !factories_.exchange)
+        {
+            return sdk::Result<void>::failure(
+                application_error("OpenRGB native plugin factories are incomplete"));
+        }
+        state_ = State::Loading;
+    }
+
+    std::unique_ptr<QtApplicationDispatcher> dispatcher;
+    try
+    {
+        dispatcher = std::make_unique<QtApplicationDispatcher>();
+    }
+    catch(const std::exception& error)
+    {
+        reset_loading_state();
+        return sdk::Result<void>::failure(application_error(
+            "OpenRGB native dispatcher failed: " + std::string(error.what())));
+    }
+    catch(...)
+    {
+        reset_loading_state();
+        return sdk::Result<void>::failure(
+            application_error("OpenRGB native dispatcher failed"));
+    }
+
+    auto coordinator = UpstreamRazerPluginCoordinator::create(
+        *host,
+        *dispatcher,
+        factories_.discovery,
+        factories_.exchange,
+        coordinator_config_);
+    if(!coordinator)
+    {
+        reset_loading_state();
+        return sdk::Result<void>::failure(coordinator.error());
+    }
+
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        host_ = std::move(host);
+        dispatcher_ = std::move(dispatcher);
+        coordinator_ = std::move(coordinator).value();
+        callbacks_enabled_ = true;
+    }
+    host_->register_detection_start(&detection_started_callback, this);
+    host_->register_detection_end(&detection_finished_callback, this);
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        callbacks_registered_ = true;
+    }
+
+    auto started = coordinator_->start();
+    if(!started)
+    {
+        auto error = started.error();
+        unload();
+        return sdk::Result<void>::failure(std::move(error));
+    }
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        state_ = State::Loaded;
+    }
+    return sdk::Result<void>::success();
+}
+
+void OpenRgbNativePluginApplication::unload() noexcept
+{
+    NativePluginHost* host = nullptr;
+    bool callbacks_registered = false;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        if(state_ == State::Unloaded || state_ == State::Unloading)
+        {
+            return;
+        }
+        state_ = State::Unloading;
+        callbacks_enabled_ = false;
+        host = host_.get();
+        callbacks_registered = callbacks_registered_;
+    }
+    if(host != nullptr)
+    {
+        host->wait_for_detection();
+        if(callbacks_registered)
+        {
+            host->unregister_detection_start(&detection_started_callback, this);
+            host->unregister_detection_end(&detection_finished_callback, this);
+        }
+    }
+
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    std::unique_ptr<QtApplicationDispatcher> dispatcher;
+    std::unique_ptr<NativePluginHost> owned_host;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        callbacks_registered_ = false;
+        coordinator = std::move(coordinator_);
+        dispatcher = std::move(dispatcher_);
+        owned_host = std::move(host_);
+    }
+    if(coordinator != nullptr)
+    {
+        coordinator->shutdown();
+    }
+    if(dispatcher != nullptr)
+    {
+        dispatcher->stop();
+    }
+    coordinator.reset();
+    dispatcher.reset();
+    owned_host.reset();
+
+    std::lock_guard lock(lifecycle_mutex_);
+    state_ = State::Unloaded;
+}
+
+void OpenRgbNativePluginApplication::request_rescan() noexcept
+{
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        coordinator = coordinator_;
+    }
+    if(coordinator != nullptr)
+    {
+        coordinator->request_rescan();
+    }
+}
+
+NativePluginApplicationStatus OpenRgbNativePluginApplication::status() const
+{
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    NativePluginApplicationStatus result;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        result.loaded = state_ == State::Loaded;
+        coordinator = coordinator_;
+    }
+    if(coordinator != nullptr)
+    {
+        result.coordinator = coordinator->status();
+    }
+    return result;
+}
+
+std::vector<UpstreamRazerControllerSummary>
+OpenRgbNativePluginApplication::controllers() const
+{
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        coordinator = coordinator_;
+    }
+    return coordinator == nullptr ? std::vector<UpstreamRazerControllerSummary> {}
+                                  : coordinator->controllers();
+}
+
+void OpenRgbNativePluginApplication::detection_started_callback(void* context) noexcept
+{
+    if(context != nullptr)
+    {
+        static_cast<OpenRgbNativePluginApplication*>(context)->detection_started();
+    }
+}
+
+void OpenRgbNativePluginApplication::detection_finished_callback(void* context) noexcept
+{
+    if(context != nullptr)
+    {
+        static_cast<OpenRgbNativePluginApplication*>(context)->detection_finished();
+    }
+}
+
+void OpenRgbNativePluginApplication::detection_started() noexcept
+{
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        if(!callbacks_enabled_)
+        {
+            return;
+        }
+        coordinator = coordinator_;
+    }
+    if(coordinator != nullptr)
+    {
+        coordinator->detection_started();
+    }
+}
+
+void OpenRgbNativePluginApplication::detection_finished() noexcept
+{
+    std::shared_ptr<UpstreamRazerPluginCoordinator> coordinator;
+    {
+        std::lock_guard lock(lifecycle_mutex_);
+        if(!callbacks_enabled_)
+        {
+            return;
+        }
+        coordinator = coordinator_;
+    }
+    if(coordinator != nullptr)
+    {
+        coordinator->detection_finished();
+    }
+}
+
+void OpenRgbNativePluginApplication::reset_loading_state() noexcept
+{
+    std::lock_guard lock(lifecycle_mutex_);
+    state_ = State::Unloaded;
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/native_route_session.cpp b/integrations/openrgb/src/native_route_session.cpp
new file mode 100644
index 0000000..9af9788
--- /dev/null
+++ b/integrations/openrgb/src/native_route_session.cpp
@@ -0,0 +1,309 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_route_session.hpp>
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <variant>
+
+namespace hyperflux::openrgb::native
+{
+namespace
+{
+
+constexpr std::uint32_t lease_duration_ms = 30'000;
+constexpr std::uint16_t exchange_timeout_ms = 1'000;
+constexpr auto lease_renew_interval = std::chrono::seconds(10);
+
+sdk::Error route_error(sdk::ErrorCode code, std::string message)
+{
+    return {code, std::move(message), "HFX-NATIVE-OPENRGB-001"};
+}
+
+template<typename T, typename Value>
+sdk::Result<T> checked_domain(Value value, std::string_view label)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        return sdk::Result<T>::failure(route_error(
+            sdk::ErrorCode::InvalidArgument,
+            "invalid generated domain value for " + std::string(label)));
+    }
+    return sdk::Result<T>::success(std::move(*decoded));
+}
+
+bool route_is_usable(const v7::NativeRoute& route)
+{
+    return route.route_state == RouteState::Available
+        && route.access == NativeRouteAccess::Qualified
+        && route.protocol_family.value() == "razer-feature-report-v1"
+        && route.report_bytes.value() == razer_native_report_bytes
+        && route.route_token.has_value()
+        && route.resource.has_value()
+        && route.resource->receiver_id == route.receiver_id
+        && route.resource->generation_id == route.generation_id
+        && route.resource->device_id == route.device_id
+        && route.resource->kind == ResourceKind::NativeControl;
+}
+
+std::string encode_hex(
+    const std::array<std::uint8_t, razer_native_report_bytes>& report)
+{
+    constexpr std::array<char, 16> digits {
+        '0', '1', '2', '3', '4', '5', '6', '7',
+        '8', '9', 'a', 'b', 'c', 'd', 'e', 'f',
+    };
+    std::string encoded;
+    encoded.reserve(report.size() * 2);
+    for(const auto byte : report)
+    {
+        encoded.push_back(digits[byte >> 4]);
+        encoded.push_back(digits[byte & 0x0f]);
+    }
+    return encoded;
+}
+
+std::optional<std::array<std::uint8_t, razer_native_report_bytes>> decode_hex(
+    std::string_view encoded)
+{
+    if(encoded.size() != razer_native_report_bytes * 2)
+    {
+        return std::nullopt;
+    }
+    const auto nibble = [](char value) -> std::optional<std::uint8_t> {
+        if(value >= '0' && value <= '9')
+        {
+            return static_cast<std::uint8_t>(value - '0');
+        }
+        if(value >= 'a' && value <= 'f')
+        {
+            return static_cast<std::uint8_t>(10 + value - 'a');
+        }
+        if(value >= 'A' && value <= 'F')
+        {
+            return static_cast<std::uint8_t>(10 + value - 'A');
+        }
+        return std::nullopt;
+    };
+    std::array<std::uint8_t, razer_native_report_bytes> report {};
+    for(std::size_t index = 0; index < report.size(); ++index)
+    {
+        const auto high = nibble(encoded[index * 2]);
+        const auto low = nibble(encoded[index * 2 + 1]);
+        if(!high.has_value() || !low.has_value())
+        {
+            return std::nullopt;
+        }
+        report[index] = static_cast<std::uint8_t>((*high << 4) | *low);
+    }
+    return report;
+}
+
+} // namespace
+
+NativeRouteIdentity native_route_identity(const v7::NativeRoute& route)
+{
+    return {
+        route.receiver_id,
+        route.generation_id,
+        route.device_id,
+        route.endpoint_id,
+        route.device_kind,
+        route.vendor_id,
+        route.product_id,
+    };
+}
+
+SdkNativeFeatureExchange::SdkNativeFeatureExchange(
+    std::unique_ptr<sdk::NativeClientApi> client,
+    v7::NativeRoute route,
+    LeaseId lease_id,
+    Clock clock)
+    : client_(std::move(client)),
+      route_(std::move(route)),
+      lease_id_(std::move(lease_id)),
+      clock_(std::move(clock)),
+      renew_due_(clock_() + lease_renew_interval)
+{
+}
+
+SdkNativeFeatureExchange::~SdkNativeFeatureExchange()
+{
+    if(client_ != nullptr)
+    {
+        static_cast<void>(client_->release_lease(lease_id_));
+    }
+}
+
+sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>
+SdkNativeFeatureExchange::connect_unix(
+    const sdk::UnixChannelConfig& channel_config,
+    const NativeRouteIdentity& expected_route)
+{
+    auto client_id = checked_domain<ClientId>("openrgb-native-route", "client ID");
+    auto client_name = checked_domain<ClientName>("OpenRGB HyperFlux native transport", "client name");
+    auto feature = checked_domain<ProtocolFeatureId>(
+        "native-receiver-tunnel", "required feature");
+    if(!client_id || !client_name || !feature)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(
+            !client_id ? client_id.error() : (!client_name ? client_name.error() : feature.error()));
+    }
+    auto connected = sdk::NativeClient::connect_unix(
+        channel_config,
+        {
+            std::move(client_id).value(),
+            std::move(client_name).value(),
+            {std::move(feature).value()},
+            {},
+        });
+    if(!connected)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(
+            connected.error());
+    }
+    return create(
+        std::make_unique<sdk::NativeClient>(std::move(connected).value()),
+        expected_route);
+}
+
+sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>> SdkNativeFeatureExchange::create(
+    std::unique_ptr<sdk::NativeClientApi> client,
+    const NativeRouteIdentity& expected_route,
+    Clock clock)
+{
+    if(client == nullptr || !clock)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(
+            route_error(sdk::ErrorCode::InvalidArgument, "native route session inputs are incomplete"));
+    }
+    auto inventory = client->native_enumerate();
+    if(!inventory)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(
+            inventory.error());
+    }
+    const auto found = std::find_if(
+        inventory.value().routes.begin(),
+        inventory.value().routes.end(),
+        [&expected_route](const v7::NativeRoute& route) {
+            return native_route_identity(route) == expected_route;
+        });
+    if(found == inventory.value().routes.end() || !route_is_usable(*found))
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(route_error(
+            sdk::ErrorCode::InvalidController,
+            "native OpenRGB route is absent, stale, or not qualified"));
+    }
+    auto duration = checked_domain<LeaseDurationMs>(lease_duration_ms, "lease duration");
+    if(!duration)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(duration.error());
+    }
+    auto lease = client->acquire_lease({*found->resource}, duration.value());
+    if(!lease)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(lease.error());
+    }
+    const auto* granted = std::get_if<v7::LeaseResultGranted>(&lease.value());
+    if(granted == nullptr)
+    {
+        return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::failure(route_error(
+            sdk::ErrorCode::OwnershipConflict,
+            "native OpenRGB route is already owned or cannot be leased"));
+    }
+    return sdk::Result<std::unique_ptr<SdkNativeFeatureExchange>>::success(
+        std::unique_ptr<SdkNativeFeatureExchange>(new SdkNativeFeatureExchange(
+            std::move(client),
+            *found,
+            granted->detail.lease_id,
+            std::move(clock))));
+}
+
+bool SdkNativeFeatureExchange::renew_if_due()
+{
+    const auto now = clock_();
+    if(now < renew_due_)
+    {
+        return true;
+    }
+    auto duration = LeaseDurationMs::from(lease_duration_ms);
+    if(!duration.has_value())
+    {
+        return false;
+    }
+    auto renewed = client_->renew_lease(lease_id_, *duration);
+    const auto* granted = renewed
+        ? std::get_if<v7::LeaseResultGranted>(&renewed.value())
+        : nullptr;
+    if(granted == nullptr)
+    {
+        return false;
+    }
+    lease_id_ = granted->detail.lease_id;
+    renew_due_ = now + lease_renew_interval;
+    return true;
+}
+
+NativeFeatureExchangeResult SdkNativeFeatureExchange::exchange(
+    const std::array<std::uint8_t, razer_native_report_bytes>& request)
+{
+    if(!renew_if_due() || !route_.route_token.has_value())
+    {
+        return {NativeExchangeCertainty::NotSent, {}};
+    }
+    auto report = NativeReportHex::from(encode_hex(request));
+    auto timeout = NativeExchangeTimeoutMs::from(exchange_timeout_ms);
+    if(!report.has_value() || !timeout.has_value())
+    {
+        return {NativeExchangeCertainty::NotSent, {}};
+    }
+    auto submission = client_->prepare_native_exchange(
+        lease_id_, *route_.route_token, *report, *timeout);
+    if(!submission)
+    {
+        return {NativeExchangeCertainty::NotSent, {}};
+    }
+    auto outcome = client_->native_transact(submission.value());
+    if(!outcome)
+    {
+        return {NativeExchangeCertainty::MayHaveBeenSent, {}};
+    }
+    if(outcome.value().request_id != submission.value().request_id
+       || outcome.value().route_token != submission.value().route_token)
+    {
+        return {NativeExchangeCertainty::MayHaveBeenSent, {}};
+    }
+    if(std::holds_alternative<v7::NativeExchangeResultNotSent>(outcome.value().result))
+    {
+        return {NativeExchangeCertainty::NotSent, {}};
+    }
+    if(std::holds_alternative<v7::NativeExchangeResultMayHaveBeenSent>(
+           outcome.value().result))
+    {
+        return {NativeExchangeCertainty::MayHaveBeenSent, {}};
+    }
+    const auto* matched = std::get_if<v7::NativeExchangeResultMatchedResponse>(
+        &outcome.value().result);
+    if(matched == nullptr)
+    {
+        return {NativeExchangeCertainty::MayHaveBeenSent, {}};
+    }
+    const auto response = decode_hex(matched->detail.response.value());
+    if(!response.has_value())
+    {
+        return {NativeExchangeCertainty::MayHaveBeenSent, {}};
+    }
+    return {NativeExchangeCertainty::MatchedResponse, *response};
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/native_route_worker.cpp b/integrations/openrgb/src/native_route_worker.cpp
new file mode 100644
index 0000000..839d038
--- /dev/null
+++ b/integrations/openrgb/src/native_route_worker.cpp
@@ -0,0 +1,421 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_route_worker.hpp>
+
+#include <algorithm>
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+
+namespace hyperflux::openrgb::native
+{
+namespace
+{
+
+sdk::Error worker_error(sdk::ErrorCode code, std::string message)
+{
+    return {code, std::move(message), "HFX-NATIVE-OPENRGB-002"};
+}
+
+template<typename T, typename Value>
+sdk::Result<T> checked_domain(Value value, std::string_view label)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        return sdk::Result<T>::failure(worker_error(
+            sdk::ErrorCode::InvalidArgument,
+            "invalid native discovery domain value for " + std::string(label)));
+    }
+    return sdk::Result<T>::success(std::move(*decoded));
+}
+
+} // namespace
+
+NativeDiscoveryClientFactory make_unix_native_discovery_factory(
+    sdk::UnixChannelConfig channel_config)
+{
+    return [channel_config = std::move(channel_config)]()
+               -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+    {
+        auto client_id = checked_domain<ClientId>(
+            "openrgb-native-discovery", "client ID");
+        auto client_name = checked_domain<ClientName>(
+            "OpenRGB HyperFlux native discovery", "client name");
+        auto feature = checked_domain<ProtocolFeatureId>(
+            "native-receiver-tunnel", "required feature");
+        if(!client_id || !client_name || !feature)
+        {
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::failure(
+                !client_id ? client_id.error()
+                           : (!client_name ? client_name.error() : feature.error()));
+        }
+        auto connected = sdk::NativeClient::connect_unix(
+            channel_config,
+            {
+                std::move(client_id).value(),
+                std::move(client_name).value(),
+                {std::move(feature).value()},
+                {},
+            });
+        if(!connected)
+        {
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::failure(
+                connected.error());
+        }
+        std::unique_ptr<sdk::NativeClientApi> erased =
+            std::make_unique<sdk::NativeClient>(std::move(connected).value());
+        return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::success(
+            std::move(erased));
+    };
+}
+
+NativeRouteWorker::NativeRouteWorker(
+    NativeDiscoveryClientFactory factory,
+    NativeRouteWorkerConfig config,
+    NativeRouteWorkerCallbacks callbacks)
+    : factory_(std::move(factory)),
+      config_(config),
+      callbacks_(std::move(callbacks))
+{
+}
+
+NativeRouteWorker::~NativeRouteWorker()
+{
+    stop();
+}
+
+sdk::Result<std::unique_ptr<NativeRouteWorker>> NativeRouteWorker::create(
+    NativeDiscoveryClientFactory factory,
+    NativeRouteWorkerConfig config,
+    NativeRouteWorkerCallbacks callbacks)
+{
+    if(!factory || config.poll_interval_ms == 0 || config.reconnect_initial_ms == 0
+       || config.reconnect_max_ms < config.reconnect_initial_ms
+       || config.max_events == 0 || config.max_events > 256)
+    {
+        return sdk::Result<std::unique_ptr<NativeRouteWorker>>::failure(worker_error(
+            sdk::ErrorCode::InvalidArgument,
+            "native OpenRGB route worker configuration is invalid"));
+    }
+    return sdk::Result<std::unique_ptr<NativeRouteWorker>>::success(
+        std::unique_ptr<NativeRouteWorker>(new NativeRouteWorker(
+            std::move(factory), config, std::move(callbacks))));
+}
+
+sdk::Result<void> NativeRouteWorker::start()
+{
+    std::lock_guard lock(mutex_);
+    if(state_ != NativeRouteWorkerState::Created)
+    {
+        return sdk::Result<void>::failure(worker_error(
+            sdk::ErrorCode::RuntimeConfiguration,
+            "native OpenRGB route worker can only start once"));
+    }
+    state_ = NativeRouteWorkerState::Starting;
+    try
+    {
+        thread_ = std::thread(&NativeRouteWorker::run, this);
+    }
+    catch(const std::exception& error)
+    {
+        state_ = NativeRouteWorkerState::Failed;
+        return sdk::Result<void>::failure(worker_error(
+            sdk::ErrorCode::RuntimeConfiguration,
+            "native OpenRGB route worker thread failed: " + std::string(error.what())));
+    }
+    return sdk::Result<void>::success();
+}
+
+void NativeRouteWorker::stop() noexcept
+{
+    {
+        std::lock_guard lock(mutex_);
+        if(state_ == NativeRouteWorkerState::Created)
+        {
+            state_ = NativeRouteWorkerState::Stopped;
+            return;
+        }
+        if(state_ == NativeRouteWorkerState::Stopped)
+        {
+            return;
+        }
+        stop_requested_ = true;
+        state_ = NativeRouteWorkerState::Stopping;
+    }
+    wake_.notify_all();
+    if(thread_.joinable())
+    {
+        thread_.join();
+    }
+    std::lock_guard lock(mutex_);
+    state_ = NativeRouteWorkerState::Stopped;
+}
+
+void NativeRouteWorker::request_rescan() noexcept
+{
+    {
+        std::lock_guard lock(mutex_);
+        if(state_ == NativeRouteWorkerState::Stopped
+           || state_ == NativeRouteWorkerState::Failed)
+        {
+            return;
+        }
+        rescan_requested_ = true;
+    }
+    wake_.notify_all();
+}
+
+NativeRouteWorkerState NativeRouteWorker::state() const noexcept
+{
+    std::lock_guard lock(mutex_);
+    return state_;
+}
+
+std::optional<NativeRouteSnapshot> NativeRouteWorker::snapshot() const
+{
+    std::lock_guard lock(mutex_);
+    return snapshot_;
+}
+
+std::optional<sdk::Error> NativeRouteWorker::last_error() const
+{
+    std::lock_guard lock(mutex_);
+    return last_error_;
+}
+
+bool NativeRouteWorker::should_stop() const noexcept
+{
+    std::lock_guard lock(mutex_);
+    return stop_requested_;
+}
+
+bool NativeRouteWorker::wait_interruptible(std::uint32_t delay_ms) noexcept
+{
+    std::unique_lock lock(mutex_);
+    wake_.wait_for(
+        lock,
+        std::chrono::milliseconds(delay_ms),
+        [this] { return stop_requested_ || rescan_requested_; });
+    return !stop_requested_;
+}
+
+bool NativeRouteWorker::publish(NativeRouteSnapshot snapshot) noexcept
+{
+    try
+    {
+        {
+            std::lock_guard lock(mutex_);
+            snapshot_ = snapshot;
+            last_error_.reset();
+            state_ = NativeRouteWorkerState::Running;
+        }
+        if(callbacks_.on_snapshot)
+        {
+            try
+            {
+                callbacks_.on_snapshot(std::move(snapshot));
+            }
+        catch(...)
+        {
+            fail_unexpected("route snapshot callback threw");
+            return false;
+        }
+        }
+        return true;
+    }
+    catch(...)
+    {
+        fail_unexpected("route snapshot publication failed");
+        return false;
+    }
+}
+
+void NativeRouteWorker::fail_unexpected(const char* operation, const char* detail) noexcept
+{
+    try
+    {
+        std::string message = "native OpenRGB ";
+        message += operation;
+        if(detail != nullptr && *detail != '\0')
+        {
+            message += ": ";
+            message += detail;
+        }
+        sdk::Error error = worker_error(
+            sdk::ErrorCode::RuntimeConfiguration, std::move(message));
+        {
+            std::lock_guard lock(mutex_);
+            last_error_ = error;
+            state_ = NativeRouteWorkerState::Failed;
+            stop_requested_ = true;
+        }
+        wake_.notify_all();
+        if(callbacks_.on_error)
+        {
+            try
+            {
+                callbacks_.on_error(std::move(error));
+            }
+            catch(...)
+            {
+            }
+        }
+    }
+    catch(...)
+    {
+        try
+        {
+            std::lock_guard lock(mutex_);
+            state_ = NativeRouteWorkerState::Failed;
+            stop_requested_ = true;
+        }
+        catch(...)
+        {
+        }
+        wake_.notify_all();
+    }
+}
+
+void NativeRouteWorker::recover(sdk::Error error, std::uint32_t& delay_ms) noexcept
+{
+    {
+        std::lock_guard lock(mutex_);
+        last_error_ = error;
+        if(!stop_requested_)
+        {
+            state_ = NativeRouteWorkerState::Recovering;
+        }
+    }
+    if(callbacks_.on_error)
+    {
+        try
+        {
+            callbacks_.on_error(std::move(error));
+        }
+        catch(...)
+        {
+        }
+    }
+    static_cast<void>(wait_interruptible(delay_ms));
+    delay_ms = std::min(config_.reconnect_max_ms, delay_ms * 2);
+}
+
+void NativeRouteWorker::run() noexcept
+{
+    try
+    {
+        std::uint32_t recovery_delay = config_.reconnect_initial_ms;
+        while(!should_stop())
+        {
+            auto connected = factory_();
+            if(!connected)
+            {
+                recover(connected.error(), recovery_delay);
+                continue;
+            }
+            auto client = std::move(connected).value();
+            auto inventory = client->native_enumerate();
+            if(!inventory)
+            {
+                recover(inventory.error(), recovery_delay);
+                continue;
+            }
+
+            auto cursor = inventory.value().cursor;
+            if(!publish({cursor, std::move(inventory.value().routes)}))
+            {
+                break;
+            }
+            recovery_delay = config_.reconnect_initial_ms;
+            std::optional<SubscriptionId> subscription_id;
+
+            while(!should_stop())
+            {
+                bool force_rescan = false;
+                {
+                    std::lock_guard lock(mutex_);
+                    force_rescan = std::exchange(rescan_requested_, false);
+                }
+                if(force_rescan)
+                {
+                    auto refreshed = client->native_enumerate();
+                    if(!refreshed)
+                    {
+                        recover(refreshed.error(), recovery_delay);
+                        break;
+                    }
+                    cursor = refreshed.value().cursor;
+                    if(!publish({cursor, std::move(refreshed.value().routes)}))
+                    {
+                        break;
+                    }
+                    subscription_id.reset();
+                }
+
+                auto limit = EventBatchLimit::from(config_.max_events);
+                if(!limit.has_value())
+                {
+                    recover(
+                        worker_error(
+                            sdk::ErrorCode::InvalidArgument,
+                            "native OpenRGB event limit is outside the protocol domain"),
+                        recovery_delay);
+                    break;
+                }
+                auto events = client->native_watch({subscription_id, cursor, *limit});
+                if(!events)
+                {
+                    recover(events.error(), recovery_delay);
+                    break;
+                }
+                subscription_id = events.value().subscription_id;
+                cursor = events.value().next_cursor;
+                if(events.value().cursor_gap || !events.value().events.empty())
+                {
+                    auto refreshed = client->native_enumerate();
+                    if(!refreshed)
+                    {
+                        recover(refreshed.error(), recovery_delay);
+                        break;
+                    }
+                    cursor = refreshed.value().cursor;
+                    if(!publish({cursor, std::move(refreshed.value().routes)}))
+                    {
+                        break;
+                    }
+                    subscription_id.reset();
+                }
+                if(!events.value().has_more
+                   && !wait_interruptible(config_.poll_interval_ms))
+                {
+                    break;
+                }
+            }
+        }
+    }
+    catch(const std::exception& error)
+    {
+        fail_unexpected("route worker threw", error.what());
+    }
+    catch(...)
+    {
+        fail_unexpected("route worker threw");
+    }
+    try
+    {
+        std::lock_guard lock(mutex_);
+        if(state_ != NativeRouteWorkerState::Failed)
+        {
+            state_ = NativeRouteWorkerState::Stopped;
+        }
+    }
+    catch(...)
+    {
+    }
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/openrgb_plugin.cpp b/integrations/openrgb/src/openrgb_plugin.cpp
index 717e63b..b17f66d 100644
--- a/integrations/openrgb/src/openrgb_plugin.cpp
+++ b/integrations/openrgb/src/openrgb_plugin.cpp
@@ -1,7 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 #include <hyperflux/openrgb/build_config.hpp>
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+#include <hyperflux/openrgb/native_plugin_application.hpp>
+#else
 #include <hyperflux/openrgb/plugin_application.hpp>
+#endif
 #include <hyperflux/openrgb/plugin_view_model.hpp>
 
 #include "plugin_widget.hpp"
@@ -78,10 +82,16 @@ class HyperFluxNextOpenRgbPlugin final : public QObject, public OpenRGBPluginInt
     {
         auto* widget = new PluginInformationWidget([this]
         {
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+            return make_plugin_information_view_model(
+                application_.status(),
+                application_.controllers());
+#else
             return make_plugin_information_view_model(
                 application_.status(),
                 application_.inventory(),
                 application_.controllers());
+#endif
         });
         connect(
             this,
@@ -106,7 +116,11 @@ class HyperFluxNextOpenRgbPlugin final : public QObject, public OpenRGBPluginInt
     void status_changed();
 
 private:
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+    OpenRgbNativePluginApplication application_;
+#else
     OpenRgbPluginApplication application_;
+#endif
 };
 
 } // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/plugin_view_model.cpp b/integrations/openrgb/src/plugin_view_model.cpp
index 5cb16e5..5fcb3ec 100644
--- a/integrations/openrgb/src/plugin_view_model.cpp
+++ b/integrations/openrgb/src/plugin_view_model.cpp
@@ -293,4 +293,100 @@ PluginInformationViewModel make_plugin_information_view_model(
     return result;
 }
 
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+PluginInformationViewModel make_plugin_information_view_model(
+    const NativePluginApplicationStatus& status,
+    const std::vector<UpstreamRazerControllerSummary>& controllers)
+{
+    PluginInformationViewModel result;
+    for(const auto& controller : controllers)
+    {
+        result.devices.push_back({
+            controller.stable_id,
+            controller.name,
+            controller_type(controller.device_kind),
+            "Receiver route",
+            controller.direct_suppressed
+                ? "Direct USB active"
+                : (controller.registered ? "Available" : "Waiting"),
+            "Reported by HyperFlux diagnostics",
+            "Qualified native route",
+            "Upstream modes, zones, LEDs and layout",
+        });
+    }
+    std::sort(
+        result.devices.begin(),
+        result.devices.end(),
+        [](const PluginDeviceRow& left, const PluginDeviceRow& right)
+        {
+            if(left.type != right.type)
+            {
+                return left.type < right.type;
+            }
+            return left.device < right.device;
+        });
+
+    if(!status.loaded)
+    {
+        result.tone = PluginHealthTone::Neutral;
+        result.headline = "Not loaded";
+        result.summary = "The native OpenRGB transport is not active.";
+    }
+    else
+    {
+        if(status.coordinator.last_error.has_value())
+        {
+            result.technical_detail = status.coordinator.last_error->message;
+        }
+        switch(status.coordinator.worker_state)
+        {
+            case NativeRouteWorkerState::Running:
+                result.tone = PluginHealthTone::Positive;
+                result.headline = status.coordinator.registered_controllers == 0
+                    ? "No receiver-routed devices"
+                    : "Native transport ready";
+                result.summary = std::to_string(status.coordinator.registered_controllers)
+                    + (status.coordinator.registered_controllers == 1
+                           ? " upstream Razer controller is active."
+                           : " upstream Razer controllers are active.");
+                if(status.coordinator.direct_suppressed_controllers > 0)
+                {
+                    result.summary += " "
+                        + std::to_string(status.coordinator.direct_suppressed_controllers)
+                        + (status.coordinator.direct_suppressed_controllers == 1
+                               ? " matching receiver route is paused for direct USB."
+                               : " matching receiver routes are paused for direct USB.");
+                }
+                break;
+            case NativeRouteWorkerState::Created:
+            case NativeRouteWorkerState::Starting:
+            case NativeRouteWorkerState::Recovering:
+                result.tone = PluginHealthTone::Warning;
+                result.headline = "Connecting";
+                result.summary = "Waiting for the local HyperFlux native tunnel.";
+                break;
+            case NativeRouteWorkerState::Failed:
+                result.tone = PluginHealthTone::Negative;
+                result.headline = "Needs attention";
+                result.summary = "The native OpenRGB transport could not continue.";
+                break;
+            case NativeRouteWorkerState::Stopping:
+            case NativeRouteWorkerState::Stopped:
+                result.tone = PluginHealthTone::Neutral;
+                result.headline = "Stopped";
+                result.summary = "The native OpenRGB transport is stopped.";
+                break;
+        }
+    }
+    result.lighting_transport =
+        "OpenRGB's upstream Razer controller sends standard Feature reports through the local HyperFlux tunnel.";
+    result.effects_authority =
+        "OpenRGB owns hardware modes, layouts, profiles and software effects; HyperFlux transports their reports unchanged.";
+    result.build_identity = std::string("Version ")
+        + std::string(build_config::component_version) + " | OpenRGB API 4 | Source "
+        + std::string(build_config::source_revision);
+    return result;
+}
+#endif
+
 } // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/razer_feature_transport.cpp b/integrations/openrgb/src/razer_feature_transport.cpp
new file mode 100644
index 0000000..08f883f
--- /dev/null
+++ b/integrations/openrgb/src/razer_feature_transport.cpp
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/razer_feature_transport.hpp>
+
+#include <algorithm>
+#include <iterator>
+
+namespace hyperflux::openrgb::native
+{
+
+HyperFluxRazerFeatureTransport::HyperFluxRazerFeatureTransport(
+    NativeFeatureExchange& exchange) noexcept
+    : exchange_(&exchange)
+{
+}
+
+int HyperFluxRazerFeatureTransport::GetFeatureReport(unsigned char* report, size_t size)
+{
+    std::lock_guard lock(mutex_);
+    if(report == nullptr || size != razer_hid_report_bytes || !response_pending_)
+    {
+        return -1;
+    }
+    std::copy(
+        pending_response_.begin(),
+        pending_response_.end(),
+        std::next(report));
+    pending_response_.fill(0);
+    response_pending_ = false;
+    return static_cast<int>(size);
+}
+
+int HyperFluxRazerFeatureTransport::SendFeatureReport(
+    const unsigned char* report, size_t size)
+{
+    std::lock_guard lock(mutex_);
+    if(report == nullptr || size != razer_hid_report_bytes)
+    {
+        return -1;
+    }
+    pending_response_.fill(0);
+    response_pending_ = false;
+    std::array<std::uint8_t, razer_native_report_bytes> request {};
+    std::copy(std::next(report), std::next(report, size), request.begin());
+    const auto outcome = exchange_->exchange(request);
+    if(outcome.certainty != NativeExchangeCertainty::MatchedResponse)
+    {
+        return -1;
+    }
+    // OpenRGB setters do not read their acknowledgement. A later atomic send
+    // therefore replaces that unconsumed response; getters consume the result
+    // of their immediately preceding send exactly once.
+    pending_response_ = outcome.response;
+    response_pending_ = true;
+    return static_cast<int>(size);
+}
+
+int HyperFluxRazerFeatureTransport::SendArgbFeatureReport(
+    const unsigned char*, size_t)
+{
+    return -1;
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/upstream_razer_coordinator.cpp b/integrations/openrgb/src/upstream_razer_coordinator.cpp
new file mode 100644
index 0000000..868add4
--- /dev/null
+++ b/integrations/openrgb/src/upstream_razer_coordinator.cpp
@@ -0,0 +1,400 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/upstream_razer_coordinator.hpp>
+
+#include <exception>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <utility>
+
+namespace hyperflux::openrgb::native
+{
+namespace
+{
+
+sdk::Error coordinator_error(std::string message)
+{
+    return {
+        sdk::ErrorCode::RuntimeConfiguration,
+        std::move(message),
+        "HFX-NATIVE-OPENRGB-003",
+    };
+}
+
+} // namespace
+
+UpstreamRazerPluginCoordinator::UpstreamRazerPluginCoordinator(
+    UpstreamPluginHost& host,
+    ApplicationDispatcher& dispatcher,
+    UpstreamRazerCoordinatorConfig config) noexcept
+    : host_(&host),
+      dispatcher_(&dispatcher),
+      on_state_changed_(std::move(config.on_state_changed))
+{
+}
+
+UpstreamRazerPluginCoordinator::~UpstreamRazerPluginCoordinator()
+{
+    shutdown();
+}
+
+sdk::Result<std::shared_ptr<UpstreamRazerPluginCoordinator>>
+UpstreamRazerPluginCoordinator::create(
+    UpstreamPluginHost& host,
+    ApplicationDispatcher& dispatcher,
+    NativeDiscoveryClientFactory discovery_factory,
+    NativeFeatureExchangeFactory exchange_factory,
+    UpstreamRazerCoordinatorConfig config)
+{
+    if(!discovery_factory || !exchange_factory)
+    {
+        return sdk::Result<std::shared_ptr<UpstreamRazerPluginCoordinator>>::failure(
+            coordinator_error("native OpenRGB coordinator factories are incomplete"));
+    }
+    auto coordinator = std::shared_ptr<UpstreamRazerPluginCoordinator>(
+        new UpstreamRazerPluginCoordinator(host, dispatcher, config));
+    coordinator->factory_ = std::make_unique<UpstreamRazerControllerFactory>(
+        std::move(exchange_factory));
+    coordinator->registry_ = std::make_unique<UpstreamRazerControllerRegistry>(
+        host, *coordinator->factory_);
+
+    std::weak_ptr<UpstreamRazerPluginCoordinator> weak = coordinator;
+    auto worker = NativeRouteWorker::create(
+        std::move(discovery_factory),
+        config.worker,
+        {
+            [weak](NativeRouteSnapshot snapshot)
+            {
+                if(auto owner = weak.lock())
+                {
+                    owner->queue_snapshot(std::move(snapshot));
+                }
+            },
+            [weak](sdk::Error error)
+            {
+                if(auto owner = weak.lock())
+                {
+                    owner->queue_error(std::move(error));
+                }
+            },
+        });
+    if(!worker)
+    {
+        return sdk::Result<std::shared_ptr<UpstreamRazerPluginCoordinator>>::failure(
+            worker.error());
+    }
+    coordinator->worker_ = std::move(worker).value();
+    return sdk::Result<std::shared_ptr<UpstreamRazerPluginCoordinator>>::success(
+        std::move(coordinator));
+}
+
+sdk::Result<void> UpstreamRazerPluginCoordinator::start()
+{
+    {
+        std::lock_guard lock(state_mutex_);
+        if(started_ || stopped_)
+        {
+            return sdk::Result<void>::failure(
+                coordinator_error("native OpenRGB coordinator cannot start in its current state"));
+        }
+        started_ = true;
+    }
+    auto started = worker_->start();
+    if(!started)
+    {
+        {
+            std::lock_guard lock(state_mutex_);
+            started_ = false;
+        }
+        record_error(started.error());
+        return started;
+    }
+    notify_state_changed();
+    return sdk::Result<void>::success();
+}
+
+void UpstreamRazerPluginCoordinator::queue_snapshot(NativeRouteSnapshot snapshot) noexcept
+{
+    try
+    {
+        std::weak_ptr<UpstreamRazerPluginCoordinator> weak = weak_from_this();
+        if(!dispatcher_->post([weak, snapshot = std::move(snapshot)]() mutable
+           {
+               if(auto owner = weak.lock())
+               {
+                   owner->apply_snapshot(std::move(snapshot));
+               }
+           }))
+        {
+            record_error(coordinator_error(
+                "OpenRGB application dispatcher rejected a native route snapshot"));
+        }
+    }
+    catch(const std::exception& error)
+    {
+        record_exception("queue a native route snapshot", error);
+    }
+    catch(...)
+    {
+        record_exception("queue a native route snapshot");
+    }
+}
+
+void UpstreamRazerPluginCoordinator::apply_snapshot(NativeRouteSnapshot snapshot) noexcept
+{
+    {
+        std::lock_guard lock(state_mutex_);
+        if(stopped_)
+        {
+            return;
+        }
+    }
+    try
+    {
+        auto applied = registry_->apply_routes(std::move(snapshot.routes));
+        if(!applied)
+        {
+            record_error(applied.error());
+            return;
+        }
+        static_cast<void>(registry_->apply_direct_serials(
+            collect_direct_razer_serials(host_->controllers())));
+        refresh_registry_state();
+    }
+    catch(const std::exception& error)
+    {
+        record_exception("reconcile native OpenRGB routes", error);
+        return;
+    }
+    catch(...)
+    {
+        record_exception("reconcile native OpenRGB routes");
+        return;
+    }
+    {
+        std::lock_guard lock(state_mutex_);
+        last_error_.reset();
+    }
+    notify_state_changed();
+}
+
+void UpstreamRazerPluginCoordinator::queue_error(sdk::Error error) noexcept
+{
+    try
+    {
+        std::weak_ptr<UpstreamRazerPluginCoordinator> weak = weak_from_this();
+        if(!dispatcher_->post([weak, error = std::move(error)]() mutable
+           {
+               if(auto owner = weak.lock())
+               {
+                   owner->record_error(std::move(error));
+               }
+           }))
+        {
+            record_error(coordinator_error(
+                "OpenRGB application dispatcher rejected a native route error"));
+        }
+    }
+    catch(const std::exception& exception)
+    {
+        record_exception("queue a native route error", exception);
+    }
+    catch(...)
+    {
+        record_exception("queue a native route error");
+    }
+}
+
+void UpstreamRazerPluginCoordinator::record_error(sdk::Error error) noexcept
+{
+    try
+    {
+        std::lock_guard lock(state_mutex_);
+        if(stopped_)
+        {
+            return;
+        }
+        last_error_ = std::move(error);
+    }
+    catch(...)
+    {
+        return;
+    }
+    notify_state_changed();
+}
+
+void UpstreamRazerPluginCoordinator::record_exception(
+    std::string_view operation, const std::exception& error) noexcept
+{
+    try
+    {
+        record_error(coordinator_error(
+            "native OpenRGB failed to " + std::string(operation) + ": " + error.what()));
+    }
+    catch(...)
+    {
+    }
+}
+
+void UpstreamRazerPluginCoordinator::record_exception(std::string_view operation) noexcept
+{
+    try
+    {
+        record_error(coordinator_error(
+            "native OpenRGB failed to " + std::string(operation)));
+    }
+    catch(...)
+    {
+    }
+}
+
+void UpstreamRazerPluginCoordinator::refresh_registry_state()
+{
+    auto controllers = registry_->summaries();
+    const auto count = registry_->size();
+    const auto registered = registry_->registered_count();
+    const auto suppressed = registry_->suppressed_count();
+    const auto suspended = registry_->suspended();
+    std::lock_guard lock(state_mutex_);
+    controllers_ = std::move(controllers);
+    controller_count_ = count;
+    registered_controller_count_ = registered;
+    direct_suppressed_controller_count_ = suppressed;
+    detection_suspended_ = suspended;
+}
+
+void UpstreamRazerPluginCoordinator::detection_started() noexcept
+{
+    {
+        std::lock_guard lock(state_mutex_);
+        if(stopped_)
+        {
+            return;
+        }
+    }
+    try
+    {
+        registry_->suspend_for_detection();
+        refresh_registry_state();
+    }
+    catch(const std::exception& error)
+    {
+        record_exception("suspend native routes for OpenRGB detection", error);
+        return;
+    }
+    catch(...)
+    {
+        record_exception("suspend native routes for OpenRGB detection");
+        return;
+    }
+    notify_state_changed();
+}
+
+void UpstreamRazerPluginCoordinator::detection_finished() noexcept
+{
+    {
+        std::lock_guard lock(state_mutex_);
+        if(stopped_)
+        {
+            return;
+        }
+    }
+    try
+    {
+        static_cast<void>(registry_->apply_direct_serials(
+            collect_direct_razer_serials(host_->controllers())));
+        registry_->resume_after_detection();
+        refresh_registry_state();
+        worker_->request_rescan();
+    }
+    catch(const std::exception& error)
+    {
+        record_exception("reconcile OpenRGB detection", error);
+        return;
+    }
+    catch(...)
+    {
+        record_exception("reconcile OpenRGB detection");
+        return;
+    }
+    notify_state_changed();
+}
+
+void UpstreamRazerPluginCoordinator::request_rescan() noexcept
+{
+    if(worker_ != nullptr)
+    {
+        worker_->request_rescan();
+    }
+}
+
+void UpstreamRazerPluginCoordinator::shutdown() noexcept
+{
+    {
+        std::lock_guard lock(state_mutex_);
+        if(stopped_)
+        {
+            return;
+        }
+        stopped_ = true;
+    }
+    if(worker_ != nullptr)
+    {
+        worker_->stop();
+    }
+    if(registry_ != nullptr)
+    {
+        registry_->shutdown();
+    }
+    {
+        std::lock_guard lock(state_mutex_);
+        detection_suspended_ = false;
+        controller_count_ = 0;
+        registered_controller_count_ = 0;
+        direct_suppressed_controller_count_ = 0;
+        controllers_.clear();
+    }
+    notify_state_changed();
+}
+
+UpstreamRazerCoordinatorStatus UpstreamRazerPluginCoordinator::status() const
+{
+    const auto worker_state = worker_ == nullptr
+        ? NativeRouteWorkerState::Created
+        : worker_->state();
+    std::lock_guard lock(state_mutex_);
+    return {
+        worker_state,
+        started_,
+        stopped_,
+        detection_suspended_,
+        controller_count_,
+        registered_controller_count_,
+        direct_suppressed_controller_count_,
+        last_error_,
+    };
+}
+
+std::vector<UpstreamRazerControllerSummary>
+UpstreamRazerPluginCoordinator::controllers() const
+{
+    std::lock_guard lock(state_mutex_);
+    return controllers_;
+}
+
+void UpstreamRazerPluginCoordinator::notify_state_changed() noexcept
+{
+    if(on_state_changed_)
+    {
+        try
+        {
+            on_state_changed_();
+        }
+        catch(...)
+        {
+        }
+    }
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/integrations/openrgb/src/upstream_razer_registry.cpp b/integrations/openrgb/src/upstream_razer_registry.cpp
new file mode 100644
index 0000000..b1f125c
--- /dev/null
+++ b/integrations/openrgb/src/upstream_razer_registry.cpp
@@ -0,0 +1,488 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/upstream_razer_registry.hpp>
+
+#include "RGBController.h"
+#include "RGBController_Razer.h"
+#include "RazerController.h"
+#include "RazerDevices.h"
+
+#include <algorithm>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+#include <utility>
+
+namespace hyperflux::openrgb::native
+{
+namespace
+{
+
+sdk::Error registry_error(std::string message)
+{
+    return {
+        sdk::ErrorCode::InvalidController,
+        std::move(message),
+        "HFX-INTEGRATION-001",
+    };
+}
+
+const razer_device* upstream_device(const v7::NativeRoute& route)
+{
+    const auto product_id = static_cast<unsigned short>(route.product_id.value());
+    const auto found = std::find_if(
+        device_list,
+        device_list + RAZER_NUM_DEVICES,
+        [product_id](const razer_device* device)
+        {
+            return device != nullptr && device->pid == product_id;
+        });
+    if(found == device_list + RAZER_NUM_DEVICES)
+    {
+        return nullptr;
+    }
+    const auto expected_type = route.device_kind == DeviceKind::Mouse
+                                   ? DEVICE_TYPE_MOUSE
+                                   : route.device_kind == DeviceKind::Keyboard
+                                         ? DEVICE_TYPE_KEYBOARD
+                                         : DEVICE_TYPE_UNKNOWN;
+    return (*found)->type == expected_type ? *found : nullptr;
+}
+
+std::string route_location(const v7::NativeRoute& route)
+{
+    return "hyperflux-next/native/receiver/" + std::string(route.receiver_id.value())
+        + "/generation/" + std::to_string(route.generation_id.value())
+        + "/device/" + std::string(route.device_id.value())
+        + "/endpoint/" + std::string(route.endpoint_id.value());
+}
+
+} // namespace
+
+UpstreamRazerControllerInstance::UpstreamRazerControllerInstance(
+    v7::NativeRoute route,
+    std::unique_ptr<NativeFeatureExchange> exchange,
+    std::unique_ptr<RGBController> controller)
+    : route_(std::move(route)),
+      exchange_(std::move(exchange)),
+      controller_(std::move(controller))
+{
+}
+
+UpstreamRazerControllerInstance::~UpstreamRazerControllerInstance() = default;
+
+RGBController& UpstreamRazerControllerInstance::controller() noexcept
+{
+    return *controller_;
+}
+
+const RGBController& UpstreamRazerControllerInstance::controller() const noexcept
+{
+    return *controller_;
+}
+
+const v7::NativeRoute& UpstreamRazerControllerInstance::route() const noexcept
+{
+    return route_;
+}
+
+std::string_view UpstreamRazerControllerInstance::serial() const noexcept
+{
+    return controller_->serial;
+}
+
+NativeFeatureExchangeFactory make_unix_native_feature_exchange_factory(
+    sdk::UnixChannelConfig channel_config)
+{
+    return [channel_config = std::move(channel_config)](
+               const NativeRouteIdentity& route)
+               -> sdk::Result<std::unique_ptr<NativeFeatureExchange>>
+    {
+        auto exchange = SdkNativeFeatureExchange::connect_unix(channel_config, route);
+        if(!exchange)
+        {
+            return sdk::Result<std::unique_ptr<NativeFeatureExchange>>::failure(
+                exchange.error());
+        }
+        std::unique_ptr<NativeFeatureExchange> erased = std::move(exchange).value();
+        return sdk::Result<std::unique_ptr<NativeFeatureExchange>>::success(
+            std::move(erased));
+    };
+}
+
+UpstreamRazerControllerFactory::UpstreamRazerControllerFactory(
+    NativeFeatureExchangeFactory exchange_factory)
+    : exchange_factory_(std::move(exchange_factory))
+{
+}
+
+sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>>
+UpstreamRazerControllerFactory::create(const v7::NativeRoute& route) const
+{
+    if(!exchange_factory_ || !is_eligible_upstream_razer_route(route))
+    {
+        return sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>>::failure(
+            registry_error("OpenRGB native route is not eligible for an upstream Razer controller"));
+    }
+    const auto* device = upstream_device(route);
+    if(device == nullptr)
+    {
+        return sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>>::failure(
+            registry_error("OpenRGB has no matching upstream Razer device record"));
+    }
+
+    auto exchange = exchange_factory_(native_route_identity(route));
+    if(!exchange)
+    {
+        return sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>>::failure(
+            exchange.error());
+    }
+    auto owned_exchange = std::move(exchange).value();
+    auto transport = std::make_unique<HyperFluxRazerFeatureTransport>(*owned_exchange);
+    auto upstream = std::make_unique<RazerController>(
+        nullptr,
+        nullptr,
+        route_location(route).c_str(),
+        static_cast<unsigned short>(route.product_id.value()),
+        device->name.c_str(),
+        std::move(transport));
+    std::unique_ptr<RGBController> controller =
+        std::make_unique<RGBController_Razer>(upstream.release());
+    return sdk::Result<std::unique_ptr<UpstreamRazerControllerInstance>>::success(
+        std::unique_ptr<UpstreamRazerControllerInstance>(new UpstreamRazerControllerInstance(
+            route,
+            std::move(owned_exchange),
+            std::move(controller))));
+}
+
+UpstreamRazerControllerRegistry::UpstreamRazerControllerRegistry(
+    UpstreamControllerHost& host,
+    UpstreamRazerControllerFactory& factory) noexcept
+    : host_(&host),
+      factory_(&factory)
+{
+}
+
+UpstreamRazerControllerRegistry::~UpstreamRazerControllerRegistry()
+{
+    shutdown();
+}
+
+std::string UpstreamRazerControllerRegistry::stable_id(const v7::NativeRoute& route)
+{
+    return std::string(route.receiver_id.value()) + "/" + std::string(route.device_id.value())
+        + "/" + std::string(route.endpoint_id.value());
+}
+
+bool UpstreamRazerControllerRegistry::should_suppress(const Entry& entry) const
+{
+    const auto serial = canonical_queried_serial(entry.instance->serial());
+    return !serial.empty() && direct_serials_.contains(serial);
+}
+
+void UpstreamRazerControllerRegistry::reconcile_registration(
+    Entry& entry, UpstreamRegistryUpdate& update)
+{
+    const bool suppress = should_suppress(entry);
+    if(suppress != entry.direct_suppressed)
+    {
+        suppress ? ++update.newly_suppressed : ++update.newly_restored;
+        entry.direct_suppressed = suppress;
+    }
+    const bool should_register = !suspended_ && !entry.direct_suppressed;
+    if(should_register && !entry.registered)
+    {
+        host_->register_controller(entry.instance->controller());
+        entry.registered = true;
+    }
+    else if(!should_register && entry.registered)
+    {
+        host_->unregister_controller(entry.instance->controller());
+        entry.registered = false;
+    }
+}
+
+sdk::Result<UpstreamRegistryUpdate> UpstreamRazerControllerRegistry::apply_routes(
+    std::vector<v7::NativeRoute> routes)
+{
+    if(stopped_)
+    {
+        return sdk::Result<UpstreamRegistryUpdate>::failure(
+            registry_error("OpenRGB upstream Razer registry is stopped"));
+    }
+
+    std::map<std::string, v7::NativeRoute, std::less<>> eligible;
+    for(auto& route : routes)
+    {
+        if(!is_eligible_upstream_razer_route(route) || upstream_device(route) == nullptr)
+        {
+            continue;
+        }
+        const auto id = stable_id(route);
+        if(!eligible.emplace(id, std::move(route)).second)
+        {
+            return sdk::Result<UpstreamRegistryUpdate>::failure(
+                registry_error("OpenRGB native route inventory contains a duplicate identity"));
+        }
+    }
+
+    std::map<std::string, std::unique_ptr<UpstreamRazerControllerInstance>, std::less<>> prepared;
+    for(const auto& [id, route] : eligible)
+    {
+        const auto existing = entries_.find(id);
+        if(existing != entries_.end() && existing->second.instance->route() == route)
+        {
+            continue;
+        }
+        auto created = factory_->create(route);
+        if(!created)
+        {
+            return sdk::Result<UpstreamRegistryUpdate>::failure(created.error());
+        }
+        prepared.emplace(id, std::move(created).value());
+    }
+
+    UpstreamRegistryUpdate update;
+    for(auto existing = entries_.begin(); existing != entries_.end();)
+    {
+        if(eligible.contains(existing->first))
+        {
+            ++existing;
+            continue;
+        }
+        if(existing->second.registered)
+        {
+            host_->unregister_controller(existing->second.instance->controller());
+        }
+        existing = entries_.erase(existing);
+        ++update.removed;
+    }
+
+    for(const auto& [id, route] : eligible)
+    {
+        auto existing = entries_.find(id);
+        if(existing == entries_.end())
+        {
+            Entry entry {std::move(prepared.at(id)), false, false};
+            auto inserted = entries_.emplace(id, std::move(entry)).first;
+            reconcile_registration(inserted->second, update);
+            ++update.added;
+            continue;
+        }
+        if(existing->second.instance->route() == route)
+        {
+            reconcile_registration(existing->second, update);
+            ++update.retained;
+            continue;
+        }
+        if(existing->second.registered)
+        {
+            host_->unregister_controller(existing->second.instance->controller());
+        }
+        existing->second = Entry {std::move(prepared.at(id)), false, false};
+        reconcile_registration(existing->second, update);
+        ++update.replaced;
+    }
+    update.registered = registered_count_internal();
+    return sdk::Result<UpstreamRegistryUpdate>::success(update);
+}
+
+UpstreamRegistryUpdate UpstreamRazerControllerRegistry::apply_direct_serials(
+    std::vector<std::string> physically_queried_serials)
+{
+    direct_serials_.clear();
+    for(auto& serial : physically_queried_serials)
+    {
+        auto canonical = canonical_queried_serial(serial);
+        if(!canonical.empty())
+        {
+            direct_serials_.insert(std::move(canonical));
+        }
+    }
+    UpstreamRegistryUpdate update;
+    if(!stopped_)
+    {
+        for(auto& [id, entry] : entries_)
+        {
+            (void)id;
+            reconcile_registration(entry, update);
+        }
+    }
+    update.registered = registered_count_internal();
+    return update;
+}
+
+void UpstreamRazerControllerRegistry::suspend_for_detection() noexcept
+{
+    if(stopped_ || suspended_)
+    {
+        return;
+    }
+    suspended_ = true;
+    for(auto& [id, entry] : entries_)
+    {
+        (void)id;
+        if(entry.registered)
+        {
+            host_->unregister_controller(entry.instance->controller());
+            entry.registered = false;
+        }
+    }
+}
+
+void UpstreamRazerControllerRegistry::resume_after_detection() noexcept
+{
+    if(stopped_ || !suspended_)
+    {
+        return;
+    }
+    suspended_ = false;
+    UpstreamRegistryUpdate update;
+    for(auto& [id, entry] : entries_)
+    {
+        (void)id;
+        reconcile_registration(entry, update);
+    }
+}
+
+void UpstreamRazerControllerRegistry::shutdown() noexcept
+{
+    if(stopped_)
+    {
+        return;
+    }
+    for(auto& [id, entry] : entries_)
+    {
+        (void)id;
+        if(entry.registered)
+        {
+            host_->unregister_controller(entry.instance->controller());
+        }
+    }
+    entries_.clear();
+    direct_serials_.clear();
+    suspended_ = false;
+    stopped_ = true;
+}
+
+std::size_t UpstreamRazerControllerRegistry::size() const noexcept
+{
+    return entries_.size();
+}
+
+std::size_t UpstreamRazerControllerRegistry::registered_count() const noexcept
+{
+    return registered_count_internal();
+}
+
+std::size_t UpstreamRazerControllerRegistry::registered_count_internal() const noexcept
+{
+    return static_cast<std::size_t>(std::count_if(
+        entries_.begin(),
+        entries_.end(),
+        [](const auto& item) { return item.second.registered; }));
+}
+
+std::size_t UpstreamRazerControllerRegistry::suppressed_count() const noexcept
+{
+    return static_cast<std::size_t>(std::count_if(
+        entries_.begin(),
+        entries_.end(),
+        [](const auto& item) { return item.second.direct_suppressed; }));
+}
+
+bool UpstreamRazerControllerRegistry::suspended() const noexcept
+{
+    return suspended_;
+}
+
+std::vector<std::string> UpstreamRazerControllerRegistry::serials() const
+{
+    std::vector<std::string> result;
+    result.reserve(entries_.size());
+    for(const auto& [id, entry] : entries_)
+    {
+        (void)id;
+        result.emplace_back(entry.instance->serial());
+    }
+    return result;
+}
+
+std::vector<UpstreamRazerControllerSummary>
+UpstreamRazerControllerRegistry::summaries() const
+{
+    std::vector<UpstreamRazerControllerSummary> result;
+    result.reserve(entries_.size());
+    for(const auto& [id, entry] : entries_)
+    {
+        const auto& route = entry.instance->route();
+        result.push_back({
+            id,
+            entry.instance->controller().name,
+            route.device_kind,
+            route.product_id,
+            entry.registered,
+            entry.direct_suppressed,
+        });
+    }
+    return result;
+}
+
+std::uintptr_t UpstreamRazerControllerRegistry::controller_identity(
+    std::string_view id) const noexcept
+{
+    const auto found = entries_.find(id);
+    return found == entries_.end()
+               ? 0
+               : reinterpret_cast<std::uintptr_t>(&found->second.instance->controller());
+}
+
+bool is_eligible_upstream_razer_route(const v7::NativeRoute& route) noexcept
+{
+    return route.route_state == RouteState::Available
+        && route.access == NativeRouteAccess::Qualified
+        && route.protocol_family.value() == "razer-feature-report-v1"
+        && route.report_bytes.value() == razer_native_report_bytes
+        && route.vendor_id.value() == 0x1532 && route.route_token.has_value()
+        && route.resource.has_value()
+        && (route.device_kind == DeviceKind::Mouse
+            || route.device_kind == DeviceKind::Keyboard);
+}
+
+std::string canonical_queried_serial(std::string_view serial)
+{
+    const auto first = serial.find_first_not_of(" \t\r\n");
+    if(first == std::string_view::npos)
+    {
+        return {};
+    }
+    const auto last = serial.find_last_not_of(" \t\r\n");
+    return std::string(serial.substr(first, last - first + 1));
+}
+
+std::vector<std::string> collect_direct_razer_serials(
+    const std::vector<RGBController*>& controllers)
+{
+    std::set<std::string, std::less<>> unique;
+    constexpr std::string_view hid_prefix = "HID: ";
+    constexpr std::string_view native_prefix = "HID: hyperflux-next/native/";
+    for(const auto* controller : controllers)
+    {
+        if(controller == nullptr || controller->vendor != "Razer"
+           || !std::string_view(controller->location).starts_with(hid_prefix)
+           || std::string_view(controller->location).starts_with(native_prefix)
+           || controller->location.size() == hid_prefix.size())
+        {
+            continue;
+        }
+        auto serial = canonical_queried_serial(controller->serial);
+        if(!serial.empty())
+        {
+            unique.insert(std::move(serial));
+        }
+    }
+    return {unique.begin(), unique.end()};
+}
+
+} // namespace hyperflux::openrgb::native
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 2ab571e..951ccfa 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -561,6 +561,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/openrgb-native-transform.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/openrgb-native-transform.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/package-build-manifest.schema.json",
@@ -1037,6 +1044,20 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/sdk/native_channel.hpp",
+      "destination": "/usr/include/hyperflux/sdk/native_channel.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "cpp-sdk-headers",
+      "source": "sdk/cpp/include/hyperflux/sdk/native_client.hpp",
+      "destination": "/usr/include/hyperflux/sdk/native_client.hpp",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "cpp-sdk-headers",
       "source": "sdk/cpp/include/hyperflux/sdk/recovery.hpp",
diff --git a/schemas/openrgb-native-transform.schema.json b/schemas/openrgb-native-transform.schema.json
new file mode 100644
index 0000000..f36d22d
--- /dev/null
+++ b/schemas/openrgb-native-transform.schema.json
@@ -0,0 +1,49 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/openrgb-native-transform-v1.json",
+  "title": "Source-bound OpenRGB native transport transformation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "upstream", "patch", "files"],
+  "properties": {
+    "$schema": {"const": "../../../schemas/openrgb-native-transform.schema.json"},
+    "schema": {"const": "hyperflux-openrgb-native-transform-v1"},
+    "upstream": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "repository", "commit"],
+      "properties": {
+        "id": {"const": "openrgb"},
+        "repository": {"const": "https://github.com/CalcProgrammer1/OpenRGB.git"},
+        "commit": {"type": "string", "pattern": "^[0-9a-f]{40}$"}
+      }
+    },
+    "patch": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "sha256"],
+      "properties": {
+        "path": {"type": "string", "pattern": "^patches/[A-Za-z0-9._-]+\\.patch$"},
+        "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+      }
+    },
+    "files": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 16,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "source_sha256", "transformed_sha256"],
+        "properties": {
+          "path": {
+            "type": "string",
+            "pattern": "^Controllers/RazerController/RazerController/[A-Za-z0-9._-]+$"
+          },
+          "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+          "transformed_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+        }
+      }
+    }
+  }
+}
diff --git a/schemas/package-build-manifest.schema.json b/schemas/package-build-manifest.schema.json
index dddcaf1..96aa430 100644
--- a/schemas/package-build-manifest.schema.json
+++ b/schemas/package-build-manifest.schema.json
@@ -57,7 +57,9 @@
         "openrazer_native_catalog_sha256",
         "openrazer_native_transform_sha256",
         "openrazer_native_deployment_sha256",
-        "openrazer_native_patch_sha256"
+        "openrazer_native_patch_sha256",
+        "openrgb_native_transform_sha256",
+        "openrgb_native_patch_sha256"
       ],
       "properties": {
         "install_manifest_sha256": {"$ref": "#/$defs/digest"},
@@ -70,7 +72,9 @@
         "openrazer_native_catalog_sha256": {"$ref": "#/$defs/digest"},
         "openrazer_native_transform_sha256": {"$ref": "#/$defs/digest"},
         "openrazer_native_deployment_sha256": {"$ref": "#/$defs/digest"},
-        "openrazer_native_patch_sha256": {"$ref": "#/$defs/digest"}
+        "openrazer_native_patch_sha256": {"$ref": "#/$defs/digest"},
+        "openrgb_native_transform_sha256": {"$ref": "#/$defs/digest"},
+        "openrgb_native_patch_sha256": {"$ref": "#/$defs/digest"}
       }
     },
     "materials": {
diff --git a/sdk/cpp/CMakeLists.txt b/sdk/cpp/CMakeLists.txt
index 204a6e9..275e085 100644
--- a/sdk/cpp/CMakeLists.txt
+++ b/sdk/cpp/CMakeLists.txt
@@ -11,6 +11,8 @@ add_library(
         src/client.cpp
         src/identity.cpp
         src/lighting.cpp
+        src/native_channel.cpp
+        src/native_client.cpp
         src/recovery.cpp
 )
 set_target_properties(hyperflux_sdk PROPERTIES POSITION_INDEPENDENT_CODE ON)
@@ -42,5 +44,6 @@ if(BUILD_TESTING)
     add_hyperflux_sdk_contract(sdk-client-contract sdk_client_contract.cpp)
     add_hyperflux_sdk_contract(sdk-channel-contract sdk_channel_contract.cpp)
     add_hyperflux_sdk_contract(sdk-lighting-contract sdk_lighting_contract.cpp)
+    add_hyperflux_sdk_contract(sdk-native-client-contract sdk_native_client_contract.cpp)
     add_hyperflux_sdk_contract(sdk-recovery-contract sdk_recovery_contract.cpp)
 endif()
diff --git a/sdk/cpp/include/hyperflux/sdk.hpp b/sdk/cpp/include/hyperflux/sdk.hpp
index 3449474..0d627db 100644
--- a/sdk/cpp/include/hyperflux/sdk.hpp
+++ b/sdk/cpp/include/hyperflux/sdk.hpp
@@ -8,5 +8,7 @@
 #include <hyperflux/sdk/error.hpp>
 #include <hyperflux/sdk/identity.hpp>
 #include <hyperflux/sdk/lighting.hpp>
+#include <hyperflux/sdk/native_channel.hpp>
+#include <hyperflux/sdk/native_client.hpp>
 #include <hyperflux/sdk/recovery.hpp>
 #include <hyperflux/sdk/result.hpp>
diff --git a/sdk/cpp/include/hyperflux/sdk/native_channel.hpp b/sdk/cpp/include/hyperflux/sdk/native_channel.hpp
new file mode 100644
index 0000000..2bab824
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/sdk/native_channel.hpp
@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "channel.hpp"
+
+#include <hyperflux/generated/protocol_v7_types.hpp>
+
+#include <cstdint>
+#include <memory>
+
+namespace hyperflux::sdk
+{
+
+/// Protocol-v7 channel kept separate from the stable protocol-v5 lighting API.
+class NativeRpcChannel
+{
+public:
+    virtual ~NativeRpcChannel() = default;
+
+    [[nodiscard]] virtual Result<v7::RpcResponse> exchange(
+        const v7::RpcRequest& request) = 0;
+};
+
+class NativeUnixRpcChannel final : public NativeRpcChannel
+{
+public:
+    ~NativeUnixRpcChannel() override;
+    NativeUnixRpcChannel(const NativeUnixRpcChannel&) = delete;
+    NativeUnixRpcChannel& operator=(const NativeUnixRpcChannel&) = delete;
+    NativeUnixRpcChannel(NativeUnixRpcChannel&& other) noexcept;
+    NativeUnixRpcChannel& operator=(NativeUnixRpcChannel&& other) noexcept;
+
+    [[nodiscard]] static Result<std::unique_ptr<NativeUnixRpcChannel>> connect(
+        const UnixChannelConfig& config);
+
+    [[nodiscard]] static Result<std::unique_ptr<NativeUnixRpcChannel>> adopt_connected_socket(
+        int file_descriptor,
+        std::uint32_t timeout_ms);
+
+    [[nodiscard]] Result<v7::RpcResponse> exchange(
+        const v7::RpcRequest& request) override;
+
+private:
+    explicit NativeUnixRpcChannel(int file_descriptor);
+
+    int file_descriptor_ = -1;
+};
+
+} // namespace hyperflux::sdk
diff --git a/sdk/cpp/include/hyperflux/sdk/native_client.hpp b/sdk/cpp/include/hyperflux/sdk/native_client.hpp
new file mode 100644
index 0000000..c09d410
--- /dev/null
+++ b/sdk/cpp/include/hyperflux/sdk/native_client.hpp
@@ -0,0 +1,133 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#pragma once
+
+#include "identity.hpp"
+#include "native_channel.hpp"
+
+#include <hyperflux/generated/protocol_v7_types.hpp>
+
+#include <memory>
+#include <optional>
+#include <vector>
+
+namespace hyperflux::sdk
+{
+
+struct NativeClientConfig
+{
+    ClientId client_id;
+    ClientName client_name;
+    std::vector<ProtocolFeatureId> required_features;
+    std::vector<ProtocolFeatureId> optional_features;
+};
+
+struct NativeEventSubscription
+{
+    std::optional<SubscriptionId> subscription_id;
+    std::optional<v7::EventCursor> expected_cursor;
+    EventBatchLimit max_events;
+};
+
+struct NativeExchangeSubmission
+{
+    RequestId request_id;
+    LeaseId lease_id;
+    NativeRouteToken route_token;
+    NativeReportHex report;
+    NativeExchangeTimeoutMs timeout_ms;
+};
+
+class NativeClientApi
+{
+public:
+    virtual ~NativeClientApi() = default;
+
+    [[nodiscard]] virtual Result<v7::LeaseResult> acquire_lease(
+        std::vector<v7::ResourceKey> resources,
+        LeaseDurationMs duration_ms) = 0;
+    [[nodiscard]] virtual Result<v7::LeaseResult> renew_lease(
+        LeaseId lease_id,
+        LeaseDurationMs duration_ms) = 0;
+    [[nodiscard]] virtual Result<v7::LeaseResult> release_lease(LeaseId lease_id) = 0;
+    [[nodiscard]] virtual Result<v7::NativeRouteInventory> native_enumerate() = 0;
+    [[nodiscard]] virtual Result<NativeExchangeSubmission> prepare_native_exchange(
+        LeaseId lease_id,
+        NativeRouteToken route_token,
+        NativeReportHex report,
+        NativeExchangeTimeoutMs timeout_ms) = 0;
+    [[nodiscard]] virtual Result<v7::NativeExchangeOutcome> native_transact(
+        const NativeExchangeSubmission& submission) = 0;
+    [[nodiscard]] virtual Result<v7::NativeRouteEventBatch> native_watch(
+        NativeEventSubscription subscription) = 0;
+};
+
+/// Protocol-v7 client for exact receiver-backed native feature exchanges.
+class NativeClient final : public NativeClientApi
+{
+public:
+    NativeClient(const NativeClient&) = delete;
+    NativeClient& operator=(const NativeClient&) = delete;
+    NativeClient(NativeClient&&) noexcept = default;
+    NativeClient& operator=(NativeClient&&) noexcept = default;
+
+    [[nodiscard]] static Result<NativeClient> connect(
+        std::unique_ptr<NativeRpcChannel> channel,
+        std::unique_ptr<IdentitySource> identities,
+        NativeClientConfig config);
+
+    [[nodiscard]] static Result<NativeClient> connect_unix(
+        const UnixChannelConfig& channel_config,
+        NativeClientConfig client_config);
+
+    [[nodiscard]] const v7::ServerHello& server_hello() const noexcept;
+    [[nodiscard]] const ClientId& client_id() const noexcept;
+
+    [[nodiscard]] Result<v7::LeaseResult> acquire_lease(
+        std::vector<v7::ResourceKey> resources,
+        LeaseDurationMs duration_ms) override;
+    [[nodiscard]] Result<v7::LeaseResult> renew_lease(
+        LeaseId lease_id,
+        LeaseDurationMs duration_ms) override;
+    [[nodiscard]] Result<v7::LeaseResult> release_lease(LeaseId lease_id) override;
+    [[nodiscard]] Result<v7::NativeRouteInventory> native_enumerate() override;
+    [[nodiscard]] Result<NativeExchangeSubmission> prepare_native_exchange(
+        LeaseId lease_id,
+        NativeRouteToken route_token,
+        NativeReportHex report,
+        NativeExchangeTimeoutMs timeout_ms) override;
+    [[nodiscard]] Result<v7::NativeExchangeOutcome> native_transact(
+        const NativeExchangeSubmission& submission) override;
+    [[nodiscard]] Result<v7::NativeRouteEventBatch> native_watch(
+        NativeEventSubscription subscription) override;
+
+private:
+    NativeClient(
+        std::unique_ptr<NativeRpcChannel> channel,
+        std::unique_ptr<IdentitySource> identities,
+        ClientId client_id,
+        v7::ServerHello hello);
+
+    template<typename T>
+    [[nodiscard]] v7::SessionRequestEnvelope<T> envelope(RequestId request_id, T params) const
+    {
+        return {
+            std::move(request_id),
+            hello_.protocol_session_id,
+            hello_.negotiation_token,
+            std::move(params),
+        };
+    }
+
+    [[nodiscard]] Result<RequestId> next_request_id();
+    [[nodiscard]] Result<v7::RpcResponse> exchange_checked(
+        const v7::RpcRequest& request,
+        const RequestId& request_id);
+
+    std::unique_ptr<NativeRpcChannel> channel_;
+    std::unique_ptr<IdentitySource> identities_;
+    ClientId client_id_;
+    v7::ServerHello hello_;
+};
+
+} // namespace hyperflux::sdk
diff --git a/sdk/cpp/src/native_channel.cpp b/sdk/cpp/src/native_channel.cpp
new file mode 100644
index 0000000..6482f5d
--- /dev/null
+++ b/sdk/cpp/src/native_channel.cpp
@@ -0,0 +1,462 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/sdk/native_channel.hpp>
+
+#include <hyperflux/generated/protocol_v7_json.hpp>
+
+#include <arpa/inet.h>
+#include <cerrno>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <limits>
+#include <optional>
+#include <pwd.h>
+#include <string>
+#include <string_view>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <sys/un.h>
+#include <unistd.h>
+#include <vector>
+
+namespace hyperflux::sdk
+{
+namespace
+{
+
+Result<void> configure_timeout(int file_descriptor, std::uint32_t timeout_ms)
+{
+    if(timeout_ms == 0)
+    {
+        return Result<void>::failure({
+            ErrorCode::InvalidArgument,
+            "socket timeout must be greater than zero",
+            std::nullopt,
+        });
+    }
+    const timeval timeout {
+        static_cast<time_t>(timeout_ms / 1'000),
+        static_cast<suseconds_t>((timeout_ms % 1'000) * 1'000),
+    };
+    if(::setsockopt(file_descriptor, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout)) != 0
+       || ::setsockopt(file_descriptor, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout)) != 0)
+    {
+        return Result<void>::failure({
+            ErrorCode::SocketConfigure,
+            "failed to configure bounded socket I/O timeouts",
+            std::nullopt,
+        });
+    }
+    return Result<void>::success();
+}
+
+Result<std::optional<std::uint32_t>> resolve_expected_peer(
+    const UnixChannelConfig& config)
+{
+    if(config.expected_peer_uid.has_value() && config.expected_peer_user.has_value())
+    {
+        return Result<std::optional<std::uint32_t>>::failure({
+            ErrorCode::InvalidArgument,
+            "bridge peer authority must use either an account name or a numeric UID",
+            std::nullopt,
+        });
+    }
+    if(config.expected_peer_uid.has_value())
+    {
+        return Result<std::optional<std::uint32_t>>::success(config.expected_peer_uid);
+    }
+    if(!config.expected_peer_user.has_value())
+    {
+        return Result<std::optional<std::uint32_t>>::success(std::nullopt);
+    }
+    if(config.expected_peer_user->empty() || config.expected_peer_user->size() > 64)
+    {
+        return Result<std::optional<std::uint32_t>>::failure({
+            ErrorCode::InvalidArgument,
+            "bridge peer account name is empty or exceeds the local bound",
+            std::nullopt,
+        });
+    }
+
+    passwd record {};
+    passwd* resolved = nullptr;
+    std::vector<char> buffer(16'384);
+    const auto status = ::getpwnam_r(
+        config.expected_peer_user->c_str(),
+        &record,
+        buffer.data(),
+        buffer.size(),
+        &resolved);
+    if(status != 0 || resolved == nullptr
+       || static_cast<std::uintmax_t>(record.pw_uid)
+           > std::numeric_limits<std::uint32_t>::max())
+    {
+        return Result<std::optional<std::uint32_t>>::failure({
+            ErrorCode::SocketConfigure,
+            "configured bridge service account is unavailable",
+            std::nullopt,
+        });
+    }
+    return Result<std::optional<std::uint32_t>>::success(
+        static_cast<std::uint32_t>(record.pw_uid));
+}
+
+Result<void> verify_peer(int file_descriptor, std::optional<std::uint32_t> expected_uid)
+{
+    if(!expected_uid.has_value())
+    {
+        return Result<void>::success();
+    }
+    ucred credentials {};
+    socklen_t length = sizeof(credentials);
+    if(::getsockopt(file_descriptor, SOL_SOCKET, SO_PEERCRED, &credentials, &length) != 0
+       || length != sizeof(credentials))
+    {
+        return Result<void>::failure({
+            ErrorCode::SocketConfigure,
+            "failed to read local bridge peer credentials",
+            std::nullopt,
+        });
+    }
+    if(credentials.uid != *expected_uid)
+    {
+        return Result<void>::failure({
+            ErrorCode::PeerCredentialMismatch,
+            "local bridge peer UID does not match the configured authority",
+            std::nullopt,
+        });
+    }
+    return Result<void>::success();
+}
+
+Result<void> write_all(int file_descriptor, const std::uint8_t* bytes, std::size_t size)
+{
+    std::size_t written = 0;
+    while(written < size)
+    {
+        const auto result = ::send(
+            file_descriptor,
+            bytes + written,
+            size - written,
+            MSG_NOSIGNAL);
+        if(result < 0)
+        {
+            if(errno == EINTR)
+            {
+                continue;
+            }
+            return Result<void>::failure({
+                ErrorCode::WriteFailed,
+                "failed to write a complete bridge RPC frame",
+                std::nullopt,
+            });
+        }
+        if(result == 0)
+        {
+            return Result<void>::failure({
+                ErrorCode::WriteFailed,
+                "bridge socket accepted zero bytes while writing",
+                std::nullopt,
+            });
+        }
+        written += static_cast<std::size_t>(result);
+    }
+    return Result<void>::success();
+}
+
+Result<void> read_all(int file_descriptor, std::uint8_t* bytes, std::size_t size)
+{
+    std::size_t received = 0;
+    while(received < size)
+    {
+        const auto result = ::recv(file_descriptor, bytes + received, size - received, 0);
+        if(result < 0)
+        {
+            if(errno == EINTR)
+            {
+                continue;
+            }
+            return Result<void>::failure({
+                ErrorCode::ReadFailed,
+                "failed to read a complete bridge RPC frame",
+                std::nullopt,
+            });
+        }
+        if(result == 0)
+        {
+            return Result<void>::failure({
+                ErrorCode::TruncatedFrame,
+                "bridge RPC frame ended before its declared length",
+                std::nullopt,
+            });
+        }
+        received += static_cast<std::size_t>(result);
+    }
+    return Result<void>::success();
+}
+
+bool nesting_is_bounded(std::string_view payload)
+{
+    std::size_t depth = 0;
+    bool in_string = false;
+    bool escaped = false;
+    for(const auto character : payload)
+    {
+        if(in_string)
+        {
+            if(escaped)
+            {
+                escaped = false;
+            }
+            else if(character == '\\')
+            {
+                escaped = true;
+            }
+            else if(character == '"')
+            {
+                in_string = false;
+            }
+            continue;
+        }
+        if(character == '"')
+        {
+            in_string = true;
+        }
+        else if(character == '{' || character == '[')
+        {
+            ++depth;
+            if(depth > v7::max_json_depth)
+            {
+                return false;
+            }
+        }
+        else if(character == '}' || character == ']')
+        {
+            if(depth == 0)
+            {
+                return false;
+            }
+            --depth;
+        }
+    }
+    return !in_string && depth == 0;
+}
+
+Result<v7::RpcResponse> decode_response(const std::string& payload)
+{
+    if(!nesting_is_bounded(payload))
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::InvalidJson,
+            "bridge response exceeds the JSON nesting bound or is structurally incomplete",
+            std::nullopt,
+        });
+    }
+    try
+    {
+        return Result<v7::RpcResponse>::success(json_codec::decode<v7::RpcResponse>(
+            nlohmann::json::parse(payload)));
+    }
+    catch(const std::exception&)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::InvalidProtocol,
+            "bridge response is not a valid protocol-v7 message",
+            std::nullopt,
+        });
+    }
+}
+
+} // namespace
+
+NativeUnixRpcChannel::NativeUnixRpcChannel(int file_descriptor)
+    : file_descriptor_(file_descriptor)
+{
+}
+
+NativeUnixRpcChannel::~NativeUnixRpcChannel()
+{
+    if(file_descriptor_ >= 0)
+    {
+        static_cast<void>(::close(file_descriptor_));
+    }
+}
+
+NativeUnixRpcChannel::NativeUnixRpcChannel(NativeUnixRpcChannel&& other) noexcept
+    : file_descriptor_(other.file_descriptor_)
+{
+    other.file_descriptor_ = -1;
+}
+
+NativeUnixRpcChannel& NativeUnixRpcChannel::operator=(NativeUnixRpcChannel&& other) noexcept
+{
+    if(this != &other)
+    {
+        if(file_descriptor_ >= 0)
+        {
+            static_cast<void>(::close(file_descriptor_));
+        }
+        file_descriptor_ = other.file_descriptor_;
+        other.file_descriptor_ = -1;
+    }
+    return *this;
+}
+
+Result<std::unique_ptr<NativeUnixRpcChannel>> NativeUnixRpcChannel::connect(
+    const UnixChannelConfig& config)
+{
+    if(config.socket_path.empty() || config.socket_path.size() >= sizeof(sockaddr_un::sun_path))
+    {
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure({
+            ErrorCode::SocketPath,
+            "bridge socket path is empty or exceeds the local socket limit",
+            std::nullopt,
+        });
+    }
+    auto expected_peer = resolve_expected_peer(config);
+    if(!expected_peer)
+    {
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure(expected_peer.error());
+    }
+    const auto file_descriptor = ::socket(AF_UNIX, SOCK_STREAM | SOCK_CLOEXEC, 0);
+    if(file_descriptor < 0)
+    {
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure({
+            ErrorCode::SocketCreate,
+            "failed to create the local bridge socket",
+            std::nullopt,
+        });
+    }
+    sockaddr_un address {};
+    address.sun_family = AF_UNIX;
+    std::memcpy(address.sun_path, config.socket_path.c_str(), config.socket_path.size() + 1);
+    if(::connect(file_descriptor, reinterpret_cast<const sockaddr*>(&address), sizeof(address)) != 0)
+    {
+        static_cast<void>(::close(file_descriptor));
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure({
+            ErrorCode::SocketConnect,
+            "failed to connect to the local HyperFlux bridge",
+            std::nullopt,
+        });
+    }
+    auto timeout = configure_timeout(file_descriptor, config.timeout_ms);
+    if(!timeout)
+    {
+        static_cast<void>(::close(file_descriptor));
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure(timeout.error());
+    }
+    auto peer = verify_peer(file_descriptor, expected_peer.value());
+    if(!peer)
+    {
+        static_cast<void>(::close(file_descriptor));
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure(peer.error());
+    }
+    return Result<std::unique_ptr<NativeUnixRpcChannel>>::success(
+        std::unique_ptr<NativeUnixRpcChannel>(new NativeUnixRpcChannel(file_descriptor)));
+}
+
+Result<std::unique_ptr<NativeUnixRpcChannel>> NativeUnixRpcChannel::adopt_connected_socket(
+    int file_descriptor,
+    std::uint32_t timeout_ms)
+{
+    if(file_descriptor < 0)
+    {
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure({
+            ErrorCode::InvalidArgument,
+            "connected socket file descriptor is invalid",
+            std::nullopt,
+        });
+    }
+    auto configured = configure_timeout(file_descriptor, timeout_ms);
+    if(!configured)
+    {
+        static_cast<void>(::close(file_descriptor));
+        return Result<std::unique_ptr<NativeUnixRpcChannel>>::failure(configured.error());
+    }
+    return Result<std::unique_ptr<NativeUnixRpcChannel>>::success(
+        std::unique_ptr<NativeUnixRpcChannel>(new NativeUnixRpcChannel(file_descriptor)));
+}
+
+Result<v7::RpcResponse> NativeUnixRpcChannel::exchange(const v7::RpcRequest& request)
+{
+    std::string payload;
+    try
+    {
+        payload = json_codec::encode(request).dump();
+    }
+    catch(const std::exception&)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::InvalidProtocol,
+            "SDK request cannot be encoded as a protocol-v7 message",
+            std::nullopt,
+        });
+    }
+    if(payload.empty() || payload.size() > v7::max_wire_message_bytes
+       || payload.size() > std::numeric_limits<std::uint32_t>::max())
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::PayloadTooLarge,
+            "SDK request is empty or exceeds the bridge message bound",
+            std::nullopt,
+        });
+    }
+    const auto length = htonl(static_cast<std::uint32_t>(payload.size()));
+    auto written = write_all(
+        file_descriptor_,
+        reinterpret_cast<const std::uint8_t*>(&length),
+        sizeof(length));
+    if(!written)
+    {
+        return Result<v7::RpcResponse>::failure(written.error());
+    }
+    written = write_all(
+        file_descriptor_,
+        reinterpret_cast<const std::uint8_t*>(payload.data()),
+        payload.size());
+    if(!written)
+    {
+        return Result<v7::RpcResponse>::failure(written.error());
+    }
+
+    std::uint32_t network_length = 0;
+    auto read = read_all(
+        file_descriptor_,
+        reinterpret_cast<std::uint8_t*>(&network_length),
+        sizeof(network_length));
+    if(!read)
+    {
+        return Result<v7::RpcResponse>::failure(read.error());
+    }
+    const auto response_size = static_cast<std::size_t>(ntohl(network_length));
+    if(response_size == 0)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::InvalidFrame,
+            "bridge response declares an empty payload",
+            std::nullopt,
+        });
+    }
+    if(response_size > v7::max_wire_message_bytes)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::PayloadTooLarge,
+            "bridge response exceeds the negotiated message bound",
+            std::nullopt,
+        });
+    }
+    std::string response(response_size, '\0');
+    read = read_all(
+        file_descriptor_,
+        reinterpret_cast<std::uint8_t*>(response.data()),
+        response.size());
+    if(!read)
+    {
+        return Result<v7::RpcResponse>::failure(read.error());
+    }
+    return decode_response(response);
+}
+
+} // namespace hyperflux::sdk
diff --git a/sdk/cpp/src/native_client.cpp b/sdk/cpp/src/native_client.cpp
new file mode 100644
index 0000000..b3ab2b5
--- /dev/null
+++ b/sdk/cpp/src/native_client.cpp
@@ -0,0 +1,412 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/sdk/native_client.hpp>
+
+#include <algorithm>
+#include <memory>
+#include <optional>
+#include <string>
+#include <type_traits>
+#include <utility>
+#include <variant>
+
+namespace hyperflux::sdk
+{
+namespace
+{
+
+const RequestId* response_request_id(const v7::RpcResponse& response)
+{
+    return std::visit(
+        [](const auto& alternative) -> const RequestId* {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            if constexpr(std::is_same_v<Alternative, v7::ErrorEnvelope>)
+            {
+                return alternative.request_id.has_value() ? &*alternative.request_id : nullptr;
+            }
+            else
+            {
+                return &alternative.response.request_id;
+            }
+        },
+        response);
+}
+
+const ServerInstanceId& response_server_instance(const v7::RpcResponse& response)
+{
+    return std::visit(
+        [](const auto& alternative) -> const ServerInstanceId& {
+            using Alternative = std::decay_t<decltype(alternative)>;
+            if constexpr(std::is_same_v<Alternative, v7::ErrorEnvelope>)
+            {
+                return alternative.server_instance_id;
+            }
+            else
+            {
+                return alternative.response.server_instance_id;
+            }
+        },
+        response);
+}
+
+Error server_error(const v7::ErrorEnvelope& envelope)
+{
+    return {
+        ErrorCode::ServerRejected,
+        std::string(envelope.error.message.value()),
+        std::string(envelope.error.finding_id.value()),
+    };
+}
+
+bool contains_feature(
+    const std::vector<ProtocolFeatureId>& features,
+    const ProtocolFeatureId& expected)
+{
+    return std::find(features.begin(), features.end(), expected) != features.end();
+}
+
+template<typename Wrapper, typename ResultType>
+Result<ResultType> unwrap_success(Result<v7::RpcResponse> response, std::string expected)
+{
+    if(!response)
+    {
+        return Result<ResultType>::failure(response.error());
+    }
+    auto* success = std::get_if<Wrapper>(&response.value());
+    if(success == nullptr)
+    {
+        return Result<ResultType>::failure({
+            ErrorCode::UnexpectedResponse,
+            "bridge returned an unexpected response to " + std::move(expected),
+            std::nullopt,
+        });
+    }
+    return Result<ResultType>::success(std::move(success->response.result));
+}
+
+} // namespace
+
+NativeClient::NativeClient(
+    std::unique_ptr<NativeRpcChannel> channel,
+    std::unique_ptr<IdentitySource> identities,
+    ClientId client_id,
+    v7::ServerHello hello)
+    : channel_(std::move(channel)),
+      identities_(std::move(identities)),
+      client_id_(std::move(client_id)),
+      hello_(std::move(hello))
+{
+}
+
+Result<NativeClient> NativeClient::connect(
+    std::unique_ptr<NativeRpcChannel> channel,
+    std::unique_ptr<IdentitySource> identities,
+    NativeClientConfig config)
+{
+    if(channel == nullptr || identities == nullptr)
+    {
+        return Result<NativeClient>::failure({
+            ErrorCode::InvalidArgument,
+            "native SDK channel and identity source are required",
+            std::nullopt,
+        });
+    }
+    auto request_id = identities->next_request_id();
+    if(!request_id)
+    {
+        return Result<NativeClient>::failure(request_id.error());
+    }
+    const auto expected_request_id = request_id.value();
+    const auto version = ProtocolVersion::from(7);
+    if(!version.has_value())
+    {
+        return Result<NativeClient>::failure({
+            ErrorCode::InvalidProtocol,
+            "protocol version 7 violates the generated domain contract",
+            std::nullopt,
+        });
+    }
+    const v7::RpcRequest request = v7::RpcRequestNegotiate {
+        {
+            std::move(request_id).value(),
+            {
+                config.client_id,
+                std::move(config.client_name),
+                *version,
+                *version,
+                config.required_features,
+                std::move(config.optional_features),
+            },
+        },
+    };
+    auto response = channel->exchange(request);
+    if(!response)
+    {
+        return Result<NativeClient>::failure(response.error());
+    }
+    if(response_request_id(response.value()) == nullptr
+       || *response_request_id(response.value()) != expected_request_id)
+    {
+        return Result<NativeClient>::failure({
+            ErrorCode::ResponseRequestMismatch,
+            "bridge negotiation response does not match the request identity",
+            std::nullopt,
+        });
+    }
+    if(const auto* error = std::get_if<v7::ErrorEnvelope>(&response.value()))
+    {
+        return Result<NativeClient>::failure(server_error(*error));
+    }
+    const auto* success = std::get_if<v7::RpcResponseNegotiateSuccess>(&response.value());
+    if(success == nullptr
+       || success->response.server_instance_id != success->response.result.server_instance_id
+       || success->response.result.selected_version != *version)
+    {
+        return Result<NativeClient>::failure({
+            ErrorCode::NegotiationFailed,
+            "bridge returned an invalid protocol-v7 negotiation",
+            std::nullopt,
+        });
+    }
+    for(const auto& required : config.required_features)
+    {
+        if(!contains_feature(success->response.result.enabled_features, required))
+        {
+            return Result<NativeClient>::failure({
+                ErrorCode::RequiredFeatureMissing,
+                "bridge negotiation omitted a required native SDK feature",
+                std::nullopt,
+            });
+        }
+    }
+    return Result<NativeClient>::success(NativeClient(
+        std::move(channel),
+        std::move(identities),
+        std::move(config.client_id),
+        success->response.result));
+}
+
+Result<NativeClient> NativeClient::connect_unix(
+    const UnixChannelConfig& channel_config,
+    NativeClientConfig client_config)
+{
+    auto channel = NativeUnixRpcChannel::connect(channel_config);
+    if(!channel)
+    {
+        return Result<NativeClient>::failure(channel.error());
+    }
+    auto identities = ProcessIdentitySource::create();
+    if(!identities)
+    {
+        return Result<NativeClient>::failure(identities.error());
+    }
+    return connect(
+        std::move(channel).value(),
+        std::move(identities).value(),
+        std::move(client_config));
+}
+
+const v7::ServerHello& NativeClient::server_hello() const noexcept
+{
+    return hello_;
+}
+
+const ClientId& NativeClient::client_id() const noexcept
+{
+    return client_id_;
+}
+
+Result<RequestId> NativeClient::next_request_id()
+{
+    return identities_->next_request_id();
+}
+
+Result<v7::RpcResponse> NativeClient::exchange_checked(
+    const v7::RpcRequest& request,
+    const RequestId& request_id)
+{
+    auto response = channel_->exchange(request);
+    if(!response)
+    {
+        return response;
+    }
+    const auto* actual_request_id = response_request_id(response.value());
+    if(actual_request_id == nullptr || *actual_request_id != request_id)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::ResponseRequestMismatch,
+            "bridge response does not match the native SDK request identity",
+            std::nullopt,
+        });
+    }
+    if(response_server_instance(response.value()) != hello_.server_instance_id)
+    {
+        return Result<v7::RpcResponse>::failure({
+            ErrorCode::ServerInstanceChanged,
+            "bridge process identity changed; reconnect before issuing another request",
+            std::nullopt,
+        });
+    }
+    if(const auto* error = std::get_if<v7::ErrorEnvelope>(&response.value()))
+    {
+        return Result<v7::RpcResponse>::failure(server_error(*error));
+    }
+    return response;
+}
+
+Result<v7::LeaseResult> NativeClient::acquire_lease(
+    std::vector<v7::ResourceKey> resources,
+    LeaseDurationMs duration_ms)
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<v7::LeaseResult>::failure(request_id.error());
+    }
+    const auto expected = request_id.value();
+    const auto params_id = request_id.value();
+    const v7::RpcRequest request = v7::RpcRequestAcquireLease {
+        envelope(
+            std::move(request_id).value(),
+            v7::LeaseRequest {
+                params_id,
+                client_id_,
+                std::move(resources),
+                duration_ms,
+            }),
+    };
+    return unwrap_success<v7::RpcResponseAcquireLeaseSuccess, v7::LeaseResult>(
+        exchange_checked(request, expected),
+        "native lease acquisition");
+}
+
+Result<v7::LeaseResult> NativeClient::renew_lease(
+    LeaseId lease_id,
+    LeaseDurationMs duration_ms)
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<v7::LeaseResult>::failure(request_id.error());
+    }
+    const auto expected = request_id.value();
+    const auto params_id = request_id.value();
+    const v7::RpcRequest request = v7::RpcRequestRenewLease {
+        envelope(
+            std::move(request_id).value(),
+            v7::RenewLeaseRequest {
+                params_id,
+                client_id_,
+                std::move(lease_id),
+                duration_ms,
+            }),
+    };
+    return unwrap_success<v7::RpcResponseRenewLeaseSuccess, v7::LeaseResult>(
+        exchange_checked(request, expected),
+        "native lease renewal");
+}
+
+Result<v7::LeaseResult> NativeClient::release_lease(LeaseId lease_id)
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<v7::LeaseResult>::failure(request_id.error());
+    }
+    const auto expected = request_id.value();
+    const auto params_id = request_id.value();
+    const v7::RpcRequest request = v7::RpcRequestReleaseLease {
+        envelope(
+            std::move(request_id).value(),
+            v7::ReleaseLeaseRequest {
+                params_id,
+                client_id_,
+                std::move(lease_id),
+            }),
+    };
+    return unwrap_success<v7::RpcResponseReleaseLeaseSuccess, v7::LeaseResult>(
+        exchange_checked(request, expected),
+        "native lease release");
+}
+
+Result<v7::NativeRouteInventory> NativeClient::native_enumerate()
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<v7::NativeRouteInventory>::failure(request_id.error());
+    }
+    const auto expected = request_id.value();
+    const v7::RpcRequest request = v7::RpcRequestNativeEnumerate {
+        envelope(std::move(request_id).value(), v7::EmptyRequest {}),
+    };
+    return unwrap_success<v7::RpcResponseNativeEnumerateSuccess, v7::NativeRouteInventory>(
+        exchange_checked(request, expected),
+        "native route enumeration");
+}
+
+Result<NativeExchangeSubmission> NativeClient::prepare_native_exchange(
+    LeaseId lease_id,
+    NativeRouteToken route_token,
+    NativeReportHex report,
+    NativeExchangeTimeoutMs timeout_ms)
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<NativeExchangeSubmission>::failure(request_id.error());
+    }
+    return Result<NativeExchangeSubmission>::success({
+        std::move(request_id).value(),
+        std::move(lease_id),
+        std::move(route_token),
+        std::move(report),
+        timeout_ms,
+    });
+}
+
+Result<v7::NativeExchangeOutcome> NativeClient::native_transact(
+    const NativeExchangeSubmission& submission)
+{
+    const v7::RpcRequest request = v7::RpcRequestNativeTransact {
+        envelope(
+            submission.request_id,
+            v7::NativeExchangeRequest {
+                submission.request_id,
+                client_id_,
+                submission.lease_id,
+                submission.route_token,
+                submission.report,
+                submission.timeout_ms,
+            }),
+    };
+    return unwrap_success<v7::RpcResponseNativeTransactSuccess, v7::NativeExchangeOutcome>(
+        exchange_checked(request, submission.request_id),
+        "native receiver exchange");
+}
+
+Result<v7::NativeRouteEventBatch> NativeClient::native_watch(
+    NativeEventSubscription subscription)
+{
+    auto request_id = next_request_id();
+    if(!request_id)
+    {
+        return Result<v7::NativeRouteEventBatch>::failure(request_id.error());
+    }
+    const auto expected = request_id.value();
+    const v7::RpcRequest request = v7::RpcRequestNativeWatch {
+        envelope(
+            std::move(request_id).value(),
+            v7::SubscriptionRequest {
+                client_id_,
+                std::move(subscription.subscription_id),
+                std::move(subscription.expected_cursor),
+                subscription.max_events,
+            }),
+    };
+    return unwrap_success<v7::RpcResponseNativeWatchSuccess, v7::NativeRouteEventBatch>(
+        exchange_checked(request, expected),
+        "native route watch");
+}
+
+} // namespace hyperflux::sdk
diff --git a/tests/cpp/openrgb_native_plugin_application_contract.cpp b/tests/cpp/openrgb_native_plugin_application_contract.cpp
new file mode 100644
index 0000000..3ca84a7
--- /dev/null
+++ b/tests/cpp/openrgb_native_plugin_application_contract.cpp
@@ -0,0 +1,495 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_plugin_application.hpp>
+
+#include "RGBController.h"
+#include "RazerDevices.h"
+
+#include <QCoreApplication>
+
+#include <algorithm>
+#include <array>
+#include <atomic>
+#include <chrono>
+#include <cstdint>
+#include <cstdlib>
+#include <iostream>
+#include <memory>
+#include <mutex>
+#include <set>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace
+{
+
+int failure(int line)
+{
+    std::cerr << "openrgb-native-plugin-application-contract failed at line "
+              << line << '\n';
+    return EXIT_FAILURE;
+}
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+hyperflux::v7::EventCursor cursor(std::uint64_t sequence)
+{
+    using namespace hyperflux;
+    return {
+        text<StreamId>("native-routes"),
+        number<StreamEpoch>(1),
+        number<ProjectionRevision>(1),
+        number<SequenceNumber>(sequence),
+    };
+}
+
+hyperflux::v7::NativeRoute route(
+    hyperflux::DeviceKind kind,
+    std::string_view device_id,
+    std::string_view endpoint_id,
+    std::uint16_t product_id,
+    char token_fill)
+{
+    using namespace hyperflux;
+    const v7::ResourceKey resource {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(4),
+        text<LogicalDeviceId>(device_id),
+        ResourceKind::NativeControl,
+    };
+    return {
+        resource.receiver_id,
+        resource.generation_id,
+        resource.device_id,
+        text<EndpointId>(endpoint_id),
+        kind,
+        number<VendorId>(0x1532),
+        number<ProductId>(product_id),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, token_fill)),
+        resource,
+    };
+}
+
+std::vector<hyperflux::v7::NativeRoute> routes()
+{
+    return {
+        route(
+            hyperflux::DeviceKind::Mouse,
+            "mouse-00cd",
+            "endpoint-mouse",
+            RAZER_BASILISK_V3_PRO_35K_WIRELESS_PID,
+            'a'),
+        route(
+            hyperflux::DeviceKind::Keyboard,
+            "keyboard-0296",
+            "endpoint-keyboard",
+            RAZER_DEATHSTALKER_V2_PRO_TKL_WIRELESS_PID,
+            'b'),
+    };
+}
+
+struct DiscoveryState
+{
+    std::atomic_size_t enumerate_calls {0};
+};
+
+class DiscoveryClient final : public hyperflux::sdk::NativeClientApi
+{
+public:
+    explicit DiscoveryClient(std::shared_ptr<DiscoveryState> state)
+        : state_(std::move(state))
+    {
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> acquire_lease(
+        std::vector<hyperflux::v7::ResourceKey>, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> renew_lease(
+        hyperflux::LeaseId, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> release_lease(
+        hyperflux::LeaseId) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory> native_enumerate() override
+    {
+        const auto sequence = state_->enumerate_calls.fetch_add(1) + 1;
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory>::success(
+            {cursor(sequence), routes()});
+    }
+
+    hyperflux::sdk::Result<hyperflux::sdk::NativeExchangeSubmission>
+    prepare_native_exchange(
+        hyperflux::LeaseId,
+        hyperflux::NativeRouteToken,
+        hyperflux::NativeReportHex,
+        hyperflux::NativeExchangeTimeoutMs) override
+    {
+        return unsupported<hyperflux::sdk::NativeExchangeSubmission>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome> native_transact(
+        const hyperflux::sdk::NativeExchangeSubmission&) override
+    {
+        return unsupported<hyperflux::v7::NativeExchangeOutcome>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch> native_watch(
+        hyperflux::sdk::NativeEventSubscription subscription) override
+    {
+        const auto current = state_->enumerate_calls.load();
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch>::success({
+            subscription.subscription_id.value_or(text<hyperflux::SubscriptionId>("routes-1")),
+            cursor(current),
+            {},
+            number<hyperflux::SequenceNumber>(current),
+            number<hyperflux::SequenceNumber>(current),
+            number<hyperflux::DroppedEventCount>(0),
+            false,
+            false,
+        });
+    }
+
+private:
+    template<typename T>
+    hyperflux::sdk::Result<T> unsupported()
+    {
+        return hyperflux::sdk::Result<T>::failure({
+            hyperflux::sdk::ErrorCode::UnexpectedResponse,
+            "outside native plugin application contract",
+            std::nullopt,
+        });
+    }
+
+    std::shared_ptr<DiscoveryState> state_;
+};
+
+class ScriptedExchange final
+    : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    explicit ScriptedExchange(std::string serial)
+        : serial_(std::move(serial))
+    {
+    }
+
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        auto response = request;
+        response[0] = 0x02;
+        response[5] = 0x00;
+        response[8] = 0x00;
+        if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+        {
+            response[8] = 3;
+            response[9] = 7;
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_SERIAL_STRING)
+        {
+            std::copy(serial_.begin(), serial_.end(), response.begin() + 8);
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_KEYBOARD_INFO)
+        {
+            response[8] = RAZER_KEYBOARD_LAYOUT_US;
+            response[9] = RAZER_KEYBOARD_VARIANT_BLACK;
+        }
+        return {
+            hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+            response,
+        };
+    }
+
+private:
+    std::string serial_;
+};
+
+struct HostState
+{
+    std::mutex mutex;
+    hyperflux::openrgb::native::DetectionCallback start = nullptr;
+    hyperflux::openrgb::native::DetectionCallback end = nullptr;
+    void* start_context = nullptr;
+    void* end_context = nullptr;
+    std::set<RGBController*> controllers;
+    std::set<std::uintptr_t> original_identities;
+    std::size_t register_calls = 0;
+    std::size_t unregister_calls = 0;
+    std::size_t waits = 0;
+    bool valid = true;
+};
+
+class Host final : public hyperflux::openrgb::native::NativePluginHost
+{
+public:
+    explicit Host(std::shared_ptr<HostState> state)
+        : state_(std::move(state))
+    {
+    }
+
+    void register_controller(RGBController& controller) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        if(!state_->controllers.insert(&controller).second)
+        {
+            state_->valid = false;
+        }
+        state_->original_identities.insert(reinterpret_cast<std::uintptr_t>(&controller));
+        ++state_->register_calls;
+    }
+
+    void unregister_controller(RGBController& controller) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        if(state_->controllers.erase(&controller) != 1)
+        {
+            state_->valid = false;
+        }
+        ++state_->unregister_calls;
+    }
+
+    std::vector<RGBController*> controllers() const override
+    {
+        std::lock_guard lock(state_->mutex);
+        return {state_->controllers.begin(), state_->controllers.end()};
+    }
+
+    void register_detection_start(
+        hyperflux::openrgb::native::DetectionCallback callback,
+        void* context) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        state_->start = callback;
+        state_->start_context = context;
+    }
+
+    void register_detection_end(
+        hyperflux::openrgb::native::DetectionCallback callback,
+        void* context) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        state_->end = callback;
+        state_->end_context = context;
+    }
+
+    void unregister_detection_start(
+        hyperflux::openrgb::native::DetectionCallback callback,
+        void* context) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        if(state_->start != callback || state_->start_context != context)
+        {
+            state_->valid = false;
+        }
+        state_->start = nullptr;
+        state_->start_context = nullptr;
+    }
+
+    void unregister_detection_end(
+        hyperflux::openrgb::native::DetectionCallback callback,
+        void* context) noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        if(state_->end != callback || state_->end_context != context)
+        {
+            state_->valid = false;
+        }
+        state_->end = nullptr;
+        state_->end_context = nullptr;
+    }
+
+    void wait_for_detection() noexcept override
+    {
+        std::lock_guard lock(state_->mutex);
+        ++state_->waits;
+    }
+
+private:
+    std::shared_ptr<HostState> state_;
+};
+
+template<typename Predicate>
+bool wait_until(Predicate predicate)
+{
+    for(std::size_t attempt = 0; attempt < 2'000; ++attempt)
+    {
+        QCoreApplication::processEvents();
+        if(predicate())
+        {
+            return true;
+        }
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    QCoreApplication::processEvents();
+    return predicate();
+}
+
+void detection(const std::shared_ptr<HostState>& state, bool start)
+{
+    hyperflux::openrgb::native::DetectionCallback callback = nullptr;
+    void* context = nullptr;
+    {
+        std::lock_guard lock(state->mutex);
+        callback = start ? state->start : state->end;
+        context = start ? state->start_context : state->end_context;
+    }
+    if(callback != nullptr)
+    {
+        callback(context);
+    }
+}
+
+} // namespace
+
+int main(int argc, char** argv)
+{
+    QCoreApplication application(argc, argv);
+    using namespace hyperflux;
+    using namespace hyperflux::openrgb::native;
+
+    auto host_state = std::make_shared<HostState>();
+    auto discovery_state = std::make_shared<DiscoveryState>();
+    std::atomic_size_t notifications {0};
+    NativePluginRuntimeFactories factories {
+        [discovery_state]() -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+        {
+            std::unique_ptr<sdk::NativeClientApi> client =
+                std::make_unique<DiscoveryClient>(discovery_state);
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::success(
+                std::move(client));
+        },
+        [](const NativeRouteIdentity& identity)
+            -> sdk::Result<std::unique_ptr<NativeFeatureExchange>>
+        {
+            const auto serial = identity.device_kind == DeviceKind::Mouse
+                                    ? "MOUSE-SERIAL-0001"
+                                    : "KEYBOARD-SERIAL-0001";
+            std::unique_ptr<NativeFeatureExchange> exchange =
+                std::make_unique<ScriptedExchange>(serial);
+            return sdk::Result<std::unique_ptr<NativeFeatureExchange>>::success(
+                std::move(exchange));
+        },
+    };
+    UpstreamRazerCoordinatorConfig config;
+    config.worker = {1, 1, 4, 8};
+    config.on_state_changed = [&notifications]
+    {
+        notifications.fetch_add(1, std::memory_order_relaxed);
+    };
+    OpenRgbNativePluginApplication plugin(std::move(factories), std::move(config));
+
+    if(!plugin.load(std::make_unique<Host>(host_state))
+       || !wait_until([&]
+       {
+           return plugin.status().coordinator.registered_controllers == 2;
+       }))
+    {
+        return failure(__LINE__);
+    }
+    std::set<std::uintptr_t> original;
+    {
+        std::lock_guard lock(host_state->mutex);
+        if(!host_state->valid || host_state->controllers.size() != 2
+           || notifications.load(std::memory_order_relaxed) == 0)
+        {
+            return failure(__LINE__);
+        }
+        original = host_state->original_identities;
+    }
+
+    plugin.request_rescan();
+    if(!wait_until([&] { return discovery_state->enumerate_calls.load() >= 2; })
+       || plugin.controllers().size() != 2)
+    {
+        return failure(__LINE__);
+    }
+
+    detection(host_state, true);
+    detection(host_state, true);
+    {
+        std::lock_guard lock(host_state->mutex);
+        if(!host_state->controllers.empty() || host_state->unregister_calls != 2
+           || !plugin.status().coordinator.detection_suspended)
+        {
+            return failure(__LINE__);
+        }
+    }
+    detection(host_state, false);
+    detection(host_state, false);
+    if(!wait_until([&]
+       {
+           std::lock_guard lock(host_state->mutex);
+           return host_state->controllers.size() == 2;
+       }))
+    {
+        return failure(__LINE__);
+    }
+    {
+        std::lock_guard lock(host_state->mutex);
+        std::set<std::uintptr_t> current;
+        for(const auto* controller : host_state->controllers)
+        {
+            current.insert(reinterpret_cast<std::uintptr_t>(controller));
+        }
+        if(!host_state->valid || current != original || host_state->register_calls != 4
+           || plugin.status().coordinator.detection_suspended)
+        {
+            return failure(__LINE__);
+        }
+    }
+
+    plugin.unload();
+    plugin.unload();
+    QCoreApplication::processEvents();
+    {
+        std::lock_guard lock(host_state->mutex);
+        if(!host_state->valid || !host_state->controllers.empty()
+           || host_state->start != nullptr || host_state->end != nullptr
+           || host_state->waits != 1 || host_state->unregister_calls != 4)
+        {
+            return failure(__LINE__);
+        }
+    }
+    if(plugin.status().loaded || !plugin.controllers().empty())
+    {
+        return failure(__LINE__);
+    }
+    return EXIT_SUCCESS;
+}
diff --git a/tests/cpp/openrgb_native_razer_presentation_contract.cpp b/tests/cpp/openrgb_native_razer_presentation_contract.cpp
new file mode 100644
index 0000000..bf0918f
--- /dev/null
+++ b/tests/cpp/openrgb_native_razer_presentation_contract.cpp
@@ -0,0 +1,163 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/razer_feature_transport.hpp>
+
+#include "RGBController_Razer.h"
+#include "RazerDevices.h"
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace
+{
+
+class ScriptedRazerExchange final
+    : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        requests.push_back(request);
+        auto response = request;
+        response[0] = 0x02;
+        response[5] = 0x00;
+        response[8] = 0x00;
+        if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+        {
+            response[8] = 3;
+            response[9] = 7;
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_SERIAL_STRING)
+        {
+            constexpr char serial[] = "HFX-NATIVE-SERIAL-0001";
+            std::copy_n(
+                reinterpret_cast<const std::uint8_t*>(serial),
+                sizeof(serial) - 1,
+                response.begin() + 8);
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_KEYBOARD_INFO)
+        {
+            response[8] = RAZER_KEYBOARD_LAYOUT_US;
+            response[9] = RAZER_KEYBOARD_VARIANT_BLACK;
+        }
+        return {
+            hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+            response,
+        };
+    }
+
+    std::vector<std::array<std::uint8_t,
+        hyperflux::openrgb::native::razer_native_report_bytes>> requests;
+};
+
+RGBController_Razer make_controller(
+    ScriptedRazerExchange& exchange,
+    unsigned short product_id,
+    const char* name)
+{
+    auto transport =
+        std::make_unique<hyperflux::openrgb::native::HyperFluxRazerFeatureTransport>(
+            exchange);
+    return RGBController_Razer(new RazerController(
+        nullptr,
+        nullptr,
+        "hyperflux-next/native/v1/route",
+        product_id,
+        name,
+        std::move(transport)));
+}
+
+const mode* find_mode(const RGBController_Razer& controller, std::string_view name)
+{
+    const auto found = std::find_if(
+        controller.modes.begin(),
+        controller.modes.end(),
+        [name](const mode& candidate) { return candidate.name == name; });
+    return found == controller.modes.end() ? nullptr : &*found;
+}
+
+} // namespace
+
+int main()
+{
+    ScriptedRazerExchange mouse_exchange;
+    auto mouse = make_controller(
+        mouse_exchange,
+        RAZER_BASILISK_V3_PRO_35K_WIRELESS_PID,
+        "Razer Basilisk V3 Pro 35K (Wireless)");
+
+    if(mouse.name != "Razer Basilisk V3 Pro 35K (Wireless)"
+       || mouse.vendor != "Razer" || mouse.type != DEVICE_TYPE_MOUSE
+       || mouse.location != "HID: hyperflux-next/native/v1/route"
+       || mouse.version != "v3.7" || mouse.serial != "HFX-NATIVE-SERIAL-0001"
+       || mouse.zones.size() != 3 || mouse.leds.size() != 13
+       || mouse.zones[0].name != "Scroll Wheel" || mouse.zones[0].leds_count != 1
+       || mouse.zones[1].name != "Logo" || mouse.zones[1].leds_count != 1
+       || mouse.zones[2].name != "LED Strip" || mouse.zones[2].leds_count != 11)
+    {
+        return 1;
+    }
+    if(mouse.modes.size() != 5 || find_mode(mouse, "Direct") == nullptr
+       || find_mode(mouse, "Off") == nullptr || find_mode(mouse, "Static") == nullptr
+       || find_mode(mouse, "Spectrum Cycle") == nullptr
+       || find_mode(mouse, "Wave") == nullptr
+       || find_mode(mouse, "Breathing") != nullptr
+       || find_mode(mouse, "Reactive") != nullptr)
+    {
+        return 2;
+    }
+    const auto* mouse_direct = find_mode(mouse, "Direct");
+    const auto* mouse_wave = find_mode(mouse, "Wave");
+    if(mouse_direct == nullptr || mouse_wave == nullptr
+       || (mouse_direct->flags & MODE_FLAG_HAS_PER_LED_COLOR) == 0
+       || (mouse_direct->flags & MODE_FLAG_HAS_BRIGHTNESS) == 0
+       || mouse_direct->brightness_min != 0 || mouse_direct->brightness_max != 255
+       || (mouse_wave->flags & MODE_FLAG_HAS_DIRECTION_LR) == 0)
+    {
+        return 3;
+    }
+
+    ScriptedRazerExchange keyboard_exchange;
+    auto keyboard = make_controller(
+        keyboard_exchange,
+        RAZER_DEATHSTALKER_V2_PRO_TKL_WIRELESS_PID,
+        "Razer DeathStalker V2 Pro TKL (Wireless)");
+
+    if(keyboard.name != "Razer DeathStalker V2 Pro TKL (Wireless)"
+       || keyboard.type != DEVICE_TYPE_KEYBOARD
+       || keyboard.description != "Razer Device, US (ANSI), Black"
+       || keyboard.zones.size() != 1 || keyboard.leds.size() != 102
+       || keyboard.zones.front().name != ZONE_EN_KEYBOARD
+       || keyboard.zones.front().type != ZONE_TYPE_MATRIX
+       || keyboard.zones.front().leds_count != 102
+       || keyboard.zones.front().matrix_map == nullptr
+       || keyboard.zones.front().matrix_map->height != 6
+       || keyboard.zones.front().matrix_map->width != 17
+       || std::none_of(
+              keyboard.leds.begin(),
+              keyboard.leds.end(),
+              [](const led& candidate) { return candidate.name == "Key: 0"; }))
+    {
+        return 4;
+    }
+    if(keyboard.modes.size() != 6 || find_mode(keyboard, "Direct") == nullptr
+       || find_mode(keyboard, "Off") == nullptr
+       || find_mode(keyboard, "Static") == nullptr
+       || find_mode(keyboard, "Breathing") == nullptr
+       || find_mode(keyboard, "Spectrum Cycle") == nullptr
+       || find_mode(keyboard, "Wave") == nullptr
+       || find_mode(keyboard, "Reactive") != nullptr)
+    {
+        return 5;
+    }
+
+    return 0;
+}
diff --git a/tests/cpp/openrgb_native_razer_upstream_contract.cpp b/tests/cpp/openrgb_native_razer_upstream_contract.cpp
new file mode 100644
index 0000000..3eaf2a5
--- /dev/null
+++ b/tests/cpp/openrgb_native_razer_upstream_contract.cpp
@@ -0,0 +1,137 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/razer_feature_transport.hpp>
+
+#include "RazerDevices.h"
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <cstring>
+#include <memory>
+#include <string>
+#include <vector>
+
+namespace
+{
+
+class ScriptedRazerExchange final
+    : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        requests.push_back(request);
+        auto response = request;
+        response[0] = 0x02;
+        response[5] = 0x00;
+        response[8] = 0x00;
+        if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+        {
+            response[8] = 3;
+            response[9] = 7;
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_SERIAL_STRING)
+        {
+            constexpr char serial[] = "HFX-NATIVE-SERIAL-0001";
+            std::copy_n(
+                reinterpret_cast<const std::uint8_t*>(serial),
+                sizeof(serial) - 1,
+                response.begin() + 8);
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_KEYBOARD_INFO)
+        {
+            response[8] = RAZER_KEYBOARD_LAYOUT_US;
+            response[9] = RAZER_KEYBOARD_VARIANT_BLACK;
+        }
+        return {
+            hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+            response,
+        };
+    }
+
+    std::vector<std::array<std::uint8_t,
+        hyperflux::openrgb::native::razer_native_report_bytes>> requests;
+};
+
+std::unique_ptr<RazerController> controller(
+    ScriptedRazerExchange& exchange,
+    unsigned short product_id,
+    const char* name)
+{
+    auto transport =
+        std::make_unique<hyperflux::openrgb::native::HyperFluxRazerFeatureTransport>(
+            exchange);
+    return std::make_unique<RazerController>(
+        nullptr,
+        nullptr,
+        "hyperflux-next/native/v1/route",
+        product_id,
+        name,
+        std::move(transport));
+}
+
+bool command_seen(const ScriptedRazerExchange& exchange, std::uint8_t command)
+{
+    return std::any_of(
+        exchange.requests.begin(),
+        exchange.requests.end(),
+        [command](const auto& request) { return request[7] == command; });
+}
+
+} // namespace
+
+int main()
+{
+    ScriptedRazerExchange mouse_exchange;
+    auto mouse = controller(
+        mouse_exchange,
+        RAZER_BASILISK_V3_PRO_35K_WIRELESS_PID,
+        "Razer Basilisk V3 Pro 35K (Wireless)");
+    if(mouse->GetDeviceType() != DEVICE_TYPE_MOUSE
+       || mouse->GetName() != "Razer Basilisk V3 Pro 35K (Wireless)"
+       || mouse->GetDeviceLocation()
+           != "HID: hyperflux-next/native/v1/route"
+       || mouse->GetFirmwareString() != "v3.7"
+       || mouse->GetSerialString() != "HFX-NATIVE-SERIAL-0001"
+       || mouse->GetMaxBrightness() != 255
+       || mouse->SupportsBreathing() || !mouse->SupportsWave()
+       || mouse->SupportsReactive())
+    {
+        return 1;
+    }
+    mouse->SetBrightness(127);
+    mouse->SetModeStatic(0x11, 0x22, 0x33);
+    mouse->SetModeSpectrumCycle();
+    mouse->SetModeWave(1);
+    mouse->SetModeOff();
+    if(mouse_exchange.requests.size() < 7
+       || !command_seen(mouse_exchange, RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+       || !command_seen(mouse_exchange, RAZER_COMMAND_ID_GET_SERIAL_STRING))
+    {
+        return 2;
+    }
+
+    ScriptedRazerExchange keyboard_exchange;
+    auto keyboard = controller(
+        keyboard_exchange,
+        RAZER_DEATHSTALKER_V2_PRO_TKL_WIRELESS_PID,
+        "Razer DeathStalker V2 Pro TKL (Wireless)");
+    if(keyboard->GetDeviceType() != DEVICE_TYPE_KEYBOARD
+       || keyboard->GetKeyboardLayoutType() != RAZER_LAYOUT_TYPE_ANSI
+       || keyboard->GetKeyboardLayoutString() != "US (ANSI)"
+       || keyboard->GetVariantName() != "Black"
+       || !keyboard->SupportsBreathing() || !keyboard->SupportsWave()
+       || keyboard->SupportsReactive())
+    {
+        return 3;
+    }
+    if(!command_seen(keyboard_exchange, RAZER_COMMAND_ID_GET_KEYBOARD_INFO))
+    {
+        return 4;
+    }
+    return 0;
+}
diff --git a/tests/cpp/openrgb_native_route_session_contract.cpp b/tests/cpp/openrgb_native_route_session_contract.cpp
new file mode 100644
index 0000000..06c8fd8
--- /dev/null
+++ b/tests/cpp/openrgb_native_route_session_contract.cpp
@@ -0,0 +1,359 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_route_session.hpp>
+
+#include <chrono>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <variant>
+#include <vector>
+
+namespace
+{
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+hyperflux::v7::EventCursor cursor()
+{
+    using namespace hyperflux;
+    return {
+        text<StreamId>("native-routes"),
+        number<StreamEpoch>(1),
+        number<ProjectionRevision>(1),
+        number<SequenceNumber>(1),
+    };
+}
+
+hyperflux::v7::NativeRoute route()
+{
+    using namespace hyperflux;
+    const v7::ResourceKey resource {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(4),
+        text<LogicalDeviceId>("mouse-00cd"),
+        ResourceKind::NativeControl,
+    };
+    return {
+        resource.receiver_id,
+        resource.generation_id,
+        resource.device_id,
+        text<EndpointId>("endpoint-mouse"),
+        DeviceKind::Mouse,
+        number<VendorId>(0x1532),
+        number<ProductId>(0x00cd),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, 'a')),
+        resource,
+    };
+}
+
+enum class Outcome
+{
+    Matched,
+    NotSent,
+    MayHaveBeenSent,
+    TransportError,
+    MismatchedIdentity,
+    MalformedResponse,
+};
+
+struct Counters
+{
+    std::size_t enumerated = 0;
+    std::size_t acquired = 0;
+    std::size_t renewed = 0;
+    std::size_t released = 0;
+    std::size_t prepared = 0;
+    std::size_t transacted = 0;
+};
+
+class FakeClient final : public hyperflux::sdk::NativeClientApi
+{
+public:
+    FakeClient(
+        std::shared_ptr<Counters> counters,
+        hyperflux::v7::NativeRoute route_value,
+        Outcome outcome,
+        bool grant = true)
+        : counters_(std::move(counters)),
+          route_(std::move(route_value)),
+          outcome_(outcome),
+          grant_(grant)
+    {
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> acquire_lease(
+        std::vector<hyperflux::v7::ResourceKey> resources,
+        hyperflux::LeaseDurationMs) override
+    {
+        ++counters_->acquired;
+        if(!grant_)
+        {
+            return hyperflux::sdk::Result<hyperflux::v7::LeaseResult>::success(
+                hyperflux::v7::LeaseResultRejected {
+                    {
+                        hyperflux::ProtocolErrorKind::OwnershipConflict,
+                        text<hyperflux::FindingId>("HFX-TEST-LEASE"),
+                    },
+                });
+        }
+        return hyperflux::sdk::Result<hyperflux::v7::LeaseResult>::success(
+            hyperflux::v7::LeaseResultGranted {
+                {
+                    text<hyperflux::LeaseId>("lease-1"),
+                    text<hyperflux::ClientId>("openrgb-native-route"),
+                    std::move(resources),
+                    number<hyperflux::MonotonicMs>(30'000),
+                    hyperflux::LeaseState::Granted,
+                },
+            });
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> renew_lease(
+        hyperflux::LeaseId,
+        hyperflux::LeaseDurationMs) override
+    {
+        ++counters_->renewed;
+        return hyperflux::sdk::Result<hyperflux::v7::LeaseResult>::success(
+            hyperflux::v7::LeaseResultGranted {
+                {
+                    text<hyperflux::LeaseId>("lease-1"),
+                    text<hyperflux::ClientId>("openrgb-native-route"),
+                    {*route_.resource},
+                    number<hyperflux::MonotonicMs>(60'000),
+                    hyperflux::LeaseState::Renewed,
+                },
+            });
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> release_lease(
+        hyperflux::LeaseId) override
+    {
+        ++counters_->released;
+        return hyperflux::sdk::Result<hyperflux::v7::LeaseResult>::success(
+            hyperflux::v7::LeaseResultGranted {
+                {
+                    text<hyperflux::LeaseId>("lease-1"),
+                    text<hyperflux::ClientId>("openrgb-native-route"),
+                    {*route_.resource},
+                    number<hyperflux::MonotonicMs>(60'000),
+                    hyperflux::LeaseState::Released,
+                },
+            });
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory> native_enumerate() override
+    {
+        ++counters_->enumerated;
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory>::success(
+            {cursor(), {route_}});
+    }
+
+    hyperflux::sdk::Result<hyperflux::sdk::NativeExchangeSubmission>
+    prepare_native_exchange(
+        hyperflux::LeaseId lease_id,
+        hyperflux::NativeRouteToken route_token,
+        hyperflux::NativeReportHex report,
+        hyperflux::NativeExchangeTimeoutMs timeout_ms) override
+    {
+        ++counters_->prepared;
+        return hyperflux::sdk::Result<hyperflux::sdk::NativeExchangeSubmission>::success({
+            text<hyperflux::RequestId>("request-1"),
+            std::move(lease_id),
+            std::move(route_token),
+            std::move(report),
+            timeout_ms,
+        });
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome> native_transact(
+        const hyperflux::sdk::NativeExchangeSubmission& submission) override
+    {
+        ++counters_->transacted;
+        if(outcome_ == Outcome::TransportError)
+        {
+            return hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome>::failure({
+                hyperflux::sdk::ErrorCode::ReadFailed,
+                "test transport failed after submission",
+                std::nullopt,
+            });
+        }
+        auto request_id = submission.request_id;
+        auto token = submission.route_token;
+        if(outcome_ == Outcome::MismatchedIdentity)
+        {
+            request_id = text<hyperflux::RequestId>("wrong-request");
+        }
+        if(outcome_ == Outcome::NotSent)
+        {
+            return hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome>::success({
+                request_id,
+                token,
+                hyperflux::v7::NativeExchangeResultNotSent {
+                    {
+                        hyperflux::ProtocolErrorKind::TransportFailure,
+                        text<hyperflux::FindingId>("HFX-TEST-NOT-SENT"),
+                    },
+                },
+            });
+        }
+        if(outcome_ == Outcome::MayHaveBeenSent)
+        {
+            return hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome>::success({
+                request_id,
+                token,
+                hyperflux::v7::NativeExchangeResultMayHaveBeenSent {
+                    {
+                        hyperflux::ProtocolErrorKind::OutcomeUnknown,
+                        text<hyperflux::FindingId>("HFX-TEST-UNCERTAIN"),
+                    },
+                },
+            });
+        }
+        const auto response = outcome_ == Outcome::MalformedResponse
+            ? std::string(180, 'z')
+            : std::string(180, 'f');
+        return hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome>::success({
+            request_id,
+            token,
+            hyperflux::v7::NativeExchangeResultMatchedResponse {
+                {text<hyperflux::NativeReportHex>(response)},
+            },
+        });
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch> native_watch(
+        hyperflux::sdk::NativeEventSubscription) override
+    {
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch>::failure({
+            hyperflux::sdk::ErrorCode::UnexpectedResponse,
+            "watch is outside this contract",
+            std::nullopt,
+        });
+    }
+
+private:
+    std::shared_ptr<Counters> counters_;
+    hyperflux::v7::NativeRoute route_;
+    Outcome outcome_;
+    bool grant_;
+};
+
+hyperflux::openrgb::native::NativeExchangeCertainty run_outcome(Outcome outcome)
+{
+    auto counters = std::make_shared<Counters>();
+    auto route_value = route();
+    auto session = hyperflux::openrgb::native::SdkNativeFeatureExchange::create(
+        std::make_unique<FakeClient>(counters, route_value, outcome),
+        hyperflux::openrgb::native::native_route_identity(route_value));
+    if(!session)
+    {
+        throw std::runtime_error("test session did not initialize");
+    }
+    std::array<std::uint8_t, hyperflux::openrgb::native::razer_native_report_bytes> report {};
+    return session.value()->exchange(report).certainty;
+}
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux;
+    using namespace hyperflux::openrgb::native;
+    auto now = std::chrono::steady_clock::time_point {};
+    auto counters = std::make_shared<Counters>();
+    auto route_value = route();
+    {
+        auto session = SdkNativeFeatureExchange::create(
+            std::make_unique<FakeClient>(counters, route_value, Outcome::Matched),
+            native_route_identity(route_value),
+            [&now] { return now; });
+        if(!session || counters->enumerated != 1 || counters->acquired != 1)
+        {
+            return 1;
+        }
+        std::array<std::uint8_t, razer_native_report_bytes> report {};
+        report[0] = 0x02;
+        const auto first = session.value()->exchange(report);
+        if(first.certainty != NativeExchangeCertainty::MatchedResponse
+           || first.response.front() != 0xff || first.response.back() != 0xff
+           || counters->prepared != 1 || counters->transacted != 1
+           || counters->renewed != 0)
+        {
+            return 2;
+        }
+        now += std::chrono::seconds(11);
+        const auto renewed = session.value()->exchange(report);
+        if(renewed.certainty != NativeExchangeCertainty::MatchedResponse
+           || counters->renewed != 1 || counters->transacted != 2)
+        {
+            return 3;
+        }
+    }
+    if(counters->released != 1)
+    {
+        return 4;
+    }
+    if(run_outcome(Outcome::NotSent) != NativeExchangeCertainty::NotSent
+       || run_outcome(Outcome::MayHaveBeenSent)
+           != NativeExchangeCertainty::MayHaveBeenSent
+       || run_outcome(Outcome::TransportError)
+           != NativeExchangeCertainty::MayHaveBeenSent
+       || run_outcome(Outcome::MismatchedIdentity)
+           != NativeExchangeCertainty::MayHaveBeenSent
+       || run_outcome(Outcome::MalformedResponse)
+           != NativeExchangeCertainty::MayHaveBeenSent)
+    {
+        return 5;
+    }
+
+    auto stale = route();
+    auto expected = native_route_identity(stale);
+    expected.generation_id = number<GenerationId>(99);
+    auto missing = SdkNativeFeatureExchange::create(
+        std::make_unique<FakeClient>(
+            std::make_shared<Counters>(), stale, Outcome::Matched),
+        expected);
+    if(missing || missing.error().code != sdk::ErrorCode::InvalidController)
+    {
+        return 6;
+    }
+    auto denied_route = route();
+    auto denied = SdkNativeFeatureExchange::create(
+        std::make_unique<FakeClient>(
+            std::make_shared<Counters>(), denied_route, Outcome::Matched, false),
+        native_route_identity(denied_route));
+    if(denied || denied.error().code != sdk::ErrorCode::OwnershipConflict)
+    {
+        return 7;
+    }
+    return 0;
+}
diff --git a/tests/cpp/openrgb_native_route_worker_contract.cpp b/tests/cpp/openrgb_native_route_worker_contract.cpp
new file mode 100644
index 0000000..7fa3c15
--- /dev/null
+++ b/tests/cpp/openrgb_native_route_worker_contract.cpp
@@ -0,0 +1,342 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/native_route_worker.hpp>
+
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <thread>
+#include <utility>
+#include <vector>
+
+namespace
+{
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+hyperflux::v7::EventCursor cursor(std::uint64_t sequence)
+{
+    using namespace hyperflux;
+    return {
+        text<StreamId>("native-routes"),
+        number<StreamEpoch>(1),
+        number<ProjectionRevision>(1),
+        number<SequenceNumber>(sequence),
+    };
+}
+
+hyperflux::v7::NativeRoute route(std::string_view device_id, std::uint16_t product_id)
+{
+    using namespace hyperflux;
+    const auto kind = product_id == 0x00cd ? DeviceKind::Mouse : DeviceKind::Keyboard;
+    const v7::ResourceKey resource {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(4),
+        text<LogicalDeviceId>(device_id),
+        ResourceKind::NativeControl,
+    };
+    return {
+        resource.receiver_id,
+        resource.generation_id,
+        resource.device_id,
+        text<EndpointId>(kind == DeviceKind::Mouse ? "endpoint-mouse" : "endpoint-keyboard"),
+        kind,
+        number<VendorId>(0x1532),
+        number<ProductId>(product_id),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, kind == DeviceKind::Mouse ? 'a' : 'b')),
+        resource,
+    };
+}
+
+struct FakeState
+{
+    std::mutex mutex;
+    std::size_t enumerate_calls = 0;
+    std::size_t watch_calls = 0;
+};
+
+class FakeClient final : public hyperflux::sdk::NativeClientApi
+{
+public:
+    explicit FakeClient(std::shared_ptr<FakeState> state)
+        : state_(std::move(state))
+    {
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> acquire_lease(
+        std::vector<hyperflux::v7::ResourceKey>, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> renew_lease(
+        hyperflux::LeaseId, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> release_lease(
+        hyperflux::LeaseId) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory> native_enumerate() override
+    {
+        std::lock_guard lock(state_->mutex);
+        ++state_->enumerate_calls;
+        if(state_->enumerate_calls == 1)
+        {
+            return hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory>::success(
+                {cursor(1), {route("mouse-00cd", 0x00cd)}});
+        }
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory>::success(
+            {cursor(2), {route("keyboard-0296", 0x0296)}});
+    }
+
+    hyperflux::sdk::Result<hyperflux::sdk::NativeExchangeSubmission>
+    prepare_native_exchange(
+        hyperflux::LeaseId,
+        hyperflux::NativeRouteToken,
+        hyperflux::NativeReportHex,
+        hyperflux::NativeExchangeTimeoutMs) override
+    {
+        return unsupported<hyperflux::sdk::NativeExchangeSubmission>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome> native_transact(
+        const hyperflux::sdk::NativeExchangeSubmission&) override
+    {
+        return unsupported<hyperflux::v7::NativeExchangeOutcome>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch> native_watch(
+        hyperflux::sdk::NativeEventSubscription) override
+    {
+        std::lock_guard lock(state_->mutex);
+        ++state_->watch_calls;
+        if(state_->watch_calls == 1)
+        {
+            const auto keyboard = route("keyboard-0296", 0x0296);
+            return hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch>::success({
+                text<hyperflux::SubscriptionId>("subscription-1"),
+                cursor(2),
+                {{number<hyperflux::SequenceNumber>(2),
+                    hyperflux::NativeRouteEventKind::Available,
+                    keyboard}},
+                number<hyperflux::SequenceNumber>(1),
+                number<hyperflux::SequenceNumber>(2),
+                number<hyperflux::DroppedEventCount>(0),
+                false,
+                false,
+            });
+        }
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch>::success({
+            text<hyperflux::SubscriptionId>("subscription-2"),
+            cursor(2),
+            {},
+            number<hyperflux::SequenceNumber>(1),
+            number<hyperflux::SequenceNumber>(2),
+            number<hyperflux::DroppedEventCount>(0),
+            false,
+            false,
+        });
+    }
+
+private:
+    template<typename T>
+    hyperflux::sdk::Result<T> unsupported()
+    {
+        return hyperflux::sdk::Result<T>::failure({
+            hyperflux::sdk::ErrorCode::UnexpectedResponse,
+            "outside native route worker contract",
+            std::nullopt,
+        });
+    }
+
+    std::shared_ptr<FakeState> state_;
+};
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux;
+    using namespace hyperflux::openrgb::native;
+
+    auto state = std::make_shared<FakeState>();
+    std::mutex callback_mutex;
+    std::condition_variable callback_wake;
+    std::vector<NativeRouteSnapshot> snapshots;
+    std::size_t factory_calls = 0;
+
+    auto worker = NativeRouteWorker::create(
+        [&]() -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+        {
+            ++factory_calls;
+            if(factory_calls == 1)
+            {
+                return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::failure({
+                    sdk::ErrorCode::SocketConnect,
+                    "expected first connection failure",
+                    std::nullopt,
+                });
+            }
+            std::unique_ptr<sdk::NativeClientApi> client =
+                std::make_unique<FakeClient>(state);
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::success(
+                std::move(client));
+        },
+        {5, 1, 4, 8},
+        {
+            [&](NativeRouteSnapshot snapshot)
+            {
+                {
+                    std::lock_guard lock(callback_mutex);
+                    snapshots.push_back(std::move(snapshot));
+                }
+                callback_wake.notify_all();
+            },
+            [](sdk::Error) {},
+        });
+    if(!worker || !worker.value()->start())
+    {
+        return 1;
+    }
+
+    {
+        std::unique_lock lock(callback_mutex);
+        if(!callback_wake.wait_for(
+               lock,
+               std::chrono::seconds(2),
+               [&] { return snapshots.size() >= 2; }))
+        {
+            worker.value()->stop();
+            return 2;
+        }
+    }
+    worker.value()->stop();
+
+    if(factory_calls != 2 || snapshots.size() < 2
+       || snapshots[0].routes.size() != 1
+       || snapshots[0].routes.front().device_id.value() != "mouse-00cd"
+       || snapshots[1].routes.size() != 1
+       || snapshots[1].routes.front().device_id.value() != "keyboard-0296"
+       || worker.value()->state() != NativeRouteWorkerState::Stopped)
+    {
+        return 3;
+    }
+    {
+        std::lock_guard lock(state->mutex);
+        if(state->enumerate_calls < 2 || state->watch_calls < 1)
+        {
+            return 4;
+        }
+    }
+
+    auto invalid = NativeRouteWorker::create(
+        []() -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+        {
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::failure({
+                sdk::ErrorCode::SocketConnect,
+                "not called",
+                std::nullopt,
+            });
+        },
+        {0, 1, 4, 8});
+    if(invalid)
+    {
+        return 5;
+    }
+
+    auto callback_failure = NativeRouteWorker::create(
+        [state]() -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+        {
+            std::unique_ptr<sdk::NativeClientApi> client =
+                std::make_unique<FakeClient>(state);
+            return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::success(
+                std::move(client));
+        },
+        {5, 1, 4, 8},
+        {
+            [](NativeRouteSnapshot) { throw std::runtime_error("expected callback failure"); },
+            [](sdk::Error) {},
+        });
+    if(!callback_failure || !callback_failure.value()->start())
+    {
+        return 6;
+    }
+    for(std::size_t attempt = 0;
+        attempt < 2'000
+        && callback_failure.value()->state() != NativeRouteWorkerState::Failed;
+        ++attempt)
+    {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    if(callback_failure.value()->state() != NativeRouteWorkerState::Failed
+       || !callback_failure.value()->last_error().has_value())
+    {
+        callback_failure.value()->stop();
+        return 7;
+    }
+    callback_failure.value()->stop();
+
+    auto factory_failure = NativeRouteWorker::create(
+        []() -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+        {
+            throw std::runtime_error("expected factory failure");
+        },
+        {5, 1, 4, 8});
+    if(!factory_failure || !factory_failure.value()->start())
+    {
+        return 8;
+    }
+    for(std::size_t attempt = 0;
+        attempt < 2'000
+        && factory_failure.value()->state() != NativeRouteWorkerState::Failed;
+        ++attempt)
+    {
+        std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
+    if(factory_failure.value()->state() != NativeRouteWorkerState::Failed
+       || !factory_failure.value()->last_error().has_value()
+       || factory_failure.value()->last_error()->message.find("expected factory failure")
+              == std::string::npos)
+    {
+        factory_failure.value()->stop();
+        return 9;
+    }
+    factory_failure.value()->stop();
+
+    return 0;
+}
diff --git a/tests/cpp/openrgb_plugin_view_model_contract.cpp b/tests/cpp/openrgb_plugin_view_model_contract.cpp
index bae960f..713e568 100644
--- a/tests/cpp/openrgb_plugin_view_model_contract.cpp
+++ b/tests/cpp/openrgb_plugin_view_model_contract.cpp
@@ -98,5 +98,52 @@ int main()
     {
         return failure(__LINE__);
     }
+
+#if HFX_OPENRGB_NATIVE_ROUTE_ENABLED
+    NativePluginApplicationStatus native_status;
+    native_status.loaded = true;
+    native_status.coordinator.worker_state = NativeRouteWorkerState::Running;
+    native_status.coordinator.started = true;
+    native_status.coordinator.controllers = 2;
+    native_status.coordinator.registered_controllers = 1;
+    native_status.coordinator.direct_suppressed_controllers = 1;
+    const std::vector<UpstreamRazerControllerSummary> native_controllers {
+        {
+            "receiver-1/mouse-00cd/endpoint-mouse",
+            "Razer Basilisk V3 Pro 35K (Wireless)",
+            DeviceKind::Mouse,
+            hyperflux::test::number<ProductId>(0x00cd),
+            true,
+            false,
+        },
+        {
+            "receiver-1/keyboard-0296/endpoint-keyboard",
+            "Razer DeathStalker V2 Pro TKL (Wireless)",
+            DeviceKind::Keyboard,
+            hyperflux::test::number<ProductId>(0x0296),
+            false,
+            true,
+        },
+    };
+    const auto native_model = make_plugin_information_view_model(
+        native_status, native_controllers);
+    if(native_model.tone != PluginHealthTone::Positive
+       || native_model.headline != "Native transport ready"
+       || native_model.summary
+              != "1 upstream Razer controller is active. 1 matching receiver route is paused for direct USB."
+       || native_model.devices.size() != 2
+       || native_model.lighting_transport.find("standard Feature reports")
+              == std::string::npos
+       || native_model.effects_authority.find("OpenRGB owns hardware modes")
+              == std::string::npos)
+    {
+        return failure(__LINE__);
+    }
+    if(native_model.devices[0].availability != "Direct USB active"
+       || native_model.devices[1].availability != "Available")
+    {
+        return failure(__LINE__);
+    }
+#endif
     return EXIT_SUCCESS;
 }
diff --git a/tests/cpp/openrgb_razer_feature_transport_contract.cpp b/tests/cpp/openrgb_razer_feature_transport_contract.cpp
new file mode 100644
index 0000000..7ef5afa
--- /dev/null
+++ b/tests/cpp/openrgb_razer_feature_transport_contract.cpp
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/razer_feature_transport.hpp>
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+
+namespace
+{
+
+class FakeExchange final : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        ++calls;
+        observed = request;
+        return next;
+    }
+
+    std::size_t calls = 0;
+    std::array<std::uint8_t,
+        hyperflux::openrgb::native::razer_native_report_bytes> observed {};
+    hyperflux::openrgb::native::NativeFeatureExchangeResult next {
+        hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+        {},
+    };
+};
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux::openrgb::native;
+    FakeExchange exchange;
+    for(std::size_t index = 0; index < exchange.next.response.size(); ++index)
+    {
+        exchange.next.response[index] = static_cast<std::uint8_t>(index);
+    }
+    HyperFluxRazerFeatureTransport transport(exchange);
+    std::array<unsigned char, razer_hid_report_bytes> request {};
+    request[0] = 0x07;
+    for(std::size_t index = 1; index < request.size(); ++index)
+    {
+        request[index] = static_cast<unsigned char>(index + 2);
+    }
+    if(transport.SendFeatureReport(request.data(), request.size())
+       != static_cast<int>(request.size()))
+    {
+        return 1;
+    }
+    if(exchange.calls != 1 || exchange.observed.front() != request[1]
+       || exchange.observed.back() != request.back())
+    {
+        return 2;
+    }
+    exchange.next.response.fill(0xaa);
+    if(transport.SendFeatureReport(request.data(), request.size())
+           != static_cast<int>(request.size())
+       || exchange.calls != 2)
+    {
+        return 3;
+    }
+
+    std::array<unsigned char, razer_hid_report_bytes> response {};
+    response[0] = 0x08;
+    if(transport.GetFeatureReport(response.data(), response.size())
+           != static_cast<int>(response.size())
+       || response[0] != 0x08 || response[1] != 0xaa || response.back() != 0xaa)
+    {
+        return 4;
+    }
+    if(transport.GetFeatureReport(response.data(), response.size()) != -1)
+    {
+        return 5;
+    }
+
+    exchange.next.certainty = NativeExchangeCertainty::NotSent;
+    if(transport.SendFeatureReport(request.data(), request.size()) != -1)
+    {
+        return 6;
+    }
+    exchange.next.certainty = NativeExchangeCertainty::MayHaveBeenSent;
+    if(transport.SendFeatureReport(request.data(), request.size()) != -1)
+    {
+        return 7;
+    }
+    exchange.next.certainty = NativeExchangeCertainty::MatchedResponse;
+    if(transport.SendFeatureReport(request.data(), request.size() - 1) != -1
+       || transport.SendFeatureReport(nullptr, request.size()) != -1
+       || transport.GetFeatureReport(nullptr, response.size()) != -1
+       || transport.SendArgbFeatureReport(request.data(), request.size()) != -1)
+    {
+        return 8;
+    }
+    return 0;
+}
diff --git a/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp b/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
new file mode 100644
index 0000000..8642654
--- /dev/null
+++ b/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
@@ -0,0 +1,384 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/upstream_razer_coordinator.hpp>
+
+#include "RGBController.h"
+#include "RazerDevices.h"
+
+#include <algorithm>
+#include <array>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <deque>
+#include <functional>
+#include <memory>
+#include <mutex>
+#include <optional>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <utility>
+#include <vector>
+
+namespace
+{
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+hyperflux::v7::EventCursor cursor()
+{
+    using namespace hyperflux;
+    return {
+        text<StreamId>("native-routes"),
+        number<StreamEpoch>(1),
+        number<ProjectionRevision>(1),
+        number<SequenceNumber>(1),
+    };
+}
+
+hyperflux::v7::NativeRoute route(
+    hyperflux::DeviceKind kind,
+    std::string_view device_id,
+    std::string_view endpoint_id,
+    std::uint16_t product_id,
+    char token_fill)
+{
+    using namespace hyperflux;
+    const v7::ResourceKey resource {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(4),
+        text<LogicalDeviceId>(device_id),
+        ResourceKind::NativeControl,
+    };
+    return {
+        resource.receiver_id,
+        resource.generation_id,
+        resource.device_id,
+        text<EndpointId>(endpoint_id),
+        kind,
+        number<VendorId>(0x1532),
+        number<ProductId>(product_id),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, token_fill)),
+        resource,
+    };
+}
+
+std::vector<hyperflux::v7::NativeRoute> routes()
+{
+    return {
+        route(
+            hyperflux::DeviceKind::Keyboard,
+            "keyboard-0296",
+            "endpoint-keyboard",
+            RAZER_DEATHSTALKER_V2_PRO_TKL_WIRELESS_PID,
+            'b'),
+        route(
+            hyperflux::DeviceKind::Mouse,
+            "mouse-00cd",
+            "endpoint-mouse",
+            RAZER_BASILISK_V3_PRO_35K_WIRELESS_PID,
+            'a'),
+    };
+}
+
+class DiscoveryClient final : public hyperflux::sdk::NativeClientApi
+{
+public:
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> acquire_lease(
+        std::vector<hyperflux::v7::ResourceKey>, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> renew_lease(
+        hyperflux::LeaseId, hyperflux::LeaseDurationMs) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::LeaseResult> release_lease(
+        hyperflux::LeaseId) override
+    {
+        return unsupported<hyperflux::v7::LeaseResult>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory> native_enumerate() override
+    {
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteInventory>::success(
+            {cursor(), routes()});
+    }
+
+    hyperflux::sdk::Result<hyperflux::sdk::NativeExchangeSubmission>
+    prepare_native_exchange(
+        hyperflux::LeaseId,
+        hyperflux::NativeRouteToken,
+        hyperflux::NativeReportHex,
+        hyperflux::NativeExchangeTimeoutMs) override
+    {
+        return unsupported<hyperflux::sdk::NativeExchangeSubmission>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeExchangeOutcome> native_transact(
+        const hyperflux::sdk::NativeExchangeSubmission&) override
+    {
+        return unsupported<hyperflux::v7::NativeExchangeOutcome>();
+    }
+
+    hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch> native_watch(
+        hyperflux::sdk::NativeEventSubscription) override
+    {
+        return hyperflux::sdk::Result<hyperflux::v7::NativeRouteEventBatch>::success({
+            text<hyperflux::SubscriptionId>("subscription-1"),
+            cursor(),
+            {},
+            number<hyperflux::SequenceNumber>(1),
+            number<hyperflux::SequenceNumber>(1),
+            number<hyperflux::DroppedEventCount>(0),
+            false,
+            false,
+        });
+    }
+
+private:
+    template<typename T>
+    hyperflux::sdk::Result<T> unsupported()
+    {
+        return hyperflux::sdk::Result<T>::failure({
+            hyperflux::sdk::ErrorCode::UnexpectedResponse,
+            "outside coordinator discovery contract",
+            std::nullopt,
+        });
+    }
+};
+
+class ScriptedExchange final
+    : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    explicit ScriptedExchange(std::string serial)
+        : serial_(std::move(serial))
+    {
+    }
+
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        auto response = request;
+        response[0] = 0x02;
+        response[5] = 0x00;
+        response[8] = 0x00;
+        if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+        {
+            response[8] = 3;
+            response[9] = 7;
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_SERIAL_STRING)
+        {
+            std::copy(serial_.begin(), serial_.end(), response.begin() + 8);
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_KEYBOARD_INFO)
+        {
+            response[8] = RAZER_KEYBOARD_LAYOUT_US;
+            response[9] = RAZER_KEYBOARD_VARIANT_BLACK;
+        }
+        return {
+            hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+            response,
+        };
+    }
+
+private:
+    std::string serial_;
+};
+
+class TestController final : public RGBController
+{
+public:
+    void SetupZones() override {}
+    void ResizeZone(int, int) override {}
+    void DeviceUpdateLEDs() override {}
+    void UpdateZoneLEDs(int) override {}
+    void UpdateSingleLED(int) override {}
+    void DeviceUpdateMode() override {}
+};
+
+class Host final : public hyperflux::openrgb::native::UpstreamPluginHost
+{
+public:
+    void register_controller(RGBController& controller) noexcept override
+    {
+        if(std::find(registered.begin(), registered.end(), &controller) == registered.end())
+        {
+            registered.push_back(&controller);
+        }
+    }
+
+    void unregister_controller(RGBController& controller) noexcept override
+    {
+        registered.erase(
+            std::remove(registered.begin(), registered.end(), &controller),
+            registered.end());
+    }
+
+    std::vector<RGBController*> controllers() const override
+    {
+        auto result = registered;
+        result.insert(result.end(), direct.begin(), direct.end());
+        return result;
+    }
+
+    std::vector<RGBController*> registered;
+    std::vector<RGBController*> direct;
+};
+
+class Dispatcher final : public hyperflux::openrgb::native::ApplicationDispatcher
+{
+public:
+    bool post(std::function<void()> task) noexcept override
+    {
+        try
+        {
+            {
+                std::lock_guard lock(mutex);
+                tasks.push_back(std::move(task));
+            }
+            wake.notify_all();
+            return true;
+        }
+        catch(...)
+        {
+            return false;
+        }
+    }
+
+    bool run_one()
+    {
+        std::function<void()> task;
+        {
+            std::unique_lock lock(mutex);
+            if(!wake.wait_for(
+                   lock,
+                   std::chrono::seconds(2),
+                   [&] { return !tasks.empty(); }))
+            {
+                return false;
+            }
+            task = std::move(tasks.front());
+            tasks.pop_front();
+        }
+        task();
+        return true;
+    }
+
+private:
+    std::mutex mutex;
+    std::condition_variable wake;
+    std::deque<std::function<void()>> tasks;
+};
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux;
+    using namespace hyperflux::openrgb::native;
+
+    Host host;
+    Dispatcher dispatcher;
+    auto discovery_factory = []()
+        -> sdk::Result<std::unique_ptr<sdk::NativeClientApi>>
+    {
+        std::unique_ptr<sdk::NativeClientApi> client =
+            std::make_unique<DiscoveryClient>();
+        return sdk::Result<std::unique_ptr<sdk::NativeClientApi>>::success(
+            std::move(client));
+    };
+    auto exchange_factory = [](const NativeRouteIdentity& identity)
+        -> sdk::Result<std::unique_ptr<NativeFeatureExchange>>
+    {
+        const auto serial = identity.device_kind == DeviceKind::Mouse
+                                ? "MOUSE-SERIAL-0001"
+                                : "KEYBOARD-SERIAL-0001";
+        std::unique_ptr<NativeFeatureExchange> exchange =
+            std::make_unique<ScriptedExchange>(serial);
+        return sdk::Result<std::unique_ptr<NativeFeatureExchange>>::success(
+            std::move(exchange));
+    };
+    auto coordinator = UpstreamRazerPluginCoordinator::create(
+        host,
+        dispatcher,
+        discovery_factory,
+        exchange_factory,
+        {{5, 1, 4, 8}, {}});
+    if(!coordinator || !coordinator.value()->start() || !dispatcher.run_one())
+    {
+        return 1;
+    }
+    auto initial = coordinator.value()->status();
+    if(initial.controllers != 2 || initial.registered_controllers != 2
+       || initial.direct_suppressed_controllers != 0 || host.registered.size() != 2)
+    {
+        return 2;
+    }
+
+    TestController direct_mouse;
+    direct_mouse.vendor = "Razer";
+    direct_mouse.location = "HID: /dev/hidraw-direct-mouse";
+    direct_mouse.serial = "MOUSE-SERIAL-0001     ";
+    coordinator.value()->detection_started();
+    host.direct = {&direct_mouse};
+    coordinator.value()->detection_finished();
+    auto suppressed = coordinator.value()->status();
+    if(suppressed.detection_suspended || suppressed.registered_controllers != 1
+       || suppressed.direct_suppressed_controllers != 1
+       || host.registered.size() != 1
+       || canonical_queried_serial(host.registered.front()->serial)
+              != "KEYBOARD-SERIAL-0001")
+    {
+        return 3;
+    }
+
+    coordinator.value()->detection_started();
+    host.direct.clear();
+    coordinator.value()->detection_finished();
+    auto restored = coordinator.value()->status();
+    if(restored.registered_controllers != 2
+       || restored.direct_suppressed_controllers != 0 || host.registered.size() != 2)
+    {
+        return 4;
+    }
+
+    coordinator.value()->shutdown();
+    if(!coordinator.value()->status().stopped || !host.registered.empty())
+    {
+        return 5;
+    }
+
+    return 0;
+}
diff --git a/tests/cpp/openrgb_upstream_razer_registry_contract.cpp b/tests/cpp/openrgb_upstream_razer_registry_contract.cpp
new file mode 100644
index 0000000..43b082f
--- /dev/null
+++ b/tests/cpp/openrgb_upstream_razer_registry_contract.cpp
@@ -0,0 +1,305 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/openrgb/upstream_razer_registry.hpp>
+
+#include "RGBController.h"
+#include "RazerDevices.h"
+
+#include <algorithm>
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <vector>
+
+namespace
+{
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+hyperflux::v7::NativeRoute route(
+    hyperflux::DeviceKind kind,
+    std::string_view device_id,
+    std::string_view endpoint_id,
+    std::uint16_t product_id,
+    std::uint64_t generation = 4,
+    char token_fill = 'a')
+{
+    using namespace hyperflux;
+    const v7::ResourceKey resource {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(generation),
+        text<LogicalDeviceId>(device_id),
+        ResourceKind::NativeControl,
+    };
+    return {
+        resource.receiver_id,
+        resource.generation_id,
+        resource.device_id,
+        text<EndpointId>(endpoint_id),
+        kind,
+        number<VendorId>(0x1532),
+        number<ProductId>(product_id),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, token_fill)),
+        resource,
+    };
+}
+
+class ScriptedExchange final
+    : public hyperflux::openrgb::native::NativeFeatureExchange
+{
+public:
+    explicit ScriptedExchange(std::string serial)
+        : serial_(std::move(serial))
+    {
+    }
+
+    hyperflux::openrgb::native::NativeFeatureExchangeResult exchange(
+        const std::array<std::uint8_t,
+            hyperflux::openrgb::native::razer_native_report_bytes>& request) override
+    {
+        auto response = request;
+        response[0] = 0x02;
+        response[5] = 0x00;
+        response[8] = 0x00;
+        if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_FIRMWARE_VERSION)
+        {
+            response[8] = 3;
+            response[9] = 7;
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_SERIAL_STRING)
+        {
+            std::copy(serial_.begin(), serial_.end(), response.begin() + 8);
+        }
+        else if(request[6] == 0x00 && request[7] == RAZER_COMMAND_ID_GET_KEYBOARD_INFO)
+        {
+            response[8] = RAZER_KEYBOARD_LAYOUT_US;
+            response[9] = RAZER_KEYBOARD_VARIANT_BLACK;
+        }
+        return {
+            hyperflux::openrgb::native::NativeExchangeCertainty::MatchedResponse,
+            response,
+        };
+    }
+
+private:
+    std::string serial_;
+};
+
+class RecordingHost final : public hyperflux::openrgb::native::UpstreamControllerHost
+{
+public:
+    void register_controller(RGBController& controller) noexcept override
+    {
+        if(std::find(registered.begin(), registered.end(), &controller) == registered.end())
+        {
+            registered.push_back(&controller);
+        }
+    }
+
+    void unregister_controller(RGBController& controller) noexcept override
+    {
+        registered.erase(
+            std::remove(registered.begin(), registered.end(), &controller),
+            registered.end());
+    }
+
+    std::vector<RGBController*> registered;
+};
+
+class TestController final : public RGBController
+{
+public:
+    void SetupZones() override {}
+    void ResizeZone(int, int) override {}
+    void DeviceUpdateLEDs() override {}
+    void UpdateZoneLEDs(int) override {}
+    void UpdateSingleLED(int) override {}
+    void DeviceUpdateMode() override {}
+};
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux;
+    using namespace hyperflux::openrgb::native;
+
+    auto exchange_factory = [](const NativeRouteIdentity& identity)
+        -> sdk::Result<std::unique_ptr<NativeFeatureExchange>>
+    {
+        const auto serial = identity.device_kind == DeviceKind::Mouse
+                                ? "MOUSE-SERIAL-0001"
+                                : "KEYBOARD-SERIAL-0001";
+        std::unique_ptr<NativeFeatureExchange> exchange =
+            std::make_unique<ScriptedExchange>(serial);
+        return sdk::Result<std::unique_ptr<NativeFeatureExchange>>::success(
+            std::move(exchange));
+    };
+    UpstreamRazerControllerFactory factory(exchange_factory);
+    RecordingHost host;
+    UpstreamRazerControllerRegistry registry(host, factory);
+
+    const auto mouse = route(
+        DeviceKind::Mouse,
+        "mouse-00cd",
+        "endpoint-mouse",
+        RAZER_BASILISK_V3_PRO_35K_WIRELESS_PID);
+    const auto keyboard = route(
+        DeviceKind::Keyboard,
+        "keyboard-0296",
+        "endpoint-keyboard",
+        RAZER_DEATHSTALKER_V2_PRO_TKL_WIRELESS_PID,
+        4,
+        'b');
+    auto initial = registry.apply_routes({keyboard, mouse});
+    if(!initial || initial.value().added != 2 || initial.value().registered != 2
+       || registry.size() != 2 || host.registered.size() != 2)
+    {
+        return 1;
+    }
+
+    const auto mouse_identity = registry.controller_identity(
+        "receiver-1/mouse-00cd/endpoint-mouse");
+    if(mouse_identity == 0
+       || registry.serials()
+              != std::vector<std::string> {
+                  "KEYBOARD-SERIAL-0001  ",
+                  "MOUSE-SERIAL-0001     ",
+              })
+    {
+        return 2;
+    }
+
+    const auto unrelated_direct = registry.apply_direct_serials({
+        "",
+        "                      ",
+        "DIFFERENT-SERIAL-SAME-PID-NAME-KIND",
+    });
+    if(unrelated_direct.newly_suppressed != 0 || registry.registered_count() != 2)
+    {
+        return 3;
+    }
+
+    TestController direct_mouse_controller;
+    direct_mouse_controller.vendor = "Razer";
+    direct_mouse_controller.location = "HID: /dev/hidraw-direct-mouse";
+    direct_mouse_controller.serial = "MOUSE-SERIAL-0001     ";
+    TestController network_controller;
+    network_controller.vendor = "Razer";
+    network_controller.location = "Network: 127.0.0.1";
+    network_controller.serial = "MOUSE-SERIAL-0001";
+    TestController unrelated_controller;
+    unrelated_controller.vendor = "Other";
+    unrelated_controller.location = "HID: /dev/hidraw-other";
+    unrelated_controller.serial = "MOUSE-SERIAL-0001";
+    TestController blank_serial_controller;
+    blank_serial_controller.vendor = "Razer";
+    blank_serial_controller.location = "HID: /dev/hidraw-blank";
+    blank_serial_controller.serial = "                      ";
+    const auto direct_serials = collect_direct_razer_serials({
+        &direct_mouse_controller,
+        &network_controller,
+        &unrelated_controller,
+        &blank_serial_controller,
+        nullptr,
+    });
+    if(direct_serials != std::vector<std::string> {"MOUSE-SERIAL-0001"})
+    {
+        return 12;
+    }
+
+    const auto direct_mouse = registry.apply_direct_serials(direct_serials);
+    if(direct_mouse.newly_suppressed != 1 || registry.suppressed_count() != 1
+       || registry.registered_count() != 1 || host.registered.size() != 1
+       || canonical_queried_serial(host.registered.front()->serial)
+              != "KEYBOARD-SERIAL-0001")
+    {
+        return 4;
+    }
+
+    const auto repeat_direct = registry.apply_direct_serials({"MOUSE-SERIAL-0001"});
+    if(repeat_direct.newly_suppressed != 0 || repeat_direct.newly_restored != 0
+       || registry.registered_count() != 1)
+    {
+        return 5;
+    }
+
+    const auto direct_removed = registry.apply_direct_serials({});
+    if(direct_removed.newly_restored != 1 || registry.registered_count() != 2
+       || registry.controller_identity("receiver-1/mouse-00cd/endpoint-mouse")
+              != mouse_identity)
+    {
+        return 6;
+    }
+
+    registry.suspend_for_detection();
+    if(registry.registered_count() != 0 || !host.registered.empty())
+    {
+        return 7;
+    }
+    registry.resume_after_detection();
+    if(registry.registered_count() != 2 || host.registered.size() != 2)
+    {
+        return 8;
+    }
+
+    auto next_mouse = mouse;
+    next_mouse.generation_id = number<GenerationId>(5);
+    next_mouse.route_token = text<NativeRouteToken>(std::string(64, 'c'));
+    next_mouse.resource->generation_id = next_mouse.generation_id;
+    auto replacement = registry.apply_routes({keyboard, next_mouse});
+    if(!replacement || replacement.value().replaced != 1
+       || replacement.value().retained != 1
+       || registry.controller_identity("receiver-1/mouse-00cd/endpoint-mouse")
+              == mouse_identity)
+    {
+        return 9;
+    }
+
+    auto candidate = keyboard;
+    candidate.access = NativeRouteAccess::Candidate;
+    auto unavailable = mouse;
+    unavailable.route_state = RouteState::Unavailable;
+    auto filtered = registry.apply_routes({candidate, unavailable});
+    if(!filtered || filtered.value().removed != 2 || registry.size() != 0
+       || !host.registered.empty())
+    {
+        return 10;
+    }
+
+    auto duplicate = registry.apply_routes({mouse, mouse});
+    if(duplicate || registry.size() != 0)
+    {
+        return 11;
+    }
+
+    return 0;
+}
diff --git a/tests/cpp/sdk_native_client_contract.cpp b/tests/cpp/sdk_native_client_contract.cpp
new file mode 100644
index 0000000..2d27a77
--- /dev/null
+++ b/tests/cpp/sdk_native_client_contract.cpp
@@ -0,0 +1,330 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <hyperflux/sdk.hpp>
+
+#include <cstdint>
+#include <memory>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+#include <type_traits>
+#include <utility>
+#include <variant>
+#include <vector>
+
+namespace
+{
+
+template<typename T>
+T text(std::string_view value)
+{
+    auto decoded = T::from(value);
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test string domain value");
+    }
+    return *decoded;
+}
+
+template<typename T>
+T number(std::uint64_t value)
+{
+    auto decoded = T::from(static_cast<typename T::value_type>(value));
+    if(!decoded.has_value())
+    {
+        throw std::runtime_error("invalid test numeric domain value");
+    }
+    return *decoded;
+}
+
+const hyperflux::RequestId& request_id(const hyperflux::v7::RpcRequest& request)
+{
+    return std::visit(
+        [](const auto& alternative) -> const hyperflux::RequestId& {
+            return alternative.request.request_id;
+        },
+        request);
+}
+
+hyperflux::v7::EventCursor cursor(std::uint64_t sequence)
+{
+    using namespace hyperflux;
+    return {
+        text<StreamId>("native-route-stream"),
+        number<StreamEpoch>(1),
+        number<ProjectionRevision>(1),
+        number<SequenceNumber>(sequence),
+    };
+}
+
+hyperflux::v7::ResourceKey resource()
+{
+    using namespace hyperflux;
+    return {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(1),
+        text<LogicalDeviceId>("mouse-00cd"),
+        ResourceKind::NativeControl,
+    };
+}
+
+hyperflux::v7::NativeRoute route()
+{
+    using namespace hyperflux;
+    return {
+        text<ReceiverId>("receiver-1"),
+        number<GenerationId>(1),
+        text<LogicalDeviceId>("mouse-00cd"),
+        text<EndpointId>("endpoint-mouse"),
+        DeviceKind::Mouse,
+        number<VendorId>(0x1532),
+        number<ProductId>(0x00cd),
+        RouteState::Available,
+        NativeRouteAccess::Qualified,
+        text<NativeProtocolFamily>("razer-feature-report-v1"),
+        number<NativeReportByteCount>(90),
+        text<NativeRouteToken>(std::string(64, 'a')),
+        resource(),
+    };
+}
+
+class DeterministicIdentities final : public hyperflux::sdk::IdentitySource
+{
+public:
+    hyperflux::sdk::Result<hyperflux::RequestId> next_request_id() override
+    {
+        ++request_sequence_;
+        return hyperflux::sdk::Result<hyperflux::RequestId>::success(
+            text<hyperflux::RequestId>("native-request-" + std::to_string(request_sequence_)));
+    }
+
+    hyperflux::sdk::Result<hyperflux::TransactionId> next_transaction_id() override
+    {
+        return hyperflux::sdk::Result<hyperflux::TransactionId>::failure({
+            hyperflux::sdk::ErrorCode::IdentityUnavailable,
+            "native client does not request transaction identities",
+            std::nullopt,
+        });
+    }
+
+private:
+    std::uint64_t request_sequence_ = 0;
+};
+
+enum class Fault
+{
+    None,
+    MissingFeature,
+    RequestMismatch,
+    ServerChanged,
+};
+
+class FakeNativeChannel final : public hyperflux::sdk::NativeRpcChannel
+{
+public:
+    explicit FakeNativeChannel(Fault fault) : fault_(fault) {}
+
+    hyperflux::sdk::Result<hyperflux::v7::RpcResponse> exchange(
+        const hyperflux::v7::RpcRequest& request) override
+    {
+        using namespace hyperflux;
+        if(const auto* negotiation = std::get_if<v7::RpcRequestNegotiate>(&request))
+        {
+            auto features = negotiation->request.params.required_features;
+            if(fault_ == Fault::MissingFeature)
+            {
+                features.clear();
+            }
+            const auto response_request = fault_ == Fault::RequestMismatch
+                ? text<RequestId>("wrong-request")
+                : negotiation->request.request_id;
+            return sdk::Result<v7::RpcResponse>::success(v7::RpcResponseNegotiateSuccess {
+                {
+                    response_request,
+                    text<ServerInstanceId>("server-1"),
+                    {
+                        number<ProtocolVersion>(7),
+                        text<ServerInstanceId>("server-1"),
+                        text<ProtocolSessionId>("session-1"),
+                        text<NegotiationToken>("token-1"),
+                        text<ComponentVersion>("0.0.0-dev.1"),
+                        std::move(features),
+                        number<QueueCapacity>(64),
+                    },
+                },
+            });
+        }
+
+        const auto server = fault_ == Fault::ServerChanged ? "server-2" : "server-1";
+        if(const auto* acquire = std::get_if<v7::RpcRequestAcquireLease>(&request))
+        {
+            return sdk::Result<v7::RpcResponse>::success(v7::RpcResponseAcquireLeaseSuccess {
+                {
+                    request_id(request),
+                    text<ServerInstanceId>(server),
+                    v7::LeaseResultGranted {
+                        {
+                            text<LeaseId>("lease-1"),
+                            acquire->request.params.client_id,
+                            acquire->request.params.resources,
+                            number<MonotonicMs>(10'000),
+                            LeaseState::Granted,
+                        },
+                    },
+                },
+            });
+        }
+        if(std::holds_alternative<v7::RpcRequestNativeEnumerate>(request))
+        {
+            return sdk::Result<v7::RpcResponse>::success(
+                v7::RpcResponseNativeEnumerateSuccess {
+                    {
+                        request_id(request),
+                        text<ServerInstanceId>(server),
+                        {cursor(1), {route()}},
+                    },
+                });
+        }
+        if(const auto* transact = std::get_if<v7::RpcRequestNativeTransact>(&request))
+        {
+            return sdk::Result<v7::RpcResponse>::success(
+                v7::RpcResponseNativeTransactSuccess {
+                    {
+                        request_id(request),
+                        text<ServerInstanceId>(server),
+                        {
+                            transact->request.params.request_id,
+                            transact->request.params.route_token,
+                            v7::NativeExchangeResultMatchedResponse {
+                                {text<NativeReportHex>(std::string(180, 'f'))},
+                            },
+                        },
+                    },
+                });
+        }
+        if(std::holds_alternative<v7::RpcRequestNativeWatch>(request))
+        {
+            return sdk::Result<v7::RpcResponse>::success(v7::RpcResponseNativeWatchSuccess {
+                {
+                    request_id(request),
+                    text<ServerInstanceId>(server),
+                    {
+                        text<SubscriptionId>("native-watch-1"),
+                        cursor(2),
+                        {},
+                        number<SequenceNumber>(1),
+                        number<SequenceNumber>(2),
+                        number<DroppedEventCount>(0),
+                        false,
+                        false,
+                    },
+                },
+            });
+        }
+        return sdk::Result<v7::RpcResponse>::failure({
+            sdk::ErrorCode::UnexpectedResponse,
+            "test channel received an unexpected request",
+            std::nullopt,
+        });
+    }
+
+private:
+    Fault fault_;
+};
+
+hyperflux::sdk::NativeClientConfig config()
+{
+    return {
+        text<hyperflux::ClientId>("openrgb-native-test"),
+        text<hyperflux::ClientName>("OpenRGB native SDK contract test"),
+        {text<hyperflux::ProtocolFeatureId>("native-receiver-tunnel")},
+        {},
+    };
+}
+
+hyperflux::sdk::Result<hyperflux::sdk::NativeClient> connect(Fault fault)
+{
+    return hyperflux::sdk::NativeClient::connect(
+        std::make_unique<FakeNativeChannel>(fault),
+        std::make_unique<DeterministicIdentities>(),
+        config());
+}
+
+} // namespace
+
+int main()
+{
+    using namespace hyperflux;
+    auto client = connect(Fault::None);
+    if(!client || client.value().server_hello().selected_version != number<ProtocolVersion>(7))
+    {
+        return 1;
+    }
+    auto inventory = client.value().native_enumerate();
+    if(!inventory || inventory.value().routes.size() != 1
+       || inventory.value().routes.front().product_id != number<ProductId>(0x00cd))
+    {
+        return 2;
+    }
+    auto lease = client.value().acquire_lease(
+        {resource()}, number<LeaseDurationMs>(5'000));
+    const auto* granted = lease
+        ? std::get_if<v7::LeaseResultGranted>(&lease.value())
+        : nullptr;
+    if(granted == nullptr || granted->detail.lease_id != text<LeaseId>("lease-1"))
+    {
+        return 3;
+    }
+    auto submission = client.value().prepare_native_exchange(
+        granted->detail.lease_id,
+        *inventory.value().routes.front().route_token,
+        text<NativeReportHex>(std::string(180, '0')),
+        number<NativeExchangeTimeoutMs>(1'000));
+    if(!submission)
+    {
+        return 4;
+    }
+    const auto request_identity = submission.value().request_id;
+    auto first = client.value().native_transact(submission.value());
+    auto replay = client.value().native_transact(submission.value());
+    const auto* matched = first
+        ? std::get_if<v7::NativeExchangeResultMatchedResponse>(&first.value().result)
+        : nullptr;
+    if(matched == nullptr || !replay || first.value().request_id != request_identity
+       || replay.value().request_id != request_identity
+       || matched->detail.response.value() != std::string(180, 'f'))
+    {
+        return 5;
+    }
+    auto watched = client.value().native_watch({
+        std::nullopt,
+        inventory.value().cursor,
+        number<EventBatchLimit>(32),
+    });
+    if(!watched || watched.value().next_cursor.sequence != number<SequenceNumber>(2))
+    {
+        return 6;
+    }
+
+    const auto missing = connect(Fault::MissingFeature);
+    if(missing || missing.error().code != sdk::ErrorCode::RequiredFeatureMissing)
+    {
+        return 7;
+    }
+    const auto mismatched = connect(Fault::RequestMismatch);
+    if(mismatched || mismatched.error().code != sdk::ErrorCode::ResponseRequestMismatch)
+    {
+        return 8;
+    }
+    auto restarted = connect(Fault::ServerChanged);
+    if(!restarted)
+    {
+        return 9;
+    }
+    const auto stale = restarted.value().native_enumerate();
+    if(stale || stale.error().code != sdk::ErrorCode::ServerInstanceChanged)
+    {
+        return 10;
+    }
+    return 0;
+}
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index 0098a35..8a70eed 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -7,6 +7,7 @@
 from pathlib import Path
 import sys
 import tempfile
+from types import SimpleNamespace
 import unittest
 from unittest.mock import patch
 import zipfile
@@ -21,6 +22,7 @@
 from hfxdev.package_pipeline import (
     BuiltArtifact,
     _base_environment,
+    _build_cmake,
     _build_python,
     _install_wheels,
     _inspect_staged_files,
@@ -35,6 +37,62 @@
 
 
 class PackagePipelineTests(unittest.TestCase):
+    def test_openrgb_build_uses_the_source_bound_native_transform(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            output = Path(temporary)
+            upstream = output / "openrgb-upstream"
+            upstream.mkdir()
+            native = output / "work" / "openrgb-native-native-source"
+            build = load_install_manifest(ROOT).build("openrgb-native")
+            commands: list[tuple[list[str], dict[str, str]]] = []
+
+            def capture_run(
+                command: list[str],
+                *,
+                cwd: Path,
+                environment: dict[str, str],
+                label: str,
+                timeout_seconds: int = 900,
+            ) -> None:
+                del cwd, label, timeout_seconds
+                commands.append((command, environment.copy()))
+
+            expected = object()
+            with (
+                patch(
+                    "hfxdev.package_pipeline._pinned_source",
+                    return_value=upstream,
+                ),
+                patch(
+                    "hfxdev.package_pipeline.prepare_openrgb_native_source",
+                    return_value=SimpleNamespace(root=native),
+                ) as prepare,
+                patch("hfxdev.package_pipeline._run", side_effect=capture_run),
+                patch(
+                    "hfxdev.package_pipeline._copy_artifact",
+                    return_value=expected,
+                ),
+            ):
+                actual = _build_cmake(
+                    ROOT,
+                    output,
+                    {},
+                    build,
+                    {"openrgb-source": upstream},
+                    "a" * 40,
+                )
+
+            self.assertIs(actual, expected)
+            prepare.assert_called_once_with(ROOT, upstream, native)
+            configure, environment = commands[0]
+            self.assertIn(f"-DHFX_OPENRGB_SOURCE_DIR={upstream}", configure)
+            self.assertIn(f"-DHFX_OPENRGB_NATIVE_SOURCE_DIR={native}", configure)
+            self.assertIn(f"-ffile-prefix-map={upstream}=.upstream/openrgb-source", environment["CXXFLAGS"])
+            self.assertIn(
+                f"-ffile-prefix-map={native}=.upstream/openrgb-source-native",
+                environment["CXXFLAGS"],
+            )
+
     def _wheel(
         self,
         path: Path,
diff --git a/tests/test_verify.py b/tests/test_verify.py
index 5ac1015..a124168 100644
--- a/tests/test_verify.py
+++ b/tests/test_verify.py
@@ -15,6 +15,7 @@
     _python_sdk_license_files,
     _resolve_schema_reference,
     _run_openrgb_adapter_contracts,
+    _run_openrgb_native_route_contracts,
     _run_openrgb_thread_sanitizer,
 )
 
@@ -94,8 +95,25 @@ def test_openrgb_release_and_sanitizer_lanes_share_complete_pipeline(self) -> No
             source = root / "openrgb"
             source.mkdir()
             (source / "OpenRGBPluginInterface.h").write_text("// fixture\n", encoding="utf-8")
+            native_source = root / "prepared-openrgb"
+            native_source.mkdir()
+            native_result = native_source / "hyperflux-native-transform-result.json"
+            native_result.write_text(
+                '{"schema":"hyperflux-openrgb-native-transform-result-v1",'
+                '"network_access_executed":false,"hardware_queried":false,'
+                '"hardware_write_executed":false}\n',
+                encoding="utf-8",
+            )
+            native_result.chmod(0o600)
+            prepared = SimpleNamespace(root=native_source, result=native_result)
             node = SimpleNamespace(timeout_seconds=300)
-            with patch("tools.hfxdev.verify._openrgb_source", return_value=source):
+            with (
+                patch("tools.hfxdev.verify._openrgb_source", return_value=source),
+                patch(
+                    "tools.hfxdev.verify.prepare_openrgb_native_source",
+                    return_value=prepared,
+                ) as prepare,
+            ):
                 with patch("tools.hfxdev.verify._run_command") as command:
                     _run_openrgb_adapter_contracts(root, node)
                     self.assertEqual(command.call_count, 3)
@@ -105,6 +123,16 @@ def test_openrgb_release_and_sanitizer_lanes_share_complete_pipeline(self) -> No
                     self.assertEqual(command.call_args_list[2].args[1][0], "ctest")
                     self.assertIsNone(command.call_args_list[2].kwargs["environment"])
 
+                with patch("tools.hfxdev.verify._run_command") as command:
+                    _run_openrgb_native_route_contracts(root, node)
+                    self.assertEqual(command.call_count, 3)
+                    native_configure = command.call_args_list[0].args[1]
+                    self.assertIn("-DCMAKE_BUILD_TYPE=Release", native_configure)
+                    self.assertIn(
+                        f"-DHFX_OPENRGB_NATIVE_SOURCE_DIR={native_source}",
+                        native_configure,
+                    )
+
                 with patch("tools.hfxdev.verify._run_command") as command:
                     _run_openrgb_thread_sanitizer(root, node)
                     self.assertEqual(command.call_count, 3)
@@ -116,6 +144,7 @@ def test_openrgb_release_and_sanitizer_lanes_share_complete_pipeline(self) -> No
                         "halt_on_error=1",
                         command.call_args_list[2].kwargs["environment"]["TSAN_OPTIONS"],
                     )
+                self.assertEqual(prepare.call_count, 2)
 
 
 if __name__ == "__main__":
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index dc3ecca..957ff45 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -24,6 +24,7 @@
 from .knowledge import import_upstream_catalogs
 from .openrazer import write_imported_metadata
 from .openrazer_native_route import prepare_openrazer_native_source
+from .openrgb_native_route import prepare_openrgb_native_source
 from .package_pipeline import build_artifacts, stage_rootfs
 from .testgraph import format_plan, load_test_catalog
 from .upstreams import prepare_upstreams
@@ -124,6 +125,12 @@ def _parser() -> argparse.ArgumentParser:
     )
     native_openrazer.add_argument("--source", required=True, type=Path)
     native_openrazer.add_argument("--output", required=True, type=Path)
+    native_openrgb = native_commands.add_parser(
+        "prepare-openrgb",
+        help="prepare the source-bound OpenRGB native transport tree",
+    )
+    native_openrgb.add_argument("--source", required=True, type=Path)
+    native_openrgb.add_argument("--output", required=True, type=Path)
 
     upstream = commands.add_parser("upstream", help="manage immutable upstream checkouts")
     upstream_commands = upstream.add_subparsers(dest="upstream_command", required=True)
@@ -326,6 +333,13 @@ def main(arguments: list[str] | None = None) -> int:
                 print(f"Prepared OpenRazer source: {prepared.root}")
                 print(f"Source binding: {prepared.result}")
                 return 0
+            if args.native_command == "prepare-openrgb":
+                prepared = prepare_openrgb_native_source(
+                    root, args.source, args.output
+                )
+                print(f"Prepared OpenRGB source: {prepared.root}")
+                print(f"Source binding: {prepared.result}")
+                return 0
         if args.command == "upstream":
             prepared = prepare_upstreams(root, args.output)
             for identifier in prepared.fetched:
diff --git a/tools/hfxdev/openrgb_native_route.py b/tools/hfxdev/openrgb_native_route.py
new file mode 100644
index 0000000..6b9f9b7
--- /dev/null
+++ b/tools/hfxdev/openrgb_native_route.py
@@ -0,0 +1,248 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import uuid
+from typing import Any
+
+from .integrations import upstream_index
+from .model import ModelError, load_json, require_unique, sha256_file
+
+
+TRANSFORM_SCHEMA = "hyperflux-openrgb-native-transform-v1"
+TRANSFORM_KEYS = {"$schema", "schema", "upstream", "patch", "files"}
+UPSTREAM_KEYS = {"id", "repository", "commit"}
+PATCH_KEYS = {"path", "sha256"}
+FILE_KEYS = {"path", "source_sha256", "transformed_sha256"}
+
+
+@dataclass(frozen=True)
+class PreparedOpenRgbNativeSource:
+    root: Path
+    result: Path
+    source_commit: str
+    patch_sha256: str
+
+
+def _exact_keys(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - set(value))
+    extras = sorted(set(value) - expected)
+    if missing:
+        raise ModelError(f"{label}: missing keys: {', '.join(missing)}")
+    if extras:
+        raise ModelError(f"{label}: unsupported keys: {', '.join(extras)}")
+
+
+def _digest(value: Any, label: str) -> str:
+    if (
+        not isinstance(value, str)
+        or len(value) != 64
+        or any(character not in "0123456789abcdef" for character in value)
+    ):
+        raise ModelError(f"{label}: expected a lowercase SHA-256 digest")
+    return value
+
+
+def _safe_path(value: Any, label: str, *, patch: bool = False) -> Path:
+    if not isinstance(value, str) or not value or len(value) > 256:
+        raise ModelError(f"{label}: expected a bounded non-empty path")
+    path = Path(value)
+    if path.is_absolute() or ".." in path.parts or path.as_posix() != value:
+        raise ModelError(f"{label}: path must be canonical and repository-relative")
+    if patch:
+        if path.suffix != ".patch" or path.parts[0] != "patches":
+            raise ModelError(f"{label}: patch must remain below patches/")
+    elif path.parts[:3] != ("Controllers", "RazerController", "RazerController"):
+        raise ModelError(f"{label}: path leaves the pinned Razer controller boundary")
+    return path
+
+
+def load_native_transform(root: Path) -> dict[str, Any]:
+    value = load_json(
+        root / "integrations" / "openrgb" / "native-route" / "transform.json"
+    )
+    _exact_keys(value, TRANSFORM_KEYS, "OpenRGB native transform")
+    if value["$schema"] != "../../../schemas/openrgb-native-transform.schema.json":
+        raise ModelError("OpenRGB native transform schema reference is not canonical")
+    if value["schema"] != TRANSFORM_SCHEMA:
+        raise ModelError("unsupported OpenRGB native transform schema")
+
+    upstream = value["upstream"]
+    if not isinstance(upstream, dict):
+        raise ModelError("OpenRGB native transform upstream must be an object")
+    _exact_keys(upstream, UPSTREAM_KEYS, "OpenRGB native transform upstream")
+    authority = upstream_index(root).get("openrgb")
+    if authority is None or any(
+        upstream[field] != authority[field] for field in ("id", "repository", "commit")
+    ):
+        raise ModelError("OpenRGB native transform differs from the integration pin")
+
+    patch = value["patch"]
+    if not isinstance(patch, dict):
+        raise ModelError("OpenRGB native transform patch must be an object")
+    _exact_keys(patch, PATCH_KEYS, "OpenRGB native transform patch")
+    _safe_path(patch["path"], "OpenRGB native patch", patch=True)
+    _digest(patch["sha256"], "OpenRGB native patch digest")
+
+    files = value["files"]
+    if not isinstance(files, list) or not 1 <= len(files) <= 16:
+        raise ModelError("OpenRGB native transform files must be a bounded non-empty list")
+    paths: list[str] = []
+    for index, record in enumerate(files):
+        if not isinstance(record, dict):
+            raise ModelError(f"OpenRGB native transform file {index}: expected an object")
+        _exact_keys(record, FILE_KEYS, f"OpenRGB native transform file {index}")
+        path = _safe_path(record["path"], f"OpenRGB native transform file {index}")
+        _digest(record["source_sha256"], f"OpenRGB native file {index} source")
+        _digest(record["transformed_sha256"], f"OpenRGB native file {index} transformed")
+        paths.append(path.as_posix())
+    require_unique(paths, "OpenRGB native transform path")
+    if paths != sorted(paths):
+        raise ModelError("OpenRGB native transform files must be sorted by path")
+    return value
+
+
+def _git(arguments: list[str], *, cwd: Path) -> str:
+    try:
+        result = subprocess.run(
+            ["git", *arguments],
+            cwd=cwd,
+            check=False,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=60,
+            env={**os.environ, "GIT_TERMINAL_PROMPT": "0"},
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot inspect OpenRGB source: {error}") from error
+    if result.returncode != 0:
+        detail = result.stderr.strip().splitlines()
+        suffix = f": {detail[-1]}" if detail else ""
+        raise ModelError(f"git {' '.join(arguments)} failed{suffix}")
+    return result.stdout.strip()
+
+
+def _validate_source(root: Path, source: Path, transform: dict[str, Any]) -> None:
+    if source.is_symlink() or not source.is_dir() or (source / ".git").is_symlink():
+        raise ModelError("OpenRGB native source is missing or uses a symbolic link")
+    if _git(["rev-parse", "--is-inside-work-tree"], cwd=source) != "true":
+        raise ModelError("OpenRGB native source is not a Git worktree")
+    if _git(["rev-parse", "HEAD"], cwd=source) != transform["upstream"]["commit"]:
+        raise ModelError("OpenRGB native source does not match the pinned commit")
+    if _git(["status", "--porcelain", "--untracked-files=all"], cwd=source):
+        raise ModelError("OpenRGB native source has local modifications")
+    if _git(["remote", "get-url", "origin"], cwd=source) != transform["upstream"]["repository"]:
+        raise ModelError("OpenRGB native source has an unexpected origin")
+
+    native_root = root / "integrations" / "openrgb" / "native-route"
+    patch = native_root / transform["patch"]["path"]
+    if patch.is_symlink() or not patch.is_file():
+        raise ModelError("OpenRGB native patch is missing or symbolic")
+    if sha256_file(patch) != transform["patch"]["sha256"]:
+        raise ModelError("OpenRGB native patch differs from its source lock")
+    for record in transform["files"]:
+        path = source / record["path"]
+        if path.is_symlink() or not path.is_file():
+            raise ModelError(f"OpenRGB native source file is missing: {record['path']}")
+        if sha256_file(path) != record["source_sha256"]:
+            raise ModelError(f"OpenRGB native source drift: {record['path']}")
+
+
+def _apply_patch(destination: Path, patch: Path) -> None:
+    for check_only in (True, False):
+        arguments = [
+            "patch",
+            "--batch",
+            "--forward",
+            "--fuzz=0",
+            "--no-backup-if-mismatch",
+            "-p1",
+            "-i",
+            str(patch),
+        ]
+        if check_only:
+            arguments.insert(1, "--dry-run")
+        try:
+            result = subprocess.run(
+                arguments,
+                cwd=destination,
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=60,
+                env={**os.environ, "LC_ALL": "C"},
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot apply OpenRGB native patch: {error}") from error
+        if result.returncode != 0:
+            detail = (result.stderr or result.stdout).strip().splitlines()
+            suffix = f": {detail[-1]}" if detail else ""
+            raise ModelError(f"OpenRGB native patch did not apply exactly{suffix}")
+
+
+def prepare_openrgb_native_source(
+    root: Path, source: Path, output: Path
+) -> PreparedOpenRgbNativeSource:
+    root = root.resolve()
+    source = source.expanduser().resolve()
+    output = output.expanduser()
+    if not output.is_absolute():
+        output = root / output
+    output = output.resolve()
+    if output.exists() or output.is_symlink():
+        raise ModelError("OpenRGB native output must not already exist")
+    if output == source or source in output.parents or output in source.parents:
+        raise ModelError("OpenRGB native output must be independent from the source checkout")
+
+    transform = load_native_transform(root)
+    _validate_source(root, source, transform)
+    output.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+    temporary = output.parent / f".{output.name}.prepare-{uuid.uuid4().hex}"
+    native_root = root / "integrations" / "openrgb" / "native-route"
+    patch = native_root / transform["patch"]["path"]
+    try:
+        shutil.copytree(source, temporary, symlinks=False, ignore=shutil.ignore_patterns(".git"))
+        _apply_patch(temporary, patch)
+        for record in transform["files"]:
+            if sha256_file(temporary / record["path"]) != record["transformed_sha256"]:
+                raise ModelError(f"OpenRGB native transformed output drift: {record['path']}")
+        result_path = temporary / "hyperflux-native-transform-result.json"
+        result_path.write_text(
+            json.dumps(
+                {
+                    "schema": "hyperflux-openrgb-native-transform-result-v1",
+                    "source_commit": transform["upstream"]["commit"],
+                    "patch_sha256": transform["patch"]["sha256"],
+                    "transformed_files": [
+                        {"path": record["path"], "sha256": record["transformed_sha256"]}
+                        for record in transform["files"]
+                    ],
+                    "network_access_executed": False,
+                    "hardware_queried": False,
+                    "hardware_write_executed": False,
+                },
+                indent=2,
+                sort_keys=True,
+            )
+            + "\n",
+            encoding="utf-8",
+        )
+        result_path.chmod(0o600)
+        os.replace(temporary, output)
+    except Exception:
+        shutil.rmtree(temporary, ignore_errors=True)
+        raise
+    return PreparedOpenRgbNativeSource(
+        root=output,
+        result=output / "hyperflux-native-transform-result.json",
+        source_commit=transform["upstream"]["commit"],
+        patch_sha256=transform["patch"]["sha256"],
+    )
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index e1a9bab..93fa8a0 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -26,9 +26,13 @@
 from .model import ModelError, load_json, require_unique, sha256_file
 from .openrazer_native_route import (
     load_native_deployment,
-    load_native_transform,
+    load_native_transform as load_openrazer_native_transform,
     prepare_openrazer_native_source,
 )
+from .openrgb_native_route import (
+    load_native_transform as load_openrgb_native_transform,
+    prepare_openrgb_native_source,
+)
 from .supply_chain import load_dependency_inventory
 from .toolchains import load_toolchain_pins, verify_current_toolchain
 from .tree_metadata import normalize_tree as _normalize_tree
@@ -319,6 +323,20 @@ def _build_cmake(
     environment["CXXFLAGS"] = (
         f"{environment.get('CXXFLAGS', '')} {upstream_remap}"
     ).strip()
+    native_upstream: Path | None = None
+    if capability == "openrgb-source":
+        native_upstream = output / "work" / f"{build.id}-native-source"
+        prepared = prepare_openrgb_native_source(root, upstream, native_upstream)
+        native_remap = (
+            f"-ffile-prefix-map={prepared.root}=.upstream/{capability}-native "
+            f"-fdebug-prefix-map={prepared.root}=.upstream/{capability}-native"
+        )
+        environment["CFLAGS"] = (
+            f"{environment.get('CFLAGS', '')} {native_remap}"
+        ).strip()
+        environment["CXXFLAGS"] = (
+            f"{environment.get('CXXFLAGS', '')} {native_remap}"
+        ).strip()
     build_directory = output / "work" / build.id
     configure = [
         "cmake",
@@ -332,6 +350,7 @@ def _build_cmake(
     ]
     if capability == "openrgb-source":
         configure.append(f"-DHFX_OPENRGB_SOURCE_DIR={upstream}")
+        configure.append(f"-DHFX_OPENRGB_NATIVE_SOURCE_DIR={native_upstream}")
     _run(configure, cwd=root, environment=environment, label=f"configure {build.id}")
     _run(
         ["cmake", "--build", str(build_directory), "--target", build.target or ""],
@@ -554,10 +573,13 @@ def _provenance_inputs(
     expected_sbom = spdx_json(inventory)
     if not sbom_path.is_file() or sbom_path.read_text(encoding="utf-8") != expected_sbom:
         raise ModelError("generated SPDX inventory is stale; run ./hfx generate")
-    transform = load_native_transform(root)
+    openrazer_transform = load_openrazer_native_transform(root)
     deployment = load_native_deployment(root)
-    native_root = root / "integrations" / "openrazer" / "native-route"
-    patch = native_root / transform["patch"]["path"]
+    openrazer_root = root / "integrations" / "openrazer" / "native-route"
+    openrazer_patch = openrazer_root / openrazer_transform["patch"]["path"]
+    openrgb_transform = load_openrgb_native_transform(root)
+    openrgb_root = root / "integrations" / "openrgb" / "native-route"
+    openrgb_patch = openrgb_root / openrgb_transform["patch"]["path"]
     return {
         "install_manifest_sha256": install.source_sha256,
         "linux_runtime_sha256": runtime.source_sha256,
@@ -566,10 +588,12 @@ def _provenance_inputs(
         "toolchain_pins_sha256": sha256_file(root / "toolchains" / "pins.json"),
         "cargo_lock_sha256": sha256_file(root / "Cargo.lock"),
         "integration_catalog_sha256": sha256_file(root / "integrations" / "catalog.json"),
-        "openrazer_native_catalog_sha256": sha256_file(native_root / "catalog.json"),
-        "openrazer_native_transform_sha256": sha256_file(native_root / "transform.json"),
+        "openrazer_native_catalog_sha256": sha256_file(openrazer_root / "catalog.json"),
+        "openrazer_native_transform_sha256": sha256_file(openrazer_root / "transform.json"),
         "openrazer_native_deployment_sha256": deployment.source_sha256,
-        "openrazer_native_patch_sha256": sha256_file(patch),
+        "openrazer_native_patch_sha256": sha256_file(openrazer_patch),
+        "openrgb_native_transform_sha256": sha256_file(openrgb_root / "transform.json"),
+        "openrgb_native_patch_sha256": sha256_file(openrgb_patch),
     }
 
 
@@ -606,6 +630,14 @@ def _provenance_materials(
             "integrations/openrazer/native-route/transform.json",
             "openrazer_native_transform_sha256",
         ),
+        "openrgb-native-patch": (
+            "integrations/openrgb/native-route/patches/0001-Add-HyperFlux-feature-transport-seam.patch",
+            "openrgb_native_patch_sha256",
+        ),
+        "openrgb-native-transform": (
+            "integrations/openrgb/native-route/transform.json",
+            "openrgb_native_transform_sha256",
+        ),
         "source-sbom": (
             "assurance/generated/hyperflux-next.spdx.json",
             "sbom_sha256",
@@ -883,6 +915,8 @@ def load_artifact_set(root: Path, manifest_path: Path) -> ArtifactSet:
         "openrazer_native_transform_sha256",
         "openrazer_native_deployment_sha256",
         "openrazer_native_patch_sha256",
+        "openrgb_native_transform_sha256",
+        "openrgb_native_patch_sha256",
     }:
         raise ModelError("package build inputs are malformed")
     revision = source["revision"]
diff --git a/tools/hfxdev/testgraph.py b/tools/hfxdev/testgraph.py
index 8eb57e1..594c5ad 100644
--- a/tools/hfxdev/testgraph.py
+++ b/tools/hfxdev/testgraph.py
@@ -58,6 +58,7 @@
     "migration-shadow-contracts",
     "cpp-sdk-contracts",
     "openrgb-adapter-contracts",
+    "openrgb-native-route-contracts",
     "openrgb-thread-sanitizer",
     "openrazer-metadata-contracts",
     "openrazer-native-route-contracts",
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index ed84632..54bb402 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -47,6 +47,7 @@
     prepare_openrazer_native_source,
 )
 from .openrgb import extract_openrgb_catalog
+from .openrgb_native_route import prepare_openrgb_native_source
 from .package_pipeline import build_artifacts, load_artifact_set, stage_rootfs
 from .performance import (
     load_performance_budgets,
@@ -1021,11 +1022,35 @@ def _run_openrgb_cmake_contracts(
     build_type: str,
     label: str,
     thread_sanitizer: bool,
+    native_route: bool,
 ) -> None:
     source = _openrgb_source(root)
     build_directory = root / "build" / build_name
     if build_directory.exists():
         shutil.rmtree(build_directory)
+    native_source: Path | None = None
+    if native_route:
+        native_source = root / "build" / f"{build_name}-source"
+        if native_source.exists():
+            shutil.rmtree(native_source)
+        prepared = prepare_openrgb_native_source(root, source, native_source)
+        if (prepared.result.stat().st_mode & 0o777) != 0o600:
+            raise ModelError("OpenRGB native source binding is not private")
+        result = load_json(prepared.result)
+        if result.get("schema") != "hyperflux-openrgb-native-transform-result-v1":
+            raise ModelError("OpenRGB native source binding schema is invalid")
+        if any(
+            result.get(field) is not False
+            for field in (
+                "network_access_executed",
+                "hardware_queried",
+                "hardware_write_executed",
+            )
+        ):
+            raise ModelError("OpenRGB native source preparation crossed a prohibited boundary")
+        if (prepared.root / ".git").exists():
+            raise ModelError("OpenRGB native source output copied upstream Git metadata")
+        native_source = prepared.root
     configure = [
         "cmake",
         "-S",
@@ -1036,6 +1061,8 @@ def _run_openrgb_cmake_contracts(
         "-DBUILD_TESTING=ON",
         f"-DHFX_OPENRGB_SOURCE_DIR={source}",
     ]
+    if native_source is not None:
+        configure.append(f"-DHFX_OPENRGB_NATIVE_SOURCE_DIR={native_source}")
     if thread_sanitizer:
         configure.append("-DHFX_OPENRGB_THREAD_SANITIZER=ON")
     _run_command(
@@ -1074,6 +1101,19 @@ def _run_openrgb_adapter_contracts(root: Path, node: TestNode) -> None:
         build_type="Release",
         label="OpenRGB adapter",
         thread_sanitizer=False,
+        native_route=False,
+    )
+
+
+def _run_openrgb_native_route_contracts(root: Path, node: TestNode) -> None:
+    _run_openrgb_cmake_contracts(
+        root,
+        node,
+        build_name="openrgb-native-route",
+        build_type="Release",
+        label="OpenRGB native route",
+        thread_sanitizer=False,
+        native_route=True,
     )
 
 
@@ -1085,6 +1125,7 @@ def _run_openrgb_thread_sanitizer(root: Path, node: TestNode) -> None:
         build_type="RelWithDebInfo",
         label="OpenRGB ThreadSanitizer",
         thread_sanitizer=True,
+        native_route=True,
     )
 
 
@@ -1458,6 +1499,7 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
     "migration-shadow-contracts": _run_migration_shadow_contracts,
     "cpp-sdk-contracts": _run_cpp_sdk_contracts,
     "openrgb-adapter-contracts": _run_openrgb_adapter_contracts,
+    "openrgb-native-route-contracts": _run_openrgb_native_route_contracts,
     "openrgb-thread-sanitizer": _run_openrgb_thread_sanitizer,
     "openrazer-metadata-contracts": _run_openrazer_metadata_contracts,
     "openrazer-native-route-contracts": _run_openrazer_native_route_contracts,
diff --git a/verification/tests.json b/verification/tests.json
index effca40..925b9c9 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -524,6 +524,35 @@
       "produced_evidence": ["openrgb-adapter-result"],
       "resume_policy": "rerun"
     },
+    {
+      "id": "openrgb-native-route-contracts",
+      "title": "Source-bound OpenRGB native Razer transport contracts",
+      "owned_domain": "integrations",
+      "lanes": ["full-software"],
+      "runner": "openrgb-native-route-contracts",
+      "required_capabilities": ["openrgb-source"],
+      "hardware_requirement": "none",
+      "writes_hardware": false,
+      "expected_duration_seconds": 180,
+      "timeout_seconds": 360,
+      "dependencies": ["openrgb-adapter-contracts"],
+      "isolation": "exclusive-process",
+      "cache_inputs": [
+        "integrations/openrgb/**/*.hpp",
+        "integrations/openrgb/**/*.cpp",
+        "integrations/openrgb/CMakeLists.txt",
+        "integrations/openrgb/native-route/**",
+        "schemas/openrgb-native-transform.schema.json",
+        "sdk/cpp/**/*.hpp",
+        "sdk/cpp/**/*.cpp",
+        "tests/cpp/openrgb_*.cpp",
+        "tests/cpp/sdk_native_client_contract.cpp",
+        "tools/hfxdev/openrgb_native_route.py",
+        "tools/hfxdev/verify.py"
+      ],
+      "produced_evidence": ["openrgb-native-route-result"],
+      "resume_policy": "rerun"
+    },
     {
       "id": "openrgb-thread-sanitizer",
       "title": "OpenRGB adapter concurrency and lifecycle race contracts",
@@ -535,7 +564,7 @@
       "writes_hardware": false,
       "expected_duration_seconds": 120,
       "timeout_seconds": 300,
-      "dependencies": ["openrgb-adapter-contracts"],
+      "dependencies": ["openrgb-native-route-contracts"],
       "isolation": "exclusive-process",
       "cache_inputs": ["integrations/openrgb/**/*.hpp", "integrations/openrgb/**/*.cpp", "integrations/openrgb/CMakeLists.txt", "tests/cpp/openrgb_*.cpp", "tools/hfxdev/verify.py"],
       "produced_evidence": ["openrgb-thread-sanitizer-result"],
@@ -605,7 +634,7 @@
       "timeout_seconds": 600,
       "dependencies": [
         "kernel-profile-contracts",
-        "openrgb-adapter-contracts",
+        "openrgb-native-route-contracts",
         "polychromatic-adapter-contracts",
         "openrazer-compatibility-contracts",
         "rust-unit",

From 13afbea94e5bd6bfe51ca9ded96f1d62b83051a7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 16:22:13 +0400
Subject: [PATCH 43/67] fix: package REUSE-compliant OpenRazer licenses

---
 tests/test_package_pipeline.py   | 38 +++++++++++++++++++++++++
 tools/hfxdev/package_pipeline.py | 48 ++++++++++++++++++++++----------
 2 files changed, 72 insertions(+), 14 deletions(-)

diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index 8a70eed..bd860e4 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -27,6 +27,7 @@
     _install_wheels,
     _inspect_staged_files,
     _normalize_tree,
+    _openrazer_dkms_projection_files,
     _private_stage_prefixes,
     _provenance_inputs,
     _provenance_materials,
@@ -37,6 +38,43 @@
 
 
 class PackagePipelineTests(unittest.TestCase):
+    def test_openrazer_dkms_projection_accepts_reuse_licenses(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            prepared = root / "prepared"
+            projection = root / "projection"
+            for path in (
+                prepared / "Makefile",
+                prepared / "install_files" / "dkms" / "dkms.conf",
+                prepared / "driver" / "Makefile",
+                prepared / "driver" / "driver.c",
+                prepared / "driver" / "driver.h",
+                prepared / "LICENSES" / "GPL-2.0-or-later.txt",
+            ):
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_text(f"fixture:{path.name}\n", encoding="utf-8")
+
+            selected = _openrazer_dkms_projection_files(prepared, projection)
+            destinations = {
+                destination.relative_to(projection).as_posix()
+                for _, destination in selected
+            }
+
+            self.assertIn("LICENSES/GPL-2.0-or-later.txt", destinations)
+            self.assertNotIn("LICENSE", destinations)
+            self.assertIn("driver/driver.c", destinations)
+            self.assertIn("driver/driver.h", destinations)
+
+    def test_openrazer_dkms_projection_requires_a_regular_license(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            prepared = root / "prepared"
+            projection = root / "projection"
+            prepared.mkdir()
+
+            with self.assertRaisesRegex(ModelError, "no regular license text"):
+                _openrazer_dkms_projection_files(prepared, projection)
+
     def test_openrgb_build_uses_the_source_bound_native_transform(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             output = Path(temporary)
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index 93fa8a0..a2945b1 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -465,20 +465,7 @@ def _openrazer_dkms_projection(
 
     projection = output / "work" / build.id / "projection"
     projection.mkdir(parents=True)
-    selected = [
-        (prepared.root / "Makefile", projection / "Makefile"),
-        (
-            prepared.root / "install_files" / "dkms" / "dkms.conf",
-            projection / "dkms.conf",
-        ),
-        (prepared.root / "LICENSE", projection / "LICENSE"),
-        (prepared.root / "driver" / "Makefile", projection / "driver" / "Makefile"),
-    ]
-    selected.extend(
-        (path, projection / "driver" / path.name)
-        for pattern in ("*.c", "*.h")
-        for path in sorted((prepared.root / "driver").glob(pattern))
-    )
+    selected = list(_openrazer_dkms_projection_files(prepared.root, projection))
     for source_path, destination in selected:
         if not source_path.is_file() or source_path.is_symlink():
             raise ModelError(f"build {build.id}: OpenRazer DKMS source projection is incomplete")
@@ -503,6 +490,39 @@ def _openrazer_dkms_projection(
     )
 
 
+def _openrazer_dkms_projection_files(
+    prepared: Path, projection: Path
+) -> tuple[tuple[Path, Path], ...]:
+    selected = [
+        (prepared / "Makefile", projection / "Makefile"),
+        (
+            prepared / "install_files" / "dkms" / "dkms.conf",
+            projection / "dkms.conf",
+        ),
+        (prepared / "driver" / "Makefile", projection / "driver" / "Makefile"),
+    ]
+    selected.extend(
+        (path, projection / "driver" / path.name)
+        for pattern in ("*.c", "*.h")
+        for path in sorted((prepared / "driver").glob(pattern))
+    )
+    license_files = []
+    legacy_license = prepared / "LICENSE"
+    if legacy_license.is_file() and not legacy_license.is_symlink():
+        license_files.append((legacy_license, projection / "LICENSE"))
+    reuse_licenses = prepared / "LICENSES"
+    if reuse_licenses.is_dir() and not reuse_licenses.is_symlink():
+        license_files.extend(
+            (path, projection / "LICENSES" / path.name)
+            for path in sorted(reuse_licenses.glob("*.txt"))
+            if path.is_file() and not path.is_symlink()
+        )
+    if not license_files:
+        raise ModelError("OpenRazer DKMS source projection has no regular license text")
+    selected.extend(license_files)
+    return tuple(selected)
+
+
 def _verify_openrazer_dkms_contract(prepared: Path, deployment: Any) -> None:
     path = prepared / "install_files" / "dkms" / "dkms.conf"
     if not path.is_file() or path.is_symlink():

From 8241f8a9d045d144d1a65c6da04f9028e3f5de06 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 16:39:23 +0400
Subject: [PATCH 44/67] fix: unify source-tree license validation

---
 tests/test_package_pipeline.py   |  9 +++++++++
 tools/hfxdev/package_pipeline.py | 24 ++++++++++++++++++++----
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index bd860e4..c7ca729 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -31,6 +31,7 @@
     _private_stage_prefixes,
     _provenance_inputs,
     _provenance_materials,
+    _source_tree_has_license,
     _tree_digest,
     load_artifact_set,
 )
@@ -38,6 +39,14 @@
 
 
 class PackagePipelineTests(unittest.TestCase):
+    def test_source_tree_license_contract_accepts_legacy_and_reuse_layouts(self) -> None:
+        self.assertTrue(_source_tree_has_license({"LICENSE"}))
+        self.assertTrue(
+            _source_tree_has_license({"LICENSES/GPL-2.0-or-later.txt"})
+        )
+        self.assertFalse(_source_tree_has_license({"LICENSES/README.md"}))
+        self.assertFalse(_source_tree_has_license({"nested/LICENSE"}))
+
     def test_openrazer_dkms_projection_accepts_reuse_licenses(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index a2945b1..6d5adf0 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -42,6 +42,18 @@
 DIGEST = re.compile(r"^[0-9a-f]{64}$")
 MANIFEST_NAME = "package-build-manifest.json"
 INVENTORY_PATH = PurePosixPath("/usr/share/hyperflux-next/installed-files.json")
+SOURCE_TREE_REQUIRED_FILES = frozenset({"Makefile", "dkms.conf", "driver/Makefile"})
+
+
+def _source_tree_has_license(files: set[str]) -> bool:
+    if "LICENSE" in files:
+        return True
+    return any(
+        len(path.parts) == 2
+        and path.parts[0] == "LICENSES"
+        and path.suffix == ".txt"
+        for path in map(PurePosixPath, files)
+    )
 
 
 @dataclass(frozen=True)
@@ -517,9 +529,13 @@ def _openrazer_dkms_projection_files(
             for path in sorted(reuse_licenses.glob("*.txt"))
             if path.is_file() and not path.is_symlink()
         )
-    if not license_files:
-        raise ModelError("OpenRazer DKMS source projection has no regular license text")
     selected.extend(license_files)
+    projected_files = {
+        destination.relative_to(projection).as_posix()
+        for _, destination in selected
+    }
+    if not _source_tree_has_license(projected_files):
+        raise ModelError("OpenRazer DKMS source projection has no regular license text")
     return tuple(selected)
 
 
@@ -1229,9 +1245,9 @@ def _install_source_tree(stage_root: Path, artifact: BuiltArtifact) -> None:
                 raise ModelError(f"artifact {artifact.build_id}: source-tree member is unreadable")
             _write_to_stage(target, source.read(), 0o644)
             files.add(raw_name)
-    required = {"Makefile", "LICENSE", "dkms.conf", "driver/Makefile"}
     if (
-        not required <= files
+        not SOURCE_TREE_REQUIRED_FILES <= files
+        or not _source_tree_has_license(files)
         or "driver" not in directories
         or not any(name.startswith("driver/") and name.endswith(".c") for name in files)
         or not any(name.startswith("driver/") and name.endswith(".h") for name in files)

From 4437d86ed78a23e9b93d3ea67b84eaa284c11e03 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:20:13 +0400
Subject: [PATCH 45/67] fix: keep native relay within thin-process budget

---
 Cargo.toml                                   |  7 +++
 assurance/generated/hyperflux-next.spdx.json |  2 +-
 docs/generated/installation.md               |  2 +-
 docs/generated/supply-chain.md               |  2 +-
 packaging/generated/install-plan.json        |  6 +-
 packaging/install.json                       |  4 ++
 schemas/install-manifest.schema.json         |  3 +-
 tests/test_install.py                        | 32 ++++++++++
 tests/test_package_pipeline.py               | 61 ++++++++++++++++++++
 tools/hfxdev/generators/install.py           |  5 ++
 tools/hfxdev/install.py                      | 16 ++++-
 tools/hfxdev/package_pipeline.py             | 16 ++---
 12 files changed, 143 insertions(+), 13 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index a92b212..8134122 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -22,3 +22,10 @@ unsafe_code = "deny"
 [workspace.lints.clippy]
 all = "deny"
 pedantic = "deny"
+
+[profile.relay]
+inherits = "release"
+codegen-units = 1
+lto = "thin"
+panic = "abort"
+strip = "symbols"
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 85ce3a1..aad5c72 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/27d52db25e0d72e5f52359a11aa5cfd97f1bc98f9b4800bc7c02c69b590a8754",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/7d3646e6c0c97ff16a7ae093b63c340045896ac6901dec8db6c6919990e4f060",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index be109cd..8c75f3e 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical manifest digest: `b939538cfddbc866e5e72213267f29053a34d6eb636264467cea0f69a7bcc750`.
+Canonical manifest digest: `3bc579591d6c7b722cf28bf6dbffe6246f31e86068d4c3b593ab60bfca47edd3`.
 
 Package: `hyperflux-next-linux` `0.0.0-dev.1` release `1`.
 
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index 546f992..6d0d96c 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `27d52db25e0d72e5f52359a11aa5cfd97f1bc98f9b4800bc7c02c69b590a8754`
+- Authority SHA-256: `7d3646e6c0c97ff16a7ae093b63c340045896ac6901dec8db6c6919990e4f060`
 
 ## License Policy
 
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 951ccfa..9f267a5 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -1,6 +1,6 @@
 {
   "schema": "hyperflux-compiled-install-plan-v1",
-  "install_manifest_sha256": "b939538cfddbc866e5e72213267f29053a34d6eb636264467cea0f69a7bcc750",
+  "install_manifest_sha256": "3bc579591d6c7b722cf28bf6dbffe6246f31e86068d4c3b593ab60bfca47edd3",
   "product": {
     "name": "hyperflux-next-linux",
     "version": "0.0.0-dev.1",
@@ -19,6 +19,7 @@
       "required": true,
       "package": "hfx-daemon",
       "target": "hyperflux-next-bridge",
+      "profile": "release",
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-bridge",
       "mode": "0755"
     },
@@ -28,6 +29,7 @@
       "required": true,
       "package": "hfx-ops",
       "target": "hyperfluxctl",
+      "profile": "release",
       "destination": "/usr/bin/hyperfluxctl",
       "mode": "0755"
     },
@@ -37,6 +39,7 @@
       "required": true,
       "package": "hfx-ops",
       "target": "hyperflux-next-activate",
+      "profile": "release",
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-activate",
       "mode": "0755"
     },
@@ -46,6 +49,7 @@
       "required": true,
       "package": "hfx-uhid-relay",
       "target": "hyperflux-next-uhid-relay",
+      "profile": "relay",
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-uhid-relay",
       "mode": "0755"
     },
diff --git a/packaging/install.json b/packaging/install.json
index ba08da9..6ec103c 100644
--- a/packaging/install.json
+++ b/packaging/install.json
@@ -13,6 +13,7 @@
       "kind": "cargo-binary",
       "package": "hfx-daemon",
       "target": "hyperflux-next-bridge",
+      "profile": "release",
       "destination": "@bridge_executable_path@",
       "mode": "0755",
       "required": true
@@ -22,6 +23,7 @@
       "kind": "cargo-binary",
       "package": "hfx-ops",
       "target": "hyperfluxctl",
+      "profile": "release",
       "destination": "@operations_cli_path@",
       "mode": "0755",
       "required": true
@@ -31,6 +33,7 @@
       "kind": "cargo-binary",
       "package": "hfx-ops",
       "target": "hyperflux-next-activate",
+      "profile": "release",
       "destination": "@activation_utility_path@",
       "mode": "0755",
       "required": true
@@ -40,6 +43,7 @@
       "kind": "cargo-binary",
       "package": "hfx-uhid-relay",
       "target": "hyperflux-next-uhid-relay",
+      "profile": "relay",
       "destination": "@openrazer_relay_executable_path@",
       "mode": "0755",
       "required": true
diff --git a/schemas/install-manifest.schema.json b/schemas/install-manifest.schema.json
index e5320bc..f0cefa3 100644
--- a/schemas/install-manifest.schema.json
+++ b/schemas/install-manifest.schema.json
@@ -68,12 +68,13 @@
     "cargoBuild": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["id", "kind", "package", "target", "destination", "mode", "required"],
+      "required": ["id", "kind", "package", "target", "profile", "destination", "mode", "required"],
       "properties": {
         "id": {"$ref": "#/$defs/identifier"},
         "kind": {"const": "cargo-binary"},
         "package": {"$ref": "#/$defs/identifier"},
         "target": {"$ref": "#/$defs/identifier"},
+        "profile": {"enum": ["release", "relay"]},
         "destination": {"$ref": "#/$defs/destination"},
         "mode": {"const": "0755"},
         "required": {"const": true}
diff --git a/tests/test_install.py b/tests/test_install.py
index 8469d14..40813f5 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -5,6 +5,7 @@
 import copy
 from pathlib import Path
 import sys
+import tomllib
 import unittest
 from unittest.mock import patch
 
@@ -64,6 +65,33 @@ def test_runtime_destinations_and_dkms_source_are_derived(self) -> None:
         self.assertIn(f"{source_directory}/dkms.conf", destinations)
         self.assertIn(f"{source_directory}/hyperflux-next-core.c", destinations)
 
+    def test_only_the_feature_relay_uses_the_thin_process_profile(self) -> None:
+        cargo_profiles = {
+            build.id: build.cargo_profile
+            for build in self.manifest.builds
+            if build.kind == "cargo-binary"
+        }
+        self.assertEqual(
+            cargo_profiles,
+            {
+                "bridge-daemon": "release",
+                "operations-cli": "release",
+                "activation-utility": "release",
+                "openrazer-native-relay": "relay",
+            },
+        )
+        cargo = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
+        self.assertEqual(
+            cargo["profile"]["relay"],
+            {
+                "inherits": "release",
+                "codegen-units": 1,
+                "lto": "thin",
+                "panic": "abort",
+                "strip": "symbols",
+            },
+        )
+
     def test_python_sdk_license_is_generated_from_repository_authority(self) -> None:
         self.assertEqual(
             (ROOT / "sdk/python/LICENSE").read_bytes(),
@@ -95,6 +123,10 @@ def test_loader_rejects_activation_and_destination_drift(self) -> None:
         stale_binary["builds"][0]["destination"] = "/usr/bin/hyperflux-next-bridge"
         cases.append(stale_binary)
 
+        unknown_profile = copy.deepcopy(self.value)
+        unknown_profile["builds"][0]["profile"] = "unreviewed"
+        cases.append(unknown_profile)
+
         traversal = copy.deepcopy(self.value)
         traversal["payloads"][0]["destination"] = "/usr/share/../escape"
         cases.append(traversal)
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index c7ca729..0e1ec5a 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -22,6 +22,7 @@
 from hfxdev.package_pipeline import (
     BuiltArtifact,
     _base_environment,
+    _build_cargo,
     _build_cmake,
     _build_python,
     _install_wheels,
@@ -39,6 +40,66 @@
 
 
 class PackagePipelineTests(unittest.TestCase):
+    def test_cargo_builds_use_their_declared_profiles_and_output_directories(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            output = Path(temporary)
+            environment = {"CARGO_TARGET_DIR": str(output / "target")}
+            install = load_install_manifest(ROOT)
+            builds = [
+                install.build("bridge-daemon"),
+                install.build("openrazer-native-relay"),
+            ]
+            commands: list[list[str]] = []
+            copied: list[Path] = []
+
+            def capture_run(
+                command: list[str],
+                *,
+                cwd: Path,
+                environment: dict[str, str],
+                label: str,
+                timeout_seconds: int = 900,
+            ) -> None:
+                del cwd, environment, label, timeout_seconds
+                commands.append(command)
+
+            def capture_copy(
+                source: Path,
+                artifacts_root: Path,
+                build: object,
+                **kwargs: object,
+            ) -> object:
+                del artifacts_root, build, kwargs
+                copied.append(source)
+                return object()
+
+            with (
+                patch("hfxdev.package_pipeline._run", side_effect=capture_run),
+                patch(
+                    "hfxdev.package_pipeline._copy_artifact",
+                    side_effect=capture_copy,
+                ),
+            ):
+                _build_cargo(ROOT, output, environment, builds)
+
+            self.assertEqual(
+                [
+                    (command[command.index("--profile") + 1], command[-1])
+                    for command in commands
+                ],
+                [
+                    ("release", "hyperflux-next-bridge"),
+                    ("relay", "hyperflux-next-uhid-relay"),
+                ],
+            )
+            self.assertEqual(
+                copied,
+                [
+                    output / "target/release/hyperflux-next-bridge",
+                    output / "target/relay/hyperflux-next-uhid-relay",
+                ],
+            )
+
     def test_source_tree_license_contract_accepts_legacy_and_reuse_layouts(self) -> None:
         self.assertTrue(_source_tree_has_license({"LICENSE"}))
         self.assertTrue(
diff --git a/tools/hfxdev/generators/install.py b/tools/hfxdev/generators/install.py
index b57028a..c56edb4 100644
--- a/tools/hfxdev/generators/install.py
+++ b/tools/hfxdev/generators/install.py
@@ -31,6 +31,11 @@ def compiled_plan(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
                 **({"source": build.source} if build.source is not None else {}),
                 **({"package": build.package} if build.package is not None else {}),
                 **({"target": build.target} if build.target is not None else {}),
+                **(
+                    {"profile": build.cargo_profile}
+                    if build.cargo_profile is not None
+                    else {}
+                ),
                 **({"output": build.output} if build.output is not None else {}),
                 **(
                     {"transform": build.transform}
diff --git a/tools/hfxdev/install.py b/tools/hfxdev/install.py
index b5be4db..d770079 100644
--- a/tools/hfxdev/install.py
+++ b/tools/hfxdev/install.py
@@ -19,7 +19,17 @@
     "enable_service_on_install",
     "preserve_configuration",
 }
-CARGO_KEYS = {"id", "kind", "package", "target", "destination", "mode", "required"}
+CARGO_KEYS = {
+    "id",
+    "kind",
+    "package",
+    "target",
+    "profile",
+    "destination",
+    "mode",
+    "required",
+}
+CARGO_PROFILES = {"release", "relay"}
 CMAKE_KEYS = {
     "id",
     "kind",
@@ -64,6 +74,7 @@ class BuildSpec:
     source: str | None = None
     package: str | None = None
     target: str | None = None
+    cargo_profile: str | None = None
     output: str | None = None
     destination: str | None = None
     mode: int | None = None
@@ -207,12 +218,15 @@ def _cargo_build(value: dict[str, Any], tokens: dict[str, str], label: str) -> B
     _exact(value, CARGO_KEYS, label)
     if value["required"] is not True:
         raise ModelError(f"{label}: Cargo product must be required")
+    if value["profile"] not in CARGO_PROFILES:
+        raise ModelError(f"{label}: unsupported Cargo profile")
     return BuildSpec(
         id=_identifier(value["id"], f"{label} id"),
         kind="cargo-binary",
         required=True,
         package=_identifier(value["package"], f"{label} package"),
         target=_identifier(value["target"], f"{label} target"),
+        cargo_profile=value["profile"],
         destination=_destination(value["destination"], f"{label} destination", tokens),
         mode=_mode(value["mode"], f"{label} mode"),
     )
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index 6d5adf0..f0d9898 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -250,16 +250,17 @@ def _build_cargo(
     environment: dict[str, str],
     builds: list[BuildSpec],
 ) -> list[BuiltArtifact]:
-    by_package: dict[str, list[BuildSpec]] = {}
+    by_package: dict[tuple[str, str], list[BuildSpec]] = {}
     for build in builds:
-        if build.package is None or build.target is None:
+        if build.package is None or build.target is None or build.cargo_profile is None:
             raise ModelError(f"build {build.id}: incomplete Cargo declaration")
-        by_package.setdefault(build.package, []).append(build)
-    for package, package_builds in sorted(by_package.items()):
+        by_package.setdefault((build.package, build.cargo_profile), []).append(build)
+    for (package, profile), package_builds in sorted(by_package.items()):
         command = [
             "cargo",
             "build",
-            "--release",
+            "--profile",
+            profile,
             "--locked",
             "--offline",
             "--package",
@@ -273,10 +274,11 @@ def _build_cargo(
             environment=environment,
             label=f"Cargo package {package}",
         )
-    release = Path(environment["CARGO_TARGET_DIR"]) / "release"
     return [
         _copy_artifact(
-            release / (build.target or ""),
+            Path(environment["CARGO_TARGET_DIR"])
+            / (build.cargo_profile or "")
+            / (build.target or ""),
             output,
             build,
             kind="cargo-binary",

From 29b110cd2b31d8164c72d6dd5809892d2bb1d9d4 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 19:22:24 +0400
Subject: [PATCH 46/67] feat: add declarative native device onboarding

---
 .../tests/fixtures/rust-qualified-mouse.json  |   2 +-
 .../tests/fixtures/rust-qualified-pair.json   |   2 +-
 architecture/repository-atlas.json            |  32 +-
 crates/hfx-bridge/README.md                   |   4 +-
 crates/hfx-bridge/src/native_projection.rs    |  28 +
 crates/hfx-ops/README.md                      |  48 +
 crates/hfx-ops/src/bin/hyperfluxctl.rs        |  33 +-
 crates/hfx-ops/src/lib.rs                     |   6 +
 crates/hfx-ops/src/native_onboarding.rs       | 321 +++++++
 crates/hfx-ops/src/probe.rs                   |  21 +-
 crates/hfx-profiles/src/catalog.rs            |  62 ++
 crates/hfx-profiles/src/generated.rs          |   4 +-
 crates/hfx-sdk/README.md                      |   4 +-
 docs/README.md                                |   1 +
 docs/architecture/native-device-onboarding.md |  70 ++
 docs/assets/social-preview.png                | Bin 9683 -> 9686 bytes
 docs/generated/installation.md                |   6 +-
 docs/generated/repository-atlas.md            |  71 +-
 docs/generated/supported-hardware.md          |   2 +-
 docs/generated/verification.md                |  36 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  12 +-
 generated/public-readiness.json               |   4 +-
 knowledge/README.md                           |   4 +-
 packaging/generated/install-plan.json         |  28 +
 profiles/README.md                            |   8 +-
 profiles/capabilities.json                    |   1 +
 schemas/README.md                             |   3 +
 ...native-device-onboarding-draft.schema.json | 189 ++++
 ...ve-device-promotion-assessment.schema.json |  52 ++
 schemas/native-route-observation.schema.json  |  34 +
 .../hyperflux/generated/profile_catalog.hpp   |   4 +-
 .../generated/profile_catalog.py              |  10 +-
 tests/README.md                               |   6 +-
 .../generated/profile-compositions.json       |   2 +-
 .../viper-ultimate-007b-observation.json      |  21 +
 tests/test_integrations.py                    |  46 +
 tests/test_native_onboarding.py               | 384 ++++++++
 tools/README.md                               |   7 +-
 tools/hfxdev/cli.py                           |  68 +-
 tools/hfxdev/native_onboarding.py             | 845 ++++++++++++++++++
 tools/hfxdev/native_parity.py                 |  45 +-
 tools/hfxdev/openrazer.py                     |  52 ++
 tools/hfxdev/openrazer_native_route.py        | 216 +++++
 tools/hfxdev/private_artifact.py              |  65 ++
 tools/hfxdev/testgraph.py                     |   1 +
 tools/hfxdev/verify.py                        |  79 +-
 verification/tests.json                       |  33 +
 49 files changed, 2801 insertions(+), 175 deletions(-)
 create mode 100644 crates/hfx-ops/README.md
 create mode 100644 crates/hfx-ops/src/native_onboarding.rs
 create mode 100644 docs/architecture/native-device-onboarding.md
 create mode 100644 schemas/native-device-onboarding-draft.schema.json
 create mode 100644 schemas/native-device-promotion-assessment.schema.json
 create mode 100644 schemas/native-route-observation.schema.json
 create mode 100644 tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json
 create mode 100644 tests/test_native_onboarding.py
 create mode 100644 tools/hfxdev/native_onboarding.py
 create mode 100644 tools/hfxdev/private_artifact.py

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index e27572f..553218d 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
+    "profile_catalog_digest": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index fe6a459..ff79aad 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
+    "profile_catalog_digest": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
   },
   "receivers": [
     {
diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index bb7a75a..b4963ec 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -27,7 +27,7 @@
       "inputs": ["Architecture invariants", "Canonical subsystem requirements"],
       "outputs": ["Validated canonical data", "Generator input contracts"],
       "public_contracts": ["Additional properties rejected", "Stable schema identifiers", "Safe repository-relative paths"],
-      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json", "schemas/lifecycle-policy-catalog.schema.json", "schemas/kernel-uapi-registry.schema.json", "schemas/kernel-uapi-native-exchange.schema.json"],
+      "canonical_files": ["schemas/domain-catalog.json", "schemas/domain-catalog.schema.json", "schemas/repository-atlas.schema.json", "schemas/public-readiness.schema.json", "schemas/local-companion.schema.json", "schemas/local-snapshot.schema.json", "schemas/licensing-policy.schema.json", "schemas/lifecycle-policy-catalog.schema.json", "schemas/kernel-uapi-registry.schema.json", "schemas/kernel-uapi-native-exchange.schema.json", "schemas/native-route-observation.schema.json", "schemas/native-device-onboarding-draft.schema.json", "schemas/native-device-promotion-assessment.schema.json"],
       "generated_files": ["schemas/README.md", "docs/generated/domain-types.md"],
       "verification": ["schema-contracts", "repository-atlas-contracts"],
       "limitations": ["Schemas validate structure and bounded values, not real hardware behavior"],
@@ -77,7 +77,7 @@
       "public_contracts": ["Exact identity plus public evidence gates writes", "Children compose independently", "Candidates inherit no authority"],
       "canonical_files": ["profiles/capabilities.json", "profiles/lifecycle-policies.json", "profiles/evidence/claims.json", "profiles/receivers/razer-hyperflux-v2-1532-00cf.json", "profiles/surfaces/razer-hyperflux-v2-hard-edition.json", "profiles/children/razer-basilisk-v3-pro-35k-00cd.json", "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json", "profiles/candidates/razer-hyperflux-v2-2026-07-13.json", "profiles/candidates/razer-hyperflux-v2-2026-07-21.json"],
       "generated_files": ["profiles/README.md", "generated/profiles/catalog.json", "docs/generated/supported-hardware.md"],
-      "verification": ["profile-contracts"],
+      "verification": ["profile-contracts", "native-onboarding-contracts"],
       "limitations": ["Only two child profiles currently carry physical qualification"],
       "safe_change_workflow": ["Add evidence before capability", "Regenerate every profile projection", "Run profile, integration, kernel, and change-selection contracts"],
       "related_docs": ["docs/generated/supported-hardware.md", "docs/architecture/device-knowledge.md"],
@@ -93,7 +93,7 @@
       "public_contracts": ["Every fact carries provenance", "Disagreement remains visible", "Imported support never promotes a route"],
       "canonical_files": ["knowledge/reviewed-facts.json", "knowledge/candidate-links.json", "knowledge/capability-map.json", "knowledge/upstreams/openrazer.json", "knowledge/upstreams/openrgb.json"],
       "generated_files": ["knowledge/README.md", "generated/knowledge/catalog.json", "docs/generated/device-knowledge.md"],
-      "verification": ["device-knowledge-contracts"],
+      "verification": ["device-knowledge-contracts", "native-onboarding-contracts"],
       "limitations": ["Research candidates remain non-writable until separately qualified"],
       "safe_change_workflow": ["Review and cite the new fact", "Refresh only the exact bounded upstream catalog", "Regenerate and run knowledge plus profile contracts"],
       "related_docs": ["docs/architecture/device-knowledge.md", "docs/generated/device-knowledge.md"],
@@ -259,6 +259,22 @@
       "related_docs": ["docs/architecture/sdk.md", "docs/generated/bridge-protocol.md"],
       "depends_on": ["rust-workspace", "protocol", "profiles"]
     },
+    {
+      "id": "operations-cli", "title": "Operations CLI", "path": "crates/hfx-ops", "category": "applications", "status": "implemented",
+      "purpose": "Provides bounded local status, diagnostics, qualification, and privacy-safe native route observation for ordinary users and maintainers.",
+      "owns": ["Installed command-line workflows", "Privacy-safe observation projection", "Local qualification companion"],
+      "must_not_own": ["Profile promotion authority", "Raw receiver reports", "Application presentation"],
+      "inputs": ["Typed SDK state", "Canonical profile and integration metadata", "Local runtime configuration"],
+      "outputs": ["Human and JSON diagnostics", "Mode-0600 native route observations", "Loopback qualification service"],
+      "public_contracts": ["No network upload", "Observation performs no device command or hardware write", "Private route identity is excluded"],
+      "canonical_files": ["crates/hfx-ops/Cargo.toml", "crates/hfx-ops/src/bin/hyperfluxctl.rs", "crates/hfx-ops/src/native_onboarding.rs", "crates/hfx-ops/src/probe.rs"],
+      "generated_files": ["crates/hfx-ops/README.md"],
+      "verification": ["rust-unit", "native-onboarding-contracts", "package-contracts"],
+      "limitations": ["An observation can propose a candidate profile but cannot qualify or enable writes"],
+      "safe_change_workflow": ["Keep each command on a typed SDK or local system boundary", "Add privacy and side-effect tests", "Run Rust, onboarding, and package contracts"],
+      "related_docs": ["docs/architecture/native-device-onboarding.md", "docs/user/troubleshooting.md"],
+      "depends_on": ["rust-sdk", "profiles", "bridge-runtime"]
+    },
     {
       "id": "kernel-transport", "title": "Kernel transport adapter", "path": "crates/hfx-kernel-transport", "category": "runtime", "status": "implemented",
       "purpose": "Adapts the generated kernel UAPI into bounded Rust observation, routing, envelope I/O, and qualified native exchanges.",
@@ -395,9 +411,9 @@
       "inputs": ["Canonical repository data", "Pinned toolchains", "Typed verification graph"],
       "outputs": ["Generated source and docs", "Verification evidence", "Repository navigation projections"],
       "public_contracts": ["One command surface", "Idempotent generation", "Explicit side-effect boundaries"],
-      "canonical_files": ["hfx", "tools/hfxdev/cli.py", "tools/hfxdev/render.py", "tools/hfxdev/verify.py", "tools/hfxdev/public_readiness.py", "tools/hfxdev/local_companion.py", "tools/hfxdev/licensing.py"],
+      "canonical_files": ["hfx", "tools/hfxdev/cli.py", "tools/hfxdev/render.py", "tools/hfxdev/verify.py", "tools/hfxdev/public_readiness.py", "tools/hfxdev/local_companion.py", "tools/hfxdev/licensing.py", "tools/hfxdev/native_onboarding.py", "tools/hfxdev/private_artifact.py", "tools/hfxdev/openrazer_native_route.py"],
       "generated_files": ["tools/README.md"],
-      "verification": ["python-unit", "generated-freshness"],
+      "verification": ["python-unit", "native-onboarding-contracts", "generated-freshness"],
       "limitations": ["Tooling projects canonical truth; it is not an independent product authority"],
       "safe_change_workflow": ["Change the narrow loader or generator owner", "Add focused deterministic tests", "Run generation twice and the affected verification lane"],
       "related_docs": ["CONTRIBUTING.md", "docs/generated/verification.md"],
@@ -411,9 +427,9 @@
       "inputs": ["Public contracts", "Generated artifacts", "Sanitized scenarios"],
       "outputs": ["Pass or fail observations", "Regression diagnostics"],
       "public_contracts": ["No required node skipped", "Software tests perform no hardware writes", "Fixtures are non-authoritative"],
-      "canonical_files": ["tests/test_foundation.py", "tests/test_repository_experience.py", "tests/test_testgraph.py"],
+      "canonical_files": ["tests/test_foundation.py", "tests/test_repository_experience.py", "tests/test_testgraph.py", "tests/test_native_onboarding.py", "tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json"],
       "generated_files": ["tests/README.md", "tests/fixtures/generated/profile-compositions.json"],
-      "verification": ["python-unit", "cpp-sdk-contracts", "rust-unit"],
+      "verification": ["python-unit", "native-onboarding-contracts", "cpp-sdk-contracts", "rust-unit"],
       "limitations": ["Tests demonstrate modeled behavior, not universal physical compatibility"],
       "safe_change_workflow": ["Add the smallest contract that exposes the risk", "Keep fixtures sanitized and bounded", "Run focused tests before the selected lane"],
       "related_docs": ["docs/generated/verification.md", "docs/assurance/simulator.md"],
@@ -459,7 +475,7 @@
       "inputs": ["Generated technical Markdown", "Reviewed user and architecture guides", "Repository navigation requirements"],
       "outputs": ["GitHub-native documentation", "Repository Atlas", "Public readiness projection", "Canonical metadata assets"],
       "public_contracts": ["Stable repository-relative links", "Audience-specific entry points", "Generated facts identify their canonical source", "No duplicate documentation website"],
-      "canonical_files": ["docs/user/overview.md", "docs/architecture/design-book.md", "docs/architecture/decisions/github-native-documentation.md"],
+      "canonical_files": ["docs/user/overview.md", "docs/architecture/design-book.md", "docs/architecture/native-device-onboarding.md", "docs/architecture/decisions/github-native-documentation.md"],
       "generated_files": ["docs/README.md", "docs/generated/repository-atlas.md", "generated/public-readiness.json"],
       "verification": ["repository-documentation-contracts", "repository-atlas-contracts"],
       "limitations": ["Repository documentation describes an unreleased project and cannot create a supported-product claim"],
diff --git a/crates/hfx-bridge/README.md b/crates/hfx-bridge/README.md
index 95e02c7..e1b4bae 100644
--- a/crates/hfx-bridge/README.md
+++ b/crates/hfx-bridge/README.md
@@ -37,11 +37,11 @@ Before opening a pull request:
 
 - Regenerate 1 declared projection(s).
 - Run `rust-unit`, `simulator-contracts`.
-- Review direct consumers: Production daemon, Device qualification console.
+- Review direct consumers: Production daemon, Device qualification console, Operations CLI.
 
 ## Relationships
 
 - **Depends on:** [Core policy engine](../hfx-core/README.md), [Versioned bridge protocol](../../protocol/README.md)
-- **Used by:** [Production daemon](../hfx-daemon/README.md), [Device qualification console](../../apps/device-qualification/README.md)
+- **Used by:** [Production daemon](../hfx-daemon/README.md), [Device qualification console](../../apps/device-qualification/README.md), [Operations CLI](../hfx-ops/README.md)
 
 See the [Repository Atlas](../../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/crates/hfx-bridge/src/native_projection.rs b/crates/hfx-bridge/src/native_projection.rs
index 41b776a..3124a48 100644
--- a/crates/hfx-bridge/src/native_projection.rs
+++ b/crates/hfx-bridge/src/native_projection.rs
@@ -143,3 +143,31 @@ fn native_route_state(endpoint: &EndpointLifecycle) -> RouteState {
         RouteState::Unknown => RouteState::Unknown,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{CapabilityId, ProductId};
+    use hfx_profiles::{RuntimeCapability, RuntimeProfileCatalog};
+
+    #[test]
+    fn native_access_is_capability_driven_not_pid_driven() {
+        let catalog = RuntimeProfileCatalog::load().expect("generated profiles are valid");
+        let mut profile = catalog
+            .child(ProductId::try_from(0x00cd_u16).expect("fixture PID is valid"))
+            .expect("the current mouse profile exists")
+            .clone();
+        assert!(!native_exchange_is_qualified(&profile));
+
+        profile.product_id = Some(ProductId::try_from(0x007b_u16).expect("fixture PID is valid"));
+        profile.capabilities.push(RuntimeCapability {
+            id: CapabilityId::try_from(NATIVE_EXCHANGE_CAPABILITY_ID)
+                .expect("native capability ID is valid"),
+            support_level: SupportLevel::ProductionQualified,
+            writable: true,
+        });
+
+        assert!(native_exchange_is_qualified(&profile));
+        assert_eq!(profile.product_id.map(ProductId::get), Some(0x007b));
+    }
+}
diff --git a/crates/hfx-ops/README.md b/crates/hfx-ops/README.md
new file mode 100644
index 0000000..74f2fcc
--- /dev/null
+++ b/crates/hfx-ops/README.md
@@ -0,0 +1,48 @@
+# Operations CLI
+
+> Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
+
+Provides bounded local status, diagnostics, qualification, and privacy-safe native route observation for ordinary users and maintainers.
+
+`implemented` | `applications` | Atlas: `operations-cli`
+
+## Start Here
+
+- [`docs/architecture/native-device-onboarding.md`](../../docs/architecture/native-device-onboarding.md)
+- [`docs/user/troubleshooting.md`](../../docs/user/troubleshooting.md)
+
+## Scope
+
+**Owns**
+- Installed command-line workflows
+- Privacy-safe observation projection
+- Local qualification companion
+
+**Does not own**
+- Profile promotion authority
+- Raw receiver reports
+- Application presentation
+
+## Change Here
+
+- [`crates/hfx-ops/Cargo.toml`](Cargo.toml)
+- [`crates/hfx-ops/src/bin/hyperfluxctl.rs`](src/bin/hyperfluxctl.rs)
+- [`crates/hfx-ops/src/native_onboarding.rs`](src/native_onboarding.rs)
+- [`crates/hfx-ops/src/probe.rs`](src/probe.rs)
+
+## Verification
+
+Run `rust-unit` `native-onboarding-contracts` `package-contracts` after changing this area.
+
+Before opening a pull request:
+
+- Regenerate 1 declared projection(s).
+- Run `rust-unit`, `native-onboarding-contracts`, `package-contracts`.
+- No direct subsystem consumer is declared; verify repository-facing outputs.
+
+## Relationships
+
+- **Depends on:** [Rust SDK](../hfx-sdk/README.md), [Composable hardware profiles](../../profiles/README.md), [Bridge runtime](../hfx-bridge/README.md)
+- **Used by:** None
+
+See the [Repository Atlas](../../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/crates/hfx-ops/src/bin/hyperfluxctl.rs b/crates/hfx-ops/src/bin/hyperfluxctl.rs
index c967548..ef11c02 100644
--- a/crates/hfx-ops/src/bin/hyperfluxctl.rs
+++ b/crates/hfx-ops/src/bin/hyperfluxctl.rs
@@ -3,10 +3,11 @@
 use hfx_ops::{
     AssessmentState, DriverState, QualificationConfigurationOutcome, QualificationServerConfig,
     RealSystemProbe, RunnerCapabilities, SystemController, SystemProbe, assess_system,
-    build_qualification_view, build_support_bundle, enable_qualification_configuration,
+    build_native_route_observations, build_qualification_view, build_support_bundle,
+    default_native_observation_directory, enable_qualification_configuration,
     preview_support_bundle, qualification_generated_at, render_doctor_text, render_status_text,
     restore_qualification_configuration, serve_qualification_console, suggested_support_name,
-    write_support_bundle,
+    write_native_route_observations, write_support_bundle,
 };
 use hfx_profiles::RuntimeProfileCatalog;
 use hfx_runtime::BRIDGE_CONFIGURATION_FILE_PATH;
@@ -14,7 +15,7 @@ use std::env;
 use std::path::PathBuf;
 
 fn usage() -> &'static str {
-    "Usage:\n  hyperfluxctl status [--json]\n  hyperfluxctl doctor [--explain] [--json] [--repair]\n  hyperfluxctl support-bundle --preview\n  hyperfluxctl support-bundle --output PATH\n  hyperfluxctl qualification view --json\n  hyperfluxctl qualification prepare\n  hyperfluxctl qualification restore\n  hyperfluxctl qualification serve [--assets PATH]\n"
+    "Usage:\n  hyperfluxctl status [--json]\n  hyperfluxctl doctor [--explain] [--json] [--repair]\n  hyperfluxctl support-bundle --preview\n  hyperfluxctl support-bundle --output PATH\n  hyperfluxctl qualification view --json\n  hyperfluxctl qualification prepare\n  hyperfluxctl qualification restore\n  hyperfluxctl qualification serve [--assets PATH]\n  hyperfluxctl native observe [--output-dir PATH]\n"
 }
 
 fn json<T: serde::Serialize>(value: &T) -> Result<String, String> {
@@ -138,6 +139,31 @@ fn qualification(arguments: &[String]) -> Result<i32, String> {
     Ok(0)
 }
 
+fn native(arguments: &[String]) -> Result<i32, String> {
+    let output = match arguments {
+        [observe] if observe == "observe" => default_native_observation_directory()
+            .map_err(|error| format!("native route observation failed: {error}"))?,
+        [observe, option, path] if observe == "observe" && option == "--output-dir" => {
+            PathBuf::from(path)
+        }
+        _ => return Err(usage().to_owned()),
+    };
+    let probe = RealSystemProbe::default();
+    let inventory = probe
+        .native_route_inventory()
+        .map_err(|error| format!("native route observation failed: {error}"))?;
+    let observations = build_native_route_observations(&inventory, &qualification_generated_at())
+        .map_err(|error| format!("native route observation failed: {error}"))?;
+    let paths = write_native_route_observations(&output, &observations)
+        .map_err(|error| format!("native route observation failed: {error}"))?;
+    println!("Native receiver routes observed: {}", paths.len());
+    println!("No device command or hardware write was executed.");
+    for path in paths {
+        println!("Privacy-safe observation: {}", path.display());
+    }
+    Ok(0)
+}
+
 fn prepare_qualification_configuration() -> Result<i32, String> {
     require_root_for_qualification_configuration()?;
     let probe = RealSystemProbe::default();
@@ -217,6 +243,7 @@ fn run() -> Result<i32, String> {
         "status" => status(rest),
         "support-bundle" => support_bundle(rest),
         "qualification" => qualification(rest),
+        "native" => native(rest),
         "--help" | "-h" | "help" => {
             print!("{}", usage());
             Ok(0)
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 5becc60..baa91e4 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -5,6 +5,7 @@
 mod activation;
 mod assessment;
 mod configuration;
+mod native_onboarding;
 mod probe;
 mod qualification;
 mod qualification_event_evidence;
@@ -28,6 +29,11 @@ pub use configuration::{
     QualificationConfigurationOutcome, confirm_configuration, enable_qualification_configuration,
     migrate_configuration, restore_qualification_configuration,
 };
+pub use native_onboarding::{
+    NativeObservationError, NativeObservationPrivacy, NativeRouteObservation,
+    build_native_route_observations, default_native_observation_directory,
+    write_native_route_observations,
+};
 pub use probe::{
     BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, KernelModuleIdentitySnapshot,
     OpenRazerDriverSnapshot, OpenRazerDriverState, ProbeError, RealCommandRunner, RealSystemProbe,
diff --git a/crates/hfx-ops/src/native_onboarding.rs b/crates/hfx-ops/src/native_onboarding.rs
new file mode 100644
index 0000000..a778221
--- /dev/null
+++ b/crates/hfx-ops/src/native_onboarding.rs
@@ -0,0 +1,321 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use hfx_protocol::NativeRouteInventory;
+use serde::ser::SerializeStruct as _;
+use serde::{Serialize, Serializer};
+use std::env;
+use std::fmt;
+use std::fs;
+use std::io;
+use std::os::unix::fs::{DirBuilderExt as _, PermissionsExt as _};
+use std::path::{Path, PathBuf};
+
+const OBSERVATION_SCHEMA_REF: &str =
+    "https://hyperflux.dev/schemas/native-route-observation-v1.json";
+const OBSERVATION_SCHEMA: &str = "hyperflux-native-route-observation-v1";
+const OBSERVATION_SOURCE: &str = "bridge-native-route-v7";
+const MAX_NATIVE_OBSERVATIONS: usize = 128;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeObservationError {
+    EmptyInventory,
+    OversizedInventory,
+    UnsupportedDeviceKind,
+    InvalidTimestamp,
+    InvalidOutputDirectory,
+    OutputExists,
+    Serialization,
+    Io,
+}
+
+impl fmt::Display for NativeObservationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::EmptyInventory => "the bridge returned no native receiver routes",
+            Self::OversizedInventory => "the bridge returned too many native receiver routes",
+            Self::UnsupportedDeviceKind => "a native route has an unsupported device kind",
+            Self::InvalidTimestamp => "the native observation timestamp is invalid",
+            Self::InvalidOutputDirectory => "the native observation directory is unsafe",
+            Self::OutputExists => "a native observation destination already exists",
+            Self::Serialization => "the native observation could not be serialized",
+            Self::Io => "the native observation could not be written privately",
+        })
+    }
+}
+
+impl std::error::Error for NativeObservationError {}
+
+impl From<io::Error> for NativeObservationError {
+    fn from(_: io::Error) -> Self {
+        Self::Io
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+pub struct NativeObservationPrivacy;
+
+impl Serialize for NativeObservationPrivacy {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        let mut state = serializer.serialize_struct("NativeObservationPrivacy", 4)?;
+        state.serialize_field("serials_included", &false)?;
+        state.serialize_field("route_tokens_included", &false)?;
+        state.serialize_field("host_paths_included", &false)?;
+        state.serialize_field("raw_reports_included", &false)?;
+        state.end()
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
+pub struct NativeRouteObservation {
+    #[serde(rename = "$schema")]
+    pub schema_ref: &'static str,
+    pub schema: &'static str,
+    pub observed_at: String,
+    pub source: &'static str,
+    pub receiver_generation: u64,
+    pub vendor_id: u16,
+    pub product_id: u16,
+    pub device_kind: String,
+    pub route_kind: &'static str,
+    pub route_state: String,
+    pub access: String,
+    pub protocol_family: String,
+    pub report_bytes: u16,
+    pub privacy: NativeObservationPrivacy,
+}
+
+/// Removes route tokens and host-local identity while preserving onboarding facts.
+///
+/// # Errors
+///
+/// Returns a typed error for an empty, oversized, or non-mouse/keyboard inventory.
+pub fn build_native_route_observations(
+    inventory: &NativeRouteInventory,
+    observed_at: &str,
+) -> Result<Vec<NativeRouteObservation>, NativeObservationError> {
+    if inventory.routes.is_empty() {
+        return Err(NativeObservationError::EmptyInventory);
+    }
+    if inventory.routes.len() > MAX_NATIVE_OBSERVATIONS {
+        return Err(NativeObservationError::OversizedInventory);
+    }
+    if !canonical_timestamp(observed_at) {
+        return Err(NativeObservationError::InvalidTimestamp);
+    }
+    inventory
+        .routes
+        .iter()
+        .map(|route| {
+            if !matches!(route.device_kind.as_str(), "mouse" | "keyboard") {
+                return Err(NativeObservationError::UnsupportedDeviceKind);
+            }
+            Ok(NativeRouteObservation {
+                schema_ref: OBSERVATION_SCHEMA_REF,
+                schema: OBSERVATION_SCHEMA,
+                observed_at: observed_at.to_owned(),
+                source: OBSERVATION_SOURCE,
+                receiver_generation: route.generation_id.get(),
+                vendor_id: route.vendor_id.get(),
+                product_id: route.product_id.get(),
+                device_kind: route.device_kind.as_str().to_owned(),
+                route_kind: "hyperflux-wireless",
+                route_state: route.route_state.as_str().to_owned(),
+                access: route.access.as_str().to_owned(),
+                protocol_family: route.protocol_family.as_str().to_owned(),
+                report_bytes: route.report_bytes.get(),
+                privacy: NativeObservationPrivacy,
+            })
+        })
+        .collect()
+}
+
+/// Returns the private per-user cache location for onboarding observations.
+///
+/// # Errors
+///
+/// Refuses to guess a relative destination when no user cache root is known.
+pub fn default_native_observation_directory() -> Result<PathBuf, NativeObservationError> {
+    let cache = env::var_os("XDG_CACHE_HOME")
+        .map(PathBuf::from)
+        .or_else(|| env::var_os("HOME").map(|home| PathBuf::from(home).join(".cache")))
+        .filter(|path| path.is_absolute())
+        .ok_or(NativeObservationError::InvalidOutputDirectory)?;
+    Ok(cache.join("hyperflux-next/native-onboarding"))
+}
+
+/// Writes each sanitized route as a new mode-0600 artifact.
+///
+/// # Errors
+///
+/// Refuses symbolic output roots, existing destinations, and partial overwrite.
+pub fn write_native_route_observations(
+    directory: &Path,
+    observations: &[NativeRouteObservation],
+) -> Result<Vec<PathBuf>, NativeObservationError> {
+    if observations.is_empty() {
+        return Err(NativeObservationError::EmptyInventory);
+    }
+    if observations.len() > MAX_NATIVE_OBSERVATIONS {
+        return Err(NativeObservationError::OversizedInventory);
+    }
+    if directory.as_os_str().is_empty()
+        || (!directory.is_absolute() && directory.components().count() > 1)
+        || fs::symlink_metadata(directory).is_ok_and(|metadata| metadata.file_type().is_symlink())
+    {
+        return Err(NativeObservationError::InvalidOutputDirectory);
+    }
+    let mut builder = fs::DirBuilder::new();
+    builder.recursive(true).mode(0o700);
+    builder.create(directory)?;
+    fs::set_permissions(directory, fs::Permissions::from_mode(0o700))?;
+    let stamp: String = observations[0]
+        .observed_at
+        .chars()
+        .filter(char::is_ascii_alphanumeric)
+        .collect();
+    let mut destinations = Vec::with_capacity(observations.len());
+    for (index, observation) in observations.iter().enumerate() {
+        let filename = format!(
+            "{stamp}-g{}-{}-{:04x}{:04x}-{index}.json",
+            observation.receiver_generation,
+            observation.device_kind,
+            observation.vendor_id,
+            observation.product_id,
+        );
+        let destination = directory.join(filename);
+        if destination.exists() || destination.is_symlink() {
+            return Err(NativeObservationError::OutputExists);
+        }
+        let temporary = directory.join(format!(".{}.{}.tmp", index, std::process::id()));
+        if temporary.exists() || temporary.is_symlink() {
+            return Err(NativeObservationError::OutputExists);
+        }
+        let mut payload = serde_json::to_vec_pretty(observation)
+            .map_err(|_| NativeObservationError::Serialization)?;
+        payload.push(b'\n');
+        crate::probe::write_private_file(&temporary, &payload)?;
+        if let Err(error) = fs::hard_link(&temporary, &destination) {
+            let _ = fs::remove_file(&temporary);
+            return Err(if error.kind() == io::ErrorKind::AlreadyExists {
+                NativeObservationError::OutputExists
+            } else {
+                NativeObservationError::Io
+            });
+        }
+        if fs::remove_file(&temporary).is_err() {
+            let _ = fs::remove_file(&destination);
+            return Err(NativeObservationError::Io);
+        }
+        destinations.push(destination);
+    }
+    fs::File::open(directory)?.sync_all()?;
+    Ok(destinations)
+}
+
+fn canonical_timestamp(value: &str) -> bool {
+    value.len() == 20
+        && value.ends_with('Z')
+        && value.bytes().enumerate().all(|(index, byte)| match index {
+            4 | 7 => byte == b'-',
+            10 => byte == b'T',
+            13 | 16 => byte == b':',
+            19 => byte == b'Z',
+            _ => byte.is_ascii_digit(),
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        DeviceKind, EndpointId, GenerationId, LogicalDeviceId, NativeProtocolFamily,
+        NativeReportByteCount, NativeRouteAccess, ProductId, ProjectionRevision, ReceiverId,
+        RouteState, SequenceNumber, StreamEpoch, StreamId, VendorId,
+    };
+    use hfx_protocol::{EventCursor, NativeRoute};
+    use std::time::{SystemTime, UNIX_EPOCH};
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is valid")
+    }
+
+    fn inventory() -> NativeRouteInventory {
+        NativeRouteInventory {
+            cursor: EventCursor {
+                stream_id: text::<StreamId>("native-routes"),
+                stream_epoch: StreamEpoch::try_from(1_u64).expect("epoch is valid"),
+                projection_revision: ProjectionRevision::try_from(1_u32)
+                    .expect("projection is valid"),
+                sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
+            },
+            routes: vec![NativeRoute {
+                receiver_id: text::<ReceiverId>("receiver-private-id"),
+                generation_id: GenerationId::try_from(7_u64).expect("generation is valid"),
+                device_id: text::<LogicalDeviceId>("device-private-id"),
+                endpoint_id: text::<EndpointId>("endpoint-private-id"),
+                device_kind: DeviceKind::Mouse,
+                vendor_id: VendorId::try_from(0x1532_u16).expect("vendor is valid"),
+                product_id: ProductId::try_from(0x007b_u16).expect("product is valid"),
+                route_state: RouteState::Available,
+                access: NativeRouteAccess::Candidate,
+                protocol_family: NativeProtocolFamily::try_from(
+                    "razer-feature-report-v1".to_owned(),
+                )
+                .expect("protocol is valid"),
+                report_bytes: NativeReportByteCount::try_from(90_u16)
+                    .expect("report size is valid"),
+                route_token: None,
+                resource: None,
+            }],
+        }
+    }
+
+    #[test]
+    fn observation_strips_every_private_route_field() {
+        let observations = build_native_route_observations(&inventory(), "2026-07-25T00:00:00Z")
+            .expect("observation builds");
+        let serialized = serde_json::to_string(&observations).expect("observation serializes");
+        assert!(!serialized.contains("receiver-private-id"));
+        assert!(!serialized.contains("device-private-id"));
+        assert!(!serialized.contains("endpoint-private-id"));
+        assert!(!serialized.contains("\"route_token\":"));
+        assert_eq!(observations[0].product_id, 0x007b);
+        assert!(serialized.contains("\"raw_reports_included\":false"));
+    }
+
+    #[test]
+    fn writer_uses_private_mode_and_refuses_overwrite() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock is valid")
+            .as_nanos();
+        let directory = env::temp_dir().join(format!(
+            "hyperflux-native-observation-{}-{unique}",
+            std::process::id()
+        ));
+        let observations = build_native_route_observations(&inventory(), "2026-07-25T00:00:00Z")
+            .expect("observation builds");
+        let paths =
+            write_native_route_observations(&directory, &observations).expect("observation writes");
+        assert_eq!(
+            fs::metadata(&paths[0])
+                .expect("metadata exists")
+                .permissions()
+                .mode()
+                & 0o777,
+            0o600
+        );
+        assert_eq!(
+            write_native_route_observations(&directory, &observations),
+            Err(NativeObservationError::OutputExists)
+        );
+        fs::remove_dir_all(directory).expect("fixture cleans up");
+    }
+}
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 1c7f1f0..c2b4f39 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -7,7 +7,7 @@ use hfx_integration_model::OPENRAZER_NATIVE_DRIVER_MODULES;
 use hfx_profiles::receiver_profile_by_usb_id;
 use hfx_protocol::{
     BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, EventBatch, EventCursor,
-    IntegrationView,
+    IntegrationView, NativeRouteInventory,
 };
 use hfx_runtime::{
     BRIDGE_SERVICE_UNIT, BRIDGE_SOCKET_PATH, EVENT_CAPACITY, KERNEL_MODULE_NAME, PRODUCT_VERSION,
@@ -31,6 +31,7 @@ const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
 const EVENT_SUBSCRIPTIONS_FEATURE: &str = "event-subscriptions";
 const INTEGRATION_VIEW_FEATURE: &str = "integration-view-projection";
 const STRUCTURED_DIAGNOSTICS_FEATURE: &str = "structured-diagnostics";
+const NATIVE_RECEIVER_TUNNEL_FEATURE: &str = "native-receiver-tunnel";
 const LEGACY_V2_BRIDGE_SERVICE_UNIT: &str = "hyperflux-bridge.service";
 const LEGACY_V2_KERNEL_MODULE_NAME: &str = "hid-razer-hyperflux-v2";
 static QUALIFICATION_CLIENT_SEQUENCE: AtomicU64 = AtomicU64::new(1);
@@ -484,6 +485,24 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         })
     }
 
+    /// Reads the privacy-neutral native route inventory exposed by protocol v7.
+    ///
+    /// # Errors
+    ///
+    /// Returns a bounded bridge-unavailable error when the local socket cannot
+    /// negotiate or return the complete inventory.
+    pub fn native_route_inventory(&self) -> Result<NativeRouteInventory, ProbeError> {
+        let client_id = qualification_client_id();
+        let mut client = self.bridge_client(
+            &client_id,
+            "HyperFlux Native Onboarding",
+            &[NATIVE_RECEIVER_TUNNEL_FEATURE],
+        )?;
+        client
+            .native_enumerate()
+            .map_err(|_| ProbeError::BridgeUnavailable)
+    }
+
     /// Requests exactly one asynchronous system suspend without invoking a
     /// shell. The qualification coordinator persists its resume checkpoint
     /// before calling this method.
diff --git a/crates/hfx-profiles/src/catalog.rs b/crates/hfx-profiles/src/catalog.rs
index ebd0dfd..be9a854 100644
--- a/crates/hfx-profiles/src/catalog.rs
+++ b/crates/hfx-profiles/src/catalog.rs
@@ -359,3 +359,65 @@ fn validate_kind(profile: &RuntimeProfile) -> Result<(), ProfileCatalogError> {
         _ => Ok(()),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{CapabilityRecord, PresentationRecord};
+
+    const SYNTHETIC_CAPABILITIES: &[CapabilityRecord] = &[CapabilityRecord {
+        id: "native.feature-report-exchange",
+        support_level: SupportLevel::ProductionQualified,
+        writable: true,
+    }];
+
+    #[test]
+    fn a_second_same_protocol_device_is_profile_data_only() {
+        let mut records = PROFILES.to_vec();
+        records.push(ProfileRecord {
+            id: "child.razer.viper-ultimate.007b",
+            runtime_sha256: "1111111111111111111111111111111111111111111111111111111111111111",
+            revision: 1,
+            profile_kind: ProfileKind::Child,
+            device_kind: DeviceKind::Mouse,
+            vendor_id: Some(0x1532),
+            product_id: Some(0x007b),
+            model_name: "Razer Viper Ultimate",
+            transport_backend_id: None,
+            protocol_family: None,
+            receiver_protocols: &["razer-hyperflux-v2"],
+            routes: &[RouteKind::HyperfluxWireless],
+            supported_child_kinds: &[],
+            required_sibling_kinds: &[],
+            exact_child_combinations: false,
+            capabilities: SYNTHETIC_CAPABILITIES,
+            native_exchange: None,
+            lighting: None,
+            passive: None,
+            lifecycle: None,
+            qualification_migrations: &[],
+            presentation: Some(PresentationRecord {
+                upstream_id: "openrgb",
+                owner: "OpenRGB",
+                project_version: "fixture",
+                source_commit: "1111111111111111111111111111111111111111",
+                model_key: "razer_viper_ultimate",
+                layout_key: None,
+                transport_variant: "wireless",
+            }),
+        });
+
+        let catalog = RuntimeProfileCatalog::from_records(&records)
+            .expect("the synthetic profile uses the existing profile contract");
+        let profile = catalog
+            .child(ProductId::try_from(0x007b_u16).expect("fixture PID is valid"))
+            .expect("the synthetic profile is addressable by exact PID");
+        assert_eq!(profile.model_name, "Razer Viper Ultimate");
+        assert_eq!(profile.routes, &[RouteKind::HyperfluxWireless]);
+        assert!(profile.capabilities.iter().any(|capability| {
+            capability.id.as_str() == "native.feature-report-exchange"
+                && capability.writable
+                && capability.support_level == SupportLevel::ProductionQualified
+        }));
+    }
+}
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 728f54d..e52921a 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca
+// Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -157,7 +157,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca";
+    "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
diff --git a/crates/hfx-sdk/README.md b/crates/hfx-sdk/README.md
index 2d63ee5..297bc3c 100644
--- a/crates/hfx-sdk/README.md
+++ b/crates/hfx-sdk/README.md
@@ -37,11 +37,11 @@ Before opening a pull request:
 
 - Regenerate 1 declared projection(s).
 - Run `rust-unit`, `protocol-contracts`.
-- No direct subsystem consumer is declared; verify repository-facing outputs.
+- Review direct consumers: Operations CLI.
 
 ## Relationships
 
 - **Depends on:** [Rust workspace](../README.md), [Versioned bridge protocol](../../protocol/README.md), [Composable hardware profiles](../../profiles/README.md)
-- **Used by:** None
+- **Used by:** [Operations CLI](../hfx-ops/README.md)
 
 See the [Repository Atlas](../../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/docs/README.md b/docs/README.md
index 4dd6a43..9b4581a 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -36,6 +36,7 @@ Organizes concise audience guidance and generated technical references for direc
 
 - [`docs/user/overview.md`](user/overview.md)
 - [`docs/architecture/design-book.md`](architecture/design-book.md)
+- [`docs/architecture/native-device-onboarding.md`](architecture/native-device-onboarding.md)
 - [`docs/architecture/decisions/github-native-documentation.md`](architecture/decisions/github-native-documentation.md)
 
 ## Verification
diff --git a/docs/architecture/native-device-onboarding.md b/docs/architecture/native-device-onboarding.md
new file mode 100644
index 0000000..6c42971
--- /dev/null
+++ b/docs/architecture/native-device-onboarding.md
@@ -0,0 +1,70 @@
+# Native Device Onboarding
+
+HyperFlux Next can study another receiver-backed Razer device without adding its PID to the kernel, bridge, transport engine, or application adapters. The onboarding path combines a privacy-safe receiver observation with exact records from the repository's pinned OpenRazer and OpenRGB revisions. It never treats an upstream support entry as permission to write.
+
+## Authority Flow
+
+```mermaid
+flowchart LR
+    O["Receiver route observation"] --> D["Non-writable profile draft"]
+    R["Pinned OpenRazer record"] --> D
+    G["Pinned OpenRGB record"] --> D
+    D --> C{"Exact agreement?"}
+    C -->|"No"| B["Conflict or backend required"]
+    C -->|"Yes"| P["Supervised native parity"]
+    P --> A["Promotion assessment"]
+    A --> M["Maintainer-reviewed profile-only change"]
+```
+
+The observation supplies only receiver generation, exact VID/PID, device kind, route state, protocol family, and report size. Serials, route tokens, host paths, raw feature reports, and stable host identity are excluded.
+
+OpenRazer contributes exact device identity and command-surface knowledge. OpenRGB contributes exact presentation, layout, zones, and modeled topology. A difference between those sources is preserved as a conflict; HyperFlux does not guess which source is physically correct.
+
+## Ordinary User Step
+
+With the installed bridge already running, create one read-only observation:
+
+```sh
+hyperfluxctl native observe
+```
+
+The command reads the bridge's bounded native-route inventory and writes new mode-`0600` JSON files under the user's cache. It sends no device command, performs no receiver write, uploads nothing, and cannot enable a route.
+
+## Maintainer Steps
+
+Create a deterministic draft from one observation:
+
+```sh
+./hfx native draft-profile --observation /path/to/observation.json
+```
+
+The draft records exact upstream source revisions and digests, source agreement or disagreement, a proposed profile identifier, and a fail-closed promotion contract. Its `writable` value is always `false`.
+
+After separate supervised direct-versus-receiver parity evidence exists, assess whether the candidate is structurally eligible for a profile-only promotion:
+
+```sh
+./hfx native assess-promotion \
+  --draft /path/to/draft.json \
+  --parity /path/to/parity-evidence.json
+```
+
+An eligible assessment still grants no authority. A maintainer must review the exact identity, source pins, method coverage, native parity, and generated projections before changing canonical profile data.
+
+## Promotion Boundary
+
+A same-protocol device may change only profile data, upstream bindings, evidence, and generated projections. It must not require a kernel, bridge, daemon, SDK transport, OpenRazer relay, or OpenRGB transport-engine change.
+
+If the observed report family or report size differs, the draft is `backend-required`. If either upstream source lacks an exact record, or if identity or topology is ambiguous, the draft remains blocked. Existing unknown candidates remain non-writable.
+
+Native upstream feature reports make a HyperFlux-specific LED carrier map unnecessary for this route. Existing qualified rollback maps remain in place until native physical parity passes and their removal receives separate approval.
+
+## Verification
+
+Run the focused contract and then the selected repository lane:
+
+```sh
+python -m unittest tests.test_native_onboarding -v
+./hfx verify --fast
+```
+
+The focused contract proves private artifact modes, exact source binding, explicit conflict handling, backend detection, tamper resistance, and a synthetic second same-protocol device that reaches only a profile-only candidate state. Physical qualification and publication remain separate gates.
diff --git a/docs/assets/social-preview.png b/docs/assets/social-preview.png
index 060cf886fa3adc81a200c39a09da7c66b293ebc7..87e42d6934453bd206f92a32251ef0baf2147b87 100644
GIT binary patch
literal 9686
zcmcgyd010d+P^mtRux4Bih?V}mQ^T-Y;i;Ds32+)4FZb7$S%qnmZ%ikx}+nD3qnw=
z=pb7a0z#I;0MY=l6-kgKAe(|fWD6JqbMCzfpi;-@`M#MyLe4$QyT8BpJvaQg+kV?z
zB~2v=g63}jcFP_J!h<1>tbhYwJO8n11cG#uw{O|FFYHBc6XD{b?P{#n!V=A%2j!Xp
z7s+!CRnu9UPReA(#v2C~z$L$R$hK8|TR@lFlTrKK6|FDczO>uYsT*}L*XH@KZjYVQ
zMC#W)w5xmqAkJzPdoBb#mXl!!+5pKw5E+sK&+r_CzXtdtYYhJElM}>DhzMY0VT~-!
zx=Fzutj}kGKhxBfll>4)P$ILfe@N&9zMnqw;o(nn`D^WF<FcI09UKr<Z0@F&O-u->
zKF7K1TQk>r7gLXiR(ep9E%p3sM_eM<MmB>P)*(P^9Iv%NVTgy%fz(*QZnEgNGo<Ve
z>yz=u5H2henh;Y6DjOtIl6_!R>ms&k=FGVbltW<Sf;D6qIS}8r@~MY93y07{c#Xb+
zi-$6)W8rQ(JXyg$xUnreXlGNamm&n{;d5kzH|UcyEnr_d*p5lUgL5JCL5u)8<9{el
z5tS_ml0#*BQ)knUuEW;nLfvA5j+0JCy?Yx+&tLbtRK(P<(@{dU>)ew$LTO4=XVn!U
ziXs9{Gsu4_n{(f)QD3X=>B^t0k0nHS16iFRc^9u2YkvX8`Q^zbhsM~!!lAoKf*NJ_
zytrLolNVq_P`Ocxne}(f??YPw;rKR89z-R`$;bRFoCesYbrBc`kpNxH^GsNY(3oj`
zXDGugX_1s7upAA@1!xa!2DB9<N~@jLE?TUMP~Hk=Q#54-5%73e>rbA|6HU64d4~qp
z?pDb-y7@)vsh+(}@2<;?hGiy=aAhydT_2L(ZImvXbMWEz1uT@B&OKCcNV(<r@i5_V
zS6UJwe0;2pYGf4HZ*o;#ukbaA860&wNhs(nEAi=lMp<_?THHRsv@PTf2RuK-X*-sc
z?cJvBIw`0eCQOWVI^+ke@lLQUp6vO9PIZ|GY@-<(MGhXhIw>3&aOmSC5cuPj<>JDL
zOw!fDXcryfSbh9*L=nUvXHYMJ2S!qAQFKsp(N(*5?J7&S2POtD5&4XK9@IR#eT*95
z%1PMJ#K^ovDp){UcQRCDBE}W0wpbDq)UT%8&q=5<EX<@6?iZzaEpf&i529+Z#8r(t
z<ba86$WWyvX);NTwS;DfJ|ivzMsIqIS;J^t?bQXSIgI^wD?||Gx0BR)VYI>Wq>Pie
z(R$iKbvXgOr*Q1<s|&Ps`x{FyP<@#?q*`LCmqH6WMyZ)Z-J$)OzRpgaQBOqZE?vlC
zC*u!7J9YyWsIJe`m%o_cHYKtjO)3kTWAt2y+{p3_{JVPU>TzX3$kTZ$Enbsa1!6Zc
zjdm7|Cs-eco&<qIT}kdg6cz^Yd%lAkHCXE=jlYBVMe&jVTh={4<_eM4p~8F_sUo=D
z^C~QK0;0l(>nnoF4y0ztgtZye3!BL{?FLVm{Ae+DAXS;8oE)O|>Jlr%V((CSnG*lX
zp-|UXhY0trn2#QAScM3jcsRcpGYoA)IVWIiUZL+EzRY=SO4*(0idpZurX=`LH4Tg~
zUA?Qn%-fDPMkD@<FQvZ5!W<)^AWdd97T9bDAv~S09G*^~sc>~V#=DpOXI=;8^5Kkq
zZ?DVnY!65YG5&Gi0GE9Lk;In`WNMCfMV4y6T#N+z8`ig&jDF#wqws?|-#xO3L{`SC
zlDP1t>XV<}*!2@?Z27GwJE0v5fEv9C_!-G^>>4lyCKgH}2eRD@St&n4XE8{EQPe1^
zId8x}t8vYnEiBk^``90lZDoWy3qmta%XeB`Y)0x>Ao?7#)TpQpK{*58W&cDcA1Szt
zjv@%^{NQ(EY&qWn-7rnyp)5i`Ud0{MEo2L*e<(#z3{jv2<qu6aP$p49LCpk0p+zxE
zv1Lq0UJ%c5i#|R+>=R52j=EmOSK=$^5YzbCx{Xew50_39l<fa~yumn<9p4YD<{$1%
zlz+ckz$jNNogo0=fN4t}uAq-~f(yUe1TT$NN$VTrZL<vVIchsnzb9m3*lZ-6@*)nC
za=PS9VFDlm!~-%$#zFq$m03iJw*gRWzhX=5aPTNp(|8(`dg(cY?<|xA2Vs|iKZ<hW
zUleJRnEh*iQi?0jR{nkb%`v8*Mf(A5RhGDJf1A3d!6KGU!+gvzfGwJ<a<k~i`GO_3
z1t(2e9x7tWJAIY#p!hp49AkW5L-yC!0-gJnTh30`hFNUl4qI2Nw-1TF>3_rtYD!R@
zD2R)!zk*5c={=>7F;E<<P^gA;Al$W5eBh|?Y3#Cm&t@mj_SKOxyE`8?7DRPxbA8_~
z%bRP;3_AYg-9MMysn1^lJpG;!Q~8P-6a>fz?GD<Je0HNTpOudTG^X3E*&31QCTDu|
zIY&NQik2{V{N-~WAc*Rx`D0xFI~^Kpt;}d^Lj%d&&?V@5opp{uX^tvh++=>9SxJmu
z_f}C;9q&g?lfh^9{k{v$Dt%X1jr$Tk-c+d^V9ye)Q@I0Vy=g#B+Y`bK*d;13G1^Nr
zD_Q7sDf33)D?<C&jY(}!`;wnXNn^s*6+Do}Q$aI(62vckQYYR5vT=ND0qdNcVAHdp
zPAKK*0{A~24ArU_5_Ml5Qz4o%tzQdZ7Zb<Lp0+0=x+YChs<It2k}i~YW$?9I1n>hA
z+V5d`gEo>V#LUPf!6w+cQl8a08JW$2x_oo1NW6fEis-zZon05ah`VfM^g$;-bsmZN
z_mdH1Hvk4fJwxuR@n^-j(RR19mjz>i$O&T%*CcHnu-$w1K$==Xkj_m(@Ry4GHKy%)
zhfQc(Yh~t8FI4$iG*meZaQ75>dOYEt*!3%;q`!4F&1_`HEzpspfGtH=tG{EII^`jd
z>A>)R9oe65>1SM1=4rB)*~Ww)5i#>!?usWKHD+A$;gM`QXu<uo2y3?n+IIsyw$Za_
zVld_L_{0#2QEr=csn@zYcUyI2=g9E`>b)5S{J|>(f;h{oR#QL5;F{MmZL@esj$Lg?
zpICFh(D&jYw=`|5_fS>RijbictEjYjDcy$8g7~+iX~N+A$zNE_4Sp2CfZv~1qYc!w
zs_Xr9?QNOQ=oFiia!!#hV;t^?Wpy!uF04$ebEi0W(<fik4I=_FR%LcHSFENBIUiIp
z)GIQ;BUCf8hsu$I{<I47*KbGm1IMvrLPgq2EhA=n<Uy)XJ6j9&8(OO*0!kfu`lM{2
zs8aQa!<ogRy2gQL_D2~S+mg5b(%uzJq4%x#<JXX=&zfPE3G4i2mT#gAyX%fqQoYx=
z?y7M+Gt^8Owi??_S<@T3sff-AV-H?o%55wAlb4WN)<;V7O!Idl_BpWKWVhLjR7Gih
zEWXBkmRFSWkZ(ZD!489`bpAZcQsR8dklHJ4pB00CBc{wNmIQKz>*P-XK9q=}Ve5b^
zZfnUWn{hVYy;TCWSNE=0Mryr&`&Q@u=tcuq!i=NI>L38Tw&?1u!-Y*iStPkZ3j88H
ztAlogU~9@@*vlanlxCA8&>^@n|6!Ju&E~PZVT&J*6Bg`vv(fd9Umi8=cs_J7Ik&g;
z`*3^K-q1ad5*I3$)s$PqOG%f~=`=I%$%ODdSp%Y*gD(GKsI|W-O|v&qClP}=``MLv
zQ#a<p=6y?xVp4i@XJHD@`5df8qyKZu!+#T=!8IPKRG-d9a)O+oD4TGrgjXmYYMZ-H
z!-{6ajEPn9=o)ElAl@?$^XE_E7ym00l7o>ts^C5!e9#^ebgRZV4Rna!Cy}d!bV1+}
zJ=x}P&)t75tyAr!GWh6$-68YAzz57-Bc4202yP}CRtjK%2Ol#q2m8vO)`~4GYdix!
zH;AAC$Un=PSJHR{qvGR_Tp8!#jC>_zKblYmani7{<@>oP6NE9CIIC`6l_?>*lAL?i
z7~_sGost0Ij&1@MvGX%TsLGrY;Wr>gwE@b&UH-6C2QwN#N+7nnxrFRT6L=8o)t0V2
zW5f`c?ooQ=-;|eh)&YtL)deixMhSaF@hK5*5UUK(O#p|>Q8QpNbUFbgF&QvJ01my&
zb5O-lC8VZPULqkIp#%!jOv}x*3(7_fo+A+v@zpsAziNX{H6Vi%aO|7q5@Aq>PB|0V
zjVJ}E-)`hjPMqXqDaTJb)n+$ryxIG`AD8vb#Z#3{f|8Isg~@))EJ9+4L9N@>&J<?y
zjy<<wUblK)PWpRHk~vL0a?{bOG@6$8GGY-6&2}SS@RdXax&iggY3LmKpl*)Mp+F$r
z;HsnAoycF!)LAVX*v5)gNiSTi>L_AWv4@DZogo8-bNNYjT8&8!o8<(LM8Dj-?|i~Y
zi?I?!HK1Y<EdREzhvNp~&Gqm81aa8lIWVnU-OKJ@76U>q>{ema=*Wor47L(5`uV*&
zj|vnpudB7<J4o4m#fdvmU#N3qK)Sa-&_DuPD^9E<Qw<ISQo3_mymkOsYf+RLtycxh
zVI@#>e(dyCDZ5RZ05$1@9(PkGcggBV{11?=AH<!zlS#=?Z1Io}?6eJha_jjcx11H^
z&7C3n$N9nEi~V;%Mnbc1TVd--*N7(>6ikSUu(#d81w9aBe+e)u$CSo}BeM~{DPI2B
zGNZ1FfSWa^(N$hRN5uLFd8ML&7110)DyKm|c^NLONu?xt%oJ$R!a6TLRsW}l5m`Q3
zj_1Y23w)`Y2!meag`I9lZ0nPw<dBm&3GRySR2XpJc_A*AyokW(AX)h_)8gF_H9ZzD
zV4X%vMWnwdD$!&-UskY!DfiV$oUUR^Rob}~@p><jScR>>BvUMDxKSR^9N`(M#oEEi
zL@ef2gSh;??q=G!2-}tnzGXLexnhg`Dw|50{?fcyeBcCY=Rn@cU^n*K%1!fG$&3)4
zL8HB(TUy^0k`K*`iH?6$ZNjwv>aY!}9$v84K^18@5Jg6P0q|A#{)|EmYB?Db*cS<i
znIR2zej~{)B*VcXmhMRUVcF#jd7zjh0Y1H{e8*4+s1!0E1rZD|Bsc|tP(t>jiH*Qa
zRtm*AhXJOc7=ug*O5#u)Mu^HzgEhhwm<E#oK?e-1^(9y;0lvjkBA}pShcZA>1Jj{X
z4XEF{Tu>q>QR<@!#AXL7B*2L3o)LgI4m(^5YC)9&plTqg7YJG-Tmiu;I7bQwKx;J&
zOOf3O<|_duF&R)ptOOjiWYH>wDFKiUF<sbU8HrX7Fwhh&Ari~Yv<ui%*0}P2jNNA>
z5~5Z>>lm1rQR2=O+PzoeKn!9POky-pxIqu_8TY^G*Z+Ur*iT=ar$_(cE`V<Q?6wKr
z`00k_LtSR?w33R$hBd(*MRxY(_kK6|91W(eGd=ph+UeEHvJ9>{&e_d93dU&!Lhz?Y
zb?VZ6vyYtJKr;!b)TyJRr5hk*M22iHgI@-0|LDK5L&M5xJ$ZDfZPyQ%L<!+U<I;B#
zV`7gVqA4o}^HW11Lh)qAnasH;`hsF82hYKQ_8&YVogUKoVQ<usv}4GE3FNW@){*!7
z8zH1!J_|w<U@Lko*wNDbj?UU1?G3e+Rr|JA)z|IcclY82zaI{{Iew-0Ba&C}d6`ql
zW?5tOepU`Y{(xuQRb&F`u+#wRYxL{@9OO{RrbWosxQR-T%P5x%tPD_euTf($G!(%u
zHI~H&brv9vyzoRs!)eIBLbzd)qukFA>qulrTiEh<s^9>ODx~cGzz9=CPcFT&<6HSx
z-0%Y{zdj~vQme{g{EhL$J-0q3gq!14807}!{3JQdq^Nx`lOpO#w2`PMgR?N**kM><
zyMgkzdXGkgQ8(l1nxDFEe225>KKBpb7}Ota&>_SUsA=@cC&-2$IAm5sVZH)O9#M+G
zbzWQVH<kg5$BoH^<@>~qLs>-zKwYHrE=@)DVs^kA&wD!Ue8iYjPC+&!w6M6CvD9*D
zjR6R^G=HrDmE~C;zuF%v7%4Kib~vhf(rydx+A1-AZ>9RG%0n|^3*0RbQ%J){5)nvG
zAaw#@hF&-jSI)E=vh{SX{Cx5-zD^y;JaYu{MKU-0==3liJ>eep-blfn1<Rsye>nnq
zHH=4BXCDE6l2vpR2(?1E2Szyz0A3bk2pd@^sZg1X`+}~sceqa0(WzaHPGiHqd}=c>
zh(x?X$hstYC~Pjbbu&oFe+O@2UgwjDxebMU%ia^j4(`I>>m#Bzh<+4j>ZbgH8}!Cf
zixe|rtKLDn5?!I{*x)rBtXagkJworzR(I^N@t#Lw_SMq8DK<6MrEhN`$?$QH1zK&v
zPS}NZ)+hX}Pk8RqV5-p7fo-2IF1su4GPO?kvLIjcJJimJtU1^hx||W^oFiUnbUSU{
zQ}BwUYB(i4nY8(KWbeQF*4_3jedis+aEhdB1dk^aa;_id2gRAKLE1bCW7OAEA_&HC
z1>+p#v1Nd-xmcIPH31zZbWwaRJ(0T+zR6@9^qlR@h?E{Fa}g^FB*;-!N2_xK4KF4J
zc?ltxt+Os|9?6A^g{KsPIj`wEwA-MS-b=PNIWZS9?W&#GzL&?ji9J8Q*p_KAn8CC&
z?H>BtG5sq0K>rwAEbipdg||9lw~vXI#r*co$m-OGTF(**Bjat)6Wh9YQS9~HRH-fi
zE$H{&>ms`t_=q@~$1w&yu#>id5<#rFM}sm)>#i>5<C;iT!j!Hrn&Y~AT`QuMhpHaZ
zeg{9Gg`M;4r^JqG-ifXVqVs>XEj>{)M|88f;!iJITgi<G@R2Gk<(6Uu-Xs0VxFek>
zIR+eX>j-$_8>59DT4qE}^B3QPmkvvQ<CZx619>?MSVFbUwUy@G_HsEwpE|aK<@5g7
z4W`sb9&rnkhDnAOHCc|Pb&TY}uE6|-i>e1*6k2X}Wkja*IPIozFW=*KBvv%{8{yye
z5^Hkog%kK^b9AlVgqHjf?c-Im{sFrwF~K6GcXT&M=UJ3MfZ5_1Y&l!T&7NJ;x%WYy
zfxP{64V_+{y@mpMGi&H{HI<A&$)BpLvyML1YyI!Lp!eFG8I2Rx4u)x~@SB@YMO`N`
z8=`G=g#YYI0j~icvyV1Yd%AA-<^Rq9M86H?g)KBR*gAMsH*2zo&i7`fJQkgF06^u|
zU@c7VD|~YELT`okaPd`wn~iobvm#|Zr-Sx9n(853B2GC+r)lKP#iCPV<|{y<O3S5!
z-q7obBJ)8HPBDQ*b6_8fXj}%B-|ZjaklgNeFoqc^bY_FdvSBjl7C)qizRN^rRrkaY
zV<$!Q?AIuhuJjHgO;27N1|lE+d<b5cgF@>v;)TRpATxNiBy}`q!bp#-z*qOT-{-VM
z>;Cq2;m#&=Uw%!luF#vwftIc!r`gBt3o7bJryf^%I6$nL)6%;xWNY<Skq3vcU>~!>
zHS~Hk?Ri`5p4<jqQ?js`%1cO;{=O-PRyHiy1xf*@Q(7}i(wcEi0~%@IWvkyY2L5qJ
zE@VuE`lE=cv<;m3tgdk7Q=P;;Y5C!u#8jd-yB@qjEp2!*i{+GC)&sEAbrhy|^j70E
z$d6^}AJa^bOKvUHTx2L4*pw;FGP#+`7Q&I?mCd?mzAnrJ+MJ(^7JBvjmAT&So2a$v
zht5~G3?vxjZ3(LVF>=H<>+xRivU1lZ@$0u&abs{JBiYo!b`j|%?H>D40F|z5u19T8
zOenQW_SN?`pb^}pK#ui65|4mP_;l|LO7Exsd+CF0`TxIgD2bPO-TK*>n0jnJkQLf)
MXTK$Dllz%}11P?EQUCw|

literal 9683
zcmd5?XIxWf+doN&Oc@S90nsX22SZVYGTaMMaTFDSAWy*-1OyQ<h6EQ@R8)$HB3KvH
z1*mL7B34o*f~`P;0TRk;2_eWxfF$tV=bQv0($?q0`~Kb!BzNv{UH@xe_c{Eqed~sa
z8q+l(2%5NQ<Juh%ga<<`MGXtSwp?B<f*`Z&o7S${75PC>zxd*mP5P9^g3{^yM`hE4
zFH$C2OiHJ(4#Pb;6>Alek12i8qSD0Nm`|Os<6+hAM3ZSB|5&%SbslM7wqv#D?!A^z
zyJI^ZalN94)d2BW@eNn-MS&)OPmC7$z#4)N6)W(eMgSkWbnvl#8hv;`I1EO-E@WxE
zO*1JN2wDl@l&Mjm+^Gs8<E@Y7HiqxN9QjfdD3`yLZagj&$g8qkXsYuwS6?FGlAqj@
zG1Y}sx2C2o#Eq%Mj;g(f@8q`q?h*Z0vUf`Xjsoe^wHfPfwOLT`Szrv!M8C0nAWZ^h
z5e1`555RW`$<ioDF@^3^BVam0_M@AWXH<@Lf{k%20cP;M!q^}twFuA!V}zH#4)2~&
z#>|u~crllfuECo@PV{Zpc6I?K1Ki9qa0f7fuha>APY5SRqJ0*hm27|zKxU2#mu!)<
zwL&q8JHwH6P2S#O$zXyD=LY|MylqDgb(3ks@T;#ExFOqDndlNbbBm$e1_UkuG#eEa
zW-xUg#kIcC?=Qnx{g^<D8&xhRVa#?s|NAC8&#kQVJh!N~)YUG{CAd)Cv>5s(fPEKh
z2=FQ>A*!mr?)rU#20<kYI%+4^CSamT$ni_~ilRryvK#Z&dg~5Fq36B{u$hn0Fu529
z7$6V<y?xI%fvu?Wv5pZ7w;~J9Ro7k5p<2`==>1vXaTwVGX4~(rf-(*0@wQJ6whDx#
zZf}m6DXuSTv&~&cSFuwyHO-z9&no<m?D~#<$v5J`Q0Qjp;j$Z3Fy|3!Cp2KK11X*`
z<0HJuPK5)Bj7;aDf$j<7ps=WCSBgr+o-Et^0kz<UMa4BvvdFN%Snd|X{Dd2xWcT{Y
zsN%PM@gE{jvAmCW_m~bJ?^(!+n34l)z3<NkcMDqnN6#eNlBj3p!^9}by!f`)X~EIo
zHhtVrW>Go&oind6q#ZkT71FL!D3j~@&eOY~qQ3kqQg`fyw7o-pSBTu9@3Jw)9}~Ns
zxl;RW*l<b7<{6Fa>l&E#0#2_c?+Pza`i4qeblhRvlA`7kQS`meHU|z}Zh7EVa^3MP
zFvoky_>d@wE9E|i8uBBM-&Ux?JLH}b*|_tTEjF_0$EFKVwCH&=(Uxt;iE3(YPXRxV
z{80*(h{J+Xr%(?c3wt%YuK$f_e(jyDF{!gCmc#QSg}xS1_r+V!Svb^sz_v4<OfUDu
z?}J>nqng&IS0~N<FvP0A%6UGl+0{T^=+)~@QBB3lI@~7>;UiZZj8*M=HmqGYWJ%|6
zR>_?-M(z@nZF+QZkb?t7*!KVm(&F79Ut2&CI<7|Ssm;&{KTCT<<#fk-A9hlW{4M-Q
zu_~Fu#aI-Sg}&N->md%v)Ipp_(6PrKo2@sGrg5Y({HOO%u%445r@EhO$lu$zw>F%0
zx}h(zknd8Yu@qrC&95ABZ+r-!21)+2>qhz9K6^S6uE1isEpoFx_Cb9g33X04iuX}X
z;Eo%+P#LcJC}fa(IYQ#}CAnz`7<jV^Y>K$u)8>wZ)`+(r*nQ^0;MblWLmQ{%Zk`JK
zT9BY1#4}3%@Kx751SW{Dz;aF{5_TWZC^a!uN8Q{!IBgLHgy}hGJur>xdIg|SN+7Ax
zH=a=^%>N1iAUy?<E{{@tmeyptBJm(3^y&T@1os$yc(&XMHm*D!Ia~Xdi)T)_|DoG)
z#+8G6mr}MpZBVSKdMJ1*W)xll<`o%Fu?4ddpv+!?sKOk}cA5r(+@k+bfkKdgY#1TH
zUW5S&vg-v7ltK6;Ts4r42?`_<WuU$xItRrLCIpv9m@B+102>+o8Y6A&N%EdflkKY~
zd2;9W6qVYpeqHmYSfDPRI<z3xIkPKq$*_$Ux4V%@Id$k-K??>NVGd_3l&c~u8p2E?
zA45-8gw%yYh1;Q6=h6&@gDCl8{q*EYQtpp8$)pRU`a8L^KCL-gC`h?m0eApo+AN9@
z?J2+E&OR4NleZgd=R-1aqF6`F1mz!bIMhR}#-UXF4U{BpuV=3jcve!mZHDXcYnmAN
zZ-+X+r5&<s-aTUyT~_1Xq&nSv3f+vOiz*7GmIXQsL{B63fW@txMwdl%LVguO@s7RD
z?GGKAUzuF_euM1EJ)E6S8R$fcEh##%d!ecsj|9GJsp+Nn!n~+-QX=2$$F8<z%`cw-
zPGGOq&dG{=NCDQBS11GkfM#q#dFdQGSDLk~r)0_Od5x1POT1gk1UtpWesRMYhpr7=
zc3D&7UO)3~?nGc3G{wV6V3m$aGPcuE>SVsOE%|@a95FO`2AN*KfiI0|-jqZdZ3Rb1
z<F!p=k9=`IcX1kBhuhHb>~PZ+(><XEW)ai-jvRID_w<-8ExO(LoJ+cJGh>#uv!J)a
z#w~%lzLZ&+yR582dMRf-M_0HF2u^w})^5SK5hT|0%7r~P;U2Rcvgg)5P>&s2<CQsJ
z>eD*sQGQ-Bd0XgtM|qel0^xJIk-x?S*1H1_s7N!#6d!~vmzw))^ET=0jT0}5@P!it
zHj;IC3oU+Y@-XnYmkHXYbhF9J{?lrm9x<fT^jg~gys-A*aq6G|16B$R#t9Zh5F@$4
zatb{`ie*b_Tz&*4EO$@q><(M1uk*gSJ>m=g9<I@<2upe2iJbft-Xb_6G<nZRT08oK
zdo*|nWUU>g!dOIQV>8i6SAo_MKqzTp<EeP-P5o<=XPK%e6fC=)O6U*#PteO+zvwHp
zs~?sbt#P^-aHVhRklMV0%xqH)GlZKwih*j`t8kwsrg82YqpmeN`j;z8$UA7LYoL5G
zXE>+DMi8Ig;+7~qMRiV>mUNQb<5>Zq*GVM~9Qq)9*ts{!IW;<y#ctdE^yUUfaYk}w
zos&8LHfgGuNbPP*=T=V3nNZHvY^{ym@Ybg)KriPek;bT|UiW3OGTO8iHCy2*aLJlU
zY1_)pIGJ9^dG3&#Ar#20Im0^$LRs#H$N`(bOr(NLw^pXuEB;Q+Ukz=k_PB*knNn5&
z@ur_sYJ;TNEg);dqP~XVUM~Y`UiIagP@(UY28lmXeMTJ#wGf;;r_-}l7n_SYzBhX9
zWV?YeyM^`9r?B~?w;DVti^?Fz!s*;_jP;Q8$1}#%MQ5L4#}QtoUiXNu{efxQlu@4X
z<8f+d0gHNHz=;wDd{{v#_hyLJ#8NZY)h`$5?J_qgem&rFsX>w*ZD882cTZ+<Fi$)+
zIEvcM;$`faPF$SJCIwdoR=xecyy?4vI9^6uYC$IMbM`oF|D*Jkl}88PFGyc0b}~6~
zW~Xla5sf49IhUfY%b4jq+ElyPX|zAS6S$>&RE9l}p2MVsY4m2~SihYA&doYu!0GoU
zR??>df_gYwTO0zQB=S0-kCgY1@m*5Pez8WYDen0;&+>>@LxW5Q$?|DhpIZ;362hq{
z?CjQRaemBLwMBAz&jFq81Hy;0QkQ4=kdE_*Of8sUnAF0!+d2F9e0|iWRh`F<a}ZE7
z-6UzuxX?uB))dxPBI-<k(;4BH3)qqeMCv{Zi)#Zz)uB5McML`4{+-Kwep?=!J(0Wj
z|5C#JZ?Ey{|9*|%I-M>o89Jrm+a>}x$L&5HbtTdvy#?oQa$<vne=6k_kcJI*>E>Y#
zk^Xcx1#Zjr=)fXyja4J)!ox-I9S^<~jx2-?$l{%UI#KYd?z#ul{F(>zG1$#s1rNa7
zfuOhMt>1w1+%c1B-l`A&YQP*m%S7d<ZmWKnCin{og0GF**cEDFaVV9?1;9%PE7Xd!
zWBz8s96$+Fjj^>sn81v|gjNIFDo;){4l2_wMY+RFM-af=7sHztg0!FnVR7CF1U!JT
zEDvR1a!MgXO&#1Uo2WFf=_uLHCiFq+vEfJhzJwKl%HH=Fnh+d#%>z(`sjh>3ReezQ
zu;3#Q0>B)yX)4eyq6QShH4j)w1OuvHz#;b}9T5x>LZQ0gKmtmZZw6;2CCw@81!bdR
zC5H&x%3RKG8Q^aP{(xb#Pr`!{Qz(pySQaQlgRtUkD0x^?=~xtGJml%d4N^UvYn$td
zdvEu<na)ci&gIslxg;K2cIfqmd3)7ba}Ol#77zM$?lLm{Np|Q%orn{*UZ5qZXPx7t
zPb?_ZY;bW21U>;+VcCEI0D=5yV2`$QBO4+UH)eQ5Cmc_@q)Wemo9vX*`pw3*0-Sa5
z`{03VoY!qO$Ak65LxO{JrqSPbCf&Y&;1%^q|2g2*pycwZOnxcKbS49Ti~OlT*4y;f
z5=>hz&9kJDrEp?8-70G2aJ-e+%Au@Y4b-Z@g=Vv2`;=HycQAMQm&@3EuFqlG%?Aa*
zfb!CQ`j>hrI`<S1B-M(NX6^$v&eP)gyTCBias9QEl<E^AIap9v;*hytGubrwQkULL
zZ2xo2ep@S9w5Ka%x`JXYj#;Dq_`ZxX5o5e0@0qLQi78uHqS6&=dUDDPdXMm4Y_S9h
zRD8&J&^N{wY4eC?K#VSjFro=vycq@%)hb#}5hlWXdzgZ7h`SKRhbUcvf6NaqW=5~X
z#-%M5@)8>~R!CO>74qokWrC;o7+#Q$)Pz7QvY_}&%zLeewL?m!aj+}lv$z<2dbBEg
zU6u+m#Il7D(BnwY4u^n3_)+yn{scK~Q`h9h;K0owq`yui@qE)InM9A38s259r_7;P
z$6K5+esUIJ(RB@SYOmAa`KoqFVRBvJkfmcDtg{q**yzfai?K3hmhdx7PtKvNxX?Q%
z?P*9Au*m?<`Zc4XnzV>9M{^YvG00A2(zd9RPqn3RK&LA0GkI!TF73K|s_$zQIiq+Z
zd^v*?4DZ?7$B<3l8YI~uE~NddN*3%A%1({F_Ff)eaEy-xJRE>X(g5y%UMb>1HdRFY
z3ncFVkvOXeNE$(+RFSD{ZRBJ>o4^CH1v9(K&Va0jrXn!$!pI28#4u64(R2-`nGpnV
zT9v13c{W8M009*c(6oav$U^dlJRbw`0c;~9xlq?V#!Q?5I`cD;r$$uvlBsmwg^8dV
zEY5?es-YDF&et$k;3lI99oYmFfo4;A>RSkeL@}U>0343$B6SEA;;lKNI>19N6;(x1
zL=*;5(hI0s`eAYZ$Jtv`fe;Z8u4G{1q*9S<)&Hc(eNsSRHGKKa_8(s-jA`n><k~rU
zWOVc|Hv(iM(n5Xlk@0)2pzc4a13>#TY5e6+Mg1?|GJJaYpRddRq^DbPAQyAg2&9-k
zyc&UyQTgZ59&d_#-}oZ}34>7C<Bg0$APh3X_HS<>$p+Ta()O3Kv)^ETNjD8%UFBHH
zl$?<E^>s@ax@Ph7dP)ctP;}(5JKn<xNmFp^1UG%iV>I}ojxHTo1Ox*feopC2QU?=o
zk^}4T#7SrZI5q*S!>u5EjDPz`;6|4NHI9_Cn`;X>YwHb+zaxF?_h61+V&Bxnr&kOS
zHg+owP!j0PrwQ_eNny~IA11|jk<+$`1CY-5nSl-zhcMKq@9{=ixod3&<-@6r6a$I&
zh24cjFE%2u%P@tbkl>PnazhDd5{z$Y5*}H?Vj|ZbP!z0clH|;_l!WwJY}aD3Vfjj0
zMfs#q1O7t`OP96x0%?*H_BgwC8{{z@-27&js932HkP9GO%M{@7U=k^AsQOkxn(zau
zvcXBp>Vx&U67rv$QP;v&{nOWacjp08;@ytLotg&#kCT@J$q2+x)pM9)p~Mty7*!T*
zh*3Q9B{`GzKi9p&9HWIK7Qqm2WAi%^;NS#I5W$C99aSHy9@tti=20O=G^f0@f6_g(
zL0NMKF;<E@%U5~4GpQ(9tUbWzFQ3b=IvoJ(Z1}{_%_lE6TL7)doh1uAlZH)-C<fSm
zJbR2>F-EPAdZ;d)&c><H2eEuj;E>9rtP)5*H~t8mK~7|qd@@q8;z3ws?r%qrEWrt6
zb^H<FCtpQIb`%hbH3lGPp$Wz-A#{}bHn!3`XhFf-7V}IRzkwCj`B2&x=$zW%5lZw(
zgx?T76aQ9L;$@zYJBV3JOXd>2vpEIa<$}ZBEza}W!P623=Gbc$zY>GznJw(_<)V)r
zB=a}o1+t4~w{t7o`Ad(I)(MCluI23-VwJHdn)@@6HG`NEb*5<z&^!L~1`BQhld<_h
zs;ur-R=1yh`(mNY-h9PPk?jppW@Xp))JEt)Zun*A9{Yd-ZcM+(=Y`0<_=k(jSDNN*
zwPq1pE9;CVwFJyNO4D0rRO2q;=lmggmC=;OBvoihu3A4@rNnhi`&DT`Zy_U{ZxWf6
zVOLvpRgcb}5Ypl8kW;J!o{scYFG1ZyiG)()%_iQ1Iw#ZJ3=+<M*!v@wB}!v>J-^c&
zm1z7lej<;Wv?hb-Dy;7|RMmCkShbf7diI-tU$)QhPBSf6nvy}PI%iEAoPXUd$^D1I
z;{6rJDs^~*1Yfb!nX8&}Tfp02{CjpBrQ+xokD<Drcz2JBX})6fw*4m&e?<X_?km6Z
z#H0{4dbQGhzfJYB>zV)V&erm2;TrGGrI$R4)Hos()Dctt?Iu?L<;8HqA8W1kXqoco
zw5`8&$QI6Wn(#9>d%tjJjlW$*vQOH3$(}(bBUXven9D&AK4ifCL(+4QYmiOB?dJT4
z(o;;47}0gtN330YL;Q5Q+vqD+cq{uxq2dG#zsneNJb3Y1&%isK2Oy%eA60sLr_4fa
zY0tV9e)(B@X{<joFviP#1sr>_wtvye-yAYeLlsffH*Ez$_`b+(KOFN8it3aN?YPA)
zY0=^z5qev_4at5PZD1_OJKCD^vas$@!P%zTi#p?b9GnAUtW9p=#)bz76j1EsA@et*
z8UrMtz^d{HWGGc#WbSWApgh(XAgkk#KslDLelq&E68%pPTfU_28Eq9tN6;6vCIBn^
z+6%l4_!2Ji=Bn*umq6gk$}1341<vWsZq<(68Esw>H<*kt*}kfJ_t%b{q-HmcDka+K
z_)zyRePpWG6Kw4KShsU1ESLPjAwIn`=hu`Ag0>lbg-J9o$JB5dcuHE?BCZ~~<|{Um
zdBsu1hB*^ayBk7Eu`AZ$UC9?j+_=iH=?SYm?m*1jR(|N1!wjhGzEH#>a__ff_YK(-
zX?fzxz~S=K(VWL(o7Y<BGZ^nBHjXp4m5W}dq+O*QyyjzsJ{GWo-;*gN1n@8&l>d<0
zG=#UT=CZ=yl|f`qra$vkS!hj>c&a>Xwh8BCkybFg>K@7#<3i3u7Yhw{yp~<{j=t~6
zd?Q?JP08EVasK)RQCli`Rz`FswbMq{`H+FXcOY+@A0#9>WE+?(-d<@Ttp^&Dys6;j
zc;l`{xAc{H4h$ebsCP0vG=TgxdDL|La{RF~kW=OScgg8@*B|O(?!4uZT3!pESsIEe
zY{DlGlp`-f7Q>sXn!dBA?uBsMBW8L;EVu)t+W_($e>KFam;b*Bc<F$2SEyc6jOa;u
z9i&+qS0oE)3}(Mj94TsW?>N*xV_Q96o6gp<ps{zj%-P`itG}@4LDAiB0z0Z5Q)iIp
zUoxeGxbOL6O}0UFT%oH(R7>=E*1ajHz;1ultFqfQp%T8Cyp$L!;{<{5FFyIDcM=HM
q_ysXA>iMH1^zeA?`K@=unC~Z_e|J=8&hG#$v}xVewNF+PPW%r{rJ}(A

diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 8c75f3e..ba6d3d2 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -35,7 +35,7 @@ The canonical plan contains `6` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `184` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `188` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -50,14 +50,14 @@ The expanded source payload contains `184` files. Every destination is normalize
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
 | `runtime-environment` | 1 | `-` |
-| `schemas` | 63 | `-` |
+| `schemas` | 66 | `-` |
 | `assurance-artifacts` | 1 | `-` |
 | `compiled-catalogs` | 2 | `-` |
 | `device-qualification-console` | 4 | `-` |
 | `runtime-authority` | 1 | `-` |
 | `integration-authority` | 12 | `-` |
 | `cpp-sdk-headers` | 32 | `-` |
-| `documentation` | 40 | `-` |
+| `documentation` | 41 | `-` |
 | `readme` | 1 | `-` |
 | `security-policy` | 1 | `-` |
 | `license` | 1 | `-` |
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index b1e4781..5f1743c 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -4,7 +4,7 @@
 
 The Atlas is a projection of one canonical repository graph. Folder READMEs, dependency views, source-to-generated relationships, and change-impact guidance are generated from the same nodes.
 
-- **Subsystems:** 32
+- **Subsystems:** 33
 - **Categories:** 8
 - **Publication state:** `public-source-pre-release`
 
@@ -18,6 +18,7 @@ flowchart LR
         n_openrazer_adapter["OpenRazer compatibility adapter"]
         n_polychromatic_adapter["Polychromatic adapter"]
         n_device_qualification_console["Device qualification console"]
+        n_operations_cli["Operations CLI"]
         n_sdk_cpp["C++ SDK"]
         n_sdk_python["Python SDK"]
     end
@@ -96,6 +97,9 @@ flowchart LR
     n_rust_workspace --> n_rust_sdk
     n_protocol --> n_rust_sdk
     n_profiles --> n_rust_sdk
+    n_rust_sdk --> n_operations_cli
+    n_profiles --> n_operations_cli
+    n_bridge_runtime --> n_operations_cli
     n_rust_workspace --> n_kernel_transport
     n_driver_contract --> n_kernel_transport
     n_protocol --> n_kernel_transport
@@ -157,8 +161,8 @@ Arrows run from a dependency to its direct consumer. They describe responsibilit
 | [Schema contracts](#schemas) | `architecture` | `implemented` | 1 | 9 | `schema-contracts`, `repository-atlas-contracts` |
 | [Assurance and release evidence](#assurance) | `assurance` | `policy` | 2 | 2 | `assurance-contracts`, `formal-model-contracts` |
 | [Application integration catalog](#integrations) | `applications` | `implemented` | 2 | 6 | `integration-contracts` |
-| [Composable hardware profiles](#profiles) | `architecture` | `implemented` | 3 | 10 | `profile-contracts` |
-| [Device knowledge](#device-knowledge) | `assurance` | `research-boundary` | 2 | 1 | `device-knowledge-contracts` |
+| [Composable hardware profiles](#profiles) | `architecture` | `implemented` | 3 | 11 | `profile-contracts`, `native-onboarding-contracts` |
+| [Device knowledge](#device-knowledge) | `assurance` | `research-boundary` | 2 | 1 | `device-knowledge-contracts`, `native-onboarding-contracts` |
 | [Versioned bridge protocol](#protocol) | `architecture` | `implemented` | 1 | 7 | `protocol-contracts`, `cpp-sdk-contracts` |
 | [OpenRGB adapter](#openrgb-adapter) | `applications` | `implemented` | 3 | 1 | `openrgb-adapter-contracts`, `openrgb-thread-sanitizer` |
 | [OpenRazer compatibility adapter](#openrazer-adapter) | `applications` | `implemented` | 3 | 2 | `openrazer-metadata-contracts`, `openrazer-compatibility-contracts` |
@@ -166,9 +170,10 @@ Arrows run from a dependency to its direct consumer. They describe responsibilit
 | [Device qualification console](#device-qualification-console) | `applications` | `implemented` | 3 | 1 | `device-qualification-console-contracts`, `rust-unit`, `package-contracts` |
 | [Rust workspace](#rust-workspace) | `runtime` | `implemented` | 3 | 5 | `rust-format`, `rust-clippy`, `rust-unit` |
 | [Core policy engine](#core-runtime) | `runtime` | `implemented` | 3 | 2 | `rust-unit`, `formal-model-contracts` |
-| [Bridge runtime](#bridge-runtime) | `runtime` | `implemented` | 2 | 2 | `rust-unit`, `simulator-contracts` |
+| [Bridge runtime](#bridge-runtime) | `runtime` | `implemented` | 2 | 3 | `rust-unit`, `simulator-contracts` |
 | [Production daemon](#daemon) | `runtime` | `implemented` | 3 | 1 | `rust-unit`, `package-contracts` |
-| [Rust SDK](#rust-sdk) | `runtime` | `implemented` | 3 | 0 | `rust-unit`, `protocol-contracts` |
+| [Rust SDK](#rust-sdk) | `runtime` | `implemented` | 3 | 1 | `rust-unit`, `protocol-contracts` |
+| [Operations CLI](#operations-cli) | `applications` | `implemented` | 3 | 0 | `rust-unit`, `native-onboarding-contracts`, `package-contracts` |
 | [Kernel transport adapter](#kernel-transport) | `runtime` | `implemented` | 3 | 1 | `rust-unit`, `kernel-profile-contracts` |
 | [Deterministic simulator](#simulator) | `assurance` | `implemented` | 2 | 1 | `simulator-contracts`, `migration-shadow-contracts` |
 | [Kernel driver contract](#driver-contract) | `runtime` | `implemented` | 2 | 2 | `kernel-profile-contracts` |
@@ -177,8 +182,8 @@ Arrows run from a dependency to its direct consumer. They describe responsibilit
 | [Packaging and installation](#packaging) | `delivery` | `implemented` | 7 | 0 | `package-contracts` |
 | [C++ SDK](#sdk-cpp) | `applications` | `implemented` | 3 | 2 | `cpp-sdk-contracts` |
 | [Python SDK](#sdk-python) | `applications` | `implemented` | 3 | 3 | `python-unit`, `protocol-contracts` |
-| [Repository tooling](#tooling) | `tooling` | `implemented` | 3 | 3 | `python-unit`, `generated-freshness` |
-| [Contract tests](#tests) | `assurance` | `implemented` | 4 | 1 | `python-unit`, `cpp-sdk-contracts`, `rust-unit` |
+| [Repository tooling](#tooling) | `tooling` | `implemented` | 3 | 3 | `python-unit`, `native-onboarding-contracts`, `generated-freshness` |
+| [Contract tests](#tests) | `assurance` | `implemented` | 4 | 1 | `python-unit`, `native-onboarding-contracts`, `cpp-sdk-contracts`, `rust-unit` |
 | [Migration provenance](#migration) | `assurance` | `research-boundary` | 3 | 0 | `foundation-contracts`, `migration-shadow-contracts` |
 | [GitHub governance authority](#governance) | `governance` | `policy` | 3 | 1 | `governance-contracts` |
 | [Documentation system](#documentation) | `documentation` | `generated` | 5 | 0 | `repository-documentation-contracts`, `repository-atlas-contracts` |
@@ -232,7 +237,7 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 
 **Used by:** [Assurance and release evidence](#assurance), [Kernel driver contract](#driver-contract), [Error catalog](#errors), [Application integration catalog](#integrations), [Composable hardware profiles](#profiles), [Versioned bridge protocol](#protocol), [Linux runtime authority](#runtime-config), [Rust workspace](#rust-workspace), [Repository tooling](#tooling)
 
-**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`, `schemas/lifecycle-policy-catalog.schema.json`, `schemas/kernel-uapi-registry.schema.json`, `schemas/kernel-uapi-native-exchange.schema.json`.
+**Canonical sources:** `schemas/domain-catalog.json`, `schemas/domain-catalog.schema.json`, `schemas/repository-atlas.schema.json`, `schemas/public-readiness.schema.json`, `schemas/local-companion.schema.json`, `schemas/local-snapshot.schema.json`, `schemas/licensing-policy.schema.json`, `schemas/lifecycle-policy-catalog.schema.json`, `schemas/kernel-uapi-registry.schema.json`, `schemas/kernel-uapi-native-exchange.schema.json`, `schemas/native-route-observation.schema.json`, `schemas/native-device-onboarding-draft.schema.json`, `schemas/native-device-promotion-assessment.schema.json`.
 
 **Generated projections:** `schemas/README.md`, `docs/generated/domain-types.md`.
 
@@ -308,13 +313,13 @@ Composes receiver, surface, and child identities with evidence-bound capabilitie
 
 **Depends on:** [Architecture authority](#architecture), [Schema contracts](#schemas), [Application integration catalog](#integrations)
 
-**Used by:** [Core policy engine](#core-runtime), [Device knowledge](#device-knowledge), [Device qualification console](#device-qualification-console), [Linux HID kernel module](#kernel-module), [OpenRazer compatibility adapter](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Rust SDK](#rust-sdk), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python), [Deterministic simulator](#simulator)
+**Used by:** [Core policy engine](#core-runtime), [Device knowledge](#device-knowledge), [Device qualification console](#device-qualification-console), [Linux HID kernel module](#kernel-module), [OpenRazer compatibility adapter](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Operations CLI](#operations-cli), [Rust SDK](#rust-sdk), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python), [Deterministic simulator](#simulator)
 
 **Canonical sources:** `profiles/capabilities.json`, `profiles/lifecycle-policies.json`, `profiles/evidence/claims.json`, `profiles/receivers/razer-hyperflux-v2-1532-00cf.json`, `profiles/surfaces/razer-hyperflux-v2-hard-edition.json`, `profiles/children/razer-basilisk-v3-pro-35k-00cd.json`, `profiles/children/razer-deathstalker-v2-pro-tkl-0296.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-13.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-21.json`.
 
 **Generated projections:** `profiles/README.md`, `generated/profiles/catalog.json`, `docs/generated/supported-hardware.md`.
 
-**Change impact:** Regenerate 3 declared projection(s). Run `profile-contracts`. Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
+**Change impact:** Regenerate 3 declared projection(s). Run `profile-contracts`, `native-onboarding-contracts`. Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
 
 </details>
 
@@ -340,7 +345,7 @@ Records provenance-bound candidate facts, semantic capabilities, upstream record
 
 **Generated projections:** `knowledge/README.md`, `generated/knowledge/catalog.json`, `docs/generated/device-knowledge.md`.
 
-**Change impact:** Regenerate 3 declared projection(s). Run `device-knowledge-contracts`. Review direct consumers: Documentation system.
+**Change impact:** Regenerate 3 declared projection(s). Run `device-knowledge-contracts`, `native-onboarding-contracts`. Review direct consumers: Documentation system.
 
 </details>
 
@@ -542,13 +547,13 @@ Adapts the core policy engine to sessions, persistence, subscriptions, snapshots
 
 **Depends on:** [Core policy engine](#core-runtime), [Versioned bridge protocol](#protocol)
 
-**Used by:** [Production daemon](#daemon), [Device qualification console](#device-qualification-console)
+**Used by:** [Production daemon](#daemon), [Device qualification console](#device-qualification-console), [Operations CLI](#operations-cli)
 
 **Canonical sources:** `crates/hfx-bridge/Cargo.toml`, `crates/hfx-bridge/src/lib.rs`, `crates/hfx-bridge/src/rpc.rs`.
 
 **Generated projections:** `crates/hfx-bridge/README.md`.
 
-**Change impact:** Regenerate 1 declared projection(s). Run `rust-unit`, `simulator-contracts`. Review direct consumers: Production daemon, Device qualification console.
+**Change impact:** Regenerate 1 declared projection(s). Run `rust-unit`, `simulator-contracts`. Review direct consumers: Production daemon, Device qualification console, Operations CLI.
 
 </details>
 
@@ -594,13 +599,39 @@ Provides the typed Rust client contract used by production integrations and inte
 
 **Depends on:** [Rust workspace](#rust-workspace), [Versioned bridge protocol](#protocol), [Composable hardware profiles](#profiles)
 
-**Used by:** None
+**Used by:** [Operations CLI](#operations-cli)
 
 **Canonical sources:** `crates/hfx-sdk/Cargo.toml`, `crates/hfx-sdk/src/lib.rs`, `crates/hfx-sdk/src/client.rs`.
 
 **Generated projections:** `crates/hfx-sdk/README.md`.
 
-**Change impact:** Regenerate 1 declared projection(s). Run `rust-unit`, `protocol-contracts`. No direct subsystem consumer is declared; verify repository-facing outputs.
+**Change impact:** Regenerate 1 declared projection(s). Run `rust-unit`, `protocol-contracts`. Review direct consumers: Operations CLI.
+
+</details>
+
+<a id="operations-cli"></a>
+<details>
+<summary><strong>Operations CLI</strong> · applications · implemented</summary>
+
+### Operations CLI
+
+`crates/hfx-ops` · `applications` · `implemented`
+
+Provides bounded local status, diagnostics, qualification, and privacy-safe native route observation for ordinary users and maintainers.
+
+**Owns:** Installed command-line workflows; Privacy-safe observation projection; Local qualification companion.
+
+**Must never own:** Profile promotion authority; Raw receiver reports; Application presentation.
+
+**Depends on:** [Rust SDK](#rust-sdk), [Composable hardware profiles](#profiles), [Bridge runtime](#bridge-runtime)
+
+**Used by:** None
+
+**Canonical sources:** `crates/hfx-ops/Cargo.toml`, `crates/hfx-ops/src/bin/hyperfluxctl.rs`, `crates/hfx-ops/src/native_onboarding.rs`, `crates/hfx-ops/src/probe.rs`.
+
+**Generated projections:** `crates/hfx-ops/README.md`.
+
+**Change impact:** Regenerate 1 declared projection(s). Run `rust-unit`, `native-onboarding-contracts`, `package-contracts`. No direct subsystem consumer is declared; verify repository-facing outputs.
 
 </details>
 
@@ -830,11 +861,11 @@ Provides the single developer CLI, canonical loaders, deterministic generators,
 
 **Used by:** [Documentation system](#documentation), [Contract tests](#tests), [Verification graph](#verification)
 
-**Canonical sources:** `hfx`, `tools/hfxdev/cli.py`, `tools/hfxdev/render.py`, `tools/hfxdev/verify.py`, `tools/hfxdev/public_readiness.py`, `tools/hfxdev/local_companion.py`, `tools/hfxdev/licensing.py`.
+**Canonical sources:** `hfx`, `tools/hfxdev/cli.py`, `tools/hfxdev/render.py`, `tools/hfxdev/verify.py`, `tools/hfxdev/public_readiness.py`, `tools/hfxdev/local_companion.py`, `tools/hfxdev/licensing.py`, `tools/hfxdev/native_onboarding.py`, `tools/hfxdev/private_artifact.py`, `tools/hfxdev/openrazer_native_route.py`.
 
 **Generated projections:** `tools/README.md`.
 
-**Change impact:** Regenerate 1 declared projection(s). Run `python-unit`, `generated-freshness`. Review direct consumers: Documentation system, Contract tests, Verification graph.
+**Change impact:** Regenerate 1 declared projection(s). Run `python-unit`, `native-onboarding-contracts`, `generated-freshness`. Review direct consumers: Documentation system, Contract tests, Verification graph.
 
 </details>
 
@@ -856,11 +887,11 @@ Holds language-specific, cross-language, fixture, lifecycle, repository-navigati
 
 **Used by:** [Verification graph](#verification)
 
-**Canonical sources:** `tests/test_foundation.py`, `tests/test_repository_experience.py`, `tests/test_testgraph.py`.
+**Canonical sources:** `tests/test_foundation.py`, `tests/test_repository_experience.py`, `tests/test_testgraph.py`, `tests/test_native_onboarding.py`, `tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json`.
 
 **Generated projections:** `tests/README.md`, `tests/fixtures/generated/profile-compositions.json`.
 
-**Change impact:** Regenerate 2 declared projection(s). Run `python-unit`, `cpp-sdk-contracts`, `rust-unit`. Review direct consumers: Verification graph.
+**Change impact:** Regenerate 2 declared projection(s). Run `python-unit`, `native-onboarding-contracts`, `cpp-sdk-contracts`, `rust-unit`. Review direct consumers: Verification graph.
 
 </details>
 
@@ -934,7 +965,7 @@ Organizes concise audience guidance and generated technical references for direc
 
 **Used by:** None
 
-**Canonical sources:** `docs/user/overview.md`, `docs/architecture/design-book.md`, `docs/architecture/decisions/github-native-documentation.md`.
+**Canonical sources:** `docs/user/overview.md`, `docs/architecture/design-book.md`, `docs/architecture/native-device-onboarding.md`, `docs/architecture/decisions/github-native-documentation.md`.
 
 **Generated projections:** `docs/README.md`, `docs/generated/repository-atlas.md`, `generated/public-readiness.json`.
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index b96ab98..6ed164b 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca`
+Profile source: `68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
diff --git a/docs/generated/verification.md b/docs/generated/verification.md
index 5e5760a..1212f64 100644
--- a/docs/generated/verification.md
+++ b/docs/generated/verification.md
@@ -24,22 +24,23 @@ Every current node is software-only and has zero hardware-write authority.
 | 15 | `openrazer-metadata-contracts` | `integrations` | `none` | `false` | 30s | `rerun` |
 | 16 | `device-knowledge-contracts` | `profiles` | `none` | `false` | 30s | `rerun` |
 | 17 | `device-qualification-console-contracts` | `applications` | `none` | `false` | 20s | `rerun` |
-| 18 | `generated-freshness` | `generation` | `none` | `false` | 15s | `reuse-verified` |
-| 19 | `repository-documentation-contracts` | `documentation` | `none` | `false` | 30s | `rerun` |
-| 20 | `python-unit` | `tooling` | `none` | `false` | 120s | `rerun` |
-| 21 | `rust-clippy` | `rust` | `none` | `false` | 180s | `rerun` |
-| 22 | `cpp-sdk-contracts` | `sdk` | `none` | `false` | 60s | `rerun` |
-| 23 | `kernel-profile-contracts` | `kernel` | `none` | `false` | 180s | `rerun` |
-| 24 | `rust-unit` | `rust` | `none` | `false` | 180s | `rerun` |
-| 25 | `simulator-contracts` | `simulation` | `none` | `false` | 180s | `rerun` |
-| 26 | `openrgb-adapter-contracts` | `integrations` | `none` | `false` | 300s | `rerun` |
-| 27 | `polychromatic-adapter-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
-| 28 | `openrazer-compatibility-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
-| 29 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
-| 30 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
-| 31 | `openrgb-native-route-contracts` | `integrations` | `none` | `false` | 360s | `rerun` |
-| 32 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
-| 33 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
+| 18 | `native-onboarding-contracts` | `profiles` | `none` | `false` | 60s | `rerun` |
+| 19 | `generated-freshness` | `generation` | `none` | `false` | 15s | `reuse-verified` |
+| 20 | `repository-documentation-contracts` | `documentation` | `none` | `false` | 30s | `rerun` |
+| 21 | `python-unit` | `tooling` | `none` | `false` | 120s | `rerun` |
+| 22 | `rust-clippy` | `rust` | `none` | `false` | 180s | `rerun` |
+| 23 | `cpp-sdk-contracts` | `sdk` | `none` | `false` | 60s | `rerun` |
+| 24 | `kernel-profile-contracts` | `kernel` | `none` | `false` | 180s | `rerun` |
+| 25 | `rust-unit` | `rust` | `none` | `false` | 180s | `rerun` |
+| 26 | `simulator-contracts` | `simulation` | `none` | `false` | 180s | `rerun` |
+| 27 | `openrgb-adapter-contracts` | `integrations` | `none` | `false` | 300s | `rerun` |
+| 28 | `polychromatic-adapter-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
+| 29 | `openrazer-compatibility-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
+| 30 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
+| 31 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
+| 32 | `openrgb-native-route-contracts` | `integrations` | `none` | `false` | 360s | `rerun` |
+| 33 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
+| 34 | `package-contracts` | `packaging` | `none` | `false` | 600s | `rerun` |
 
 ## Dependencies
 
@@ -62,6 +63,7 @@ flowchart LR
     openrazer_metadata_contracts["openrazer-metadata-contracts"]
     device_knowledge_contracts["device-knowledge-contracts"]
     device_qualification_console_contracts["device-qualification-console-contracts"]
+    native_onboarding_contracts["native-onboarding-contracts"]
     generated_freshness["generated-freshness"]
     repository_documentation_contracts["repository-documentation-contracts"]
     python_unit["python-unit"]
@@ -99,6 +101,8 @@ flowchart LR
     profile_contracts --> device_knowledge_contracts
     schema_contracts --> device_qualification_console_contracts
     profile_contracts --> device_qualification_console_contracts
+    schema_contracts --> native_onboarding_contracts
+    device_knowledge_contracts --> native_onboarding_contracts
     profile_contracts --> generated_freshness
     device_knowledge_contracts --> generated_freshness
     protocol_contracts --> generated_freshness
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index 4de15d1..e535634 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca */
+/* Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 61bb91c..49a23a8 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "fba23260a420dc6bdc3de6795e840757436ef051132787579a23be3a5436d020",
+  "source_sha256": "4964897e3b52a753cb3c6bd8a8b00733ac7bc97c79aa2196d49840509148421f",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index cd4dc2b..9cd2dbe 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -322,6 +322,16 @@
       "resource": "lighting",
       "summary": "Retain and deliver one qualified static RGB state."
     },
+    {
+      "access": "write",
+      "id": "native.feature-report-exchange",
+      "owner": "bridge",
+      "profile_kinds": [
+        "child"
+      ],
+      "resource": "native-control",
+      "summary": "Carry one opaque upstream-owned feature report over a qualified receiver child route."
+    },
     {
       "access": "read",
       "id": "presence.passive-evidence",
@@ -1524,5 +1534,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
+  "source_sha256": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
 }
diff --git a/generated/public-readiness.json b/generated/public-readiness.json
index ef537e5..bcb2713 100644
--- a/generated/public-readiness.json
+++ b/generated/public-readiness.json
@@ -28,10 +28,10 @@
   },
   "qualification_console_access": "loopback-only",
   "repository": {
-    "atlas_subsystems": 32,
+    "atlas_subsystems": 33,
     "label": "Repository map",
     "state": "ready",
-    "summary": "The Repository Atlas owns 32 subsystem records and their generated projections."
+    "summary": "The Repository Atlas owns 33 subsystem records and their generated projections."
   },
   "schema": "hyperflux-public-readiness-v1",
   "software": {
diff --git a/knowledge/README.md b/knowledge/README.md
index 7272631..877b3ca 100644
--- a/knowledge/README.md
+++ b/knowledge/README.md
@@ -33,12 +33,12 @@ Records provenance-bound candidate facts, semantic capabilities, upstream record
 
 ## Verification
 
-Run `device-knowledge-contracts` after changing this area.
+Run `device-knowledge-contracts` `native-onboarding-contracts` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 3 declared projection(s).
-- Run `device-knowledge-contracts`.
+- Run `device-knowledge-contracts`, `native-onboarding-contracts`.
 - Review direct consumers: Documentation system.
 
 ## Relationships
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 9f267a5..2176d34 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -502,6 +502,27 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "schemas",
+      "source": "schemas/native-device-onboarding-draft.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/native-device-onboarding-draft.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/native-device-promotion-assessment.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/native-device-promotion-assessment.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
+    {
+      "component": "schemas",
+      "source": "schemas/native-route-observation.schema.json",
+      "destination": "/usr/share/hyperflux-next/schemas/native-route-observation.schema.json",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "schemas",
       "source": "schemas/native-transport-parity-evidence.schema.json",
@@ -1111,6 +1132,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "documentation",
+      "source": "docs/architecture/native-device-onboarding.md",
+      "destination": "/usr/share/doc/hyperflux-next/architecture/native-device-onboarding.md",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "documentation",
       "source": "docs/architecture/openrazer-compatibility.md",
diff --git a/profiles/README.md b/profiles/README.md
index df06474..8f708b2 100644
--- a/profiles/README.md
+++ b/profiles/README.md
@@ -37,17 +37,17 @@ Composes receiver, surface, and child identities with evidence-bound capabilitie
 
 ## Verification
 
-Run `profile-contracts` after changing this area.
+Run `profile-contracts` `native-onboarding-contracts` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 3 declared projection(s).
-- Run `profile-contracts`.
-- Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
+- Run `profile-contracts`, `native-onboarding-contracts`.
+- Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
 
 ## Relationships
 
 - **Depends on:** [Architecture authority](../architecture/README.md), [Schema contracts](../schemas/README.md), [Application integration catalog](../integrations/README.md)
-- **Used by:** [Core policy engine](../crates/hfx-core/README.md), [Device knowledge](../knowledge/README.md), [Device qualification console](../apps/device-qualification/README.md), [Linux HID kernel module](../driver/kernel/README.md), [OpenRazer compatibility adapter](../integrations/openrazer/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [Rust SDK](../crates/hfx-sdk/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md), [Deterministic simulator](../crates/hfx-sim/README.md)
+- **Used by:** [Core policy engine](../crates/hfx-core/README.md), [Device knowledge](../knowledge/README.md), [Device qualification console](../apps/device-qualification/README.md), [Linux HID kernel module](../driver/kernel/README.md), [OpenRazer compatibility adapter](../integrations/openrazer/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [Operations CLI](../crates/hfx-ops/README.md), [Rust SDK](../crates/hfx-sdk/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md), [Deterministic simulator](../crates/hfx-sim/README.md)
 
 See the [Repository Atlas](../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/profiles/capabilities.json b/profiles/capabilities.json
index 65de359..0ad4bed 100644
--- a/profiles/capabilities.json
+++ b/profiles/capabilities.json
@@ -13,6 +13,7 @@
     {"id": "lighting.software-effect-frames", "summary": "Carry streamed Direct-mode frames produced by an application effect engine.", "access": "write", "owner": "bridge", "resource": "lighting", "profile_kinds": ["child"]},
     {"id": "lighting.stable-state-restore", "summary": "Restore a retained stable Static or Off state after a trusted lifecycle event.", "access": "write", "owner": "bridge", "resource": "lighting", "profile_kinds": ["receiver"]},
     {"id": "lighting.static", "summary": "Retain and deliver one qualified static RGB state.", "access": "write", "owner": "bridge", "resource": "lighting", "profile_kinds": ["child"]},
+    {"id": "native.feature-report-exchange", "summary": "Carry one opaque upstream-owned feature report over a qualified receiver child route.", "access": "write", "owner": "bridge", "resource": "native-control", "profile_kinds": ["child"]},
     {"id": "presence.passive-evidence", "summary": "Derive availability dimensions from passive generation-bound evidence.", "access": "read", "owner": "bridge", "resource": null, "profile_kinds": ["child"]},
     {"id": "receiver.exclusive-writer-session", "summary": "Permit one generation-bound structured writer session.", "access": "write", "owner": "kernel", "resource": null, "profile_kinds": ["receiver"]},
     {"id": "receiver.generation", "summary": "Create a new identity and session generation after receiver discovery.", "access": "read", "owner": "kernel", "resource": null, "profile_kinds": ["receiver"]},
diff --git a/schemas/README.md b/schemas/README.md
index 2bdcda7..1fdeaf5 100644
--- a/schemas/README.md
+++ b/schemas/README.md
@@ -35,6 +35,9 @@ Defines strict machine-readable shapes for every shared repository fact and gene
 - [`schemas/lifecycle-policy-catalog.schema.json`](lifecycle-policy-catalog.schema.json)
 - [`schemas/kernel-uapi-registry.schema.json`](kernel-uapi-registry.schema.json)
 - [`schemas/kernel-uapi-native-exchange.schema.json`](kernel-uapi-native-exchange.schema.json)
+- [`schemas/native-route-observation.schema.json`](native-route-observation.schema.json)
+- [`schemas/native-device-onboarding-draft.schema.json`](native-device-onboarding-draft.schema.json)
+- [`schemas/native-device-promotion-assessment.schema.json`](native-device-promotion-assessment.schema.json)
 
 ## Verification
 
diff --git a/schemas/native-device-onboarding-draft.schema.json b/schemas/native-device-onboarding-draft.schema.json
new file mode 100644
index 0000000..60958c0
--- /dev/null
+++ b/schemas/native-device-onboarding-draft.schema.json
@@ -0,0 +1,189 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/native-device-onboarding-draft-v1.json",
+  "title": "Fail-closed native receiver device onboarding draft",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "created_at", "source_revision", "observation", "source_bindings", "assessment", "candidate_profile", "promotion_contract", "safety"],
+  "properties": {
+    "$schema": {"const": "https://hyperflux.dev/schemas/native-device-onboarding-draft-v1.json"},
+    "schema": {"const": "hyperflux-native-device-onboarding-draft-v1"},
+    "created_at": {"type": "string", "format": "date-time"},
+    "source_revision": {"$ref": "#/$defs/revision"},
+    "observation": {"$ref": "#/$defs/observation"},
+    "source_bindings": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["openrazer", "openrgb"],
+      "properties": {
+        "openrazer": {"$ref": "#/$defs/source-binding"},
+        "openrgb": {"$ref": "#/$defs/source-binding"}
+      }
+    },
+    "assessment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["state", "reason_codes", "same_protocol", "identity_state", "topology_state", "existing_profile_id", "writable"],
+      "properties": {
+        "state": {"enum": ["candidate", "partial", "conflicted", "ambiguous", "unknown", "backend-required"]},
+        "reason_codes": {"$ref": "#/$defs/strings"},
+        "same_protocol": {"type": "boolean"},
+        "identity_state": {"enum": ["agreement", "partial", "unresolved"]},
+        "topology_state": {"enum": ["agreement", "partial", "conflict", "unavailable"]},
+        "existing_profile_id": {"oneOf": [{"type": "null"}, {"$ref": "#/$defs/profile-id"}]},
+        "writable": {"const": false}
+      }
+    },
+    "candidate_profile": {"$ref": "#/$defs/candidate-profile"},
+    "promotion_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["decision", "engine_changes_allowed", "allowed_domains", "immutable_engine_domains"],
+      "properties": {
+        "decision": {"enum": ["profile-only-candidate", "blocked", "backend-required"]},
+        "engine_changes_allowed": {"const": false},
+        "allowed_domains": {"$ref": "#/$defs/strings"},
+        "immutable_engine_domains": {"$ref": "#/$defs/strings"}
+      }
+    },
+    "safety": {"$ref": "#/$defs/safety"}
+  },
+  "$defs": {
+    "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "profile-id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$", "maxLength": 128},
+    "strings": {
+      "type": "array",
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": {"type": "string", "minLength": 1, "maxLength": 256}
+    },
+    "observation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["observed_at", "source", "receiver_generation", "vendor_id", "product_id", "device_kind", "route_kind", "route_state", "access", "protocol_family", "report_bytes"],
+      "properties": {
+        "observed_at": {"type": "string", "format": "date-time"},
+        "source": {"const": "bridge-native-route-v7"},
+        "receiver_generation": {"type": "integer", "minimum": 1},
+        "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+        "device_kind": {"enum": ["mouse", "keyboard"]},
+        "route_kind": {"const": "hyperflux-wireless"},
+        "route_state": {"enum": ["available", "stale", "unavailable", "unknown"]},
+        "access": {"enum": ["candidate", "qualified", "backend-required"]},
+        "protocol_family": {"type": "string", "minLength": 1, "maxLength": 64},
+        "report_bytes": {"type": "integer", "minimum": 1, "maximum": 4096}
+      }
+    },
+    "source-binding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["upstream_id", "commit", "catalog_sha256", "match_state", "records"],
+      "properties": {
+        "upstream_id": {"enum": ["openrazer", "openrgb"]},
+        "commit": {"$ref": "#/$defs/revision"},
+        "catalog_sha256": {"$ref": "#/$defs/sha256"},
+        "match_state": {"enum": ["absent", "exact", "ambiguous"]},
+        "records": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {"$ref": "https://hyperflux.dev/schemas/upstream-device-catalog-v1.json#/properties/records/items"}
+        }
+      }
+    },
+    "candidate-profile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["profile_id", "revision", "kind", "device_kind", "identity", "compatibility", "presentation", "upstream_record_ids", "native_control", "topology", "required_evidence", "restrictions"],
+      "properties": {
+        "profile_id": {"$ref": "#/$defs/profile-id"},
+        "revision": {"type": ["integer", "null"], "minimum": 1},
+        "kind": {"const": "child"},
+        "device_kind": {"enum": ["mouse", "keyboard"]},
+        "identity": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["manufacturer", "model_name", "authority", "vendor_id", "product_id"],
+          "properties": {
+            "manufacturer": {"const": "Razer"},
+            "model_name": {"type": "string", "minLength": 1, "maxLength": 128},
+            "authority": {"const": "paired-product-id"},
+            "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+            "product_id": {"type": "integer", "minimum": 0, "maximum": 65535}
+          }
+        },
+        "compatibility": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["receiver_protocols", "routes", "required_sibling_kinds"],
+          "properties": {
+            "receiver_protocols": {"const": ["razer-hyperflux-v2"]},
+            "routes": {"const": ["hyperflux-wireless"]},
+            "required_sibling_kinds": {"const": []}
+          }
+        },
+        "presentation": {
+          "oneOf": [
+            {"type": "null"},
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["upstream_id", "owner", "project_version", "source_commit", "model_key", "layout_key", "transport_variant"],
+              "properties": {
+                "upstream_id": {"const": "openrgb"},
+                "owner": {"const": "OpenRGB"},
+                "project_version": {"type": "string", "minLength": 1, "maxLength": 64},
+                "source_commit": {"$ref": "#/$defs/revision"},
+                "model_key": {"type": "string", "pattern": "^[A-Za-z0-9_]+$"},
+                "layout_key": {"type": ["string", "null"], "pattern": "^[A-Za-z0-9_]+$"},
+                "transport_variant": {"const": "wireless"}
+              }
+            }
+          ]
+        },
+        "upstream_record_ids": {"$ref": "#/$defs/strings"},
+        "native_control": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["protocol_family", "report_bytes", "capability_id", "support_level", "write_authority"],
+          "properties": {
+            "protocol_family": {"type": "string", "minLength": 1, "maxLength": 64},
+            "report_bytes": {"type": "integer", "minimum": 1, "maximum": 4096},
+            "capability_id": {"const": "native.feature-report-exchange"},
+            "support_level": {"const": "candidate"},
+            "write_authority": {"const": false}
+          }
+        },
+        "topology": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["authority", "state", "hyperflux_carrier_map"],
+          "properties": {
+            "authority": {"const": "upstream"},
+            "state": {"enum": ["agreement", "partial", "conflict", "unavailable"]},
+            "hyperflux_carrier_map": {"const": null}
+          }
+        },
+        "required_evidence": {"$ref": "#/$defs/strings"},
+        "restrictions": {"$ref": "#/$defs/strings"}
+      }
+    },
+    "safety": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidate_only", "write_authority_granted", "serials_persisted", "raw_reports_persisted", "private_paths_persisted", "network_upload", "hardware_queried_by_tool", "hardware_write_executed", "file_mode"],
+      "properties": {
+        "candidate_only": {"const": true},
+        "write_authority_granted": {"const": false},
+        "serials_persisted": {"const": false},
+        "raw_reports_persisted": {"const": false},
+        "private_paths_persisted": {"const": false},
+        "network_upload": {"const": false},
+        "hardware_queried_by_tool": {"const": false},
+        "hardware_write_executed": {"const": false},
+        "file_mode": {"const": "0600"}
+      }
+    }
+  }
+}
diff --git a/schemas/native-device-promotion-assessment.schema.json b/schemas/native-device-promotion-assessment.schema.json
new file mode 100644
index 0000000..35aff54
--- /dev/null
+++ b/schemas/native-device-promotion-assessment.schema.json
@@ -0,0 +1,52 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/native-device-promotion-assessment-v1.json",
+  "title": "Native receiver profile-only promotion assessment",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "created_at", "source_revision", "draft_sha256", "profile_id", "state", "reason_codes", "evidence_bindings", "change_contract", "safety"],
+  "properties": {
+    "$schema": {"const": "https://hyperflux.dev/schemas/native-device-promotion-assessment-v1.json"},
+    "schema": {"const": "hyperflux-native-device-promotion-assessment-v1"},
+    "created_at": {"type": "string", "format": "date-time"},
+    "source_revision": {"$ref": "#/$defs/revision"},
+    "draft_sha256": {"$ref": "#/$defs/sha256"},
+    "profile_id": {"type": "string", "pattern": "^child\\.[a-z0-9.-]+$", "maxLength": 128},
+    "state": {"enum": ["ready-for-reviewed-profile-promotion", "blocked", "backend-required"]},
+    "reason_codes": {"$ref": "#/$defs/strings"},
+    "evidence_bindings": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["onboarding_source_revision", "parity_source_revision", "openrazer_commit", "native_probe_catalog_sha256", "parity_conclusion"],
+      "properties": {
+        "onboarding_source_revision": {"$ref": "#/$defs/revision"},
+        "parity_source_revision": {"$ref": "#/$defs/revision"},
+        "openrazer_commit": {"$ref": "#/$defs/revision"},
+        "native_probe_catalog_sha256": {"$ref": "#/$defs/sha256"},
+        "parity_conclusion": {"enum": ["passed", "incomplete", "backend-required"]}
+      }
+    },
+    "change_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["engine_changes_allowed", "allowed_domains", "immutable_engine_domains", "automatic_write_authority_granted"],
+      "properties": {
+        "engine_changes_allowed": {"const": false},
+        "allowed_domains": {"$ref": "#/$defs/strings"},
+        "immutable_engine_domains": {"$ref": "#/$defs/strings"},
+        "automatic_write_authority_granted": {"const": false}
+      }
+    },
+    "safety": {"$ref": "https://hyperflux.dev/schemas/native-device-onboarding-draft-v1.json#/$defs/safety"}
+  },
+  "$defs": {
+    "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+    "sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "strings": {
+      "type": "array",
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": {"type": "string", "minLength": 1, "maxLength": 256}
+    }
+  }
+}
diff --git a/schemas/native-route-observation.schema.json b/schemas/native-route-observation.schema.json
new file mode 100644
index 0000000..dba8a45
--- /dev/null
+++ b/schemas/native-route-observation.schema.json
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hyperflux.dev/schemas/native-route-observation-v1.json",
+  "title": "Privacy-safe receiver native-route observation",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["$schema", "schema", "observed_at", "source", "receiver_generation", "vendor_id", "product_id", "device_kind", "route_kind", "route_state", "access", "protocol_family", "report_bytes", "privacy"],
+  "properties": {
+    "$schema": {"const": "https://hyperflux.dev/schemas/native-route-observation-v1.json"},
+    "schema": {"const": "hyperflux-native-route-observation-v1"},
+    "observed_at": {"type": "string", "format": "date-time"},
+    "source": {"const": "bridge-native-route-v7"},
+    "receiver_generation": {"type": "integer", "minimum": 1},
+    "vendor_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+    "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
+    "device_kind": {"enum": ["mouse", "keyboard"]},
+    "route_kind": {"const": "hyperflux-wireless"},
+    "route_state": {"enum": ["available", "stale", "unavailable", "unknown"]},
+    "access": {"enum": ["candidate", "qualified", "backend-required"]},
+    "protocol_family": {"type": "string", "minLength": 1, "maxLength": 64},
+    "report_bytes": {"type": "integer", "minimum": 1, "maximum": 4096},
+    "privacy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["serials_included", "route_tokens_included", "host_paths_included", "raw_reports_included"],
+      "properties": {
+        "serials_included": {"const": false},
+        "route_tokens_included": {"const": false},
+        "host_paths_included": {"const": false},
+        "raw_reports_included": {"const": false}
+      }
+    }
+  }
+}
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index 17633c4..b23c572 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca
+// Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca";
+inline constexpr std::string_view profile_source_sha256 = "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 5260b16..2f7d9c0 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca'
+PROFILE_SOURCE_SHA256: Final = '68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -232,6 +232,12 @@
                    'profile_kinds': ['child'],
                    'resource': 'lighting',
                    'summary': 'Retain and deliver one qualified static RGB state.'},
+                  {'access': 'write',
+                   'id': 'native.feature-report-exchange',
+                   'owner': 'bridge',
+                   'profile_kinds': ['child'],
+                   'resource': 'native-control',
+                   'summary': 'Carry one opaque upstream-owned feature report over a qualified receiver child route.'},
                   {'access': 'read',
                    'id': 'presence.passive-evidence',
                    'owner': 'bridge',
@@ -893,7 +899,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca'}
+ 'source_sha256': '68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/README.md b/tests/README.md
index 895e0c3..459d3b6 100644
--- a/tests/README.md
+++ b/tests/README.md
@@ -28,15 +28,17 @@ Holds language-specific, cross-language, fixture, lifecycle, repository-navigati
 - [`tests/test_foundation.py`](test_foundation.py)
 - [`tests/test_repository_experience.py`](test_repository_experience.py)
 - [`tests/test_testgraph.py`](test_testgraph.py)
+- [`tests/test_native_onboarding.py`](test_native_onboarding.py)
+- [`tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json`](fixtures/native-onboarding/viper-ultimate-007b-observation.json)
 
 ## Verification
 
-Run `python-unit` `cpp-sdk-contracts` `rust-unit` after changing this area.
+Run `python-unit` `native-onboarding-contracts` `cpp-sdk-contracts` `rust-unit` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 2 declared projection(s).
-- Run `python-unit`, `cpp-sdk-contracts`, `rust-unit`.
+- Run `python-unit`, `native-onboarding-contracts`, `cpp-sdk-contracts`, `rust-unit`.
 - Review direct consumers: Verification graph.
 
 ## Relationships
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index f68302e..a7009e1 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "5d896228d3392cee30dde3dd43b92d2807329d979863bfb9ccbb353fce5640ca"
+  "source_sha256": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
 }
diff --git a/tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json b/tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json
new file mode 100644
index 0000000..cdfe572
--- /dev/null
+++ b/tests/fixtures/native-onboarding/viper-ultimate-007b-observation.json
@@ -0,0 +1,21 @@
+{
+  "$schema": "https://hyperflux.dev/schemas/native-route-observation-v1.json",
+  "schema": "hyperflux-native-route-observation-v1",
+  "observed_at": "2026-07-25T00:00:00Z",
+  "source": "bridge-native-route-v7",
+  "receiver_generation": 7,
+  "vendor_id": 5426,
+  "product_id": 123,
+  "device_kind": "mouse",
+  "route_kind": "hyperflux-wireless",
+  "route_state": "available",
+  "access": "candidate",
+  "protocol_family": "razer-feature-report-v1",
+  "report_bytes": 90,
+  "privacy": {
+    "serials_included": false,
+    "route_tokens_included": false,
+    "host_paths_included": false,
+    "raw_reports_included": false
+  }
+}
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index d23ac04..34bb102 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -37,10 +37,15 @@
 )
 from hfxdev.openrazer import (
     _ClassCatalog,
+    effective_event_regex,
     load_import_selection,
     load_imported_metadata,
     transformed_metadata,
 )
+from hfxdev.openrazer_native_route import (
+    load_native_route_catalog,
+    transformed_native_route_catalog,
+)
 from hfxdev.generators.integrations import python_openrazer_metadata
 from hfxdev.profiles import load_profile_inputs
 
@@ -217,6 +222,30 @@ def test_openrazer_native_probe_catalog_matches_exact_checkout_when_available(se
             load_native_probe_catalog(ROOT),
         )
 
+    def test_openrazer_native_route_catalog_is_fully_authority_bound(self) -> None:
+        routes = load_native_route_catalog(ROOT)
+        metadata = load_imported_metadata(ROOT)
+        probes = load_native_probe_catalog(ROOT)
+        self.assertEqual(
+            [route["profile_id"] for route in routes["routes"]],
+            [device["profile_id"] for device in metadata["devices"]],
+        )
+        probes_by_profile = {
+            device["profile_id"]: device for device in probes["devices"]
+        }
+        for route in routes["routes"]:
+            direct = probes_by_profile[route["profile_id"]]["direct_usb_reference"]
+            self.assertEqual(route["direct_data_product_ids"], [direct["product_id"]])
+
+    def test_openrazer_native_route_catalog_matches_exact_checkout_when_available(self) -> None:
+        source_value = os.environ.get("HFX_OPENRAZER_SOURCE_DIR")
+        if source_value is None:
+            self.skipTest("HFX_OPENRAZER_SOURCE_DIR is not configured")
+        self.assertEqual(
+            transformed_native_route_catalog(ROOT, Path(source_value)),
+            load_native_route_catalog(ROOT),
+        )
+
     def test_openrazer_native_probe_policy_rejects_unbound_qualification_probe(self) -> None:
         inventory = deepcopy(load_native_method_inventory(ROOT))
         inventory["devices"][0]["qualification_probes"].append("unbound_probe")
@@ -289,6 +318,23 @@ def test_openrazer_ast_import_handles_diamond_inheritance_without_execution(self
             {"METHODS": ["child"], "USB_PID": 2, "USB_VID": 1},
         )
 
+    def test_openrazer_event_matcher_resolves_inheritance_without_execution(self) -> None:
+        with TemporaryDirectory() as directory:
+            path = Path(directory) / "devices.py"
+            path.write_text(
+                "\n".join(
+                    (
+                        "import re",
+                        "class Root:",
+                        "    EVENT_FILE_REGEX = re.compile(r\"root-event\")",
+                        "class Child(Root):",
+                        "    pass",
+                    )
+                ),
+                encoding="utf-8",
+            )
+            self.assertEqual(effective_event_regex(path, "Child"), "root-event")
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_native_onboarding.py b/tests/test_native_onboarding.py
new file mode 100644
index 0000000..2e311f0
--- /dev/null
+++ b/tests/test_native_onboarding.py
@@ -0,0 +1,384 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from copy import deepcopy
+import json
+import os
+from pathlib import Path
+import stat
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import patch
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+
+import hfxdev.native_onboarding as onboarding
+import hfxdev.private_artifact as private_artifact
+from hfxdev.knowledge import load_knowledge_inputs
+from hfxdev.model import ModelError, sha256_file
+from hfxdev.native_onboarding import (
+    build_onboarding_draft,
+    build_promotion_assessment,
+    build_promotion_from_files,
+    load_route_observation,
+    load_onboarding_draft,
+    validate_onboarding_draft,
+    write_onboarding_draft,
+)
+from hfxdev.native_probe import load_native_probe_catalog
+from hfxdev.private_artifact import write_new_private_json
+
+
+REVISION = "1" * 40
+CREATED_AT = "2026-07-25T00:00:01Z"
+
+
+def observation(
+    product_id: int,
+    *,
+    device_kind: str = "mouse",
+    protocol_family: str = "razer-feature-report-v1",
+    report_bytes: int = 90,
+) -> dict:
+    return {
+        "$schema": "https://hyperflux.dev/schemas/native-route-observation-v1.json",
+        "schema": "hyperflux-native-route-observation-v1",
+        "observed_at": "2026-07-25T00:00:00Z",
+        "source": "bridge-native-route-v7",
+        "receiver_generation": 7,
+        "vendor_id": 0x1532,
+        "product_id": product_id,
+        "device_kind": device_kind,
+        "route_kind": "hyperflux-wireless",
+        "route_state": "available",
+        "access": "candidate",
+        "protocol_family": protocol_family,
+        "report_bytes": report_bytes,
+        "privacy": {
+            "serials_included": False,
+            "route_tokens_included": False,
+            "host_paths_included": False,
+            "raw_reports_included": False,
+        },
+    }
+
+
+def passed_parity(profile_id: str, source_revision: str) -> dict:
+    catalog = load_native_probe_catalog(ROOT)
+    device = next(
+        value for value in catalog["devices"] if value["profile_id"] == profile_id
+    )
+    observations = []
+    for probe in device["probes"]:
+        request = probe["request"]
+        observations.append(
+            {
+                "method": probe["method"],
+                "origin": "receiver-route",
+                "comparison": probe["comparison"],
+                "request": {
+                    "sha256": request["normalized_sha256"],
+                    "command_class": request["command_class"],
+                    "command_id": request["command_id"],
+                    "data_size": request["data_size"],
+                    "upstream_signature_matched": True,
+                    "complete_capture": True,
+                    "reconstructed_from_upstream": False,
+                },
+                "response": {
+                    "status": 2,
+                    "structural_match": True,
+                    "complete_capture": True,
+                    "summary": {},
+                },
+                "receiver_comparison": {
+                    "attempts": 1,
+                    "unchanged_request": True,
+                    "standard_response": True,
+                    "semantic_parity": True,
+                },
+            }
+        )
+    required = [probe["method"] for probe in device["probes"]]
+    return {
+        "$schema": "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json",
+        "schema": "hyperflux-native-transport-parity-evidence-v1",
+        "created_at": CREATED_AT,
+        "source_revision": source_revision,
+        "profile_id": profile_id,
+        "upstream_commit": catalog["upstream"]["commit"],
+        "catalog_sha256": sha256_file(
+            ROOT / "integrations" / "openrazer" / "native-probe-catalog.json"
+        ),
+        "safety": {
+            "read_only": True,
+            "settings_changed": False,
+            "serials_persisted": False,
+            "raw_reports_persisted": False,
+            "private_paths_persisted": False,
+            "network_upload": False,
+            "file_mode": "0600",
+        },
+        "observations": observations,
+        "coverage": {
+            "required": required,
+            "passed": required,
+            "missing": [],
+            "failed": [],
+        },
+        "conclusion": "passed",
+    }
+
+
+class NativeOnboardingTests(unittest.TestCase):
+    def draft(self, value: dict) -> dict:
+        return build_onboarding_draft(
+            ROOT,
+            value,
+            created_at=CREATED_AT,
+            source_revision=REVISION,
+        )
+
+    def test_existing_device_is_exact_but_remains_non_writable(self) -> None:
+        draft = self.draft(observation(0x00CD))
+        self.assertEqual(draft["assessment"]["state"], "candidate")
+        self.assertEqual(draft["assessment"]["topology_state"], "agreement")
+        self.assertEqual(
+            draft["assessment"]["existing_profile_id"],
+            "child.razer.basilisk-v3-pro-35k.00cd",
+        )
+        self.assertFalse(draft["assessment"]["writable"])
+        self.assertFalse(
+            draft["candidate_profile"]["native_control"]["write_authority"]
+        )
+
+    def test_second_same_protocol_device_onboards_without_engine_or_map_changes(self) -> None:
+        value = load_route_observation(
+            ROOT
+            / "tests"
+            / "fixtures"
+            / "native-onboarding"
+            / "viper-ultimate-007b-observation.json"
+        )
+        draft = self.draft(value)
+        self.assertEqual(draft["assessment"]["state"], "candidate")
+        self.assertIsNone(draft["assessment"]["existing_profile_id"])
+        self.assertEqual(
+            draft["candidate_profile"]["profile_id"],
+            "child.razer.viper-ultimate.007b",
+        )
+        self.assertEqual(
+            draft["candidate_profile"]["topology"]["state"], "agreement"
+        )
+        self.assertIsNone(
+            draft["candidate_profile"]["topology"]["hyperflux_carrier_map"]
+        )
+        self.assertFalse(draft["promotion_contract"]["engine_changes_allowed"])
+        self.assertIn(
+            "crates/hfx-bridge",
+            draft["promotion_contract"]["immutable_engine_domains"],
+        )
+
+    def test_upstream_topology_disagreement_is_explicit_and_blocking(self) -> None:
+        draft = self.draft(observation(0x00D7))
+        self.assertEqual(draft["assessment"]["state"], "conflicted")
+        self.assertEqual(draft["assessment"]["topology_state"], "conflict")
+        self.assertIn(
+            "upstream-topology-disagreement", draft["assessment"]["reason_codes"]
+        )
+        self.assertEqual(draft["promotion_contract"]["decision"], "blocked")
+
+    def test_different_report_format_stops_as_backend_required(self) -> None:
+        draft = self.draft(
+            observation(0x007B, protocol_family="different-family", report_bytes=64)
+        )
+        self.assertEqual(draft["assessment"]["state"], "backend-required")
+        self.assertFalse(draft["assessment"]["same_protocol"])
+        self.assertEqual(
+            draft["promotion_contract"]["decision"], "backend-required"
+        )
+
+    def test_unknown_and_ambiguous_records_never_become_writable(self) -> None:
+        unknown = self.draft(observation(0x7FFF))
+        self.assertEqual(unknown["assessment"]["state"], "unknown")
+
+        inputs = deepcopy(load_knowledge_inputs(ROOT))
+        duplicate = deepcopy(inputs.source_catalogs["openrazer"]["records"][0])
+        source = next(
+            record
+            for record in inputs.source_catalogs["openrazer"]["records"]
+            if record["usb_identity"] == {"vendor_id": 0x1532, "product_id": 0x007B}
+        )
+        duplicate = deepcopy(source)
+        duplicate["record_id"] = "openrazer:SyntheticDuplicate"
+        duplicate["source_device_key"] = "SyntheticDuplicate"
+        inputs.source_catalogs["openrazer"]["records"].append(duplicate)
+        with patch.object(onboarding, "load_knowledge_inputs", return_value=inputs):
+            ambiguous = self.draft(observation(0x007B))
+        self.assertEqual(ambiguous["assessment"]["state"], "ambiguous")
+        self.assertFalse(ambiguous["assessment"]["writable"])
+
+    def test_private_draft_is_mode_0600_non_overwriting_and_path_safe(self) -> None:
+        draft = self.draft(observation(0x007B))
+        with TemporaryDirectory() as directory:
+            cache = Path(directory) / "cache"
+            destination = write_onboarding_draft(draft, cache_root=cache)
+            self.assertEqual(stat.S_IMODE(destination.stat().st_mode), 0o600)
+            serialized = destination.read_text(encoding="utf-8")
+            self.assertNotIn("/home/", serialized)
+            self.assertNotIn("route_token", serialized)
+            with self.assertRaisesRegex(ModelError, "already exists"):
+                write_onboarding_draft(draft, cache_root=cache)
+
+    def test_private_writer_never_replaces_a_racing_destination(self) -> None:
+        with TemporaryDirectory() as directory:
+            cache = Path(directory)
+            destination = cache / "race.json"
+            original_link = os.link
+
+            def racing_link(source, target, *, follow_symlinks=True):
+                Path(target).write_text("concurrent winner\n", encoding="utf-8")
+                return original_link(
+                    source, target, follow_symlinks=follow_symlinks
+                )
+
+            with patch.object(
+                private_artifact.os, "link", side_effect=racing_link
+            ):
+                with self.assertRaisesRegex(ModelError, "already exists"):
+                    write_new_private_json(cache, "race.json", {"safe": True})
+            self.assertEqual(
+                destination.read_text(encoding="utf-8"), "concurrent winner\n"
+            )
+            self.assertEqual(list(cache.glob(".*.tmp")), [])
+
+    def test_observation_timestamp_and_protocol_family_are_canonical(self) -> None:
+        noncanonical = observation(0x007B)
+        noncanonical["observed_at"] = "2026-7-25T00:00:00Z"
+        with self.assertRaisesRegex(ModelError, "canonical UTC"):
+            self.draft(noncanonical)
+
+        impossible = observation(0x007B)
+        impossible["observed_at"] = "2026-02-30T00:00:00Z"
+        with self.assertRaisesRegex(ModelError, "invalid timestamp"):
+            self.draft(impossible)
+
+        oversized = observation(0x007B, protocol_family="x" * 65)
+        with self.assertRaisesRegex(ModelError, "protocol family is invalid"):
+            self.draft(oversized)
+
+        oversized_utf8 = observation(0x007B, protocol_family="é" * 33)
+        with self.assertRaisesRegex(ModelError, "protocol family is invalid"):
+            self.draft(oversized_utf8)
+
+    def test_input_loaders_reject_symlinks_and_oversized_documents(self) -> None:
+        fixture = (
+            ROOT
+            / "tests"
+            / "fixtures"
+            / "native-onboarding"
+            / "viper-ultimate-007b-observation.json"
+        )
+        with TemporaryDirectory() as directory:
+            base = Path(directory)
+            linked = base / "observation.json"
+            linked.symlink_to(fixture)
+            with self.assertRaisesRegex(ModelError, "symbolic, or unreadable"):
+                load_route_observation(linked)
+
+            oversized = base / "oversized.json"
+            oversized.write_bytes(b"{" + b" " * onboarding.MAX_INPUT_BYTES + b"}")
+            with self.assertRaisesRegex(ModelError, "exceeds"):
+                load_route_observation(oversized)
+
+            draft = self.draft(observation(0x00CD))
+            draft_path = base / "draft.json"
+            draft_path.write_text(json.dumps(draft), encoding="utf-8")
+            self.assertEqual(load_onboarding_draft(draft_path), draft)
+            parity_path = base / "parity.json"
+            parity_path.write_bytes(
+                b"{" + b" " * onboarding.MAX_INPUT_BYTES + b"}"
+            )
+            with self.assertRaisesRegex(ModelError, "native parity evidence exceeds"):
+                build_promotion_from_files(
+                    ROOT,
+                    draft_path,
+                    parity_path,
+                    created_at="2026-07-25T00:00:02Z",
+                    source_revision=REVISION,
+                )
+
+    def test_tampering_cannot_grant_write_authority(self) -> None:
+        draft = self.draft(observation(0x007B))
+        draft["candidate_profile"]["native_control"]["write_authority"] = True
+        with self.assertRaisesRegex(ModelError, "cannot be writable"):
+            validate_onboarding_draft(draft)
+
+    def test_promotion_rederives_the_complete_draft_from_canonical_sources(self) -> None:
+        original = self.draft(observation(0x00CD))
+        parity = passed_parity(
+            "child.razer.basilisk-v3-pro-35k.00cd", REVISION
+        )
+        mutations = (
+            lambda draft: draft["source_bindings"]["openrazer"].__setitem__(
+                "commit", "2" * 40
+            ),
+            lambda draft: draft["candidate_profile"]["identity"].__setitem__(
+                "model_name", "Edited model"
+            ),
+        )
+        for mutate in mutations:
+            with self.subTest(mutation=mutate):
+                draft = deepcopy(original)
+                mutate(draft)
+                with self.assertRaisesRegex(
+                    ModelError, "differs from canonical sources"
+                ):
+                    build_promotion_assessment(
+                        ROOT,
+                        draft,
+                        parity,
+                        created_at="2026-07-25T00:00:02Z",
+                        source_revision=REVISION,
+                    )
+
+    def test_promotion_requires_exact_full_parity_and_never_grants_automatically(self) -> None:
+        draft = self.draft(observation(0x00CD))
+        parity = passed_parity(
+            "child.razer.basilisk-v3-pro-35k.00cd", REVISION
+        )
+        assessment = build_promotion_assessment(
+            ROOT,
+            draft,
+            parity,
+            created_at="2026-07-25T00:00:02Z",
+            source_revision=REVISION,
+        )
+        self.assertEqual(
+            assessment["state"], "ready-for-reviewed-profile-promotion"
+        )
+        self.assertFalse(
+            assessment["change_contract"]["automatic_write_authority_granted"]
+        )
+
+        parity["coverage"]["passed"] = parity["coverage"]["passed"][:-1]
+        parity["coverage"]["missing"] = [parity["coverage"]["required"][-1]]
+        parity["observations"] = parity["observations"][:-1]
+        parity["conclusion"] = "incomplete"
+        blocked = build_promotion_assessment(
+            ROOT,
+            draft,
+            parity,
+            created_at="2026-07-25T00:00:03Z",
+            source_revision=REVISION,
+        )
+        self.assertEqual(blocked["state"], "blocked")
+        self.assertIn("native-parity-not-passed", blocked["reason_codes"])
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tools/README.md b/tools/README.md
index ceea538..d8a6fe5 100644
--- a/tools/README.md
+++ b/tools/README.md
@@ -32,15 +32,18 @@ Provides the single developer CLI, canonical loaders, deterministic generators,
 - [`tools/hfxdev/public_readiness.py`](hfxdev/public_readiness.py)
 - [`tools/hfxdev/local_companion.py`](hfxdev/local_companion.py)
 - [`tools/hfxdev/licensing.py`](hfxdev/licensing.py)
+- [`tools/hfxdev/native_onboarding.py`](hfxdev/native_onboarding.py)
+- [`tools/hfxdev/private_artifact.py`](hfxdev/private_artifact.py)
+- [`tools/hfxdev/openrazer_native_route.py`](hfxdev/openrazer_native_route.py)
 
 ## Verification
 
-Run `python-unit` `generated-freshness` after changing this area.
+Run `python-unit` `native-onboarding-contracts` `generated-freshness` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 1 declared projection(s).
-- Run `python-unit`, `generated-freshness`.
+- Run `python-unit`, `native-onboarding-contracts`, `generated-freshness`.
 - Review direct consumers: Documentation system, Contract tests, Verification graph.
 
 ## Relationships
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 957ff45..6a3b35c 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import argparse
+from datetime import UTC, datetime
 import os
 from pathlib import Path
 import sys
@@ -14,6 +15,12 @@
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
 from .native_control import write_native_method_inventory
+from .native_onboarding import (
+    build_draft_from_file,
+    build_promotion_from_files,
+    write_onboarding_draft,
+    write_promotion_assessment,
+)
 from .native_parity import build_offline_parity_evidence, write_parity_evidence
 from .native_probe import write_native_probe_catalog
 from .distribution_package import build_distribution_package
@@ -23,7 +30,10 @@
 from .github_sync import verify as verify_github
 from .knowledge import import_upstream_catalogs
 from .openrazer import write_imported_metadata
-from .openrazer_native_route import prepare_openrazer_native_source
+from .openrazer_native_route import (
+    prepare_openrazer_native_source,
+    write_native_route_catalog,
+)
 from .openrgb_native_route import prepare_openrgb_native_source
 from .package_pipeline import build_artifacts, stage_rootfs
 from .testgraph import format_plan, load_test_catalog
@@ -131,6 +141,19 @@ def _parser() -> argparse.ArgumentParser:
     )
     native_openrgb.add_argument("--source", required=True, type=Path)
     native_openrgb.add_argument("--output", required=True, type=Path)
+    native_draft = native_commands.add_parser(
+        "draft-profile",
+        help="create a non-writable profile draft from a privacy-safe route observation",
+    )
+    native_draft.add_argument("--observation", required=True, type=Path)
+    native_draft.add_argument("--output-dir", type=Path)
+    native_promote = native_commands.add_parser(
+        "assess-promotion",
+        help="assess whether exact parity evidence permits a profile-only promotion",
+    )
+    native_promote.add_argument("--draft", required=True, type=Path)
+    native_promote.add_argument("--parity", required=True, type=Path)
+    native_promote.add_argument("--output-dir", type=Path)
 
     upstream = commands.add_parser("upstream", help="manage immutable upstream checkouts")
     upstream_commands = upstream.add_subparsers(dest="upstream_command", required=True)
@@ -296,6 +319,13 @@ def main(arguments: list[str] | None = None) -> int:
                 "Imported OpenRazer native probes: "
                 f"{probe_destination.relative_to(root)}"
             )
+            route_destination = write_native_route_catalog(
+                root, args.source.resolve()
+            )
+            print(
+                "Imported OpenRazer native routes: "
+                f"{route_destination.relative_to(root)}"
+            )
             return 0
         if args.command == "knowledge":
             paths = import_upstream_catalogs(
@@ -340,6 +370,42 @@ def main(arguments: list[str] | None = None) -> int:
                 print(f"Prepared OpenRGB source: {prepared.root}")
                 print(f"Source binding: {prepared.result}")
                 return 0
+            timestamp = (
+                datetime.now(UTC)
+                .replace(microsecond=0)
+                .isoformat()
+                .replace("+00:00", "Z")
+            )
+            if args.native_command == "draft-profile":
+                draft = build_draft_from_file(
+                    root,
+                    args.observation,
+                    created_at=timestamp,
+                )
+                destination = write_onboarding_draft(
+                    draft,
+                    cache_root=args.output_dir,
+                )
+                print(f"Native onboarding: {draft['assessment']['state']}")
+                print(f"Candidate profile: {draft['candidate_profile']['profile_id']}")
+                print("Write authority: not granted")
+                print(f"Privacy-safe draft: {destination}")
+                return 0
+            if args.native_command == "assess-promotion":
+                assessment = build_promotion_from_files(
+                    root,
+                    args.draft,
+                    args.parity,
+                    created_at=timestamp,
+                )
+                destination = write_promotion_assessment(
+                    assessment,
+                    cache_root=args.output_dir,
+                )
+                print(f"Native promotion: {assessment['state']}")
+                print("Write authority: not granted automatically")
+                print(f"Privacy-safe assessment: {destination}")
+                return 0
         if args.command == "upstream":
             prepared = prepare_upstreams(root, args.output)
             for identifier in prepared.fetched:
diff --git a/tools/hfxdev/native_onboarding.py b/tools/hfxdev/native_onboarding.py
new file mode 100644
index 0000000..d342bfa
--- /dev/null
+++ b/tools/hfxdev/native_onboarding.py
@@ -0,0 +1,845 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from copy import deepcopy
+from datetime import datetime
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import stat
+import subprocess
+from typing import Any
+
+from .integrations import load_integration_catalog
+from .knowledge import load_knowledge_inputs
+from .model import ModelError, sha256_file
+from .native_parity import validate_parity_evidence
+from .native_probe import load_native_probe_catalog
+from .openrazer_native_route import (
+    NATIVE_PROTOCOL_FAMILY,
+    NATIVE_REPORT_BYTES,
+)
+from .private_artifact import write_new_private_json
+from .profiles import load_profile_inputs
+
+
+OBSERVATION_SCHEMA = "hyperflux-native-route-observation-v1"
+DRAFT_SCHEMA = "hyperflux-native-device-onboarding-draft-v1"
+PROMOTION_SCHEMA = "hyperflux-native-device-promotion-assessment-v1"
+SOURCE_REVISION_PATTERN = re.compile(r"[0-9a-f]{40}\Z")
+PROFILE_ID_PATTERN = re.compile(r"child\.[a-z0-9.-]{1,120}\Z")
+UPSTREAM_IDS = ("openrazer", "openrgb")
+NATIVE_CAPABILITY_ID = "native.feature-report-exchange"
+MAX_INPUT_BYTES = 1024 * 1024
+DRAFT_OBSERVATION_KEYS = {
+    "observed_at",
+    "source",
+    "receiver_generation",
+    "vendor_id",
+    "product_id",
+    "device_kind",
+    "route_kind",
+    "route_state",
+    "access",
+    "protocol_family",
+    "report_bytes",
+}
+ALLOWED_PROMOTION_DOMAINS = (
+    "evidence/native-transport",
+    "generated/profile-projections",
+    "integrations/openrazer/source-bindings",
+    "integrations/openrgb/source-bindings",
+    "profiles/children",
+)
+IMMUTABLE_ENGINE_DOMAINS = (
+    "crates/hfx-bridge",
+    "crates/hfx-kernel-transport",
+    "crates/hfx-sdk",
+    "crates/hfx-uhid-relay",
+    "driver/kernel",
+    "integrations/openrazer/native-route/patches",
+    "integrations/openrgb/native-route/patches",
+    "protocol",
+)
+SAFETY = {
+    "candidate_only": True,
+    "write_authority_granted": False,
+    "serials_persisted": False,
+    "raw_reports_persisted": False,
+    "private_paths_persisted": False,
+    "network_upload": False,
+    "hardware_queried_by_tool": False,
+    "hardware_write_executed": False,
+    "file_mode": "0600",
+}
+
+
+def _exact(value: dict[str, Any], expected: set[str], label: str) -> None:
+    missing = sorted(expected - set(value))
+    extras = sorted(set(value) - expected)
+    if missing:
+        raise ModelError(f"{label}: missing keys: {', '.join(missing)}")
+    if extras:
+        raise ModelError(f"{label}: unsupported keys: {', '.join(extras)}")
+
+
+def _timestamp(value: Any, label: str) -> str:
+    if not isinstance(value, str):
+        raise ModelError(f"{label}: expected canonical UTC")
+    try:
+        parsed = datetime.strptime(value, "%Y-%m-%dT%H:%M:%SZ")
+    except ValueError as error:
+        raise ModelError(f"{label}: invalid timestamp") from error
+    if parsed.strftime("%Y-%m-%dT%H:%M:%SZ") != value:
+        raise ModelError(f"{label}: expected canonical UTC")
+    return value
+
+
+def _revision(value: Any, label: str) -> str:
+    if not isinstance(value, str) or SOURCE_REVISION_PATTERN.fullmatch(value) is None:
+        raise ModelError(f"{label}: expected a 40-character lowercase Git revision")
+    return value
+
+
+def _integer(value: Any, label: str, minimum: int, maximum: int) -> int:
+    if isinstance(value, bool) or not isinstance(value, int) or not minimum <= value <= maximum:
+        raise ModelError(f"{label}: expected an integer from {minimum} through {maximum}")
+    return value
+
+
+def _canonical_digest(value: Any) -> str:
+    payload = json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+    return hashlib.sha256(payload.encode()).hexdigest()
+
+
+def _load_bounded_json(path: Path, label: str) -> dict[str, Any]:
+    flags = os.O_RDONLY
+    if hasattr(os, "O_CLOEXEC"):
+        flags |= os.O_CLOEXEC
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    descriptor = -1
+    try:
+        descriptor = os.open(path, flags)
+        metadata = os.fstat(descriptor)
+        if not stat.S_ISREG(metadata.st_mode):
+            raise ModelError(f"{label} is not a regular file")
+        if metadata.st_size > MAX_INPUT_BYTES:
+            raise ModelError(f"{label} exceeds {MAX_INPUT_BYTES} bytes")
+        with os.fdopen(descriptor, "rb", closefd=True) as source:
+            descriptor = -1
+            payload = source.read(MAX_INPUT_BYTES + 1)
+    except ModelError:
+        raise
+    except OSError as error:
+        raise ModelError(f"{label} is missing, symbolic, or unreadable") from error
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+    if len(payload) > MAX_INPUT_BYTES:
+        raise ModelError(f"{label} exceeds {MAX_INPUT_BYTES} bytes")
+    try:
+        value = json.loads(payload)
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise ModelError(f"{label} is not valid JSON") from error
+    if not isinstance(value, dict):
+        raise ModelError(f"{label} root must be an object")
+    return value
+
+
+def _git_revision(root: Path) -> str:
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=root,
+            check=True,
+            capture_output=True,
+            text=True,
+            timeout=10,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot identify onboarding source revision: {error}") from error
+    return _revision(result.stdout.strip(), "onboarding source revision")
+
+
+def validate_route_observation(value: dict[str, Any]) -> None:
+    _exact(
+        value,
+        {
+            "$schema",
+            "schema",
+            "observed_at",
+            "source",
+            "receiver_generation",
+            "vendor_id",
+            "product_id",
+            "device_kind",
+            "route_kind",
+            "route_state",
+            "access",
+            "protocol_family",
+            "report_bytes",
+            "privacy",
+        },
+        "native route observation",
+    )
+    if value["$schema"] != "https://hyperflux.dev/schemas/native-route-observation-v1.json":
+        raise ModelError("native route observation schema reference is not canonical")
+    if value["schema"] != OBSERVATION_SCHEMA:
+        raise ModelError("unsupported native route observation schema")
+    _timestamp(value["observed_at"], "native route observation timestamp")
+    if value["source"] != "bridge-native-route-v7":
+        raise ModelError("native route observation does not come from protocol v7")
+    _integer(value["receiver_generation"], "receiver generation", 1, 2**64 - 1)
+    _integer(value["vendor_id"], "native route vendor id", 0, 65535)
+    _integer(value["product_id"], "native route product id", 0, 65535)
+    if value["device_kind"] not in {"mouse", "keyboard"}:
+        raise ModelError("native route observation device kind is unsupported")
+    if value["route_kind"] != "hyperflux-wireless":
+        raise ModelError("native route observation is not receiver-backed")
+    if value["route_state"] not in {"available", "stale", "unavailable", "unknown"}:
+        raise ModelError("native route observation state is invalid")
+    if value["access"] not in {"candidate", "qualified", "backend-required"}:
+        raise ModelError("native route observation access is invalid")
+    if (
+        not isinstance(value["protocol_family"], str)
+        or not 1 <= len(value["protocol_family"].encode("utf-8")) <= 64
+    ):
+        raise ModelError("native route observation protocol family is invalid")
+    _integer(value["report_bytes"], "native route report bytes", 1, 4096)
+    if value["privacy"] != {
+        "serials_included": False,
+        "route_tokens_included": False,
+        "host_paths_included": False,
+        "raw_reports_included": False,
+    }:
+        raise ModelError("native route observation privacy declaration is invalid")
+
+
+def load_route_observation(path: Path) -> dict[str, Any]:
+    value = _load_bounded_json(path, "native route observation")
+    validate_route_observation(value)
+    return value
+
+
+def _route_observation_from_draft(value: Any) -> dict[str, Any]:
+    if not isinstance(value, dict):
+        raise ModelError("native onboarding draft observation is invalid")
+    _exact(value, DRAFT_OBSERVATION_KEYS, "native onboarding draft observation")
+    observation = {
+        "$schema": "https://hyperflux.dev/schemas/native-route-observation-v1.json",
+        "schema": OBSERVATION_SCHEMA,
+        **deepcopy(value),
+        "privacy": {
+            "serials_included": False,
+            "route_tokens_included": False,
+            "host_paths_included": False,
+            "raw_reports_included": False,
+        },
+    }
+    validate_route_observation(observation)
+    return observation
+
+
+def _matching_records(
+    records: list[dict[str, Any]], observation: dict[str, Any]
+) -> list[dict[str, Any]]:
+    return [
+        deepcopy(record)
+        for record in records
+        if record["usb_identity"]
+        == {
+            "vendor_id": observation["vendor_id"],
+            "product_id": observation["product_id"],
+        }
+        and record["device_kind"] == observation["device_kind"]
+    ]
+
+
+def _source_binding(
+    root: Path,
+    upstream_id: str,
+    catalog: dict[str, Any],
+    observation: dict[str, Any],
+) -> dict[str, Any]:
+    matches = _matching_records(catalog["records"], observation)
+    return {
+        "upstream_id": upstream_id,
+        "commit": catalog["source"]["commit"],
+        "catalog_sha256": sha256_file(
+            root / "knowledge" / "upstreams" / f"{upstream_id}.json"
+        ),
+        "match_state": (
+            "absent" if not matches else "exact" if len(matches) == 1 else "ambiguous"
+        ),
+        "records": matches,
+    }
+
+
+def _topology(record: dict[str, Any] | None) -> dict[str, Any] | None:
+    if record is None or not isinstance(record.get("lighting_topology"), dict):
+        return None
+    source = record["lighting_topology"]
+    dimensions = source.get("matrix_dimensions")
+    if isinstance(dimensions, list) and len(dimensions) == 2:
+        rows, columns = dimensions
+        slots = rows * columns
+    else:
+        rows = source.get("rows")
+        columns = source.get("columns")
+        slots = source.get("application_slot_count")
+    return {
+        "rows": rows if isinstance(rows, int) else None,
+        "columns": columns if isinstance(columns, int) else None,
+        "application_slot_count": slots if isinstance(slots, int) else None,
+        "layout_key": source.get("layout_key"),
+        "zones": deepcopy(source.get("zones", [])),
+    }
+
+
+def _topology_assessment(bindings: dict[str, dict[str, Any]]) -> tuple[str, list[str]]:
+    exact = {
+        upstream_id: binding["records"][0]
+        for upstream_id, binding in bindings.items()
+        if binding["match_state"] == "exact"
+    }
+    if len(exact) < 2:
+        return ("partial" if exact else "unavailable", [])
+    values = {upstream_id: _topology(record) for upstream_id, record in exact.items()}
+    comparable = {
+        upstream_id: (
+            value["rows"], value["columns"], value["application_slot_count"]
+        )
+        for upstream_id, value in values.items()
+        if value is not None
+    }
+    if len(comparable) < 2:
+        return "partial", []
+    distinct = set(comparable.values())
+    if len(distinct) == 1:
+        return "agreement", []
+    return (
+        "conflict",
+        [
+            "topology:"
+            + upstream_id
+            + ":"
+            + "x".join("unknown" if item is None else str(item) for item in value)
+            for upstream_id, value in sorted(comparable.items())
+        ],
+    )
+
+
+def _existing_profile(root: Path, observation: dict[str, Any]) -> str | None:
+    matches = [
+        profile["profile_id"]
+        for profile in load_profile_inputs(root).profiles
+        if profile["kind"] == "child"
+        and profile["device_kind"] == observation["device_kind"]
+        and profile["identity"].get("vendor_id") == observation["vendor_id"]
+        and profile["identity"].get("product_id") == observation["product_id"]
+    ]
+    if len(matches) > 1:
+        raise ModelError("multiple child profiles claim the observed native identity")
+    return matches[0] if matches else None
+
+
+def _slug(model_name: str) -> str:
+    value = re.sub(r"\(wireless\)", "", model_name, flags=re.IGNORECASE)
+    value = re.sub(r"^razer\s+", "", value.strip(), flags=re.IGNORECASE)
+    value = re.sub(r"[^a-z0-9]+", "-", value.lower()).strip("-")
+    if not value:
+        raise ModelError("cannot derive a candidate profile identifier")
+    return value[:96].rstrip("-")
+
+
+def _profile_proposal(
+    root: Path,
+    observation: dict[str, Any],
+    bindings: dict[str, dict[str, Any]],
+    existing_profile_id: str | None,
+    topology_state: str,
+) -> dict[str, Any]:
+    exact_records = [
+        binding["records"][0]
+        for binding in bindings.values()
+        if binding["match_state"] == "exact"
+    ]
+    preferred = next(
+        (record for record in exact_records if record["record_id"].startswith("openrgb:")),
+        exact_records[0] if exact_records else None,
+    )
+    model_name = (
+        preferred["model_name"]
+        if preferred is not None
+        else f"Razer device {observation['product_id']:04X}"
+    )
+    profile_id = existing_profile_id or (
+        f"child.razer.{_slug(model_name)}.{observation['product_id']:04x}"
+    )
+    if PROFILE_ID_PATTERN.fullmatch(profile_id) is None:
+        raise ModelError("generated candidate profile identifier is invalid")
+    openrgb = bindings["openrgb"]
+    presentation = None
+    if openrgb["match_state"] == "exact":
+        record = openrgb["records"][0]
+        upstreams = {
+            value["id"]: value for value in load_integration_catalog(root)["upstreams"]
+        }
+        authority = upstreams["openrgb"]
+        topology = record.get("lighting_topology") or {}
+        presentation = {
+            "upstream_id": "openrgb",
+            "owner": authority["name"],
+            "project_version": authority["version"],
+            "source_commit": authority["commit"],
+            "model_key": record["source_device_key"],
+            "layout_key": topology.get("layout_key"),
+            "transport_variant": "wireless",
+        }
+    return {
+        "profile_id": profile_id,
+        "revision": 1 if existing_profile_id is None else None,
+        "kind": "child",
+        "device_kind": observation["device_kind"],
+        "identity": {
+            "manufacturer": "Razer",
+            "model_name": model_name,
+            "authority": "paired-product-id",
+            "vendor_id": observation["vendor_id"],
+            "product_id": observation["product_id"],
+        },
+        "compatibility": {
+            "receiver_protocols": ["razer-hyperflux-v2"],
+            "routes": ["hyperflux-wireless"],
+            "required_sibling_kinds": [],
+        },
+        "presentation": presentation,
+        "upstream_record_ids": sorted(
+            record["record_id"] for record in exact_records
+        ),
+        "native_control": {
+            "protocol_family": observation["protocol_family"],
+            "report_bytes": observation["report_bytes"],
+            "capability_id": NATIVE_CAPABILITY_ID,
+            "support_level": "candidate",
+            "write_authority": False,
+        },
+        "topology": {
+            "authority": "upstream",
+            "state": topology_state,
+            "hyperflux_carrier_map": None,
+        },
+        "required_evidence": [
+            "exact-upstream-identity",
+            "native-read-only-parity",
+            "native-reversible-write-parity",
+            "direct-usb-precedence",
+            "lifecycle-and-sibling-isolation",
+        ],
+        "restrictions": [
+            "This draft grants no native write authority.",
+            "Another PID, route kind, or report format inherits nothing.",
+            "Upstream topology remains authoritative; HyperFlux generates no LED carrier map.",
+        ],
+    }
+
+
+def build_onboarding_draft(
+    root: Path,
+    observation: dict[str, Any],
+    *,
+    created_at: str,
+    source_revision: str,
+) -> dict[str, Any]:
+    validate_route_observation(observation)
+    _timestamp(created_at, "onboarding draft timestamp")
+    _revision(source_revision, "onboarding draft source revision")
+    inputs = load_knowledge_inputs(root)
+    bindings = {
+        upstream_id: _source_binding(
+            root,
+            upstream_id,
+            inputs.source_catalogs[upstream_id],
+            observation,
+        )
+        for upstream_id in UPSTREAM_IDS
+    }
+    same_protocol = (
+        observation["protocol_family"] == NATIVE_PROTOCOL_FAMILY
+        and observation["report_bytes"] == NATIVE_REPORT_BYTES
+    )
+    topology_state, topology_reasons = _topology_assessment(bindings)
+    match_states = {binding["match_state"] for binding in bindings.values()}
+    reasons: list[str] = list(topology_reasons)
+    if not same_protocol or observation["access"] == "backend-required":
+        state = "backend-required"
+        reasons.append(
+            "different-native-report-format"
+            if not same_protocol
+            else "bridge-classified-backend-required"
+        )
+    elif "ambiguous" in match_states:
+        state = "ambiguous"
+        reasons.append("multiple-exact-upstream-records")
+    elif all(binding["match_state"] == "absent" for binding in bindings.values()):
+        state = "unknown"
+        reasons.append("no-exact-upstream-record")
+    elif any(binding["match_state"] == "absent" for binding in bindings.values()):
+        state = "partial"
+        reasons.append("one-upstream-catalog-has-no-exact-record")
+    elif any(
+        binding["records"][0]["source_route"] != "vendor-wireless-receiver"
+        for binding in bindings.values()
+    ):
+        state = "conflicted"
+        reasons.append("upstream-route-is-not-wireless-receiver")
+    elif topology_state == "conflict":
+        state = "conflicted"
+        reasons.append("upstream-topology-disagreement")
+    else:
+        state = "candidate"
+    existing_profile_id = _existing_profile(root, observation)
+    profile = _profile_proposal(
+        root, observation, bindings, existing_profile_id, topology_state
+    )
+    draft = {
+        "$schema": "https://hyperflux.dev/schemas/native-device-onboarding-draft-v1.json",
+        "schema": DRAFT_SCHEMA,
+        "created_at": created_at,
+        "source_revision": source_revision,
+        "observation": {
+            key: deepcopy(observation[key])
+            for key in (
+                "observed_at",
+                "source",
+                "receiver_generation",
+                "vendor_id",
+                "product_id",
+                "device_kind",
+                "route_kind",
+                "route_state",
+                "access",
+                "protocol_family",
+                "report_bytes",
+            )
+        },
+        "source_bindings": bindings,
+        "assessment": {
+            "state": state,
+            "reason_codes": sorted(set(reasons)),
+            "same_protocol": same_protocol,
+            "identity_state": (
+                "agreement"
+                if all(binding["match_state"] == "exact" for binding in bindings.values())
+                else "partial"
+                if any(binding["match_state"] == "exact" for binding in bindings.values())
+                else "unresolved"
+            ),
+            "topology_state": topology_state,
+            "existing_profile_id": existing_profile_id,
+            "writable": False,
+        },
+        "candidate_profile": profile,
+        "promotion_contract": {
+            "decision": (
+                "profile-only-candidate"
+                if state == "candidate"
+                else "backend-required"
+                if state == "backend-required"
+                else "blocked"
+            ),
+            "engine_changes_allowed": False,
+            "allowed_domains": list(ALLOWED_PROMOTION_DOMAINS),
+            "immutable_engine_domains": list(IMMUTABLE_ENGINE_DOMAINS),
+        },
+        "safety": deepcopy(SAFETY),
+    }
+    validate_onboarding_draft(draft)
+    return draft
+
+
+def validate_onboarding_draft(value: dict[str, Any]) -> None:
+    _exact(
+        value,
+        {
+            "$schema",
+            "schema",
+            "created_at",
+            "source_revision",
+            "observation",
+            "source_bindings",
+            "assessment",
+            "candidate_profile",
+            "promotion_contract",
+            "safety",
+        },
+        "native onboarding draft",
+    )
+    if value["$schema"] != "https://hyperflux.dev/schemas/native-device-onboarding-draft-v1.json":
+        raise ModelError("native onboarding draft schema reference is not canonical")
+    if value["schema"] != DRAFT_SCHEMA:
+        raise ModelError("unsupported native onboarding draft schema")
+    _timestamp(value["created_at"], "native onboarding draft timestamp")
+    _revision(value["source_revision"], "native onboarding draft source revision")
+    _route_observation_from_draft(value["observation"])
+    if not isinstance(value["source_bindings"], dict) or set(value["source_bindings"]) != set(UPSTREAM_IDS):
+        raise ModelError("native onboarding draft source bindings are incomplete")
+    assessment = value["assessment"]
+    if not isinstance(assessment, dict) or assessment.get("state") not in {
+        "candidate",
+        "partial",
+        "conflicted",
+        "ambiguous",
+        "unknown",
+        "backend-required",
+    }:
+        raise ModelError("native onboarding draft assessment is invalid")
+    if assessment.get("writable") is not False:
+        raise ModelError("native onboarding draft cannot grant write authority")
+    profile = value["candidate_profile"]
+    if not isinstance(profile, dict) or PROFILE_ID_PATTERN.fullmatch(
+        str(profile.get("profile_id", ""))
+    ) is None:
+        raise ModelError("native onboarding draft profile identifier is invalid")
+    native = profile.get("native_control")
+    if not isinstance(native, dict) or native.get("write_authority") is not False:
+        raise ModelError("native onboarding profile proposal cannot be writable")
+    contract = value["promotion_contract"]
+    if (
+        not isinstance(contract, dict)
+        or contract.get("engine_changes_allowed") is not False
+        or contract.get("allowed_domains") != list(ALLOWED_PROMOTION_DOMAINS)
+        or contract.get("immutable_engine_domains") != list(IMMUTABLE_ENGINE_DOMAINS)
+    ):
+        raise ModelError("native onboarding promotion boundary is invalid")
+    if value["safety"] != SAFETY:
+        raise ModelError("native onboarding safety declaration is invalid")
+    forbidden = {
+        "serial",
+        "serial_value",
+        "route_token",
+        "raw_report",
+        "request_bytes",
+        "response_bytes",
+        "host_path",
+    }
+
+    def walk(item: Any) -> None:
+        if isinstance(item, dict):
+            if forbidden & set(item):
+                raise ModelError("native onboarding draft contains forbidden private material")
+            for child in item.values():
+                walk(child)
+        elif isinstance(item, list):
+            for child in item:
+                walk(child)
+        elif isinstance(item, str) and item.startswith("/home/"):
+            raise ModelError("native onboarding draft contains a private path")
+
+    walk(value)
+
+
+def load_onboarding_draft(path: Path) -> dict[str, Any]:
+    value = _load_bounded_json(path, "native onboarding draft")
+    validate_onboarding_draft(value)
+    return value
+
+
+def _cache_root() -> Path:
+    base = Path(os.environ.get("XDG_CACHE_HOME", Path.home() / ".cache")).expanduser()
+    return base / "hyperflux-next" / "native-onboarding"
+
+
+def write_onboarding_draft(
+    value: dict[str, Any], *, cache_root: Path | None = None
+) -> Path:
+    validate_onboarding_draft(value)
+    stamp = re.sub(r"[^0-9TZ]", "", value["created_at"])
+    profile = value["candidate_profile"]["profile_id"]
+    return write_new_private_json(
+        cache_root or _cache_root(), f"{stamp}-{profile}.json", value
+    )
+
+
+def build_promotion_assessment(
+    root: Path,
+    draft: dict[str, Any],
+    parity_evidence: dict[str, Any],
+    *,
+    created_at: str,
+    source_revision: str,
+) -> dict[str, Any]:
+    validate_onboarding_draft(draft)
+    canonical_draft = build_onboarding_draft(
+        root,
+        _route_observation_from_draft(draft["observation"]),
+        created_at=draft["created_at"],
+        source_revision=draft["source_revision"],
+    )
+    if canonical_draft != draft:
+        raise ModelError("native onboarding draft differs from canonical sources")
+    validate_parity_evidence(parity_evidence)
+    _timestamp(created_at, "native promotion timestamp")
+    _revision(source_revision, "native promotion source revision")
+    reasons: list[str] = []
+    draft_state = draft["assessment"]["state"]
+    profile_id = draft["candidate_profile"]["profile_id"]
+    if draft_state != "candidate":
+        reasons.append(f"onboarding-{draft_state}")
+    if source_revision != draft["source_revision"]:
+        reasons.append("assessment-source-revision-mismatch")
+    if parity_evidence["profile_id"] != profile_id:
+        reasons.append("parity-profile-mismatch")
+    if parity_evidence["source_revision"] != draft["source_revision"]:
+        reasons.append("source-revision-mismatch")
+    if parity_evidence["upstream_commit"] != draft["source_bindings"]["openrazer"]["commit"]:
+        reasons.append("openrazer-commit-mismatch")
+    probe_catalog = load_native_probe_catalog(root)
+    probe_digest = sha256_file(
+        root / "integrations" / "openrazer" / "native-probe-catalog.json"
+    )
+    if parity_evidence["catalog_sha256"] != probe_digest:
+        reasons.append("native-probe-catalog-mismatch")
+    if parity_evidence["conclusion"] != "passed":
+        reasons.append("native-parity-not-passed")
+    probe_profiles = [
+        device for device in probe_catalog["devices"] if device["profile_id"] == profile_id
+    ]
+    if len(probe_profiles) != 1:
+        reasons.append("native-probe-profile-missing")
+    else:
+        expected_methods = [probe["method"] for probe in probe_profiles[0]["probes"]]
+        coverage = parity_evidence["coverage"]
+        if (
+            coverage["required"] != expected_methods
+            or coverage["passed"] != expected_methods
+            or coverage["missing"]
+            or coverage["failed"]
+        ):
+            reasons.append("native-parity-coverage-incomplete")
+    if draft_state == "backend-required" or parity_evidence["conclusion"] == "backend-required":
+        state = "backend-required"
+    elif draft_state != "candidate" or reasons:
+        state = "blocked"
+    else:
+        state = "ready-for-reviewed-profile-promotion"
+    assessment = {
+        "$schema": "https://hyperflux.dev/schemas/native-device-promotion-assessment-v1.json",
+        "schema": PROMOTION_SCHEMA,
+        "created_at": created_at,
+        "source_revision": source_revision,
+        "draft_sha256": _canonical_digest(draft),
+        "profile_id": profile_id,
+        "state": state,
+        "reason_codes": sorted(set(reasons)),
+        "evidence_bindings": {
+            "onboarding_source_revision": draft["source_revision"],
+            "parity_source_revision": parity_evidence["source_revision"],
+            "openrazer_commit": parity_evidence["upstream_commit"],
+            "native_probe_catalog_sha256": parity_evidence["catalog_sha256"],
+            "parity_conclusion": parity_evidence["conclusion"],
+        },
+        "change_contract": {
+            "engine_changes_allowed": False,
+            "allowed_domains": list(ALLOWED_PROMOTION_DOMAINS),
+            "immutable_engine_domains": list(IMMUTABLE_ENGINE_DOMAINS),
+            "automatic_write_authority_granted": False,
+        },
+        "safety": deepcopy(SAFETY),
+    }
+    validate_promotion_assessment(assessment)
+    return assessment
+
+
+def validate_promotion_assessment(value: dict[str, Any]) -> None:
+    _exact(
+        value,
+        {
+            "$schema",
+            "schema",
+            "created_at",
+            "source_revision",
+            "draft_sha256",
+            "profile_id",
+            "state",
+            "reason_codes",
+            "evidence_bindings",
+            "change_contract",
+            "safety",
+        },
+        "native promotion assessment",
+    )
+    if value["$schema"] != "https://hyperflux.dev/schemas/native-device-promotion-assessment-v1.json":
+        raise ModelError("native promotion assessment schema reference is not canonical")
+    if value["schema"] != PROMOTION_SCHEMA:
+        raise ModelError("unsupported native promotion assessment schema")
+    _timestamp(value["created_at"], "native promotion timestamp")
+    _revision(value["source_revision"], "native promotion source revision")
+    if PROFILE_ID_PATTERN.fullmatch(str(value["profile_id"])) is None:
+        raise ModelError("native promotion profile identifier is invalid")
+    if value["state"] not in {
+        "ready-for-reviewed-profile-promotion",
+        "blocked",
+        "backend-required",
+    }:
+        raise ModelError("native promotion state is invalid")
+    contract = value["change_contract"]
+    if (
+        not isinstance(contract, dict)
+        or contract.get("engine_changes_allowed") is not False
+        or contract.get("automatic_write_authority_granted") is not False
+        or contract.get("allowed_domains") != list(ALLOWED_PROMOTION_DOMAINS)
+        or contract.get("immutable_engine_domains") != list(IMMUTABLE_ENGINE_DOMAINS)
+    ):
+        raise ModelError("native promotion change boundary is invalid")
+    if value["safety"] != SAFETY:
+        raise ModelError("native promotion safety declaration is invalid")
+
+
+def write_promotion_assessment(
+    value: dict[str, Any], *, cache_root: Path | None = None
+) -> Path:
+    validate_promotion_assessment(value)
+    stamp = re.sub(r"[^0-9TZ]", "", value["created_at"])
+    return write_new_private_json(
+        cache_root or _cache_root(),
+        f"{stamp}-{value['profile_id']}-promotion.json",
+        value,
+    )
+
+
+def build_draft_from_file(
+    root: Path,
+    observation_path: Path,
+    *,
+    created_at: str,
+    source_revision: str | None = None,
+) -> dict[str, Any]:
+    return build_onboarding_draft(
+        root,
+        load_route_observation(observation_path),
+        created_at=created_at,
+        source_revision=source_revision or _git_revision(root),
+    )
+
+
+def build_promotion_from_files(
+    root: Path,
+    draft_path: Path,
+    parity_path: Path,
+    *,
+    created_at: str,
+    source_revision: str | None = None,
+) -> dict[str, Any]:
+    parity = _load_bounded_json(parity_path, "native parity evidence")
+    return build_promotion_assessment(
+        root,
+        load_onboarding_draft(draft_path),
+        parity,
+        created_at=created_at,
+        source_revision=source_revision or _git_revision(root),
+    )
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index 4f481bc..59b65e6 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -16,6 +16,7 @@
 
 from .model import ModelError, sha256_file
 from .native_probe import REPORT_SIZE, load_native_probe_catalog
+from .private_artifact import write_new_private_json
 
 
 EVIDENCE_SCHEMA = "hyperflux-native-transport-parity-evidence-v1"
@@ -881,44 +882,10 @@ def write_parity_evidence(
     cache_root: Path | None = None,
 ) -> Path:
     validate_parity_evidence(value)
-    base_value = cache_root if cache_root is not None else _default_cache_root()
-    if base_value.exists() and base_value.is_symlink():
-        raise ModelError("native parity cache root may not be a symbolic link")
-    base = base_value.expanduser().resolve()
-    base.mkdir(parents=True, mode=0o700, exist_ok=True)
-    try:
-        base.chmod(0o700)
-    except OSError as error:
-        raise ModelError(f"cannot secure native parity cache root: {error}") from error
     stamp = re.sub(r"[^0-9TZ]", "", value["created_at"])
     profile = re.sub(r"[^a-z0-9.-]", "-", value["profile_id"])
-    destination = base / f"{stamp}-{profile}.json"
-    if destination.exists() or destination.is_symlink():
-        raise ModelError("native parity evidence destination already exists")
-    temporary = base / f".{destination.name}.{secrets.token_hex(8)}.tmp"
-    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
-    if hasattr(os, "O_NOFOLLOW"):
-        flags |= os.O_NOFOLLOW
-    payload = (json.dumps(value, indent=2, ensure_ascii=True) + "\n").encode()
-    descriptor = -1
-    try:
-        descriptor = os.open(temporary, flags, 0o600)
-        with os.fdopen(descriptor, "wb", closefd=True) as output:
-            descriptor = -1
-            output.write(payload)
-            output.flush()
-            os.fsync(output.fileno())
-        os.replace(temporary, destination)
-        destination.chmod(0o600)
-        directory = os.open(base, os.O_RDONLY | os.O_DIRECTORY)
-        try:
-            os.fsync(directory)
-        finally:
-            os.close(directory)
-    except OSError as error:
-        raise ModelError(f"cannot write native parity evidence: {error}") from error
-    finally:
-        if descriptor >= 0:
-            os.close(descriptor)
-        temporary.unlink(missing_ok=True)
-    return destination
+    return write_new_private_json(
+        cache_root if cache_root is not None else _default_cache_root(),
+        f"{stamp}-{profile}.json",
+        value,
+    )
diff --git a/tools/hfxdev/openrazer.py b/tools/hfxdev/openrazer.py
index ba30373..c75965a 100644
--- a/tools/hfxdev/openrazer.py
+++ b/tools/hfxdev/openrazer.py
@@ -551,6 +551,58 @@ def _catalog_route(class_name: str, docstring: str) -> str:
     return "direct-usb"
 
 
+def effective_event_regex(source: Path, class_name: str) -> str:
+    """Resolve one OpenRazer class's inherited event matcher without execution."""
+
+    try:
+        tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+    except (OSError, SyntaxError) as error:
+        raise ModelError(f"cannot parse OpenRazer event matcher source: {error}") from error
+    classes = {
+        node.name: node
+        for node in tree.body
+        if isinstance(node, ast.ClassDef)
+    }
+
+    def resolve(name: str, visited: set[str]) -> str | None:
+        if name in visited:
+            raise ModelError("OpenRazer event matcher inheritance contains a cycle")
+        node = classes.get(name)
+        if node is None:
+            return None
+        visited = {*visited, name}
+        for statement in node.body:
+            if not isinstance(statement, ast.Assign) or not any(
+                isinstance(target, ast.Name) and target.id == "EVENT_FILE_REGEX"
+                for target in statement.targets
+            ):
+                continue
+            value = statement.value
+            if (
+                isinstance(value, ast.Call)
+                and isinstance(value.func, ast.Attribute)
+                and isinstance(value.func.value, ast.Name)
+                and value.func.value.id == "re"
+                and value.func.attr == "compile"
+                and len(value.args) == 1
+                and isinstance(value.args[0], ast.Constant)
+                and isinstance(value.args[0].value, str)
+            ):
+                return value.args[0].value
+            raise ModelError(f"OpenRazer class {name} has an unsupported event matcher")
+        for base in node.bases:
+            if isinstance(base, ast.Name):
+                inherited = resolve(base.id, visited)
+                if inherited is not None:
+                    return inherited
+        return None
+
+    result = resolve(class_name, set())
+    if result is None:
+        raise ModelError(f"OpenRazer class {class_name} has no effective event matcher")
+    return result
+
+
 def extract_openrazer_catalog(
     source_root: Path,
     *,
diff --git a/tools/hfxdev/openrazer_native_route.py b/tools/hfxdev/openrazer_native_route.py
index d5e507a..4744414 100644
--- a/tools/hfxdev/openrazer_native_route.py
+++ b/tools/hfxdev/openrazer_native_route.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from dataclasses import dataclass
+import hashlib
 import json
 import os
 from pathlib import Path, PurePosixPath
@@ -13,11 +14,21 @@
 from typing import Any
 
 from .integrations import upstream_index
+from .native_probe import (
+    load_native_probe_catalog,
+    transformed_native_probe_catalog,
+)
 from .model import ModelError, load_json, require_unique, sha256_file
+from .openrazer import (
+    effective_event_regex,
+    load_imported_metadata,
+    transformed_metadata,
+)
 
 
 TRANSFORM_SCHEMA = "hyperflux-openrazer-native-transform-v1"
 DEPLOYMENT_SCHEMA = "hyperflux-openrazer-native-deployment-v1"
+CATALOG_SCHEMA = "hyperflux-openrazer-native-route-catalog-v1"
 TRANSFORM_KEYS = {"$schema", "schema", "upstream", "patch", "files"}
 DEPLOYMENT_KEYS = {"$schema", "schema", "relay", "driver"}
 RELAY_KEYS = {"executable_path", "service_unit", "uhid_device", "restart_seconds"}
@@ -25,6 +36,37 @@
 UPSTREAM_KEYS = {"id", "repository", "commit"}
 PATCH_KEYS = {"path", "sha256"}
 FILE_KEYS = {"path", "source_sha256", "transformed_sha256"}
+CATALOG_KEYS = {
+    "$schema",
+    "schema",
+    "upstream_commit",
+    "metadata_sha256",
+    "transport",
+    "routes",
+}
+CATALOG_TRANSPORT_KEYS = {
+    "protocol_family",
+    "report_bytes",
+    "phys_prefix",
+    "descriptor_hex",
+    "descriptor_sha256",
+}
+CATALOG_ROUTE_KEYS = {
+    "profile_id",
+    "vendor_id",
+    "wireless_product_id",
+    "model_name",
+    "device_kind",
+    "driver_family",
+    "source",
+    "direct_data_product_ids",
+    "event_file_regex",
+}
+CATALOG_SOURCE_KEYS = {"path", "class_name", "sha256"}
+NATIVE_DESCRIPTOR_HEX = "0600ff0901a101150026ff007508955ab102c0"
+NATIVE_PROTOCOL_FAMILY = "razer-feature-report-v1"
+NATIVE_REPORT_BYTES = 90
+NATIVE_PHYS_PREFIX = "hyperflux-next/native/v1/"
 
 
 @dataclass(frozen=True)
@@ -58,6 +100,180 @@ class OpenRazerNativeDeployment:
     driver: OpenRazerDriverDeployment
 
 
+def _json_payload(value: dict[str, Any]) -> bytes:
+    return (json.dumps(value, indent=2, ensure_ascii=True) + "\n").encode()
+
+
+def _native_transport() -> dict[str, Any]:
+    descriptor = bytes.fromhex(NATIVE_DESCRIPTOR_HEX)
+    return {
+        "protocol_family": NATIVE_PROTOCOL_FAMILY,
+        "report_bytes": NATIVE_REPORT_BYTES,
+        "phys_prefix": NATIVE_PHYS_PREFIX,
+        "descriptor_hex": NATIVE_DESCRIPTOR_HEX,
+        "descriptor_sha256": hashlib.sha256(descriptor).hexdigest(),
+    }
+
+
+def _route_catalog_from_authorities(
+    metadata: dict[str, Any],
+    probes: dict[str, Any],
+    source_root: Path,
+) -> dict[str, Any]:
+    if metadata["upstream"]["commit"] != probes["upstream"]["commit"]:
+        raise ModelError("OpenRazer native route authorities use different commits")
+    if probes["report_size"] != NATIVE_REPORT_BYTES:
+        raise ModelError("OpenRazer native route report size differs from the transport")
+    probes_by_profile = {
+        device["profile_id"]: device for device in probes["devices"]
+    }
+    routes: list[dict[str, Any]] = []
+    for device in metadata["devices"]:
+        profile_id = device["profile_id"]
+        probe = probes_by_profile.get(profile_id)
+        if probe is None:
+            raise ModelError(f"OpenRazer native route {profile_id} has no probe authority")
+        identity = device["identity"]
+        direct = probe["direct_usb_reference"]
+        if (
+            probe["wireless_identity"] != identity
+            or direct["vendor_id"] != identity["vendor_id"]
+            or direct["device_kind"] != identity["device_kind"]
+            or direct["transport_variant"] != "wired"
+            or direct["product_id"] == identity["product_id"]
+        ):
+            raise ModelError(f"OpenRazer native route {profile_id} has invalid direct precedence")
+        source = device["source"]
+        matcher = effective_event_regex(
+            source_root / source["path"], source["class_name"]
+        )
+        try:
+            re.compile(matcher)
+        except re.error as error:
+            raise ModelError(
+                f"OpenRazer native route {profile_id} has an invalid event matcher: {error}"
+            ) from error
+        routes.append(
+            {
+                "profile_id": profile_id,
+                "vendor_id": identity["vendor_id"],
+                "wireless_product_id": identity["product_id"],
+                "model_name": identity["model_name"],
+                "device_kind": identity["device_kind"],
+                "driver_family": (
+                    "razermouse" if identity["device_kind"] == "mouse" else "razerkbd"
+                ),
+                "source": source,
+                "direct_data_product_ids": [direct["product_id"]],
+                "event_file_regex": matcher,
+            }
+        )
+    routes.sort(key=lambda route: route["profile_id"])
+    if set(probes_by_profile) != {route["profile_id"] for route in routes}:
+        raise ModelError("OpenRazer native route and probe profile sets differ")
+    return {
+        "$schema": "../../../schemas/openrazer-native-route-catalog.schema.json",
+        "schema": CATALOG_SCHEMA,
+        "upstream_commit": metadata["upstream"]["commit"],
+        "metadata_sha256": hashlib.sha256(_json_payload(metadata)).hexdigest(),
+        "transport": _native_transport(),
+        "routes": routes,
+    }
+
+
+def transformed_native_route_catalog(root: Path, source_root: Path) -> dict[str, Any]:
+    """Build the relay catalog from one exact upstream checkout and repository data."""
+
+    source_root = source_root.resolve()
+    return _route_catalog_from_authorities(
+        transformed_metadata(root, source_root),
+        transformed_native_probe_catalog(root, source_root),
+        source_root,
+    )
+
+
+def load_native_route_catalog(root: Path) -> dict[str, Any]:
+    """Load and cross-check the committed source-bound relay catalog."""
+
+    path = root / "integrations" / "openrazer" / "native-route" / "catalog.json"
+    value = load_json(path)
+    _exact_keys(value, CATALOG_KEYS, "OpenRazer native route catalog")
+    if value["$schema"] != "../../../schemas/openrazer-native-route-catalog.schema.json":
+        raise ModelError("OpenRazer native route catalog schema reference is not canonical")
+    if value["schema"] != CATALOG_SCHEMA:
+        raise ModelError("unsupported OpenRazer native route catalog schema")
+    metadata = load_imported_metadata(root)
+    probes = load_native_probe_catalog(root)
+    if value["upstream_commit"] != metadata["upstream"]["commit"]:
+        raise ModelError("OpenRazer native route catalog upstream binding drifted")
+    if value["metadata_sha256"] != sha256_file(
+        root / "integrations" / "openrazer" / "metadata.json"
+    ):
+        raise ModelError("OpenRazer native route catalog metadata binding drifted")
+    transport = value["transport"]
+    if not isinstance(transport, dict):
+        raise ModelError("OpenRazer native route catalog transport must be an object")
+    _exact_keys(transport, CATALOG_TRANSPORT_KEYS, "OpenRazer native route transport")
+    if transport != _native_transport():
+        raise ModelError("OpenRazer native route transport differs from its canonical profile")
+    routes = value["routes"]
+    if not isinstance(routes, list) or not 1 <= len(routes) <= 1024:
+        raise ModelError("OpenRazer native route catalog is empty or oversized")
+    metadata_by_profile = {
+        device["profile_id"]: device for device in metadata["devices"]
+    }
+    probes_by_profile = {
+        device["profile_id"]: device for device in probes["devices"]
+    }
+    profile_ids: list[str] = []
+    for index, route in enumerate(routes):
+        label = f"OpenRazer native route {index}"
+        if not isinstance(route, dict):
+            raise ModelError(f"{label}: expected an object")
+        _exact_keys(route, CATALOG_ROUTE_KEYS, label)
+        profile_id = route["profile_id"]
+        if not isinstance(profile_id, str) or not profile_id:
+            raise ModelError(f"{label}: invalid profile id")
+        profile_ids.append(profile_id)
+        device = metadata_by_profile.get(profile_id)
+        probe = probes_by_profile.get(profile_id)
+        if device is None or probe is None:
+            raise ModelError(f"{label}: missing metadata or probe authority")
+        identity = device["identity"]
+        if route["source"] != device["source"] or any(
+            route[field] != identity[field]
+            for field in ("vendor_id", "model_name", "device_kind")
+        ) or route["wireless_product_id"] != identity["product_id"]:
+            raise ModelError(f"{label}: source or identity binding drifted")
+        if not isinstance(route["source"], dict):
+            raise ModelError(f"{label}: source must be an object")
+        _exact_keys(route["source"], CATALOG_SOURCE_KEYS, f"{label} source")
+        expected_family = "razermouse" if identity["device_kind"] == "mouse" else "razerkbd"
+        if route["driver_family"] != expected_family:
+            raise ModelError(f"{label}: driver family drifted")
+        direct_product = probe["direct_usb_reference"]["product_id"]
+        if route["direct_data_product_ids"] != [direct_product]:
+            raise ModelError(f"{label}: direct precedence binding drifted")
+        matcher = route["event_file_regex"]
+        if not isinstance(matcher, str) or not matcher or len(matcher) > 256:
+            raise ModelError(f"{label}: event matcher is invalid")
+        try:
+            re.compile(matcher)
+        except re.error as error:
+            raise ModelError(f"{label}: event matcher is invalid: {error}") from error
+    require_unique(profile_ids, "OpenRazer native route profile id")
+    if profile_ids != sorted(profile_ids) or set(profile_ids) != set(metadata_by_profile):
+        raise ModelError("OpenRazer native route catalog profile coverage drifted")
+    return value
+
+
+def write_native_route_catalog(root: Path, source_root: Path) -> Path:
+    destination = root / "integrations" / "openrazer" / "native-route" / "catalog.json"
+    value = transformed_native_route_catalog(root, source_root)
+    destination.write_bytes(_json_payload(value))
+    return destination
+
+
 def _exact_keys(value: dict[str, Any], expected: set[str], label: str) -> None:
     missing = sorted(expected - set(value))
     extras = sorted(set(value) - expected)
diff --git a/tools/hfxdev/private_artifact.py b/tools/hfxdev/private_artifact.py
new file mode 100644
index 0000000..89c2383
--- /dev/null
+++ b/tools/hfxdev/private_artifact.py
@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+import re
+import secrets
+from typing import Any
+
+from .model import ModelError
+
+
+SAFE_FILENAME = re.compile(r"[A-Za-z0-9][A-Za-z0-9._-]{0,191}\.json\Z")
+
+
+def write_new_private_json(directory: Path, filename: str, value: Any) -> Path:
+    """Atomically create one non-overwriting, private JSON artifact."""
+
+    if SAFE_FILENAME.fullmatch(filename) is None:
+        raise ModelError("private artifact filename is invalid")
+    requested = directory.expanduser()
+    if requested.exists() and requested.is_symlink():
+        raise ModelError("private artifact directory may not be a symbolic link")
+    base = requested.resolve()
+    base.mkdir(parents=True, mode=0o700, exist_ok=True)
+    try:
+        base.chmod(0o700)
+    except OSError as error:
+        raise ModelError(f"cannot secure private artifact directory: {error}") from error
+    destination = base / filename
+    if destination.exists() or destination.is_symlink():
+        raise ModelError("private artifact destination already exists")
+    temporary = base / f".{filename}.{secrets.token_hex(8)}.tmp"
+    flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    payload = (json.dumps(value, indent=2, ensure_ascii=True) + "\n").encode()
+    descriptor = -1
+    try:
+        descriptor = os.open(temporary, flags, 0o600)
+        with os.fdopen(descriptor, "wb", closefd=True) as output:
+            descriptor = -1
+            output.write(payload)
+            output.flush()
+            os.fsync(output.fileno())
+        try:
+            os.link(temporary, destination, follow_symlinks=False)
+        except FileExistsError as error:
+            raise ModelError("private artifact destination already exists") from error
+        temporary.unlink()
+        destination.chmod(0o600)
+        directory_descriptor = os.open(base, os.O_RDONLY | os.O_DIRECTORY)
+        try:
+            os.fsync(directory_descriptor)
+        finally:
+            os.close(directory_descriptor)
+    except OSError as error:
+        raise ModelError(f"cannot write private artifact: {error}") from error
+    finally:
+        if descriptor >= 0:
+            os.close(descriptor)
+        temporary.unlink(missing_ok=True)
+    return destination
diff --git a/tools/hfxdev/testgraph.py b/tools/hfxdev/testgraph.py
index 594c5ad..dd11ed5 100644
--- a/tools/hfxdev/testgraph.py
+++ b/tools/hfxdev/testgraph.py
@@ -39,6 +39,7 @@
     "integration-contracts",
     "profile-contracts",
     "device-knowledge-contracts",
+    "native-onboarding-contracts",
     "repository-atlas-contracts",
     "protocol-contracts",
     "error-contracts",
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 54bb402..48d8831 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -2,7 +2,6 @@
 
 from __future__ import annotations
 
-import ast
 import json
 import os
 from pathlib import Path, PurePosixPath
@@ -38,13 +37,16 @@
     transformed_native_probe_catalog,
 )
 from .openrazer import (
+    effective_event_regex,
     extract_openrazer_catalog,
     load_imported_metadata,
     transformed_metadata,
 )
 from .openrazer_native_route import (
     load_native_deployment,
+    load_native_route_catalog,
     prepare_openrazer_native_source,
+    transformed_native_route_catalog,
 )
 from .openrgb import extract_openrgb_catalog
 from .openrgb_native_route import prepare_openrgb_native_source
@@ -668,9 +670,12 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
     if (prepared.root / ".git").exists():
         raise ModelError("OpenRazer native source output copied upstream Git metadata")
 
-    route_catalog = load_json(
-        root / "integrations" / "openrazer" / "native-route" / "catalog.json"
-    )
+    route_catalog = load_native_route_catalog(root)
+    if route_catalog != transformed_native_route_catalog(root, source):
+        raise ModelError(
+            "committed OpenRazer native route catalog is stale; "
+            "rerun ./hfx import openrazer"
+        )
     metadata = load_imported_metadata(root)
     probes = load_native_probe_catalog(root)
     metadata_by_profile = {device["profile_id"]: device for device in metadata["devices"]}
@@ -708,7 +713,7 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
         ):
             raise ModelError(f"OpenRazer native route {profile_id} serial proof drifted")
         source_path = source / route["source"]["path"]
-        effective_regex = _openrazer_effective_event_regex(
+        effective_regex = effective_event_regex(
             source_path, route["source"]["class_name"]
         )
         if effective_regex != route["event_file_regex"]:
@@ -789,56 +794,6 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
         raise ModelError("OpenRazer native deployment drifted from package staging")
 
 
-def _openrazer_effective_event_regex(source: Path, class_name: str) -> str:
-    try:
-        tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
-    except (OSError, SyntaxError) as error:
-        raise ModelError(f"cannot parse OpenRazer event matcher source: {error}") from error
-    classes = {
-        node.name: node
-        for node in tree.body
-        if isinstance(node, ast.ClassDef)
-    }
-
-    def resolve(name: str, visited: set[str]) -> str | None:
-        if name in visited:
-            raise ModelError("OpenRazer event matcher inheritance contains a cycle")
-        node = classes.get(name)
-        if node is None:
-            return None
-        visited = {*visited, name}
-        for statement in node.body:
-            if not isinstance(statement, ast.Assign) or not any(
-                isinstance(target, ast.Name) and target.id == "EVENT_FILE_REGEX"
-                for target in statement.targets
-            ):
-                continue
-            value = statement.value
-            if (
-                isinstance(value, ast.Call)
-                and isinstance(value.func, ast.Attribute)
-                and isinstance(value.func.value, ast.Name)
-                and value.func.value.id == "re"
-                and value.func.attr == "compile"
-                and len(value.args) == 1
-                and isinstance(value.args[0], ast.Constant)
-                and isinstance(value.args[0].value, str)
-            ):
-                return value.args[0].value
-            raise ModelError(f"OpenRazer class {name} has an unsupported event matcher")
-        for base in node.bases:
-            if isinstance(base, ast.Name):
-                inherited = resolve(base.id, visited)
-                if inherited is not None:
-                    return inherited
-        return None
-
-    result = resolve(class_name, set())
-    if result is None:
-        raise ModelError(f"OpenRazer class {class_name} has no effective event matcher")
-    return result
-
-
 def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
     inputs = load_knowledge_inputs(root)
     catalog = compiled_knowledge_catalog(root)
@@ -870,6 +825,19 @@ def _run_device_knowledge_contracts(root: Path, _node: TestNode) -> None:
         )
 
 
+def _run_native_onboarding_contracts(root: Path, node: TestNode) -> None:
+    _run_command(
+        root,
+        [sys.executable, "-m", "unittest", "tests.test_native_onboarding", "-v"],
+        "native device onboarding contracts",
+        node.timeout_seconds,
+        environment={
+            "HFX_OPENRAZER_SOURCE_DIR": str(_openrazer_source(root)),
+            "HFX_OPENRGB_SOURCE_DIR": str(_openrgb_source(root)),
+        },
+    )
+
+
 def _run_repository_atlas_contracts(root: Path, _node: TestNode) -> None:
     atlas = load_repository_atlas(root)
     if len(atlas.nodes) < 24:
@@ -1479,6 +1447,7 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
     "profile-contracts": _run_profile_contracts,
     "integration-contracts": _run_integration_contracts,
     "device-knowledge-contracts": _run_device_knowledge_contracts,
+    "native-onboarding-contracts": _run_native_onboarding_contracts,
     "repository-atlas-contracts": _run_repository_atlas_contracts,
     "protocol-contracts": _run_protocol_contracts,
     "error-contracts": _run_error_contracts,
diff --git a/verification/tests.json b/verification/tests.json
index 925b9c9..05b53cb 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -213,6 +213,39 @@
       "produced_evidence": ["device-knowledge-result", "upstream-catalog-freshness"],
       "resume_policy": "rerun"
     },
+    {
+      "id": "native-onboarding-contracts",
+      "title": "Fail-closed native device onboarding and profile-only promotion",
+      "owned_domain": "profiles",
+      "lanes": ["fast", "full-software"],
+      "runner": "native-onboarding-contracts",
+      "required_capabilities": ["openrazer-source", "openrgb-source"],
+      "hardware_requirement": "none",
+      "writes_hardware": false,
+      "expected_duration_seconds": 3,
+      "timeout_seconds": 60,
+      "dependencies": ["schema-contracts", "device-knowledge-contracts"],
+      "isolation": "exclusive-process",
+      "cache_inputs": [
+        "crates/hfx-ops/src/bin/hyperfluxctl.rs",
+        "crates/hfx-ops/src/native_onboarding.rs",
+        "crates/hfx-ops/src/probe.rs",
+        "integrations/openrazer/native-route/catalog.json",
+        "knowledge/upstreams/openrazer.json",
+        "knowledge/upstreams/openrgb.json",
+        "profiles/capabilities.json",
+        "schemas/native-device-onboarding-draft.schema.json",
+        "schemas/native-device-promotion-assessment.schema.json",
+        "schemas/native-route-observation.schema.json",
+        "tests/fixtures/native-onboarding/**",
+        "tests/test_native_onboarding.py",
+        "tools/hfxdev/native_onboarding.py",
+        "tools/hfxdev/openrazer_native_route.py",
+        "tools/hfxdev/private_artifact.py"
+      ],
+      "produced_evidence": ["native-onboarding-result"],
+      "resume_policy": "rerun"
+    },
     {
       "id": "protocol-contracts",
       "title": "Versioned bridge protocol and SDK contract",

From 612362601ad413b26ea497cc1cd6a0594de22343 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 20:47:07 +0400
Subject: [PATCH 47/67] feat: bound native exchange scheduling

---
 crates/hfx-bridge/src/actor.rs                | 706 ++++++++++++++++--
 crates/hfx-bridge/src/backend.rs              | 267 ++++++-
 crates/hfx-bridge/src/lib.rs                  |   8 +-
 crates/hfx-bridge/src/native_exchange.rs      |  76 +-
 crates/hfx-bridge/src/native_invalidation.rs  | 146 ++++
 crates/hfx-bridge/src/native_scheduler.rs     | 209 ++++++
 crates/hfx-bridge/src/rpc.rs                  | 161 +++-
 crates/hfx-bridge/tests/connection_runtime.rs |   2 +
 crates/hfx-daemon/src/manager.rs              |   5 +-
 crates/hfx-daemon/src/production.rs           |   1 +
 10 files changed, 1482 insertions(+), 99 deletions(-)
 create mode 100644 crates/hfx-bridge/src/native_invalidation.rs
 create mode 100644 crates/hfx-bridge/src/native_scheduler.rs

diff --git a/crates/hfx-bridge/src/actor.rs b/crates/hfx-bridge/src/actor.rs
index 86f2fa9..a39e8ec 100644
--- a/crates/hfx-bridge/src/actor.rs
+++ b/crates/hfx-bridge/src/actor.rs
@@ -1,10 +1,11 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+use crate::native_scheduler::{FairRouteQueue, FairRouteQueueError};
 use crate::{
-    BridgeRpcBackend, BridgeSessionConfig, ConnectionDispatcher, ConnectionServeReport, RpcFailure,
-    SessionIdentitySource, SessionRegistry,
+    BridgeRpcBackend, BridgeSessionConfig, ConnectionDispatcher, ConnectionServeReport,
+    NativeExchangeRejection, RpcFailure, SessionIdentitySource, SessionRegistry,
 };
-use hfx_domain::{ProtocolVersion, QueueCapacity};
+use hfx_domain::{NativeExchangeTimeoutMs, NativeRouteToken, ProtocolVersion, QueueCapacity};
 use hfx_protocol::{
     FrameError, RpcRequest, RpcResponse, read_rpc_request, read_rpc_request_for_version,
     write_rpc_response, write_rpc_response_for_version,
@@ -13,8 +14,8 @@ use std::collections::BTreeMap;
 use std::convert::Infallible;
 use std::fmt;
 use std::io::{Read, Write};
-use std::sync::mpsc::{self, Receiver, RecvTimeoutError, SyncSender, TrySendError};
-use std::time::Duration;
+use std::sync::mpsc::{self, Receiver, RecvTimeoutError, SyncSender, TryRecvError, TrySendError};
+use std::time::{Duration, Instant};
 
 #[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)]
 pub struct BridgeConnectionId(u64);
@@ -23,17 +24,24 @@ pub struct BridgeConnectionId(u64);
 pub struct BridgeActorLimits {
     pub command_capacity: QueueCapacity,
     pub connection_capacity: QueueCapacity,
+    pub native_transaction_capacity: QueueCapacity,
     pub response_timeout: Duration,
 }
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum BridgeActorStartError {
     ZeroResponseTimeout,
+    InvalidNativeTransactionCapacity,
 }
 
 impl fmt::Display for BridgeActorStartError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
-        formatter.write_str("bridge actor response timeout must be positive")
+        formatter.write_str(match self {
+            Self::ZeroResponseTimeout => "bridge actor response timeout must be positive",
+            Self::InvalidNativeTransactionCapacity => {
+                "bridge actor native transaction capacity is invalid"
+            }
+        })
     }
 }
 
@@ -94,6 +102,14 @@ enum BridgeActorCommand {
     },
 }
 
+struct PendingNativeCommand {
+    connection_id: BridgeConnectionId,
+    route_token: NativeRouteToken,
+    request: Box<RpcRequest>,
+    reply: SyncSender<Result<RpcResponse, BridgeActorError>>,
+    deadline: Instant,
+}
+
 #[derive(Clone)]
 pub struct BridgeActorHandle {
     sender: SyncSender<BridgeActorCommand>,
@@ -180,6 +196,8 @@ pub struct BridgeActor<I, B> {
     backend: B,
     commands: Receiver<BridgeActorCommand>,
     dispatchers: BTreeMap<BridgeConnectionId, ConnectionDispatcher>,
+    native_pending: FairRouteQueue<NativeRouteToken, PendingNativeCommand>,
+    command_batch_capacity: usize,
     connection_capacity: usize,
     next_connection_id: u64,
 }
@@ -204,6 +222,9 @@ where
         if limits.response_timeout.is_zero() {
             return Err(BridgeActorStartError::ZeroResponseTimeout);
         }
+        let native_pending =
+            FairRouteQueue::new(usize::from(limits.native_transaction_capacity.get()))
+                .map_err(|_| BridgeActorStartError::InvalidNativeTransactionCapacity)?;
         let (sender, commands) = mpsc::sync_channel(usize::from(limits.command_capacity.get()));
         Ok((
             Self {
@@ -213,6 +234,8 @@ where
                 backend,
                 commands,
                 dispatchers: BTreeMap::new(),
+                native_pending,
+                command_batch_capacity: usize::from(limits.command_capacity.get()),
                 connection_capacity: usize::from(limits.connection_capacity.get()),
                 next_connection_id: 1,
             },
@@ -267,37 +290,59 @@ where
             interval
         };
         loop {
-            match self.commands.recv_timeout(interval) {
-                Ok(BridgeActorCommand::Shutdown { reply }) => {
-                    let exit = self.cleanup_all();
-                    let _ = reply.send(exit);
-                    return Ok(exit);
+            let command = if self.native_pending.is_empty() {
+                match self.commands.recv_timeout(interval) {
+                    Ok(command) => Some(command),
+                    Err(RecvTimeoutError::Timeout) => None,
+                    Err(RecvTimeoutError::Disconnected) => return Ok(self.cleanup_all()),
+                }
+            } else {
+                match self.commands.try_recv() {
+                    Ok(command) => Some(command),
+                    Err(TryRecvError::Empty) => None,
+                    Err(TryRecvError::Disconnected) => return Ok(self.cleanup_all()),
                 }
+            };
+
+            if let Some(command) = command
+                && let Some(reply) = self.process_batch(command)
+            {
+                let exit = self.cleanup_all();
+                let _ = reply.send(exit);
+                return Ok(exit);
+            }
+            self.cancel_invalidated_native();
+            self.dispatch_next_native();
+            self.cancel_invalidated_native();
+            match tick(&mut self.backend, &self.sessions) {
+                Ok(true) => self.cancel_invalidated_native(),
+                Ok(false) => return Ok(self.cleanup_all()),
+                Err(error) => {
+                    let cleanup = self.cleanup_all();
+                    return Err(BridgeActorTickFailure { error, cleanup });
+                }
+            }
+        }
+    }
+
+    fn process_batch(&mut self, first: BridgeActorCommand) -> Option<SyncSender<BridgeActorExit>> {
+        if let Some(reply) = self.process(first) {
+            return Some(reply);
+        }
+        for _ in 1..self.command_batch_capacity {
+            match self.commands.try_recv() {
                 Ok(command) => {
-                    self.process(command);
-                    match tick(&mut self.backend, &self.sessions) {
-                        Ok(true) => {}
-                        Ok(false) => return Ok(self.cleanup_all()),
-                        Err(error) => {
-                            let cleanup = self.cleanup_all();
-                            return Err(BridgeActorTickFailure { error, cleanup });
-                        }
+                    if let Some(reply) = self.process(command) {
+                        return Some(reply);
                     }
                 }
-                Err(RecvTimeoutError::Timeout) => match tick(&mut self.backend, &self.sessions) {
-                    Ok(true) => {}
-                    Ok(false) => return Ok(self.cleanup_all()),
-                    Err(error) => {
-                        let cleanup = self.cleanup_all();
-                        return Err(BridgeActorTickFailure { error, cleanup });
-                    }
-                },
-                Err(RecvTimeoutError::Disconnected) => return Ok(self.cleanup_all()),
+                Err(TryRecvError::Empty | TryRecvError::Disconnected) => break,
             }
         }
+        None
     }
 
-    fn process(&mut self, command: BridgeActorCommand) {
+    fn process(&mut self, command: BridgeActorCommand) -> Option<SyncSender<BridgeActorExit>> {
         match command {
             BridgeActorCommand::Open { reply } => {
                 let _ = reply.send(self.open());
@@ -307,18 +352,7 @@ where
                 request,
                 reply,
             } => {
-                let response = self.dispatchers.get_mut(&connection_id).map_or(
-                    Err(BridgeActorError::UnknownConnection),
-                    |dispatcher| {
-                        Ok(dispatcher.dispatch(
-                            *request,
-                            &mut self.identities,
-                            &mut self.sessions,
-                            &mut self.backend,
-                        ))
-                    },
-                );
-                let _ = reply.send(response);
+                self.process_request(connection_id, request, reply);
             }
             BridgeActorCommand::Disconnect {
                 connection_id,
@@ -326,12 +360,146 @@ where
             } => {
                 let _ = reply.send(self.close(connection_id));
             }
-            BridgeActorCommand::Shutdown { .. } => {
-                unreachable!("shutdown is handled by the actor loop")
+            BridgeActorCommand::Shutdown { reply } => return Some(reply),
+        }
+        None
+    }
+
+    fn process_request(
+        &mut self,
+        connection_id: BridgeConnectionId,
+        request: Box<RpcRequest>,
+        reply: SyncSender<Result<RpcResponse, BridgeActorError>>,
+    ) {
+        let Some(dispatcher) = self.dispatchers.get_mut(&connection_id) else {
+            let _ = reply.send(Err(BridgeActorError::UnknownConnection));
+            return;
+        };
+        let RpcRequest::NativeTransact(envelope) = request.as_ref() else {
+            let response = dispatcher.dispatch(
+                *request,
+                &mut self.identities,
+                &mut self.sessions,
+                &mut self.backend,
+            );
+            let _ = reply.send(Ok(response));
+            return;
+        };
+        if let Err(failure) = dispatcher.deferred_native_authorized(&request, &self.sessions) {
+            let response = dispatcher.failure_response(request.request_id().clone(), failure);
+            let _ = reply.send(Ok(response));
+            return;
+        }
+
+        let route_token = envelope.params.route_token.clone();
+        let deadline = Instant::now()
+            .checked_add(Duration::from_millis(u64::from(
+                envelope.params.timeout_ms.get(),
+            )))
+            .expect("canonical native timeout fits Instant");
+        let pending = PendingNativeCommand {
+            connection_id,
+            route_token: route_token.clone(),
+            request,
+            reply,
+            deadline,
+        };
+        match self.native_pending.admit(route_token, pending) {
+            Ok(()) => {}
+            Err((FairRouteQueueError::Full, pending)) => {
+                self.reject_pending_native(pending, NativeExchangeRejection::QueueFull);
+            }
+            Err((FairRouteQueueError::InvalidCapacity, pending)) => {
+                debug_assert!(false, "validated native queue became invalid");
+                self.reject_pending_native(pending, NativeExchangeRejection::QueueFull);
             }
         }
     }
 
+    fn dispatch_next_native(&mut self) {
+        let Some(mut pending) = self.native_pending.pop_next() else {
+            return;
+        };
+        let now = Instant::now();
+        let remaining = pending.deadline.saturating_duration_since(now);
+        if remaining < Duration::from_millis(1) {
+            self.reject_pending_native(pending, NativeExchangeRejection::DeadlineExceeded);
+            return;
+        }
+        let remaining_ms = u16::try_from(remaining.as_millis().min(1_000))
+            .expect("bounded native timeout fits u16");
+        let RpcRequest::NativeTransact(envelope) = pending.request.as_mut() else {
+            unreachable!("native scheduler accepts only native requests");
+        };
+        envelope.params.timeout_ms = NativeExchangeTimeoutMs::try_from(remaining_ms)
+            .expect("remaining native timeout is canonical");
+
+        let response = self.dispatchers.get_mut(&pending.connection_id).map_or(
+            Err(BridgeActorError::UnknownConnection),
+            |dispatcher| {
+                Ok(dispatcher.dispatch(
+                    *pending.request,
+                    &mut self.identities,
+                    &mut self.sessions,
+                    &mut self.backend,
+                ))
+            },
+        );
+        let _ = pending.reply.send(response);
+    }
+
+    fn reject_pending_native(
+        &mut self,
+        pending: PendingNativeCommand,
+        rejection: NativeExchangeRejection,
+    ) {
+        let response = self.dispatchers.get_mut(&pending.connection_id).map_or(
+            Err(BridgeActorError::UnknownConnection),
+            |dispatcher| {
+                Ok(dispatcher.dispatch_native_rejection(
+                    *pending.request,
+                    &self.sessions,
+                    &mut self.backend,
+                    rejection,
+                ))
+            },
+        );
+        let _ = pending.reply.send(response);
+    }
+
+    fn cancel_connection_native(&mut self, connection_id: BridgeConnectionId) {
+        let cancelled = self
+            .native_pending
+            .remove_where(|pending| pending.connection_id == connection_id);
+        for pending in cancelled {
+            self.reject_pending_native(pending, NativeExchangeRejection::SessionEnded);
+        }
+    }
+
+    fn cancel_invalidated_native(&mut self) {
+        let invalidations = self.backend.take_native_route_invalidations();
+        if invalidations.is_empty() {
+            return;
+        }
+        let invalidations = invalidations.into_iter().collect::<BTreeMap<_, _>>();
+        let cancelled = self
+            .native_pending
+            .remove_where(|pending| invalidations.contains_key(&pending.route_token));
+        for pending in cancelled {
+            let rejection = invalidations
+                .get(&pending.route_token)
+                .copied()
+                .expect("cancelled route owns an invalidation");
+            self.reject_pending_native(pending, rejection);
+        }
+    }
+
+    fn cancel_all_native(&mut self) {
+        for pending in self.native_pending.drain() {
+            self.reject_pending_native(pending, NativeExchangeRejection::SessionEnded);
+        }
+    }
+
     fn open(&mut self) -> Result<BridgeConnectionId, BridgeActorError> {
         if self.dispatchers.len() >= self.connection_capacity {
             return Err(BridgeActorError::ConnectionCapacityExhausted);
@@ -349,6 +517,7 @@ where
     }
 
     fn close(&mut self, connection_id: BridgeConnectionId) -> Result<(), BridgeActorError> {
+        self.cancel_connection_native(connection_id);
         let Some(mut dispatcher) = self.dispatchers.remove(&connection_id) else {
             return Err(BridgeActorError::UnknownConnection);
         };
@@ -358,6 +527,7 @@ where
     }
 
     fn cleanup_all(&mut self) -> BridgeActorExit {
+        self.cancel_all_native();
         let dispatchers = std::mem::take(&mut self.dispatchers);
         let mut exit = BridgeActorExit::default();
         for (_, mut dispatcher) in dispatchers {
@@ -491,3 +661,453 @@ fn map_receive_error(error: RecvTimeoutError) -> BridgeActorError {
         RecvTimeoutError::Disconnected => BridgeActorError::Unavailable,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{AuthorizedSession, BackendRequestContext, SessionIdentityError};
+    use hfx_domain::{
+        ClientId, ClientName, ComponentVersion, FindingId, LeaseId, NativeReportHex,
+        ProtocolFeatureId, RequestId, ServerInstanceId,
+    };
+    use hfx_protocol::{
+        BridgeSnapshot, ClientHello, DiagnosticSnapshot, EventBatch, IntegrationView, LeaseRequest,
+        LeaseResult, NativeExchangeMatchedResponse, NativeExchangeNotSent, NativeExchangeOutcome,
+        NativeExchangeRequest, NativeExchangeResult, NegotiationRequestEnvelope,
+        ReleaseLeaseRequest, RenewLeaseRequest, SessionRequestEnvelope, SubscriptionRequest,
+        TransactionLookup, TransactionRequest, TransactionResult,
+    };
+    #[derive(Debug)]
+    struct DeterministicIdentities(u8);
+
+    impl SessionIdentitySource for DeterministicIdentities {
+        fn fill_bytes(&mut self, destination: &mut [u8]) -> Result<(), SessionIdentityError> {
+            for byte in destination {
+                *byte = self.0;
+                self.0 = self.0.wrapping_add(1);
+            }
+            Ok(())
+        }
+    }
+
+    #[derive(Debug, Default)]
+    struct NativeBackend {
+        dispatched: Vec<NativeRouteToken>,
+        rejected: Vec<NativeExchangeRejection>,
+        invalidations: Vec<(NativeRouteToken, NativeExchangeRejection)>,
+    }
+
+    impl BridgeRpcBackend for NativeBackend {
+        fn snapshot(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+        ) -> Result<BridgeSnapshot, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn integration_view(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+        ) -> Result<IntegrationView, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn acquire_lease(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: LeaseRequest,
+        ) -> Result<LeaseResult, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn renew_lease(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: RenewLeaseRequest,
+        ) -> Result<LeaseResult, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn release_lease(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: ReleaseLeaseRequest,
+        ) -> Result<LeaseResult, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn submit_transaction(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: TransactionRequest,
+        ) -> Result<TransactionResult, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn transaction_outcome(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: TransactionLookup,
+        ) -> Result<TransactionResult, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn subscribe(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            _request: SubscriptionRequest,
+        ) -> Result<EventBatch, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn diagnostics(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+        ) -> Result<DiagnosticSnapshot, RpcFailure> {
+            Err(RpcFailure::internal())
+        }
+
+        fn native_transact(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            request: NativeExchangeRequest,
+        ) -> Result<NativeExchangeOutcome, RpcFailure> {
+            self.dispatched.push(request.route_token.clone());
+            Ok(NativeExchangeOutcome {
+                request_id: request.request_id,
+                route_token: request.route_token,
+                result: NativeExchangeResult::MatchedResponse(NativeExchangeMatchedResponse {
+                    response: request.report,
+                }),
+            })
+        }
+
+        fn reject_native_exchange(
+            &mut self,
+            _context: BackendRequestContext<'_>,
+            request: NativeExchangeRequest,
+            rejection: NativeExchangeRejection,
+        ) -> Result<NativeExchangeOutcome, RpcFailure> {
+            self.rejected.push(rejection);
+            Ok(NativeExchangeOutcome {
+                request_id: request.request_id,
+                route_token: request.route_token,
+                result: NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                    error_kind: rejection.error_kind(),
+                    finding_id: FindingId::try_from(rejection.error_code().as_str())
+                        .expect("catalog code is a finding identity"),
+                }),
+            })
+        }
+
+        fn take_native_route_invalidations(
+            &mut self,
+        ) -> Vec<(NativeRouteToken, NativeExchangeRejection)> {
+            std::mem::take(&mut self.invalidations)
+        }
+
+        fn disconnect(&mut self, _session: &AuthorizedSession) -> Result<(), RpcFailure> {
+            Ok(())
+        }
+    }
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is canonical")
+    }
+
+    fn actor(native_capacity: u16) -> BridgeActor<DeterministicIdentities, NativeBackend> {
+        let capacity = QueueCapacity::try_from(8_u16).expect("capacity is canonical");
+        let (actor, _handle) = BridgeActor::new(
+            BridgeSessionConfig {
+                server_instance_id: text::<ServerInstanceId>("server-native-scheduler"),
+                bridge_version: text::<ComponentVersion>("0.0.0-test"),
+                event_buffer_capacity: capacity,
+            },
+            DeterministicIdentities(1),
+            SessionRegistry::new(capacity),
+            NativeBackend::default(),
+            BridgeActorLimits {
+                command_capacity: capacity,
+                connection_capacity: capacity,
+                native_transaction_capacity: QueueCapacity::try_from(native_capacity)
+                    .expect("native capacity is canonical"),
+                response_timeout: Duration::from_secs(2),
+            },
+        )
+        .expect("actor starts");
+        actor
+    }
+
+    fn open_and_negotiate(
+        actor: &mut BridgeActor<DeterministicIdentities, NativeBackend>,
+    ) -> (BridgeConnectionId, hfx_protocol::ServerHello) {
+        let (open_reply, open_response) = mpsc::sync_channel(1);
+        assert!(
+            actor
+                .process(BridgeActorCommand::Open { reply: open_reply })
+                .is_none()
+        );
+        let connection_id = open_response
+            .recv()
+            .expect("open response is sent")
+            .expect("connection opens");
+
+        let (reply, response) = mpsc::sync_channel(1);
+        let negotiation = RpcRequest::Negotiate(NegotiationRequestEnvelope {
+            request_id: text::<RequestId>("request-negotiate-native-scheduler"),
+            params: ClientHello {
+                client_id: text::<ClientId>("client-native-scheduler"),
+                client_name: text::<ClientName>("Native scheduler test"),
+                minimum_version: ProtocolVersion::try_from(7_u16).expect("version is canonical"),
+                maximum_version: ProtocolVersion::try_from(7_u16).expect("version is canonical"),
+                required_features: vec![text::<ProtocolFeatureId>("native-receiver-tunnel")],
+                optional_features: Vec::new(),
+            },
+        });
+        assert!(
+            actor
+                .process(BridgeActorCommand::Request {
+                    connection_id,
+                    request: Box::new(negotiation),
+                    reply,
+                })
+                .is_none()
+        );
+        let response = response
+            .recv()
+            .expect("negotiation response is sent")
+            .expect("actor remains available");
+        let RpcResponse::NegotiateSuccess(envelope) = response else {
+            panic!("native negotiation succeeds: {response:?}");
+        };
+        (connection_id, envelope.result)
+    }
+
+    fn native_request(
+        hello: &hfx_protocol::ServerHello,
+        request_id: &str,
+        route_fill: char,
+        timeout_ms: u16,
+    ) -> RpcRequest {
+        RpcRequest::NativeTransact(SessionRequestEnvelope {
+            request_id: text::<RequestId>(request_id),
+            protocol_session_id: hello.protocol_session_id.clone(),
+            negotiation_token: hello.negotiation_token.clone(),
+            params: NativeExchangeRequest {
+                request_id: text::<RequestId>(request_id),
+                client_id: text::<ClientId>("client-native-scheduler"),
+                lease_id: text::<LeaseId>("lease-native-scheduler"),
+                route_token: text::<NativeRouteToken>(&route_fill.to_string().repeat(64)),
+                report: text::<NativeReportHex>(&"00".repeat(90)),
+                timeout_ms: NativeExchangeTimeoutMs::try_from(timeout_ms)
+                    .expect("timeout is canonical"),
+            },
+        })
+    }
+
+    fn enqueue(
+        actor: &mut BridgeActor<DeterministicIdentities, NativeBackend>,
+        connection_id: BridgeConnectionId,
+        request: RpcRequest,
+    ) -> Receiver<Result<RpcResponse, BridgeActorError>> {
+        let (reply, response) = mpsc::sync_channel(1);
+        assert!(
+            actor
+                .process(BridgeActorCommand::Request {
+                    connection_id,
+                    request: Box::new(request),
+                    reply,
+                })
+                .is_none()
+        );
+        response
+    }
+
+    #[test]
+    fn actor_dispatches_route_local_fifo_with_fair_sibling_turns() {
+        let mut actor = actor(8);
+        let (connection_id, hello) = open_and_negotiate(&mut actor);
+        let responses = [
+            native_request(&hello, "request-mouse-1", 'a', 1_000),
+            native_request(&hello, "request-mouse-2", 'a', 1_000),
+            native_request(&hello, "request-keyboard-1", 'b', 1_000),
+            native_request(&hello, "request-mouse-3", 'a', 1_000),
+            native_request(&hello, "request-keyboard-2", 'b', 1_000),
+        ]
+        .into_iter()
+        .map(|request| enqueue(&mut actor, connection_id, request))
+        .collect::<Vec<_>>();
+
+        for _ in 0..responses.len() {
+            actor.dispatch_next_native();
+        }
+        assert_eq!(
+            actor
+                .backend
+                .dispatched
+                .iter()
+                .map(|token| token.as_str().chars().next().expect("token is nonempty"))
+                .collect::<Vec<_>>(),
+            vec!['a', 'b', 'a', 'b', 'a']
+        );
+        for response in responses {
+            assert!(matches!(
+                response.recv().expect("response is sent"),
+                Ok(RpcResponse::NativeTransactSuccess(_))
+            ));
+        }
+    }
+
+    #[test]
+    fn saturation_and_expiry_are_retained_not_sent_without_dispatch() {
+        let mut actor = actor(1);
+        let (connection_id, hello) = open_and_negotiate(&mut actor);
+        let first = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-first", 'a', 1_000),
+        );
+        let saturated = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-saturated", 'b', 1_000),
+        );
+        let saturated = saturated.recv().expect("saturation response is sent");
+        assert!(matches!(
+            saturated,
+            Ok(RpcResponse::NativeTransactSuccess(envelope))
+                if matches!(
+                    envelope.result.result,
+                    NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                        error_kind: hfx_domain::ProtocolErrorKind::QueueFull,
+                        ..
+                    })
+                )
+        ));
+        assert!(actor.backend.dispatched.is_empty());
+
+        actor.dispatch_next_native();
+        assert!(matches!(
+            first.recv().expect("first response is sent"),
+            Ok(RpcResponse::NativeTransactSuccess(_))
+        ));
+        let expired = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-expired", 'c', 1),
+        );
+        std::thread::sleep(Duration::from_millis(3));
+        actor.dispatch_next_native();
+        let expired = expired.recv().expect("expiry response is sent");
+        assert!(matches!(
+            expired,
+            Ok(RpcResponse::NativeTransactSuccess(envelope))
+                if matches!(
+                    envelope.result.result,
+                    NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                        error_kind: hfx_domain::ProtocolErrorKind::DeadlineExceeded,
+                        ..
+                    })
+                )
+        ));
+        assert_eq!(actor.backend.dispatched.len(), 1);
+        assert_eq!(
+            actor.backend.rejected,
+            vec![
+                NativeExchangeRejection::QueueFull,
+                NativeExchangeRejection::DeadlineExceeded,
+            ]
+        );
+    }
+
+    #[test]
+    fn route_invalidation_cancels_exact_lane_and_preserves_sibling_service() {
+        let mut actor = actor(8);
+        let (connection_id, hello) = open_and_negotiate(&mut actor);
+        let mouse_one = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-invalidated-1", 'a', 1_000),
+        );
+        let mouse_two = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-invalidated-2", 'a', 1_000),
+        );
+        let keyboard = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-sibling", 'b', 1_000),
+        );
+        actor.backend.invalidations.push((
+            text::<NativeRouteToken>(&"a".repeat(64)),
+            NativeExchangeRejection::StaleGeneration,
+        ));
+
+        actor.cancel_invalidated_native();
+        for response in [mouse_one, mouse_two] {
+            assert!(matches!(
+                response.recv().expect("cancellation response is sent"),
+                Ok(RpcResponse::NativeTransactSuccess(envelope))
+                    if matches!(
+                        envelope.result.result,
+                        NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                            error_kind: hfx_domain::ProtocolErrorKind::StaleGeneration,
+                            ..
+                        })
+                    )
+            ));
+        }
+        assert!(actor.backend.dispatched.is_empty());
+
+        actor.dispatch_next_native();
+        assert!(matches!(
+            keyboard.recv().expect("sibling response is sent"),
+            Ok(RpcResponse::NativeTransactSuccess(_))
+        ));
+        assert_eq!(
+            actor.backend.dispatched,
+            vec![text::<NativeRouteToken>(&"b".repeat(64))]
+        );
+        assert_eq!(
+            actor.backend.rejected,
+            vec![
+                NativeExchangeRejection::StaleGeneration,
+                NativeExchangeRejection::StaleGeneration,
+            ]
+        );
+    }
+
+    #[test]
+    fn disconnect_cancels_queued_native_work_before_session_revocation() {
+        let mut actor = actor(8);
+        let (connection_id, hello) = open_and_negotiate(&mut actor);
+        let pending = enqueue(
+            &mut actor,
+            connection_id,
+            native_request(&hello, "request-disconnect", 'a', 1_000),
+        );
+
+        actor.close(connection_id).expect("connection closes");
+        assert!(matches!(
+            pending.recv().expect("cancellation response is sent"),
+            Ok(RpcResponse::NativeTransactSuccess(envelope))
+                if matches!(
+                    envelope.result.result,
+                    NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                        error_kind: hfx_domain::ProtocolErrorKind::OwnershipConflict,
+                        ..
+                    })
+                )
+        ));
+        assert!(actor.backend.dispatched.is_empty());
+        assert_eq!(
+            actor.backend.rejected,
+            vec![NativeExchangeRejection::SessionEnded]
+        );
+    }
+}
diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index 092028b..dabe785 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -1,10 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+use crate::native_invalidation::NativeInvalidationJournal;
 use crate::{
     AuthorizedSession, BackendRequestContext, BridgeRpcBackend, GenerationActivationOutcome,
     GenerationOrchestrationError, GenerationOrchestrator, LifecycleObservation,
     LifecycleObservationError, LifecycleObservationOrchestrator, LifecycleObservationOutcome,
-    NativeExchangeJournal, NativeExchangeJournalError, NativeRouteJournal, NativeRouteJournalError,
+    NativeExchangeJournal, NativeExchangeJournalError, NativeExchangeRejection,
+    NativeInvalidationJournalError, NativeRouteJournal, NativeRouteJournalError,
     NativeRouteProjectionError, ReceiverDisconnectCompletionOutcome, ReceiverDisconnectObservation,
     ReceiverDisconnectOutcome, ReceiverGenerationObservation, RestorationRuntime, RpcFailure,
     RuntimeIdentityError, RuntimeIdentityIssuer, RuntimeProfileAuthority, SessionIdentitySource,
@@ -23,18 +25,18 @@ use hfx_core::{
 };
 use hfx_domain::{
     DeviceKind, EventKind, FindingId, LeaseDurationMs, MonotonicMs, NativeReportHex,
-    NativeRouteAccess, ProjectionRevision, ProtocolErrorKind, QueueCapacity, ReceiverId,
-    ResourceKind, RestoreClaimId, RouteState, StreamEpoch, StreamId,
+    NativeRouteAccess, NativeRouteToken, ProjectionRevision, ProtocolErrorKind, QueueCapacity,
+    ReceiverId, ResourceKind, RestoreClaimId, RouteState, StreamEpoch, StreamId,
 };
 use hfx_errors::ErrorCode;
 use hfx_integration_model::project_integration_view;
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, EventBatch, IntegrationView, LeaseRequest, LeaseResult,
     NativeExchangeMatchedResponse, NativeExchangeNotSent, NativeExchangeOutcome,
-    NativeExchangeRequest, NativeExchangeResult, NativeExchangeUncertain, NativeRouteEventBatch,
-    NativeRouteInventory, ReleaseLeaseRequest, RenewLeaseRequest, SubscriptionRequest,
-    TransactionLookup, TransactionRequest, TransactionResult, TransactionUnavailable,
-    validate_lease_request,
+    NativeExchangeRequest, NativeExchangeResult, NativeExchangeUncertain, NativeRoute,
+    NativeRouteEventBatch, NativeRouteInventory, ReleaseLeaseRequest, RenewLeaseRequest,
+    SubscriptionRequest, TransactionLookup, TransactionRequest, TransactionResult,
+    TransactionUnavailable, validate_lease_request,
 };
 use sha2::{Digest, Sha256};
 use std::fmt;
@@ -93,6 +95,7 @@ pub enum CoreBridgeBackendError {
     Subscription(SubscriptionRegistryError),
     NativeRoute(NativeRouteJournalError),
     NativeExchange(NativeExchangeJournalError),
+    NativeInvalidation(NativeInvalidationJournalError),
 }
 
 impl fmt::Display for CoreBridgeBackendError {
@@ -106,6 +109,7 @@ impl fmt::Display for CoreBridgeBackendError {
             Self::Subscription(_) => "subscription registry initialization failed",
             Self::NativeRoute(_) => "native route journal initialization failed",
             Self::NativeExchange(_) => "native exchange journal initialization failed",
+            Self::NativeInvalidation(_) => "native invalidation journal initialization failed",
         })
     }
 }
@@ -131,6 +135,7 @@ pub struct CoreBridgeBackend<C, W, T, R, S> {
     subscriptions: SubscriptionRegistry,
     native_routes: NativeRouteJournal,
     native_exchanges: NativeExchangeJournal,
+    native_invalidations: NativeInvalidationJournal,
     native_subscriptions: SubscriptionRegistry,
     event_sink: S,
 }
@@ -199,6 +204,9 @@ where
         let native_exchanges =
             NativeExchangeJournal::new(usize::from(config.transaction_capacity.get()))
                 .map_err(CoreBridgeBackendError::NativeExchange)?;
+        let native_invalidations =
+            NativeInvalidationJournal::new(usize::from(config.transaction_capacity.get()))
+                .map_err(CoreBridgeBackendError::NativeInvalidation)?;
         let native_subscriptions =
             SubscriptionRegistry::new(usize::from(config.subscription_capacity.get()))
                 .map_err(CoreBridgeBackendError::Subscription)?;
@@ -219,6 +227,7 @@ where
             subscriptions,
             native_routes,
             native_exchanges,
+            native_invalidations,
             native_subscriptions,
             event_sink,
         })
@@ -294,14 +303,15 @@ where
         })
     }
 
-    /// Advances time-driven bridge policy without requiring an RPC request.
+    /// Advances time-driven policy and reconciles native route authority.
     ///
     /// # Errors
     ///
-    /// Returns a canonical event failure without partially committing an
-    /// ownership transition.
+    /// Returns a canonical lease, profile, or route failure without granting
+    /// authority from a partially reconciled native inventory.
     pub fn tick(&mut self) -> Result<(), RpcFailure> {
-        self.expire_leases()
+        self.expire_leases()?;
+        self.synchronize_native_routes()
     }
 
     /// Atomically activates one transport-confirmed receiver generation.
@@ -693,11 +703,40 @@ where
     }
 
     fn synchronize_native_routes(&mut self) -> Result<(), RpcFailure> {
+        let previous = self.native_routes.inventory().routes;
         let routes = project_native_routes(&self.receivers, &self.profiles)
             .map_err(native_projection_failure)?;
         self.native_routes
             .synchronize(routes, &mut self.identities)
-            .map_err(native_route_failure)
+            .map_err(native_route_failure)?;
+        let current = self.native_routes.inventory().routes;
+
+        for route in &current {
+            if let Some(route_token) = &route.route_token {
+                self.native_invalidations.retire(route_token);
+            }
+        }
+        for route in previous {
+            let Some(route_token) = route.route_token.as_ref() else {
+                continue;
+            };
+            if current
+                .iter()
+                .any(|candidate| candidate.route_token.as_ref() == Some(route_token))
+            {
+                continue;
+            }
+            let rejection = native_route_invalidation(&route, &current);
+            let finding_id = native_finding(rejection.error_kind(), false);
+            self.native_exchanges.invalidate_route(
+                route_token,
+                rejection.error_kind(),
+                &finding_id,
+            );
+            self.native_invalidations
+                .invalidate(route_token.clone(), rejection);
+        }
+        Ok(())
     }
 
     fn qualify_resources(&mut self, request: &LeaseRequest) -> Result<(), RpcFailure> {
@@ -805,6 +844,43 @@ where
         }
         Ok(())
     }
+
+    fn complete_native_exchange(
+        &mut self,
+        request: NativeExchangeRequest,
+        result: NativeExchangeResult,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        if let Some(outcome) = self
+            .native_exchanges
+            .retained(&request)
+            .map_err(native_exchange_failure)?
+        {
+            return Ok(outcome);
+        }
+        let outcome = NativeExchangeOutcome {
+            request_id: request.request_id.clone(),
+            route_token: request.route_token.clone(),
+            result,
+        };
+        self.native_exchanges
+            .remember(request, outcome.clone())
+            .map_err(native_exchange_failure)?;
+        Ok(outcome)
+    }
+
+    fn reject_native_before_set(
+        &mut self,
+        request: NativeExchangeRequest,
+        error_kind: ProtocolErrorKind,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        self.complete_native_exchange(
+            request,
+            NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                error_kind,
+                finding_id: native_finding(error_kind, false),
+            }),
+        )
+    }
 }
 
 impl<C, W, T, R, S> BridgeRpcBackend for CoreBridgeBackend<C, W, T, R, S>
@@ -1022,6 +1098,9 @@ where
     ) -> Result<NativeExchangeOutcome, RpcFailure> {
         Self::authorize_client(context, &request.client_id)?;
         self.tick()?;
+        if let Some(rejection) = self.native_invalidations.rejection(&request.route_token) {
+            return self.reject_native_before_set(request, rejection.error_kind());
+        }
         if let Some(outcome) = self
             .native_exchanges
             .retained(&request)
@@ -1031,44 +1110,54 @@ where
         }
 
         self.synchronize_native_routes()?;
-        let route = self
+        let Some(route) = self
             .native_routes
             .route_by_token(&request.route_token)
             .cloned()
-            .ok_or_else(profile_failure)?;
-        if route.access != NativeRouteAccess::Qualified
-            || route.route_state != RouteState::Available
-        {
-            return Err(profile_failure());
+        else {
+            return self.reject_native_before_set(request, ProtocolErrorKind::UnsupportedFeature);
+        };
+        if route.access != NativeRouteAccess::Qualified {
+            return self.reject_native_before_set(request, ProtocolErrorKind::UnsupportedFeature);
         }
-        let resource = route.resource.clone().ok_or_else(profile_failure)?;
+        if route.route_state != RouteState::Available {
+            return self.reject_native_before_set(request, ProtocolErrorKind::TransportFailure);
+        }
+        let Some(resource) = route.resource.clone() else {
+            return self.reject_native_before_set(request, ProtocolErrorKind::UnsupportedFeature);
+        };
         if !self.leases.owns(
             &request.client_id,
             &request.lease_id,
             std::slice::from_ref(&resource),
             self.clock.now(),
         ) {
-            return Err(ownership_failure());
+            return self.reject_native_before_set(request, ProtocolErrorKind::OwnershipConflict);
         }
         if self.transport.current_generation(&route.receiver_id) != Some(route.generation_id) {
-            return Err(generation_failure());
+            return self.reject_native_before_set(request, ProtocolErrorKind::StaleGeneration);
         }
         if !self
             .transport
             .native_exchange_available(&route.receiver_id, route.generation_id)
         {
-            return Err(transport_unavailable_failure());
+            return self.reject_native_before_set(request, ProtocolErrorKind::TransportFailure);
         }
         if usize::from(route.report_bytes.get()) != NATIVE_REPORT_BYTES {
-            return Err(profile_failure());
+            return self.reject_native_before_set(request, ProtocolErrorKind::InvalidRequest);
         }
 
         let endpoint = match route.device_kind {
             DeviceKind::Mouse => NativeEndpointLane::Pointer,
             DeviceKind::Keyboard => NativeEndpointLane::Keyboard,
-            _ => return Err(profile_failure()),
+            _ => {
+                return self
+                    .reject_native_before_set(request, ProtocolErrorKind::UnsupportedFeature);
+            }
+        };
+        let Ok(report) = decode_native_report(&request.report) else {
+            return self.reject_native_before_set(request, ProtocolErrorKind::InvalidRequest);
         };
-        let report = decode_native_report(&request.report)?;
         let route_token_digest = native_route_token_digest(&request.route_token);
         let dispatch = NativeTransportDispatch {
             session_id: context.session().session_id.clone(),
@@ -1092,15 +1181,24 @@ where
         } else {
             protocol_native_result(&transport_outcome.result)?
         };
-        let outcome = NativeExchangeOutcome {
-            request_id: request.request_id.clone(),
-            route_token: request.route_token.clone(),
-            result,
-        };
-        self.native_exchanges
-            .remember(request, outcome.clone())
-            .map_err(native_exchange_failure)?;
-        Ok(outcome)
+        self.complete_native_exchange(request, result)
+    }
+
+    fn reject_native_exchange(
+        &mut self,
+        context: BackendRequestContext<'_>,
+        request: NativeExchangeRequest,
+        rejection: NativeExchangeRejection,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        Self::authorize_client(context, &request.client_id)?;
+        self.tick()?;
+        self.reject_native_before_set(request, rejection.error_kind())
+    }
+
+    fn take_native_route_invalidations(
+        &mut self,
+    ) -> Vec<(NativeRouteToken, NativeExchangeRejection)> {
+        self.native_invalidations.take_pending()
     }
 
     fn native_watch(
@@ -1227,6 +1325,29 @@ fn native_finding(error_kind: ProtocolErrorKind, uncertain: bool) -> FindingId {
     })
 }
 
+fn native_route_invalidation(
+    previous: &NativeRoute,
+    current: &[NativeRoute],
+) -> NativeExchangeRejection {
+    let replacement = current.iter().find(|candidate| {
+        candidate.receiver_id == previous.receiver_id
+            && candidate.device_id == previous.device_id
+            && candidate.endpoint_id == previous.endpoint_id
+    });
+    match replacement {
+        Some(route) if route.generation_id != previous.generation_id => {
+            NativeExchangeRejection::StaleGeneration
+        }
+        Some(route) if route.access != NativeRouteAccess::Qualified => {
+            NativeExchangeRejection::RouteWithdrawn
+        }
+        Some(route) if route.route_state != RouteState::Available => {
+            NativeExchangeRejection::RouteUnavailable
+        }
+        Some(_) | None => NativeExchangeRejection::RouteUnavailable,
+    }
+}
+
 fn desired_effect_failure(_error: DesiredEffectError) -> RpcFailure {
     RpcFailure::internal()
 }
@@ -1398,3 +1519,81 @@ fn subscription_failure(error: SubscriptionRegistryError) -> RpcFailure {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{
+        EndpointId, GenerationId, LogicalDeviceId, NativeProtocolFamily, NativeReportByteCount,
+        ProductId, VendorId,
+    };
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is canonical")
+    }
+
+    fn route(generation: u64, access: NativeRouteAccess, route_state: RouteState) -> NativeRoute {
+        NativeRoute {
+            receiver_id: text::<ReceiverId>("receiver-1"),
+            generation_id: GenerationId::try_from(generation).expect("generation is canonical"),
+            device_id: text::<LogicalDeviceId>("mouse-1"),
+            endpoint_id: text::<EndpointId>("pointer"),
+            device_kind: DeviceKind::Mouse,
+            vendor_id: VendorId::try_from(0x1532_u16).expect("vendor is canonical"),
+            product_id: ProductId::try_from(0x00cd_u16).expect("product is canonical"),
+            route_state,
+            access,
+            protocol_family: text::<NativeProtocolFamily>("razer-feature-report-v1"),
+            report_bytes: NativeReportByteCount::try_from(90_u16)
+                .expect("report size is canonical"),
+            route_token: None,
+            resource: None,
+        }
+    }
+
+    #[test]
+    fn route_invalidation_preserves_generation_availability_and_authority_causes() {
+        let previous = route(1, NativeRouteAccess::Qualified, RouteState::Available);
+        assert_eq!(
+            native_route_invalidation(
+                &previous,
+                &[route(
+                    2,
+                    NativeRouteAccess::Qualified,
+                    RouteState::Available,
+                )],
+            ),
+            NativeExchangeRejection::StaleGeneration
+        );
+        assert_eq!(
+            native_route_invalidation(
+                &previous,
+                &[route(
+                    1,
+                    NativeRouteAccess::Qualified,
+                    RouteState::Unavailable,
+                )],
+            ),
+            NativeExchangeRejection::RouteUnavailable
+        );
+        assert_eq!(
+            native_route_invalidation(
+                &previous,
+                &[route(
+                    1,
+                    NativeRouteAccess::Candidate,
+                    RouteState::Available,
+                )],
+            ),
+            NativeExchangeRejection::RouteWithdrawn
+        );
+        assert_eq!(
+            native_route_invalidation(&previous, &[]),
+            NativeExchangeRejection::RouteUnavailable
+        );
+    }
+}
diff --git a/crates/hfx-bridge/src/lib.rs b/crates/hfx-bridge/src/lib.rs
index 29ba4cf..f33ba03 100644
--- a/crates/hfx-bridge/src/lib.rs
+++ b/crates/hfx-bridge/src/lib.rs
@@ -8,8 +8,10 @@ mod clock;
 mod connection;
 mod generation;
 mod native_exchange;
+mod native_invalidation;
 mod native_projection;
 mod native_routes;
+mod native_scheduler;
 mod observation;
 mod persistence;
 mod profile_authority;
@@ -45,6 +47,7 @@ pub use hfx_protocol::{
     write_rpc_request_for_version, write_rpc_response, write_rpc_response_for_version,
 };
 pub use native_exchange::{NativeExchangeJournal, NativeExchangeJournalError};
+pub use native_invalidation::NativeInvalidationJournalError;
 pub use native_projection::{
     NATIVE_EXCHANGE_CAPABILITY_ID, NativeRouteProjectionError, project_native_routes,
 };
@@ -63,7 +66,10 @@ pub use profile_authority::{
     RuntimeProfileAuthority, RuntimeProfileAuthorityError, RuntimeProfileView,
 };
 pub use restoration_runtime::{DurableRestorationRuntime, RestorationRuntime};
-pub use rpc::{BackendRequestContext, BridgeRpcBackend, ConnectionDispatcher, RpcFailure};
+pub use rpc::{
+    BackendRequestContext, BridgeRpcBackend, ConnectionDispatcher, NativeExchangeRejection,
+    RpcFailure,
+};
 pub use runtime_identity::{RuntimeIdentityError, RuntimeIdentityIssuer};
 pub use session::{
     AuthorizedSession, BridgeSession, BridgeSessionConfig, KernelSessionIdentitySource,
diff --git a/crates/hfx-bridge/src/native_exchange.rs b/crates/hfx-bridge/src/native_exchange.rs
index 124a7d5..9de7f2c 100644
--- a/crates/hfx-bridge/src/native_exchange.rs
+++ b/crates/hfx-bridge/src/native_exchange.rs
@@ -1,7 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use hfx_domain::{ClientId, RequestId};
-use hfx_protocol::{NativeExchangeOutcome, NativeExchangeRequest};
+use hfx_domain::{ClientId, FindingId, NativeRouteToken, ProtocolErrorKind, RequestId};
+use hfx_protocol::{
+    NativeExchangeNotSent, NativeExchangeOutcome, NativeExchangeRequest, NativeExchangeResult,
+};
 use std::collections::{BTreeMap, VecDeque};
 use std::fmt;
 
@@ -118,6 +120,32 @@ impl NativeExchangeJournal {
         Ok(())
     }
 
+    /// Removes cached response bytes for one invalidated route while keeping
+    /// request-identity conflict protection.
+    ///
+    /// Exact retries receive a generation-bound `not-sent` tombstone. A
+    /// contradictory reuse of the same client/request identity remains an
+    /// error, so invalidation cannot reopen transport admission.
+    pub fn invalidate_route(
+        &mut self,
+        route_token: &NativeRouteToken,
+        error_kind: ProtocolErrorKind,
+        finding_id: &FindingId,
+    ) -> usize {
+        let mut invalidated = 0;
+        for record in self.records.values_mut() {
+            if &record.request.route_token != route_token {
+                continue;
+            }
+            record.outcome.result = NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                error_kind,
+                finding_id: finding_id.clone(),
+            });
+            invalidated += 1;
+        }
+        invalidated
+    }
+
     #[must_use]
     pub fn len(&self) -> usize {
         self.records.len()
@@ -136,7 +164,9 @@ mod tests {
         FindingId, LeaseId, NativeExchangeTimeoutMs, NativeReportHex, NativeRouteToken,
         ProtocolErrorKind,
     };
-    use hfx_protocol::{NativeExchangeNotSent, NativeExchangeResult};
+    use hfx_protocol::{
+        NativeExchangeMatchedResponse, NativeExchangeNotSent, NativeExchangeResult,
+    };
 
     fn text<T>(value: &str) -> T
     where
@@ -206,4 +236,44 @@ mod tests {
         );
         assert!(journal.retained(&third).expect("lookup succeeds").is_some());
     }
+
+    #[test]
+    fn route_invalidation_removes_response_bytes_without_reopening_request_identity() {
+        let mut journal = NativeExchangeJournal::new(2).expect("capacity is valid");
+        let original = request("client-1", "request-1", '0');
+        let matched = NativeExchangeOutcome {
+            request_id: original.request_id.clone(),
+            route_token: original.route_token.clone(),
+            result: NativeExchangeResult::MatchedResponse(NativeExchangeMatchedResponse {
+                response: original.report.clone(),
+            }),
+        };
+        journal
+            .remember(original.clone(), matched)
+            .expect("matched response is retained");
+
+        let finding = text::<FindingId>("HFX-GENERATION-001");
+        assert_eq!(
+            journal.invalidate_route(
+                &original.route_token,
+                ProtocolErrorKind::StaleGeneration,
+                &finding,
+            ),
+            1
+        );
+        assert!(matches!(
+            journal.retained(&original),
+            Ok(Some(NativeExchangeOutcome {
+                result: NativeExchangeResult::NotSent(NativeExchangeNotSent {
+                    error_kind: ProtocolErrorKind::StaleGeneration,
+                    ..
+                }),
+                ..
+            }))
+        ));
+        assert_eq!(
+            journal.retained(&request("client-1", "request-1", '1')),
+            Err(NativeExchangeJournalError::RequestIdentityReused)
+        );
+    }
 }
diff --git a/crates/hfx-bridge/src/native_invalidation.rs b/crates/hfx-bridge/src/native_invalidation.rs
new file mode 100644
index 0000000..68d9bcd
--- /dev/null
+++ b/crates/hfx-bridge/src/native_invalidation.rs
@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::NativeExchangeRejection;
+use hfx_domain::NativeRouteToken;
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
+use std::fmt;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeInvalidationJournalError {
+    InvalidCapacity,
+}
+
+impl fmt::Display for NativeInvalidationJournalError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("native route invalidation capacity is invalid")
+    }
+}
+
+impl std::error::Error for NativeInvalidationJournalError {}
+
+/// Bounded route-token tombstones plus one coalesced scheduler notification.
+///
+/// Tombstones prevent an old generation token from regaining authority. The
+/// pending set is independent: consuming a scheduler notification does not
+/// erase the rejection reason used by later exact request replays.
+#[derive(Clone, Debug)]
+pub(crate) struct NativeInvalidationJournal {
+    capacity: usize,
+    order: VecDeque<NativeRouteToken>,
+    reasons: BTreeMap<NativeRouteToken, NativeExchangeRejection>,
+    pending: BTreeSet<NativeRouteToken>,
+}
+
+impl NativeInvalidationJournal {
+    pub(crate) fn new(capacity: usize) -> Result<Self, NativeInvalidationJournalError> {
+        if !(1..=4096).contains(&capacity) {
+            return Err(NativeInvalidationJournalError::InvalidCapacity);
+        }
+        Ok(Self {
+            capacity,
+            order: VecDeque::with_capacity(capacity),
+            reasons: BTreeMap::new(),
+            pending: BTreeSet::new(),
+        })
+    }
+
+    pub(crate) fn invalidate(
+        &mut self,
+        route_token: NativeRouteToken,
+        rejection: NativeExchangeRejection,
+    ) {
+        if self.reasons.contains_key(&route_token) {
+            self.reasons.insert(route_token.clone(), rejection);
+            self.pending.insert(route_token);
+            return;
+        }
+        if self.reasons.len() == self.capacity
+            && let Some(expired) = self.order.pop_front()
+        {
+            self.reasons.remove(&expired);
+            self.pending.remove(&expired);
+        }
+        self.order.push_back(route_token.clone());
+        self.reasons.insert(route_token.clone(), rejection);
+        self.pending.insert(route_token);
+    }
+
+    #[must_use]
+    pub(crate) fn rejection(
+        &self,
+        route_token: &NativeRouteToken,
+    ) -> Option<NativeExchangeRejection> {
+        self.reasons.get(route_token).copied()
+    }
+
+    pub(crate) fn retire(&mut self, route_token: &NativeRouteToken) {
+        if self.reasons.remove(route_token).is_none() {
+            return;
+        }
+        self.order.retain(|retained| retained != route_token);
+        self.pending.remove(route_token);
+    }
+
+    pub(crate) fn take_pending(&mut self) -> Vec<(NativeRouteToken, NativeExchangeRejection)> {
+        let pending = std::mem::take(&mut self.pending);
+        pending
+            .into_iter()
+            .filter_map(|route_token| {
+                self.reasons
+                    .get(&route_token)
+                    .copied()
+                    .map(|rejection| (route_token, rejection))
+            })
+            .collect()
+    }
+
+    #[cfg(test)]
+    #[must_use]
+    pub(crate) fn len(&self) -> usize {
+        self.reasons.len()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn token(fill: char) -> NativeRouteToken {
+        NativeRouteToken::try_from(fill.to_string().repeat(64)).expect("token is canonical")
+    }
+
+    #[test]
+    fn scheduler_notifications_are_coalesced_without_erasing_tombstones() {
+        let mut journal = NativeInvalidationJournal::new(2).expect("capacity is valid");
+        let route = token('a');
+        journal.invalidate(route.clone(), NativeExchangeRejection::RouteUnavailable);
+        journal.invalidate(route.clone(), NativeExchangeRejection::StaleGeneration);
+
+        assert_eq!(
+            journal.take_pending(),
+            vec![(route.clone(), NativeExchangeRejection::StaleGeneration)]
+        );
+        assert!(journal.take_pending().is_empty());
+        assert_eq!(
+            journal.rejection(&route),
+            Some(NativeExchangeRejection::StaleGeneration)
+        );
+    }
+
+    #[test]
+    fn tombstones_are_bounded_and_current_authority_can_retire_one() {
+        let mut journal = NativeInvalidationJournal::new(2).expect("capacity is valid");
+        let first = token('a');
+        let second = token('b');
+        let third = token('c');
+        journal.invalidate(first.clone(), NativeExchangeRejection::RouteUnavailable);
+        journal.invalidate(second.clone(), NativeExchangeRejection::RouteUnavailable);
+        journal.invalidate(third.clone(), NativeExchangeRejection::RouteWithdrawn);
+
+        assert_eq!(journal.len(), 2);
+        assert_eq!(journal.rejection(&first), None);
+        journal.retire(&second);
+        assert_eq!(journal.len(), 1);
+        assert_eq!(journal.rejection(&second), None);
+    }
+}
diff --git a/crates/hfx-bridge/src/native_scheduler.rs b/crates/hfx-bridge/src/native_scheduler.rs
new file mode 100644
index 0000000..de10d6a
--- /dev/null
+++ b/crates/hfx-bridge/src/native_scheduler.rs
@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use std::collections::{BTreeMap, VecDeque};
+use std::fmt;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum FairRouteQueueError {
+    InvalidCapacity,
+    Full,
+}
+
+impl fmt::Display for FairRouteQueueError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidCapacity => "native route queue capacity is invalid",
+            Self::Full => "native route queue is full",
+        })
+    }
+}
+
+impl std::error::Error for FairRouteQueueError {}
+
+/// Bounded route-local FIFO scheduler with fair round-robin lane selection.
+///
+/// A route enters the rotation exactly once while it has queued work. Popping
+/// one request moves a still-nonempty route to the back, so a busy child cannot
+/// consume a sibling child's turn.
+#[derive(Clone, Debug)]
+pub(crate) struct FairRouteQueue<K, T> {
+    capacity: usize,
+    len: usize,
+    rotation: VecDeque<K>,
+    lanes: BTreeMap<K, VecDeque<T>>,
+}
+
+impl<K, T> FairRouteQueue<K, T>
+where
+    K: Clone + Ord,
+{
+    pub(crate) fn new(capacity: usize) -> Result<Self, FairRouteQueueError> {
+        if !(1..=4096).contains(&capacity) {
+            return Err(FairRouteQueueError::InvalidCapacity);
+        }
+        Ok(Self {
+            capacity,
+            len: 0,
+            rotation: VecDeque::with_capacity(capacity),
+            lanes: BTreeMap::new(),
+        })
+    }
+
+    pub(crate) fn admit(&mut self, route: K, item: T) -> Result<(), (FairRouteQueueError, T)> {
+        if self.len == self.capacity {
+            return Err((FairRouteQueueError::Full, item));
+        }
+        let lane = self.lanes.entry(route.clone()).or_default();
+        if lane.is_empty() {
+            self.rotation.push_back(route);
+        }
+        lane.push_back(item);
+        self.len += 1;
+        Ok(())
+    }
+
+    pub(crate) fn pop_next(&mut self) -> Option<T> {
+        let route = self.rotation.pop_front()?;
+        let lane = self
+            .lanes
+            .get_mut(&route)
+            .expect("rotated native route owns a lane");
+        let item = lane
+            .pop_front()
+            .expect("rotated native route owns queued work");
+        self.len -= 1;
+        if lane.is_empty() {
+            self.lanes.remove(&route);
+        } else {
+            self.rotation.push_back(route);
+        }
+        Some(item)
+    }
+
+    pub(crate) fn remove_where<F>(&mut self, mut predicate: F) -> Vec<T>
+    where
+        F: FnMut(&T) -> bool,
+    {
+        let mut removed = Vec::new();
+        for lane in self.lanes.values_mut() {
+            let mut retained = VecDeque::with_capacity(lane.len());
+            while let Some(item) = lane.pop_front() {
+                if predicate(&item) {
+                    self.len -= 1;
+                    removed.push(item);
+                } else {
+                    retained.push_back(item);
+                }
+            }
+            *lane = retained;
+        }
+        self.lanes.retain(|_, lane| !lane.is_empty());
+        self.rotation.retain(|route| self.lanes.contains_key(route));
+        removed
+    }
+
+    pub(crate) fn drain(&mut self) -> Vec<T> {
+        let mut drained = Vec::with_capacity(self.len);
+        while let Some(item) = self.pop_next() {
+            drained.push(item);
+        }
+        drained
+    }
+
+    #[must_use]
+    #[cfg(test)]
+    pub(crate) const fn len(&self) -> usize {
+        self.len
+    }
+
+    #[must_use]
+    pub(crate) const fn is_empty(&self) -> bool {
+        self.len == 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+    struct Item {
+        route: char,
+        sequence: u8,
+        connection: u8,
+    }
+
+    fn item(route: char, sequence: u8, connection: u8) -> Item {
+        Item {
+            route,
+            sequence,
+            connection,
+        }
+    }
+
+    #[test]
+    fn route_fifo_and_sibling_round_robin_are_simultaneously_preserved() {
+        let mut queue = FairRouteQueue::new(8).expect("queue is bounded");
+        for next in [
+            item('m', 1, 1),
+            item('m', 2, 1),
+            item('k', 1, 2),
+            item('m', 3, 1),
+            item('k', 2, 2),
+        ] {
+            queue
+                .admit(next.route, next)
+                .expect("fixture remains within capacity");
+        }
+
+        assert_eq!(
+            queue.drain(),
+            vec![
+                item('m', 1, 1),
+                item('k', 1, 2),
+                item('m', 2, 1),
+                item('k', 2, 2),
+                item('m', 3, 1),
+            ]
+        );
+    }
+
+    #[test]
+    fn admission_is_exactly_bounded_and_returns_the_unadmitted_item() {
+        let mut queue = FairRouteQueue::new(2).expect("queue is bounded");
+        queue
+            .admit('m', item('m', 1, 1))
+            .expect("first item is admitted");
+        queue
+            .admit('k', item('k', 1, 2))
+            .expect("second item is admitted");
+        let rejected = item('m', 2, 1);
+        assert_eq!(
+            queue.admit('m', rejected),
+            Err((FairRouteQueueError::Full, rejected))
+        );
+        assert_eq!(queue.len(), 2);
+    }
+
+    #[test]
+    fn connection_cancellation_keeps_other_lanes_ordered_and_fair() {
+        let mut queue = FairRouteQueue::new(8).expect("queue is bounded");
+        for next in [
+            item('m', 1, 1),
+            item('k', 1, 2),
+            item('m', 2, 1),
+            item('k', 2, 2),
+        ] {
+            queue
+                .admit(next.route, next)
+                .expect("fixture remains within capacity");
+        }
+
+        assert_eq!(
+            queue.remove_where(|pending| pending.connection == 1),
+            vec![item('m', 1, 1), item('m', 2, 1)]
+        );
+        assert_eq!(queue.drain(), vec![item('k', 1, 2), item('k', 2, 2)]);
+        assert!(queue.is_empty());
+    }
+}
diff --git a/crates/hfx-bridge/src/rpc.rs b/crates/hfx-bridge/src/rpc.rs
index 3d1e626..e7d1bca 100644
--- a/crates/hfx-bridge/src/rpc.rs
+++ b/crates/hfx-bridge/src/rpc.rs
@@ -5,7 +5,9 @@ use crate::{
     SessionRegistry, SessionRegistryError,
 };
 use hfx_core::SessionAuthority;
-use hfx_domain::{FindingId, HumanMessage, ProtocolErrorKind, RequestId, ServerInstanceId};
+use hfx_domain::{
+    FindingId, HumanMessage, NativeRouteToken, ProtocolErrorKind, RequestId, ServerInstanceId,
+};
 use hfx_errors::{ErrorCode, error_by_code};
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, ErrorEnvelope, EventBatch, IntegrationView, LeaseRequest,
@@ -145,6 +147,48 @@ impl fmt::Display for RpcFailure {
 
 impl std::error::Error for RpcFailure {}
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeExchangeRejection {
+    /// The bounded actor queue had no admission capacity.
+    QueueFull,
+    /// The complete exchange deadline expired before SET began.
+    DeadlineExceeded,
+    /// The owning protocol session ended while the request was queued.
+    SessionEnded,
+    /// The route token belongs to a replaced receiver generation.
+    StaleGeneration,
+    /// The route still exists but cannot currently carry native control.
+    RouteUnavailable,
+    /// The route no longer has qualified native-control authority.
+    RouteWithdrawn,
+}
+
+impl NativeExchangeRejection {
+    #[must_use]
+    pub const fn error_kind(self) -> ProtocolErrorKind {
+        match self {
+            Self::QueueFull => ProtocolErrorKind::QueueFull,
+            Self::DeadlineExceeded => ProtocolErrorKind::DeadlineExceeded,
+            Self::SessionEnded => ProtocolErrorKind::OwnershipConflict,
+            Self::StaleGeneration => ProtocolErrorKind::StaleGeneration,
+            Self::RouteUnavailable => ProtocolErrorKind::TransportFailure,
+            Self::RouteWithdrawn => ProtocolErrorKind::UnsupportedFeature,
+        }
+    }
+
+    #[must_use]
+    pub const fn error_code(self) -> ErrorCode {
+        match self {
+            Self::QueueFull => ErrorCode::HfxQueue001,
+            Self::DeadlineExceeded => ErrorCode::HfxDeadline001,
+            Self::SessionEnded => ErrorCode::HfxOwnership002,
+            Self::StaleGeneration => ErrorCode::HfxGeneration001,
+            Self::RouteUnavailable => ErrorCode::HfxTransport001,
+            Self::RouteWithdrawn => ErrorCode::HfxProfile001,
+        }
+    }
+}
+
 /// Application-neutral method backend used by the connection dispatcher.
 ///
 /// Implementations own core state and transport policy. The dispatcher owns
@@ -260,6 +304,37 @@ pub trait BridgeRpcBackend {
         ))
     }
 
+    /// Retains one retry-safe native result for work rejected before SET.
+    ///
+    /// Actor admission, absolute deadline, and disconnect cancellation use
+    /// this path so a repeated request identity cannot later reach hardware.
+    ///
+    /// # Errors
+    ///
+    /// The default rejects the additive method as unsupported.
+    fn reject_native_exchange(
+        &mut self,
+        _context: BackendRequestContext<'_>,
+        _request: NativeExchangeRequest,
+        _rejection: NativeExchangeRejection,
+    ) -> Result<NativeExchangeOutcome, RpcFailure> {
+        Err(RpcFailure::new(
+            ErrorCode::HfxProtocol002,
+            ProtocolErrorKind::UnsupportedFeature,
+        ))
+    }
+
+    /// Drains bounded route-token invalidations for the actor scheduler.
+    ///
+    /// Backends without a native route authority have no invalidations. The
+    /// production backend keeps rejection tombstones after this notification
+    /// is consumed, so draining it cannot restore old authority.
+    fn take_native_route_invalidations(
+        &mut self,
+    ) -> Vec<(NativeRouteToken, NativeExchangeRejection)> {
+        Vec::new()
+    }
+
     /// Reads bounded native-route lifecycle changes after one cursor.
     ///
     /// # Errors
@@ -322,22 +397,9 @@ impl ConnectionDispatcher {
             return self.dispatch_negotiation(&request, request_id, identities, sessions);
         }
 
-        let authorization = match self.session.authorize_request(&request) {
-            Ok(authorization)
-                if sessions
-                    .authorizes(&authorization.session_id, authorization.authorization_epoch) =>
-            {
-                authorization
-            }
-            Ok(_) => {
-                return self.error_response(
-                    Some(request_id),
-                    RpcFailure::from_session(&SessionError::SessionRevoked),
-                );
-            }
-            Err(error) => {
-                return self.error_response(Some(request_id), RpcFailure::from_session(&error));
-            }
+        let authorization = match self.authorize(&request, sessions) {
+            Ok(authorization) => authorization,
+            Err(failure) => return self.error_response(Some(request_id), failure),
         };
 
         let error_request_id = request_id.clone();
@@ -388,6 +450,71 @@ impl ConnectionDispatcher {
         response.unwrap_or_else(|failure| self.error_response(Some(error_request_id), failure))
     }
 
+    pub(crate) fn deferred_native_authorized(
+        &self,
+        request: &RpcRequest,
+        sessions: &SessionRegistry,
+    ) -> Result<(), RpcFailure> {
+        if !matches!(request, RpcRequest::NativeTransact(_)) {
+            return Err(RpcFailure::new(
+                ErrorCode::HfxRequest001,
+                ProtocolErrorKind::InvalidRequest,
+            ));
+        }
+        self.authorize(request, sessions).map(|_| ())
+    }
+
+    pub(crate) fn failure_response(
+        &self,
+        request_id: RequestId,
+        failure: RpcFailure,
+    ) -> RpcResponse {
+        self.error_response(Some(request_id), failure)
+    }
+
+    pub(crate) fn dispatch_native_rejection<B>(
+        &mut self,
+        request: RpcRequest,
+        sessions: &SessionRegistry,
+        backend: &mut B,
+        rejection: NativeExchangeRejection,
+    ) -> RpcResponse
+    where
+        B: BridgeRpcBackend,
+    {
+        let request_id = request.request_id().clone();
+        let authorization = match self.authorize(&request, sessions) {
+            Ok(authorization) => authorization,
+            Err(failure) => return self.error_response(Some(request_id), failure),
+        };
+        let RpcRequest::NativeTransact(envelope) = request else {
+            return self.error_response(
+                Some(request_id),
+                RpcFailure::new(ErrorCode::HfxRequest001, ProtocolErrorKind::InvalidRequest),
+            );
+        };
+        let context = BackendRequestContext::new(&authorization, sessions);
+        match backend.reject_native_exchange(context, envelope.params, rejection) {
+            Ok(result) => RpcResponse::NativeTransactSuccess(self.success(request_id, result)),
+            Err(failure) => self.error_response(Some(request_id), failure),
+        }
+    }
+
+    fn authorize(
+        &self,
+        request: &RpcRequest,
+        sessions: &SessionRegistry,
+    ) -> Result<AuthorizedSession, RpcFailure> {
+        let authorization = self
+            .session
+            .authorize_request(request)
+            .map_err(|error| RpcFailure::from_session(&error))?;
+        if !sessions.authorizes(&authorization.session_id, authorization.authorization_epoch) {
+            return Err(RpcFailure::from_session(&SessionError::SessionRevoked));
+        }
+        Ok(authorization)
+    }
+
     fn dispatch_negotiation<S: SessionIdentitySource>(
         &mut self,
         request: &RpcRequest,
diff --git a/crates/hfx-bridge/tests/connection_runtime.rs b/crates/hfx-bridge/tests/connection_runtime.rs
index c1cbc44..c3ad17e 100644
--- a/crates/hfx-bridge/tests/connection_runtime.rs
+++ b/crates/hfx-bridge/tests/connection_runtime.rs
@@ -334,6 +334,7 @@ fn shared_actor_serves_two_independent_clients_without_backend_lock_ownership()
     let limits = BridgeActorLimits {
         command_capacity: QueueCapacity::try_from(16).expect("command capacity is valid"),
         connection_capacity: QueueCapacity::try_from(4).expect("connection capacity is valid"),
+        native_transaction_capacity: QueueCapacity::try_from(16).expect("native capacity is valid"),
         response_timeout: Duration::from_secs(2),
     };
     let (actor, handle) = BridgeActor::new(
@@ -416,6 +417,7 @@ fn runtime_tick_runs_after_commands_even_when_idle_timeout_is_long() {
     let limits = BridgeActorLimits {
         command_capacity: QueueCapacity::try_from(4).expect("command capacity is valid"),
         connection_capacity: QueueCapacity::try_from(2).expect("connection capacity is valid"),
+        native_transaction_capacity: QueueCapacity::try_from(4).expect("native capacity is valid"),
         response_timeout: Duration::from_secs(2),
     };
     let (actor, handle) = BridgeActor::new(
diff --git a/crates/hfx-daemon/src/manager.rs b/crates/hfx-daemon/src/manager.rs
index ad17eaf..7c3d4d2 100644
--- a/crates/hfx-daemon/src/manager.rs
+++ b/crates/hfx-daemon/src/manager.rs
@@ -8,7 +8,7 @@ use crate::{
 };
 use hfx_bridge::{
     GenerationOrchestrationError, LifecycleObservationError, LifecycleObservationOutcome,
-    ReceiverDisconnectObservation, ReceiverGenerationObservation, SessionRegistry,
+    ReceiverDisconnectObservation, ReceiverGenerationObservation, RpcFailure, SessionRegistry,
     StableCaptureStatus,
 };
 use hfx_core::{Clock, LifecycleError, RestorationError};
@@ -59,6 +59,7 @@ pub enum RuntimeTickError {
     Route(KernelRouteError),
     Generation(GenerationOrchestrationError),
     Observation(LifecycleObservationError),
+    NativeRoutes(RpcFailure),
     Translation(PassiveTranslationError),
     Lifecycle(LifecycleError),
     Domain(DomainValueError),
@@ -80,6 +81,7 @@ impl fmt::Display for RuntimeTickError {
             Self::Route(_) => "kernel receiver routing failed",
             Self::Generation(_) => "receiver generation orchestration failed",
             Self::Observation(_) => "receiver lifecycle observation failed",
+            Self::NativeRoutes(_) => "native receiver route reconciliation failed",
             Self::Translation(_) => "passive receiver observation is contradictory",
             Self::Lifecycle(_) => "receiver lifecycle stamp is invalid",
             Self::Domain(_) => "receiver runtime identity value is invalid",
@@ -156,6 +158,7 @@ impl LinuxRuntimeManager {
             self.next_discovery = Some(now + nonzero_interval(self.discovery_interval));
         }
         self.process_observations(backend, &mut report)?;
+        backend.tick().map_err(RuntimeTickError::NativeRoutes)?;
         let application_waiting = backend.queued_transactions() > 0;
         if !application_waiting || self.prefer_restoration {
             report.restoration = self
diff --git a/crates/hfx-daemon/src/production.rs b/crates/hfx-daemon/src/production.rs
index 3a7dddc..fc93a64 100644
--- a/crates/hfx-daemon/src/production.rs
+++ b/crates/hfx-daemon/src/production.rs
@@ -159,6 +159,7 @@ pub fn compose_production(
         actor_limits: BridgeActorLimits {
             command_capacity,
             connection_capacity,
+            native_transaction_capacity: transaction_capacity,
             response_timeout: Duration::from_millis(ACTOR_RESPONSE_TIMEOUT_MS),
         },
         session_identities: KernelSessionIdentitySource,

From 16d853610926bb8ab10554a0131c7865a845138e Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 21:02:47 +0400
Subject: [PATCH 48/67] fix: preserve actor runtime tick ordering

---
 crates/hfx-bridge/src/actor.rs | 60 ++++++++++++++++++----------------
 1 file changed, 32 insertions(+), 28 deletions(-)

diff --git a/crates/hfx-bridge/src/actor.rs b/crates/hfx-bridge/src/actor.rs
index a39e8ec..0667971 100644
--- a/crates/hfx-bridge/src/actor.rs
+++ b/crates/hfx-bridge/src/actor.rs
@@ -304,42 +304,46 @@ where
                 }
             };
 
-            if let Some(command) = command
-                && let Some(reply) = self.process_batch(command)
-            {
-                let exit = self.cleanup_all();
-                let _ = reply.send(exit);
-                return Ok(exit);
+            let mut processed_command = false;
+            if let Some(mut command) = command {
+                for batch_index in 0..self.command_batch_capacity {
+                    if let Some(reply) = self.process(command) {
+                        let exit = self.cleanup_all();
+                        let _ = reply.send(exit);
+                        return Ok(exit);
+                    }
+                    processed_command = true;
+                    match tick(&mut self.backend, &self.sessions) {
+                        Ok(true) => self.cancel_invalidated_native(),
+                        Ok(false) => return Ok(self.cleanup_all()),
+                        Err(error) => {
+                            let cleanup = self.cleanup_all();
+                            return Err(BridgeActorTickFailure { error, cleanup });
+                        }
+                    }
+                    if batch_index + 1 == self.command_batch_capacity {
+                        break;
+                    }
+                    match self.commands.try_recv() {
+                        Ok(next) => command = next,
+                        Err(TryRecvError::Empty | TryRecvError::Disconnected) => break,
+                    }
+                }
             }
             self.cancel_invalidated_native();
             self.dispatch_next_native();
             self.cancel_invalidated_native();
-            match tick(&mut self.backend, &self.sessions) {
-                Ok(true) => self.cancel_invalidated_native(),
-                Ok(false) => return Ok(self.cleanup_all()),
-                Err(error) => {
-                    let cleanup = self.cleanup_all();
-                    return Err(BridgeActorTickFailure { error, cleanup });
-                }
-            }
-        }
-    }
-
-    fn process_batch(&mut self, first: BridgeActorCommand) -> Option<SyncSender<BridgeActorExit>> {
-        if let Some(reply) = self.process(first) {
-            return Some(reply);
-        }
-        for _ in 1..self.command_batch_capacity {
-            match self.commands.try_recv() {
-                Ok(command) => {
-                    if let Some(reply) = self.process(command) {
-                        return Some(reply);
+            if !processed_command {
+                match tick(&mut self.backend, &self.sessions) {
+                    Ok(true) => self.cancel_invalidated_native(),
+                    Ok(false) => return Ok(self.cleanup_all()),
+                    Err(error) => {
+                        let cleanup = self.cleanup_all();
+                        return Err(BridgeActorTickFailure { error, cleanup });
                     }
                 }
-                Err(TryRecvError::Empty | TryRecvError::Disconnected) => break,
             }
         }
-        None
     }
 
     fn process(&mut self, command: BridgeActorCommand) -> Option<SyncSender<BridgeActorExit>> {

From 0b6299923677161f0d971acce0dd146ea5cb35a0 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 21:51:59 +0400
Subject: [PATCH 49/67] fix: validate native report structure

---
 crates/hfx-bridge/src/backend.rs              | 158 ++++++++-
 crates/hfx-bridge/src/profile_authority.rs    |  16 +-
 crates/hfx-profiles/src/catalog.rs            |  16 +-
 crates/hfx-profiles/src/generated.rs          |  91 ++++-
 crates/hfx-profiles/src/lib.rs                |   5 +
 crates/hfx-profiles/src/native_report.rs      | 326 ++++++++++++++++++
 docs/generated/supported-hardware.md          |   4 +-
 .../generated/hyperflux_receiver_profiles.inc |  19 +-
 driver/kernel/hyperflux-next-native.c         |  76 +++-
 driver/kernel/hyperflux-next-profile.h        |  22 ++
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  39 ++-
 .../razer-hyperflux-v2-1532-00cf.json         |  11 +-
 schemas/hardware-profile.schema.json          |  62 +++-
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  20 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_kernel_driver.py                   |  28 ++
 tests/test_profiles.py                        |  42 +++
 tools/hfxdev/generators/profiles.py           | 122 +++++++
 tools/hfxdev/profiles.py                      | 109 ++++++
 21 files changed, 1134 insertions(+), 42 deletions(-)
 create mode 100644 crates/hfx-profiles/src/native_report.rs

diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index dabe785..0a0094f 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -17,11 +17,12 @@ use hfx_core::{
     BoundedEventLog, Clock, DesiredEffectError, DiagnosticRegistry, DiagnosticRegistryError,
     DispatchResult, EventDraft, EventLogError, EventSink, LeaseManager, LeaseManagerError,
     LifecycleLimits, NATIVE_REPORT_BYTES, NativeEndpointLane, NativeTransportDispatch,
-    NativeTransportResult, OutcomeJournalError, OutcomeLookup, PersistedStableIntent,
-    ProfileRegistry, ReceiverLifecycleRegistry, ReceiverTransport, RestorationAuthority,
-    RestorationError, RestoreAdvanceResult, RestorePlanResult, RestoreRecord, RestoreTrigger,
-    SessionAuthority, StableCommitOutcome, SubmissionResult, TransactionCoordinator,
-    TransactionCoordinatorError, TransactionQueueError, VolatileEffectRegistry, WallClock,
+    NativeTransportOutcome, NativeTransportResult, OutcomeJournalError, OutcomeLookup,
+    PersistedStableIntent, ProfileRegistry, ReceiverLifecycleRegistry, ReceiverTransport,
+    RestorationAuthority, RestorationError, RestoreAdvanceResult, RestorePlanResult, RestoreRecord,
+    RestoreTrigger, SessionAuthority, StableCommitOutcome, SubmissionResult,
+    TransactionCoordinator, TransactionCoordinatorError, TransactionQueueError,
+    VolatileEffectRegistry, WallClock,
 };
 use hfx_domain::{
     DeviceKind, EventKind, FindingId, LeaseDurationMs, MonotonicMs, NativeReportHex,
@@ -30,6 +31,7 @@ use hfx_domain::{
 };
 use hfx_errors::ErrorCode;
 use hfx_integration_model::project_integration_view;
+use hfx_profiles::{NativeExchangeRecord, native_response_matches, validate_native_request};
 use hfx_protocol::{
     BridgeSnapshot, DiagnosticSnapshot, EventBatch, IntegrationView, LeaseRequest, LeaseResult,
     NativeExchangeMatchedResponse, NativeExchangeNotSent, NativeExchangeOutcome,
@@ -1146,6 +1148,11 @@ where
         if usize::from(route.report_bytes.get()) != NATIVE_REPORT_BYTES {
             return self.reject_native_before_set(request, ProtocolErrorKind::InvalidRequest);
         }
+        let native_profile = match native_profile_for_route(&self.profiles, &self.receivers, &route)
+        {
+            Ok(profile) => profile,
+            Err(error_kind) => return self.reject_native_before_set(request, error_kind),
+        };
 
         let endpoint = match route.device_kind {
             DeviceKind::Mouse => NativeEndpointLane::Pointer,
@@ -1158,6 +1165,9 @@ where
         let Ok(report) = decode_native_report(&request.report) else {
             return self.reject_native_before_set(request, ProtocolErrorKind::InvalidRequest);
         };
+        if validate_native_request(&native_profile, &report).is_err() {
+            return self.reject_native_before_set(request, ProtocolErrorKind::InvalidRequest);
+        }
         let route_token_digest = native_route_token_digest(&request.route_token);
         let dispatch = NativeTransportDispatch {
             session_id: context.session().session_id.clone(),
@@ -1171,16 +1181,12 @@ where
             timeout_ms: request.timeout_ms,
         };
         let transport_outcome = self.transport.native_exchange(&dispatch);
-        let result = if transport_outcome.dispatch_nonce != dispatch.dispatch_nonce
-            || transport_outcome.route_token_digest != dispatch.route_token_digest
-        {
-            NativeExchangeResult::MayHaveBeenSent(NativeExchangeUncertain {
-                error_kind: ProtocolErrorKind::OutcomeUnknown,
-                finding_id: finding(ErrorCode::HfxTransport002),
-            })
-        } else {
-            protocol_native_result(&transport_outcome.result)?
-        };
+        let result = validated_native_transport_result(
+            &native_profile,
+            &report,
+            &dispatch,
+            &transport_outcome,
+        )?;
         self.complete_native_exchange(request, result)
     }
 
@@ -1282,6 +1288,49 @@ fn native_route_token_digest(token: &hfx_domain::NativeRouteToken) -> [u8; 32] {
     Sha256::digest(token.as_str().as_bytes()).into()
 }
 
+fn native_profile_for_route(
+    profiles: &RuntimeProfileAuthority,
+    receivers: &ReceiverLifecycleRegistry,
+    route: &NativeRoute,
+) -> Result<NativeExchangeRecord, ProtocolErrorKind> {
+    let profile = profiles
+        .view(receivers)
+        .native_exchange(&route.receiver_id, route.generation_id)
+        .ok_or(ProtocolErrorKind::UnsupportedFeature)?;
+    if profile.protocol_family != route.protocol_family.as_str()
+        || profile.report_bytes != route.report_bytes.get()
+    {
+        return Err(ProtocolErrorKind::InvalidRequest);
+    }
+    Ok(profile)
+}
+
+fn validated_native_transport_result(
+    profile: &NativeExchangeRecord,
+    request: &[u8; NATIVE_REPORT_BYTES],
+    dispatch: &NativeTransportDispatch,
+    outcome: &NativeTransportOutcome,
+) -> Result<NativeExchangeResult, RpcFailure> {
+    if outcome.dispatch_nonce != dispatch.dispatch_nonce
+        || outcome.route_token_digest != dispatch.route_token_digest
+    {
+        return Ok(native_uncertain_result());
+    }
+    if let NativeTransportResult::MatchedResponse(response) = &outcome.result
+        && native_response_matches(profile, request, response) != Ok(true)
+    {
+        return Ok(native_uncertain_result());
+    }
+    protocol_native_result(&outcome.result)
+}
+
+fn native_uncertain_result() -> NativeExchangeResult {
+    NativeExchangeResult::MayHaveBeenSent(NativeExchangeUncertain {
+        error_kind: ProtocolErrorKind::OutcomeUnknown,
+        finding_id: finding(ErrorCode::HfxTransport002),
+    })
+}
+
 fn protocol_native_result(
     result: &NativeTransportResult,
 ) -> Result<NativeExchangeResult, RpcFailure> {
@@ -1524,8 +1573,9 @@ fn subscription_failure(error: SubscriptionRegistryError) -> RpcFailure {
 mod tests {
     use super::*;
     use hfx_domain::{
-        EndpointId, GenerationId, LogicalDeviceId, NativeProtocolFamily, NativeReportByteCount,
-        ProductId, VendorId,
+        AuthorizationEpoch, DispatchNonce, EndpointId, GenerationId, LogicalDeviceId,
+        NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, ProductId, SessionId,
+        VendorId,
     };
 
     fn text<T>(value: &str) -> T
@@ -1555,6 +1605,33 @@ mod tests {
         }
     }
 
+    fn native_report(status: u8) -> [u8; NATIVE_REPORT_BYTES] {
+        let mut report = [0_u8; NATIVE_REPORT_BYTES];
+        report[0] = status;
+        report[5] = 2;
+        report[6] = 0x1f;
+        report[7] = 0x03;
+        report[8] = 0xaa;
+        report[9] = 0x55;
+        report[88] = report[2..88].iter().fold(0_u8, |value, byte| value ^ byte);
+        report
+    }
+
+    fn native_dispatch() -> NativeTransportDispatch {
+        NativeTransportDispatch {
+            session_id: text::<SessionId>("session-1"),
+            authorization_epoch: AuthorizationEpoch::try_from(1_u64)
+                .expect("authorization epoch is canonical"),
+            dispatch_nonce: DispatchNonce::try_from(1_u64).expect("nonce is canonical"),
+            receiver_id: text("receiver-1"),
+            generation_id: GenerationId::try_from(1_u64).expect("generation is canonical"),
+            endpoint: NativeEndpointLane::Pointer,
+            route_token_digest: [0x5a; 32],
+            report: native_report(0),
+            timeout_ms: NativeExchangeTimeoutMs::try_from(100_u16).expect("timeout is canonical"),
+        }
+    }
+
     #[test]
     fn route_invalidation_preserves_generation_availability_and_authority_causes() {
         let previous = route(1, NativeRouteAccess::Qualified, RouteState::Available);
@@ -1596,4 +1673,51 @@ mod tests {
             NativeExchangeRejection::RouteUnavailable
         );
     }
+
+    #[test]
+    fn bridge_accepts_only_structurally_valid_matching_native_responses() {
+        let catalog = hfx_profiles::RuntimeProfileCatalog::load().expect("profiles are valid");
+        let profile = catalog
+            .receiver(
+                VendorId::try_from(0x1532_u16).expect("vendor is canonical"),
+                ProductId::try_from(0x00cf_u16).expect("product is canonical"),
+            )
+            .and_then(|receiver| receiver.native_exchange)
+            .expect("receiver native profile exists");
+        let dispatch = native_dispatch();
+        let matched = NativeTransportOutcome {
+            dispatch_nonce: dispatch.dispatch_nonce,
+            route_token_digest: dispatch.route_token_digest,
+            result: NativeTransportResult::MatchedResponse(native_report(2)),
+        };
+        assert!(matches!(
+            validated_native_transport_result(&profile, &dispatch.report, &dispatch, &matched),
+            Ok(NativeExchangeResult::MatchedResponse(_))
+        ));
+
+        let mut malformed = native_report(2);
+        malformed[88] ^= 1;
+        let malformed = NativeTransportOutcome {
+            result: NativeTransportResult::MatchedResponse(malformed),
+            ..matched.clone()
+        };
+        assert_eq!(
+            validated_native_transport_result(&profile, &dispatch.report, &dispatch, &malformed),
+            Ok(native_uncertain_result())
+        );
+
+        let mut unrelated = native_report(2);
+        unrelated[7] ^= 1;
+        unrelated[88] = unrelated[2..88]
+            .iter()
+            .fold(0_u8, |value, byte| value ^ byte);
+        let unrelated = NativeTransportOutcome {
+            result: NativeTransportResult::MatchedResponse(unrelated),
+            ..matched
+        };
+        assert_eq!(
+            validated_native_transport_result(&profile, &dispatch.report, &dispatch, &unrelated),
+            Ok(native_uncertain_result())
+        );
+    }
 }
diff --git a/crates/hfx-bridge/src/profile_authority.rs b/crates/hfx-bridge/src/profile_authority.rs
index 878c53d..f73c273 100644
--- a/crates/hfx-bridge/src/profile_authority.rs
+++ b/crates/hfx-bridge/src/profile_authority.rs
@@ -8,7 +8,9 @@ use hfx_domain::{
     DeviceWriteReadiness, GenerationId, PresenceState, ProductId, ProfileDigest, ProfileId,
     ProfileKind, ReceiverId, ReceiverLifecycleState, ResourceKind, VendorId,
 };
-use hfx_profiles::{ProfileCatalogError, RuntimeProfile, RuntimeProfileCatalog};
+use hfx_profiles::{
+    NativeExchangeRecord, ProfileCatalogError, RuntimeProfile, RuntimeProfileCatalog,
+};
 use hfx_protocol::ResourceKey;
 use std::collections::BTreeMap;
 use std::fmt;
@@ -218,6 +220,18 @@ pub struct RuntimeProfileView<'a> {
 }
 
 impl<'a> RuntimeProfileView<'a> {
+    /// Returns the generated native-exchange contract for one exact active
+    /// receiver generation.
+    #[must_use]
+    pub fn native_exchange(
+        self,
+        receiver_id: &ReceiverId,
+        generation_id: GenerationId,
+    ) -> Option<NativeExchangeRecord> {
+        let (_, _, receiver_profile) = self.active_generation(receiver_id, generation_id)?;
+        receiver_profile.native_exchange
+    }
+
     #[must_use]
     pub fn profile_for_device(
         self,
diff --git a/crates/hfx-profiles/src/catalog.rs b/crates/hfx-profiles/src/catalog.rs
index be9a854..321fe4f 100644
--- a/crates/hfx-profiles/src/catalog.rs
+++ b/crates/hfx-profiles/src/catalog.rs
@@ -5,6 +5,7 @@ use crate::{
     PassiveTelemetryRecord, PresentationRecord, ProfileRecord, QualificationMigrationRecord,
     ReturnEvidenceSource,
 };
+use crate::{NativeReportValidationError, validate_native_exchange_record};
 use hfx_domain::{
     CapabilityId, CarrierIndex, DeviceKind, DomainValueError, LedCount, ProductId, ProfileDigest,
     ProfileId, ProfileKind, ProfileRevision, ReturnEvidence, RouteKind, SupportLevel, VendorId,
@@ -22,6 +23,7 @@ pub enum ProfileCatalogError {
     MissingPresentation(ProfileId),
     UnexpectedPresentation(ProfileId),
     InvalidProfileKind(ProfileId),
+    InvalidNativeExchange(ProfileId, NativeReportValidationError),
 }
 
 impl fmt::Display for ProfileCatalogError {
@@ -63,6 +65,12 @@ impl fmt::Display for ProfileCatalogError {
                     "profile kind and device kind disagree: {profile_id}"
                 )
             }
+            Self::InvalidNativeExchange(profile_id, error) => {
+                write!(
+                    formatter,
+                    "native exchange profile is invalid for {profile_id}: {error}"
+                )
+            }
         }
     }
 }
@@ -255,8 +263,14 @@ impl RuntimeProfileCatalog {
 }
 
 fn convert_profile(record: &ProfileRecord) -> Result<RuntimeProfile, ProfileCatalogError> {
+    let profile_id = ProfileId::try_from(record.id)?;
+    if let Some(native_exchange) = record.native_exchange {
+        validate_native_exchange_record(&native_exchange).map_err(|error| {
+            ProfileCatalogError::InvalidNativeExchange(profile_id.clone(), error)
+        })?;
+    }
     Ok(RuntimeProfile {
-        profile_id: ProfileId::try_from(record.id)?,
+        profile_id,
         runtime_digest: ProfileDigest::try_from(record.runtime_sha256)?,
         revision: ProfileRevision::try_from(record.revision)?,
         profile_kind: record.profile_kind,
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index e52921a..55f519b 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad
+// Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -118,6 +118,55 @@ pub struct NativeMatchRangeRecord {
     pub length: u16,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeChecksumAlgorithm {
+    Xor8,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeByteValueRecord {
+    pub offset: u16,
+    pub value: u8,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeByteRangeRecord {
+    pub offset: u16,
+    pub minimum: u8,
+    pub maximum: u8,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeDataSizeRecord {
+    pub offset: u16,
+    pub maximum: u8,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeChecksumRecord {
+    pub algorithm: NativeChecksumAlgorithm,
+    pub start_offset: u16,
+    pub end_offset_exclusive: u16,
+    pub result_offset: u16,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeTransactionIdRecord {
+    pub offset: u16,
+    pub match_mask: u8,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeReportFormatRecord {
+    pub request_status: NativeByteValueRecord,
+    pub response_status: NativeByteRangeRecord,
+    pub protocol_type: NativeByteValueRecord,
+    pub data_size: NativeDataSizeRecord,
+    pub checksum: NativeChecksumRecord,
+    pub trailer: NativeByteValueRecord,
+    pub transaction_id: NativeTransactionIdRecord,
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct NativeExchangeRecord {
     pub protocol_family: &'static str,
@@ -127,6 +176,7 @@ pub struct NativeExchangeRecord {
     pub initial_response_delay_us: u32,
     pub response_retry_delay_us: u32,
     pub max_response_attempts: u8,
+    pub report_format: NativeReportFormatRecord,
     pub match_ranges: &'static [NativeMatchRangeRecord],
 }
 
@@ -157,7 +207,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad";
+    "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
@@ -558,8 +608,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "receiver.razer.hyperflux-v2.1532-00cf",
-        runtime_sha256: "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2",
-        revision: 2,
+        runtime_sha256: "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01",
+        revision: 3,
         profile_kind: ProfileKind::Receiver,
         device_kind: DeviceKind::Receiver,
         vendor_id: Some(5426),
@@ -581,6 +631,39 @@ pub const PROFILES: &[ProfileRecord] = &[
             initial_response_delay_us: 8000,
             response_retry_delay_us: 10000,
             max_response_attempts: 5,
+            report_format: NativeReportFormatRecord {
+                request_status: NativeByteValueRecord {
+                    offset: 0,
+                    value: 0,
+                },
+                response_status: NativeByteRangeRecord {
+                    offset: 0,
+                    minimum: 1,
+                    maximum: 5,
+                },
+                protocol_type: NativeByteValueRecord {
+                    offset: 4,
+                    value: 0,
+                },
+                data_size: NativeDataSizeRecord {
+                    offset: 5,
+                    maximum: 80,
+                },
+                checksum: NativeChecksumRecord {
+                    algorithm: NativeChecksumAlgorithm::Xor8,
+                    start_offset: 2,
+                    end_offset_exclusive: 88,
+                    result_offset: 88,
+                },
+                trailer: NativeByteValueRecord {
+                    offset: 89,
+                    value: 0,
+                },
+                transaction_id: NativeTransactionIdRecord {
+                    offset: 1,
+                    match_mask: 0,
+                },
+            },
             match_ranges: NATIVE_MATCH_RANGES_2,
         }),
         lighting: None,
diff --git a/crates/hfx-profiles/src/lib.rs b/crates/hfx-profiles/src/lib.rs
index 10555bc..ab822f0 100644
--- a/crates/hfx-profiles/src/lib.rs
+++ b/crates/hfx-profiles/src/lib.rs
@@ -4,9 +4,14 @@
 
 mod catalog;
 mod generated;
+mod native_report;
 
 pub use catalog::{
     ProfileCatalogError, RuntimeCapability, RuntimeLightingTopology, RuntimePresentation,
     RuntimeProfile, RuntimeProfileCatalog,
 };
 pub use generated::*;
+pub use native_report::{
+    NativeReportValidationError, native_response_matches, validate_native_exchange_record,
+    validate_native_request, validate_native_response,
+};
diff --git a/crates/hfx-profiles/src/native_report.rs b/crates/hfx-profiles/src/native_report.rs
new file mode 100644
index 0000000..190f651
--- /dev/null
+++ b/crates/hfx-profiles/src/native_report.rs
@@ -0,0 +1,326 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::{NativeChecksumAlgorithm, NativeExchangeRecord};
+use std::fmt;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeReportValidationError {
+    InvalidProfile,
+    InvalidLength,
+    InvalidRequestStatus,
+    InvalidResponseStatus,
+    InvalidProtocolType,
+    InvalidDataSize,
+    InvalidChecksum,
+    InvalidTrailer,
+}
+
+impl fmt::Display for NativeReportValidationError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::InvalidProfile => "native report profile is invalid",
+            Self::InvalidLength => "native report length is invalid",
+            Self::InvalidRequestStatus => "native request status is invalid",
+            Self::InvalidResponseStatus => "native response status is invalid",
+            Self::InvalidProtocolType => "native report protocol type is invalid",
+            Self::InvalidDataSize => "native report data size is invalid",
+            Self::InvalidChecksum => "native report checksum is invalid",
+            Self::InvalidTrailer => "native report trailer is invalid",
+        })
+    }
+}
+
+impl std::error::Error for NativeReportValidationError {}
+
+/// Validates one generated native-exchange record before runtime use.
+///
+/// # Errors
+///
+/// Returns [`NativeReportValidationError::InvalidProfile`] when an offset,
+/// checksum range, or response match range escapes the declared report.
+pub fn validate_native_exchange_record(
+    profile: &NativeExchangeRecord,
+) -> Result<(), NativeReportValidationError> {
+    let report_bytes = usize::from(profile.report_bytes);
+    let format = profile.report_format;
+    let offsets = [
+        format.request_status.offset,
+        format.response_status.offset,
+        format.protocol_type.offset,
+        format.data_size.offset,
+        format.checksum.result_offset,
+        format.trailer.offset,
+        format.transaction_id.offset,
+    ];
+    if report_bytes == 0
+        || offsets
+            .iter()
+            .any(|offset| usize::from(*offset) >= report_bytes)
+        || format.checksum.start_offset >= format.checksum.end_offset_exclusive
+        || usize::from(format.checksum.end_offset_exclusive) > report_bytes
+        || (format.checksum.result_offset >= format.checksum.start_offset
+            && format.checksum.result_offset < format.checksum.end_offset_exclusive)
+        || profile.match_ranges.is_empty()
+    {
+        return Err(NativeReportValidationError::InvalidProfile);
+    }
+    let mut previous_end = 0_usize;
+    for range in profile.match_ranges {
+        let offset = usize::from(range.offset);
+        let length = usize::from(range.length);
+        if length == 0 || offset < previous_end || offset + length > report_bytes {
+            return Err(NativeReportValidationError::InvalidProfile);
+        }
+        previous_end = offset + length;
+    }
+    Ok(())
+}
+
+/// Validates one opaque request against its generated protocol format.
+///
+/// # Errors
+///
+/// Returns a typed structural error before any transport may observe malformed
+/// request bytes.
+pub fn validate_native_request(
+    profile: &NativeExchangeRecord,
+    report: &[u8],
+) -> Result<(), NativeReportValidationError> {
+    validate_native_exchange_record(profile)?;
+    validate_report_length(profile, report)?;
+    let format = profile.report_format;
+    if report[usize::from(format.request_status.offset)] != format.request_status.value {
+        return Err(NativeReportValidationError::InvalidRequestStatus);
+    }
+    validate_common_report(profile, report)
+}
+
+/// Validates one response against its generated protocol format.
+///
+/// Response status remains an upstream-device semantic. The tunnel validates
+/// framing and returns failure statuses unchanged to the owning application.
+///
+/// # Errors
+///
+/// Returns a typed structural error for malformed response bytes.
+pub fn validate_native_response(
+    profile: &NativeExchangeRecord,
+    report: &[u8],
+) -> Result<(), NativeReportValidationError> {
+    validate_native_exchange_record(profile)?;
+    validate_report_length(profile, report)?;
+    let status = profile.report_format.response_status;
+    let response_status = report[usize::from(status.offset)];
+    if response_status < status.minimum || response_status > status.maximum {
+        return Err(NativeReportValidationError::InvalidResponseStatus);
+    }
+    validate_common_report(profile, report)
+}
+
+/// Checks one structurally valid response against declarative request fields.
+///
+/// # Errors
+///
+/// Returns a typed structural error when either report is malformed. A valid
+/// but unrelated response returns `Ok(false)`.
+pub fn native_response_matches(
+    profile: &NativeExchangeRecord,
+    request: &[u8],
+    response: &[u8],
+) -> Result<bool, NativeReportValidationError> {
+    validate_native_request(profile, request)?;
+    validate_native_response(profile, response)?;
+    let transaction = profile.report_format.transaction_id;
+    let transaction_difference =
+        request[usize::from(transaction.offset)] ^ response[usize::from(transaction.offset)];
+    if transaction_difference & transaction.match_mask != 0 {
+        return Ok(false);
+    }
+    Ok(profile.match_ranges.iter().all(|range| {
+        let start = usize::from(range.offset);
+        let end = start + usize::from(range.length);
+        request[start..end] == response[start..end]
+    }))
+}
+
+fn validate_report_length(
+    profile: &NativeExchangeRecord,
+    report: &[u8],
+) -> Result<(), NativeReportValidationError> {
+    if report.len() == usize::from(profile.report_bytes) {
+        Ok(())
+    } else {
+        Err(NativeReportValidationError::InvalidLength)
+    }
+}
+
+fn validate_common_report(
+    profile: &NativeExchangeRecord,
+    report: &[u8],
+) -> Result<(), NativeReportValidationError> {
+    let format = profile.report_format;
+    if report[usize::from(format.protocol_type.offset)] != format.protocol_type.value {
+        return Err(NativeReportValidationError::InvalidProtocolType);
+    }
+    if report[usize::from(format.data_size.offset)] > format.data_size.maximum {
+        return Err(NativeReportValidationError::InvalidDataSize);
+    }
+    let checksum = match format.checksum.algorithm {
+        NativeChecksumAlgorithm::Xor8 => report[usize::from(format.checksum.start_offset)
+            ..usize::from(format.checksum.end_offset_exclusive)]
+            .iter()
+            .fold(0_u8, |value, byte| value ^ byte),
+    };
+    if checksum != report[usize::from(format.checksum.result_offset)] {
+        return Err(NativeReportValidationError::InvalidChecksum);
+    }
+    if report[usize::from(format.trailer.offset)] != format.trailer.value {
+        return Err(NativeReportValidationError::InvalidTrailer);
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{
+        NativeByteRangeRecord, NativeByteValueRecord, NativeChecksumRecord, NativeDataSizeRecord,
+        NativeMatchRangeRecord, NativeReportFormatRecord, NativeTransactionIdRecord,
+    };
+
+    const MATCH_RANGES: &[NativeMatchRangeRecord] = &[
+        NativeMatchRangeRecord {
+            offset: 2,
+            length: 2,
+        },
+        NativeMatchRangeRecord {
+            offset: 6,
+            length: 2,
+        },
+    ];
+
+    const fn profile(transaction_mask: u8) -> NativeExchangeRecord {
+        NativeExchangeRecord {
+            protocol_family: "razer-feature-report-v1",
+            report_bytes: 90,
+            set_report_index: 0,
+            response_report_index: 0,
+            initial_response_delay_us: 8_000,
+            response_retry_delay_us: 10_000,
+            max_response_attempts: 5,
+            report_format: NativeReportFormatRecord {
+                request_status: NativeByteValueRecord {
+                    offset: 0,
+                    value: 0,
+                },
+                response_status: NativeByteRangeRecord {
+                    offset: 0,
+                    minimum: 1,
+                    maximum: 5,
+                },
+                protocol_type: NativeByteValueRecord {
+                    offset: 4,
+                    value: 0,
+                },
+                data_size: NativeDataSizeRecord {
+                    offset: 5,
+                    maximum: 80,
+                },
+                checksum: NativeChecksumRecord {
+                    algorithm: NativeChecksumAlgorithm::Xor8,
+                    start_offset: 2,
+                    end_offset_exclusive: 88,
+                    result_offset: 88,
+                },
+                trailer: NativeByteValueRecord {
+                    offset: 89,
+                    value: 0,
+                },
+                transaction_id: NativeTransactionIdRecord {
+                    offset: 1,
+                    match_mask: transaction_mask,
+                },
+            },
+            match_ranges: MATCH_RANGES,
+        }
+    }
+
+    fn report(status: u8, transaction: u8) -> [u8; 90] {
+        let mut report = [0_u8; 90];
+        report[0] = status;
+        report[1] = transaction;
+        report[5] = 2;
+        report[6] = 0x1f;
+        report[7] = 0x03;
+        report[8] = 0xaa;
+        report[9] = 0x55;
+        report[88] = report[2..88].iter().fold(0_u8, |value, byte| value ^ byte);
+        report
+    }
+
+    #[test]
+    fn valid_request_and_response_match_declarative_fields() {
+        let request = report(0, 0x4f);
+        let response = report(2, 0x4f);
+        assert_eq!(validate_native_request(&profile(0xff), &request), Ok(()));
+        assert_eq!(validate_native_response(&profile(0xff), &response), Ok(()));
+        assert_eq!(
+            native_response_matches(&profile(0xff), &request, &response),
+            Ok(true)
+        );
+    }
+
+    #[test]
+    fn malformed_fields_fail_before_matching() {
+        let valid = report(0, 0);
+        for (offset, expected) in [
+            (0, NativeReportValidationError::InvalidRequestStatus),
+            (4, NativeReportValidationError::InvalidProtocolType),
+            (5, NativeReportValidationError::InvalidDataSize),
+            (88, NativeReportValidationError::InvalidChecksum),
+            (89, NativeReportValidationError::InvalidTrailer),
+        ] {
+            let mut malformed = valid;
+            malformed[offset] = if offset == 5 { 81 } else { 1 };
+            assert_eq!(
+                validate_native_request(&profile(0), &malformed),
+                Err(expected)
+            );
+        }
+    }
+
+    #[test]
+    fn response_matching_honors_optional_transaction_mask() {
+        let request = report(0, 0x10);
+        let response = report(2, 0x20);
+        assert_eq!(
+            native_response_matches(&profile(0), &request, &response),
+            Ok(true)
+        );
+        assert_eq!(
+            native_response_matches(&profile(0xff), &request, &response),
+            Ok(false)
+        );
+    }
+
+    #[test]
+    fn malformed_response_is_not_a_match() {
+        let request = report(0, 0);
+        let mut response = report(2, 0);
+        response[88] ^= 1;
+        assert_eq!(
+            native_response_matches(&profile(0), &request, &response),
+            Err(NativeReportValidationError::InvalidChecksum)
+        );
+    }
+
+    #[test]
+    fn nonterminal_response_status_is_not_a_match() {
+        let request = report(0, 0);
+        let response = report(0, 0);
+        assert_eq!(
+            native_response_matches(&profile(0), &request, &response),
+            Err(NativeReportValidationError::InvalidResponseStatus)
+        );
+    }
+}
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 6ed164b..63fac06 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad`
+Profile source: `ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -12,7 +12,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `62f114182069` | 7 | 7 |
 | **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `46703d44d594` | 6 | 7 |
-| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `4f469c2f3f70` | 4 | 2 |
+| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `196946934e4c` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
 ## Composition Contract
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index e535634..fa950cf 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad */
+/* Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343 */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
@@ -17,6 +17,23 @@ HFX_RECEIVER_PROFILE(
 	.native_initial_response_delay_us = 8000,
 	.native_response_retry_delay_us = 10000,
 	.native_max_response_attempts = 5,
+	.native_request_status_offset = 0,
+	.native_request_status_value = 0,
+	.native_response_status_offset = 0,
+	.native_response_status_minimum = 1,
+	.native_response_status_maximum = 5,
+	.native_protocol_type_offset = 4,
+	.native_protocol_type_value = 0,
+	.native_data_size_offset = 5,
+	.native_max_data_size = 80,
+	.native_checksum_kind = HFX_NATIVE_CHECKSUM_XOR8,
+	.native_checksum_start_offset = 2,
+	.native_checksum_end_offset = 88,
+	.native_checksum_result_offset = 88,
+	.native_trailer_offset = 89,
+	.native_trailer_value = 0,
+	.native_transaction_id_offset = 1,
+	.native_transaction_id_match_mask = 0,
 	.native_match_range_count = 2,
 	.native_match_ranges = { { .offset = 2, .length = 2 }, { .offset = 6, .length = 2 } }
 )
diff --git a/driver/kernel/hyperflux-next-native.c b/driver/kernel/hyperflux-next-native.c
index 85bdf9b..05fe573 100644
--- a/driver/kernel/hyperflux-next-native.c
+++ b/driver/kernel/hyperflux-next-native.c
@@ -26,7 +26,24 @@ static bool hfx_native_profile_valid(const struct hfx_receiver_profile *profile)
 	    !profile->native_max_response_attempts ||
 	    profile->native_max_response_attempts > 16U ||
 	    !profile->native_match_range_count ||
-	    profile->native_match_range_count > HFX_NATIVE_MATCH_RANGE_CAPACITY)
+	    profile->native_match_range_count > HFX_NATIVE_MATCH_RANGE_CAPACITY ||
+	    profile->native_request_status_offset >= profile->native_report_bytes ||
+	    profile->native_response_status_offset >= profile->native_report_bytes ||
+	    profile->native_response_status_minimum >
+		    profile->native_response_status_maximum ||
+	    profile->native_protocol_type_offset >= profile->native_report_bytes ||
+	    profile->native_data_size_offset >= profile->native_report_bytes ||
+	    profile->native_checksum_kind != HFX_NATIVE_CHECKSUM_XOR8 ||
+	    profile->native_checksum_start_offset >=
+		    profile->native_checksum_end_offset ||
+	    profile->native_checksum_end_offset > profile->native_report_bytes ||
+	    profile->native_checksum_result_offset >= profile->native_report_bytes ||
+	    (profile->native_checksum_result_offset >=
+		     profile->native_checksum_start_offset &&
+	     profile->native_checksum_result_offset <
+		     profile->native_checksum_end_offset) ||
+	    profile->native_trailer_offset >= profile->native_report_bytes ||
+	    profile->native_transaction_id_offset >= profile->native_report_bytes)
 		return false;
 
 	for (index = 0; index < profile->native_match_range_count; index++) {
@@ -41,6 +58,50 @@ static bool hfx_native_profile_valid(const struct hfx_receiver_profile *profile)
 	return true;
 }
 
+static bool hfx_native_checksum_valid(
+	const struct hfx_receiver_profile *profile, const u8 *report)
+{
+	u8 checksum = 0;
+	u16 index;
+
+	if (profile->native_checksum_kind != HFX_NATIVE_CHECKSUM_XOR8)
+		return false;
+	for (index = profile->native_checksum_start_offset;
+	     index < profile->native_checksum_end_offset; index++)
+		checksum ^= report[index];
+	return checksum == report[profile->native_checksum_result_offset];
+}
+
+static bool hfx_native_request_report_valid(
+	const struct hfx_receiver_profile *profile, const u8 *report)
+{
+	return report[profile->native_request_status_offset] ==
+		       profile->native_request_status_value &&
+		report[profile->native_protocol_type_offset] ==
+		       profile->native_protocol_type_value &&
+		report[profile->native_data_size_offset] <=
+		       profile->native_max_data_size &&
+		hfx_native_checksum_valid(profile, report) &&
+		report[profile->native_trailer_offset] ==
+		       profile->native_trailer_value;
+}
+
+static bool hfx_native_response_report_valid(
+	const struct hfx_receiver_profile *profile, const u8 *report)
+{
+	u8 status = report[profile->native_response_status_offset];
+
+	return status >= profile->native_response_status_minimum &&
+		status <= profile->native_response_status_maximum &&
+		report[profile->native_protocol_type_offset] ==
+		       profile->native_protocol_type_value &&
+		report[profile->native_data_size_offset] <=
+		       profile->native_max_data_size &&
+		hfx_native_checksum_valid(profile, report) &&
+		report[profile->native_trailer_offset] ==
+		       profile->native_trailer_value;
+}
+
 static int hfx_native_submit_validate(
 	const struct hfx_receiver *receiver,
 	const struct hfx_uapi_native_exchange_submit *submit)
@@ -62,7 +123,8 @@ static int hfx_native_submit_validate(
 	    submit->endpoint_slot != HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE)
 		return -EINVAL;
 	if (submit->report_length != HFX_UAPI_NATIVE_REPORT_BYTES ||
-	    submit->kernel_sequence)
+	    submit->kernel_sequence ||
+	    !hfx_native_request_report_valid(receiver->profile, submit->report))
 		return -EINVAL;
 	if (submit->deadline_boottime_ns <= now_ns ||
 	    submit->deadline_boottime_ns - now_ns >
@@ -256,6 +318,16 @@ static bool hfx_native_response_matches(
 	const u8 *request, const u8 *response)
 {
 	u16 index;
+	u8 transaction_difference;
+
+	if (!hfx_native_response_report_valid(profile, response))
+		return false;
+	transaction_difference =
+		request[profile->native_transaction_id_offset] ^
+		response[profile->native_transaction_id_offset];
+	if (transaction_difference &
+	    profile->native_transaction_id_match_mask)
+		return false;
 
 	for (index = 0; index < profile->native_match_range_count; index++) {
 		const struct hfx_native_match_range *range =
diff --git a/driver/kernel/hyperflux-next-profile.h b/driver/kernel/hyperflux-next-profile.h
index ba82ce7..a08c59c 100644
--- a/driver/kernel/hyperflux-next-profile.h
+++ b/driver/kernel/hyperflux-next-profile.h
@@ -14,6 +14,11 @@ enum hfx_native_exchange_kind {
 	HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 = 1,
 };
 
+enum hfx_native_checksum_kind {
+	HFX_NATIVE_CHECKSUM_NONE = 0,
+	HFX_NATIVE_CHECKSUM_XOR8 = 1,
+};
+
 #define HFX_NATIVE_MATCH_RANGE_CAPACITY 4U
 
 struct hfx_native_match_range {
@@ -32,6 +37,23 @@ struct hfx_receiver_profile {
 	u16 native_response_report_index;
 	u16 native_max_response_attempts;
 	u16 native_match_range_count;
+	u16 native_request_status_offset;
+	u16 native_response_status_offset;
+	u16 native_protocol_type_offset;
+	u16 native_data_size_offset;
+	u16 native_checksum_kind;
+	u16 native_checksum_start_offset;
+	u16 native_checksum_end_offset;
+	u16 native_checksum_result_offset;
+	u16 native_trailer_offset;
+	u16 native_transaction_id_offset;
+	u8 native_request_status_value;
+	u8 native_response_status_minimum;
+	u8 native_response_status_maximum;
+	u8 native_protocol_type_value;
+	u8 native_max_data_size;
+	u8 native_trailer_value;
+	u8 native_transaction_id_match_mask;
 	u32 native_initial_response_delay_us;
 	u32 native_response_retry_delay_us;
 	struct hfx_native_match_range
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 49a23a8..db4059b 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "4964897e3b52a753cb3c6bd8a8b00733ac7bc97c79aa2196d49840509148421f",
+  "source_sha256": "f004e43cdf57428ebf096160f6f1cda7b78bed6a1b079faa17a26ab18ff5ea10",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index 9cd2dbe..edd3c36 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1451,8 +1451,8 @@
         "Receiver inventory does not imply child availability.",
         "The receiver and mat do not appear as addressable RGB controllers."
       ],
-      "revision": 2,
-      "runtime_sha256": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2",
+      "revision": 3,
+      "runtime_sha256": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/receivers/razer-hyperflux-v2-1532-00cf.json",
       "transport": {
@@ -1476,6 +1476,39 @@
           "max_response_attempts": 5,
           "protocol_family": "razer-feature-report-v1",
           "report_bytes": 90,
+          "report_format": {
+            "checksum": {
+              "algorithm": "xor8",
+              "end_offset_exclusive": 88,
+              "result_offset": 88,
+              "start_offset": 2
+            },
+            "data_size": {
+              "maximum": 80,
+              "offset": 5
+            },
+            "protocol_type": {
+              "offset": 4,
+              "value": 0
+            },
+            "request_status": {
+              "offset": 0,
+              "value": 0
+            },
+            "response_status": {
+              "maximum": 5,
+              "minimum": 1,
+              "offset": 0
+            },
+            "trailer": {
+              "offset": 89,
+              "value": 0
+            },
+            "transaction_id": {
+              "match_mask": 0,
+              "offset": 1
+            }
+          },
           "response_report_index": 0,
           "response_retry_delay_us": 10000,
           "set_report_index": 0
@@ -1534,5 +1567,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
+  "source_sha256": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
 }
diff --git a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
index 7d0d990..ad67094 100644
--- a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
+++ b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "receiver.razer.hyperflux-v2.1532-00cf",
-  "revision": 2,
+  "revision": 3,
   "kind": "receiver",
   "device_kind": "receiver",
   "identity": {"manufacturer": "Razer", "model_name": "Razer HyperFlux V2 Receiver", "authority": "usb", "vendor_id": 5426, "product_id": 207},
@@ -22,6 +22,15 @@
       "initial_response_delay_us": 8000,
       "response_retry_delay_us": 10000,
       "max_response_attempts": 5,
+      "report_format": {
+        "request_status": {"offset": 0, "value": 0},
+        "response_status": {"offset": 0, "minimum": 1, "maximum": 5},
+        "protocol_type": {"offset": 4, "value": 0},
+        "data_size": {"offset": 5, "maximum": 80},
+        "checksum": {"algorithm": "xor8", "start_offset": 2, "end_offset_exclusive": 88, "result_offset": 88},
+        "trailer": {"offset": 89, "value": 0},
+        "transaction_id": {"offset": 1, "match_mask": 0}
+      },
       "match_ranges": [
         {"offset": 2, "length": 2},
         {"offset": 6, "length": 2}
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index c9aafe7..c657c3f 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -95,7 +95,7 @@
     "native-exchange": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["protocol_family", "report_bytes", "set_report_index", "response_report_index", "initial_response_delay_us", "response_retry_delay_us", "max_response_attempts", "match_ranges"],
+      "required": ["protocol_family", "report_bytes", "set_report_index", "response_report_index", "initial_response_delay_us", "response_retry_delay_us", "max_response_attempts", "report_format", "match_ranges"],
       "properties": {
         "protocol_family": {"const": "razer-feature-report-v1"},
         "report_bytes": {"const": 90},
@@ -104,6 +104,7 @@
         "initial_response_delay_us": {"type": "integer", "minimum": 0, "maximum": 100000},
         "response_retry_delay_us": {"type": "integer", "minimum": 1, "maximum": 100000},
         "max_response_attempts": {"type": "integer", "minimum": 1, "maximum": 16},
+        "report_format": {"$ref": "#/$defs/native-report-format"},
         "match_ranges": {
           "type": "array",
           "minItems": 1,
@@ -120,6 +121,65 @@
         }
       }
     },
+    "native-report-format": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["request_status", "response_status", "protocol_type", "data_size", "checksum", "trailer", "transaction_id"],
+      "properties": {
+        "request_status": {"$ref": "#/$defs/native-byte-value"},
+        "response_status": {"$ref": "#/$defs/native-byte-range"},
+        "protocol_type": {"$ref": "#/$defs/native-byte-value"},
+        "data_size": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["offset", "maximum"],
+          "properties": {
+            "offset": {"type": "integer", "minimum": 0, "maximum": 89},
+            "maximum": {"type": "integer", "minimum": 0, "maximum": 255}
+          }
+        },
+        "checksum": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["algorithm", "start_offset", "end_offset_exclusive", "result_offset"],
+          "properties": {
+            "algorithm": {"const": "xor8"},
+            "start_offset": {"type": "integer", "minimum": 0, "maximum": 89},
+            "end_offset_exclusive": {"type": "integer", "minimum": 1, "maximum": 90},
+            "result_offset": {"type": "integer", "minimum": 0, "maximum": 89}
+          }
+        },
+        "trailer": {"$ref": "#/$defs/native-byte-value"},
+        "transaction_id": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["offset", "match_mask"],
+          "properties": {
+            "offset": {"type": "integer", "minimum": 0, "maximum": 89},
+            "match_mask": {"type": "integer", "minimum": 0, "maximum": 255}
+          }
+        }
+      }
+    },
+    "native-byte-value": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["offset", "value"],
+      "properties": {
+        "offset": {"type": "integer", "minimum": 0, "maximum": 89},
+        "value": {"type": "integer", "minimum": 0, "maximum": 255}
+      }
+    },
+    "native-byte-range": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["offset", "minimum", "maximum"],
+      "properties": {
+        "offset": {"type": "integer", "minimum": 0, "maximum": 89},
+        "minimum": {"type": "integer", "minimum": 0, "maximum": 255},
+        "maximum": {"type": "integer", "minimum": 0, "maximum": 255}
+      }
+    },
     "lighting": {
       "type": "object",
       "additionalProperties": false,
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index b23c572..a9a0e98 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad
+// Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad";
+inline constexpr std::string_view profile_source_sha256 = "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
@@ -238,7 +238,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf", 3, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &lifecycle_0, &presentation_0},
     {"child.razer.deathstalker-v2-pro-tkl.0296", "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63", 6, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &lifecycle_1, &presentation_1},
-    {"receiver.razer.hyperflux-v2.1532-00cf", "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2", 2, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
+    {"receiver.razer.hyperflux-v2.1532-00cf", "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01", 3, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr, nullptr},
 }};
 
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 2f7d9c0..4f73e98 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad'
+PROFILE_SOURCE_SHA256: Final = 'ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -854,8 +854,8 @@
                'restrictions': ['Unknown children receive zero writable capabilities.',
                                 'Receiver inventory does not imply child availability.',
                                 'The receiver and mat do not appear as addressable RGB controllers.'],
-               'revision': 2,
-               'runtime_sha256': '4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2',
+               'revision': 3,
+               'runtime_sha256': '196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/receivers/razer-hyperflux-v2-1532-00cf.json',
                'transport': {'application_raw_frames': False,
@@ -869,6 +869,18 @@
                                                  'max_response_attempts': 5,
                                                  'protocol_family': 'razer-feature-report-v1',
                                                  'report_bytes': 90,
+                                                 'report_format': {'checksum': {'algorithm': 'xor8',
+                                                                                'end_offset_exclusive': 88,
+                                                                                'result_offset': 88,
+                                                                                'start_offset': 2},
+                                                                   'data_size': {'maximum': 80, 'offset': 5},
+                                                                   'protocol_type': {'offset': 4, 'value': 0},
+                                                                   'request_status': {'offset': 0, 'value': 0},
+                                                                   'response_status': {'maximum': 5,
+                                                                                       'minimum': 1,
+                                                                                       'offset': 0},
+                                                                   'trailer': {'offset': 89, 'value': 0},
+                                                                   'transaction_id': {'match_mask': 0, 'offset': 1}},
                                                  'response_report_index': 0,
                                                  'response_retry_delay_us': 10000,
                                                  'set_report_index': 0},
@@ -899,7 +911,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad'}
+ 'source_sha256': 'ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index a7009e1..1095f72 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
+  "source_sha256": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
 }
diff --git a/tests/test_kernel_driver.py b/tests/test_kernel_driver.py
index 663bce2..4faeba5 100644
--- a/tests/test_kernel_driver.py
+++ b/tests/test_kernel_driver.py
@@ -82,6 +82,18 @@ def test_native_exchange_uses_declarative_receiver_profile(self) -> None:
             "profile->native_initial_response_delay_us",
             "profile->native_response_retry_delay_us",
             "profile->native_max_response_attempts",
+            "profile->native_request_status_offset",
+            "profile->native_response_status_offset",
+            "profile->native_response_status_minimum",
+            "profile->native_response_status_maximum",
+            "profile->native_protocol_type_offset",
+            "profile->native_data_size_offset",
+            "profile->native_checksum_start_offset",
+            "profile->native_checksum_end_offset",
+            "profile->native_checksum_result_offset",
+            "profile->native_trailer_offset",
+            "profile->native_transaction_id_offset",
+            "profile->native_transaction_id_match_mask",
             "profile->native_match_ranges",
         ):
             self.assertIn(profile_field, source)
@@ -90,8 +102,24 @@ def test_native_exchange_uses_declarative_receiver_profile(self) -> None:
             ROOT / "driver/kernel/generated/hyperflux_receiver_profiles.inc"
         ).read_text(encoding="utf-8")
         self.assertIn("HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1", table)
+        self.assertIn("HFX_NATIVE_CHECKSUM_XOR8", table)
         self.assertIn(".native_match_ranges", table)
 
+    def test_native_exchange_validates_request_before_set_and_response_before_match(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-native.c").read_text(
+            encoding="utf-8"
+        )
+        submit_start = source.index("static int hfx_native_submit_validate")
+        submit_end = source.index("static bool hfx_native_key_matches", submit_start)
+        submit = source[submit_start:submit_end]
+        self.assertIn("hfx_native_request_report_valid", submit)
+
+        match_start = source.index("static bool hfx_native_response_matches")
+        match_end = source.index("static int hfx_native_usb_set", match_start)
+        matcher = source[match_start:match_end]
+        self.assertIn("hfx_native_response_report_valid", matcher)
+        self.assertIn("native_transaction_id_match_mask", matcher)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index e57bc18..9c52870 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -96,6 +96,23 @@ def test_receiver_native_exchange_is_declarative_bounded_and_digest_bound(self)
         self.assertEqual(native["report_bytes"], 90)
         self.assertEqual(native["set_report_index"], 0)
         self.assertEqual(native["response_report_index"], 0)
+        self.assertEqual(
+            native["report_format"],
+            {
+                "request_status": {"offset": 0, "value": 0},
+                "response_status": {"offset": 0, "minimum": 1, "maximum": 5},
+                "protocol_type": {"offset": 4, "value": 0},
+                "data_size": {"offset": 5, "maximum": 80},
+                "checksum": {
+                    "algorithm": "xor8",
+                    "start_offset": 2,
+                    "end_offset_exclusive": 88,
+                    "result_offset": 88,
+                },
+                "trailer": {"offset": 89, "value": 0},
+                "transaction_id": {"offset": 1, "match_mask": 0},
+            },
+        )
         self.assertEqual(native["match_ranges"], [{"offset": 2, "length": 2}, {"offset": 6, "length": 2}])
         before = self.runtime_profile_digest(receiver, capabilities)
         native["response_retry_delay_us"] += 1
@@ -117,6 +134,31 @@ def test_receiver_native_exchange_is_declarative_bounded_and_digest_bound(self)
         with self.assertRaisesRegex(ModelError, "exactly 90 bytes"):
             self.validate_profiles(profiles, capabilities, claims)
 
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        checksum = receiver["transport"]["native_exchange"]["report_format"]["checksum"]
+        checksum["result_offset"] = 87
+        with self.assertRaisesRegex(ModelError, "checksum range is out of bounds"):
+            self.validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        transaction = receiver["transport"]["native_exchange"]["report_format"][
+            "transaction_id"
+        ]
+        transaction["match_mask"] = 256
+        with self.assertRaisesRegex(ModelError, "transaction id is out of bounds"):
+            self.validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        response_status = receiver["transport"]["native_exchange"]["report_format"][
+            "response_status"
+        ]
+        response_status["minimum"] = 6
+        with self.assertRaisesRegex(ModelError, "response status range is reversed"):
+            self.validate_profiles(profiles, capabilities, claims)
+
     def test_runtime_digest_is_profile_local_and_ignores_presentation_only_edits(self) -> None:
         profiles, capabilities, _ = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index 12a3af3..a58f936 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -315,6 +315,55 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum NativeChecksumAlgorithm {",
+        "    Xor8,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeByteValueRecord {",
+        "    pub offset: u16,",
+        "    pub value: u8,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeByteRangeRecord {",
+        "    pub offset: u16,",
+        "    pub minimum: u8,",
+        "    pub maximum: u8,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeDataSizeRecord {",
+        "    pub offset: u16,",
+        "    pub maximum: u8,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeChecksumRecord {",
+        "    pub algorithm: NativeChecksumAlgorithm,",
+        "    pub start_offset: u16,",
+        "    pub end_offset_exclusive: u16,",
+        "    pub result_offset: u16,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeTransactionIdRecord {",
+        "    pub offset: u16,",
+        "    pub match_mask: u8,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeReportFormatRecord {",
+        "    pub request_status: NativeByteValueRecord,",
+        "    pub response_status: NativeByteRangeRecord,",
+        "    pub protocol_type: NativeByteValueRecord,",
+        "    pub data_size: NativeDataSizeRecord,",
+        "    pub checksum: NativeChecksumRecord,",
+        "    pub trailer: NativeByteValueRecord,",
+        "    pub transaction_id: NativeTransactionIdRecord,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct NativeExchangeRecord {",
         "    pub protocol_family: &'static str,",
         "    pub report_bytes: u16,",
@@ -323,6 +372,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "    pub initial_response_delay_us: u32,",
         "    pub response_retry_delay_us: u32,",
         "    pub max_response_attempts: u8,",
+        "    pub report_format: NativeReportFormatRecord,",
         "    pub match_ranges: &'static [NativeMatchRangeRecord],",
         "}",
         "",
@@ -477,6 +527,8 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         exact_child_combinations = str(compatibility.get("exact_child_combinations", False)).lower()
         native_exchange = profile.get("transport", {}).get("native_exchange")
         if native_exchange:
+            report_format = native_exchange["report_format"]
+            checksum = report_format["checksum"]
             native_exchange_lines = [
                 "        native_exchange: Some(NativeExchangeRecord {",
                 f"            protocol_family: {json.dumps(native_exchange['protocol_family'])},",
@@ -489,6 +541,39 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 f"{native_exchange['response_retry_delay_us']},",
                 "            max_response_attempts: "
                 f"{native_exchange['max_response_attempts']},",
+                "            report_format: NativeReportFormatRecord {",
+                "                request_status: NativeByteValueRecord {",
+                f"                    offset: {report_format['request_status']['offset']},",
+                f"                    value: {report_format['request_status']['value']},",
+                "                },",
+                "                response_status: NativeByteRangeRecord {",
+                f"                    offset: {report_format['response_status']['offset']},",
+                f"                    minimum: {report_format['response_status']['minimum']},",
+                f"                    maximum: {report_format['response_status']['maximum']},",
+                "                },",
+                "                protocol_type: NativeByteValueRecord {",
+                f"                    offset: {report_format['protocol_type']['offset']},",
+                f"                    value: {report_format['protocol_type']['value']},",
+                "                },",
+                "                data_size: NativeDataSizeRecord {",
+                f"                    offset: {report_format['data_size']['offset']},",
+                f"                    maximum: {report_format['data_size']['maximum']},",
+                "                },",
+                "                checksum: NativeChecksumRecord {",
+                f"                    algorithm: NativeChecksumAlgorithm::{_variant(checksum['algorithm'])},",
+                f"                    start_offset: {checksum['start_offset']},",
+                f"                    end_offset_exclusive: {checksum['end_offset_exclusive']},",
+                f"                    result_offset: {checksum['result_offset']},",
+                "                },",
+                "                trailer: NativeByteValueRecord {",
+                f"                    offset: {report_format['trailer']['offset']},",
+                f"                    value: {report_format['trailer']['value']},",
+                "                },",
+                "                transaction_id: NativeTransactionIdRecord {",
+                f"                    offset: {report_format['transaction_id']['offset']},",
+                f"                    match_mask: {report_format['transaction_id']['match_mask']},",
+                "                },",
+                "            },",
                 f"            match_ranges: NATIVE_MATCH_RANGES_{index},",
                 "        }),",
             ]
@@ -999,6 +1084,20 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
                 "initial_response_delay_us": 0,
                 "response_retry_delay_us": 0,
                 "max_response_attempts": 0,
+                "report_format": {
+                    "request_status": {"offset": 0, "value": 0},
+                    "response_status": {"offset": 0, "minimum": 0, "maximum": 0},
+                    "protocol_type": {"offset": 0, "value": 0},
+                    "data_size": {"offset": 0, "maximum": 0},
+                    "checksum": {
+                        "algorithm": "xor8",
+                        "start_offset": 0,
+                        "end_offset_exclusive": 0,
+                        "result_offset": 0,
+                    },
+                    "trailer": {"offset": 0, "value": 0},
+                    "transaction_id": {"offset": 0, "match_mask": 0},
+                },
             }
             match_ranges: list[dict[str, int]] = []
         else:
@@ -1011,6 +1110,8 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
                 )
             native_values = native
             match_ranges = native["match_ranges"]
+        report_format = native_values["report_format"]
+        checksum = report_format["checksum"]
         range_values = ", ".join(
             f"{{ .offset = {item['offset']}, .length = {item['length']} }}"
             for item in match_ranges
@@ -1028,6 +1129,27 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
                 f'\t.native_initial_response_delay_us = {native_values["initial_response_delay_us"]},',
                 f'\t.native_response_retry_delay_us = {native_values["response_retry_delay_us"]},',
                 f'\t.native_max_response_attempts = {native_values["max_response_attempts"]},',
+                f'\t.native_request_status_offset = {report_format["request_status"]["offset"]},',
+                f'\t.native_request_status_value = {report_format["request_status"]["value"]},',
+                f'\t.native_response_status_offset = {report_format["response_status"]["offset"]},',
+                f'\t.native_response_status_minimum = {report_format["response_status"]["minimum"]},',
+                f'\t.native_response_status_maximum = {report_format["response_status"]["maximum"]},',
+                f'\t.native_protocol_type_offset = {report_format["protocol_type"]["offset"]},',
+                f'\t.native_protocol_type_value = {report_format["protocol_type"]["value"]},',
+                f'\t.native_data_size_offset = {report_format["data_size"]["offset"]},',
+                f'\t.native_max_data_size = {report_format["data_size"]["maximum"]},',
+                "\t.native_checksum_kind = "
+                + {
+                    "xor8": "HFX_NATIVE_CHECKSUM_XOR8",
+                }[checksum["algorithm"]]
+                + ",",
+                f'\t.native_checksum_start_offset = {checksum["start_offset"]},',
+                f'\t.native_checksum_end_offset = {checksum["end_offset_exclusive"]},',
+                f'\t.native_checksum_result_offset = {checksum["result_offset"]},',
+                f'\t.native_trailer_offset = {report_format["trailer"]["offset"]},',
+                f'\t.native_trailer_value = {report_format["trailer"]["value"]},',
+                f'\t.native_transaction_id_offset = {report_format["transaction_id"]["offset"]},',
+                f'\t.native_transaction_id_match_mask = {report_format["transaction_id"]["match_mask"]},',
                 f"\t.native_match_range_count = {len(match_ranges)},",
                 f"\t.native_match_ranges = {{ {range_values} }}",
                 ")",
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index 83d259f..a81c12f 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -91,9 +91,29 @@
     "initial_response_delay_us",
     "response_retry_delay_us",
     "max_response_attempts",
+    "report_format",
     "match_ranges",
 }
 NATIVE_MATCH_RANGE_KEYS = {"offset", "length"}
+NATIVE_REPORT_FORMAT_KEYS = {
+    "request_status",
+    "response_status",
+    "protocol_type",
+    "data_size",
+    "checksum",
+    "trailer",
+    "transaction_id",
+}
+NATIVE_BYTE_VALUE_KEYS = {"offset", "value"}
+NATIVE_BYTE_RANGE_KEYS = {"offset", "minimum", "maximum"}
+NATIVE_DATA_SIZE_KEYS = {"offset", "maximum"}
+NATIVE_CHECKSUM_KEYS = {
+    "algorithm",
+    "start_offset",
+    "end_offset_exclusive",
+    "result_offset",
+}
+NATIVE_TRANSACTION_ID_KEYS = {"offset", "match_mask"}
 LIFECYCLE_KEYS = {
     "power_off_departure_evidence",
     "return_policy_id",
@@ -557,6 +577,95 @@ def _validate_native_exchange(profile_id: str, value: object) -> None:
         item = value[key]
         if isinstance(item, bool) or not isinstance(item, int) or not minimum <= item <= maximum:
             raise ModelError(f"{profile_id}: native exchange {key} is out of bounds")
+    report_format = value["report_format"]
+    if not isinstance(report_format, dict):
+        raise ModelError(f"{profile_id}: native report format must be an object")
+    _expect_keys(report_format, NATIVE_REPORT_FORMAT_KEYS, f"{profile_id} native report format")
+    if set(report_format) != NATIVE_REPORT_FORMAT_KEYS:
+        raise ModelError(f"{profile_id}: native report format is incomplete")
+
+    def byte_value(name: str) -> None:
+        item = report_format[name]
+        if not isinstance(item, dict):
+            raise ModelError(f"{profile_id}: native {name} must be an object")
+        _expect_keys(item, NATIVE_BYTE_VALUE_KEYS, f"{profile_id} native {name}")
+        if set(item) != NATIVE_BYTE_VALUE_KEYS:
+            raise ModelError(f"{profile_id}: native {name} is incomplete")
+        if any(
+            isinstance(item[key], bool)
+            or not isinstance(item[key], int)
+            or not 0 <= item[key] <= maximum
+            for key, maximum in (("offset", value["report_bytes"] - 1), ("value", 255))
+        ):
+            raise ModelError(f"{profile_id}: native {name} is out of bounds")
+
+    byte_value("request_status")
+    byte_value("protocol_type")
+    byte_value("trailer")
+    response_status = report_format["response_status"]
+    if not isinstance(response_status, dict):
+        raise ModelError(f"{profile_id}: native response status must be an object")
+    _expect_keys(
+        response_status,
+        NATIVE_BYTE_RANGE_KEYS,
+        f"{profile_id} native response status",
+    )
+    if set(response_status) != NATIVE_BYTE_RANGE_KEYS or any(
+        isinstance(response_status[key], bool)
+        or not isinstance(response_status[key], int)
+        or not 0 <= response_status[key] <= maximum
+        for key, maximum in (
+            ("offset", value["report_bytes"] - 1),
+            ("minimum", 255),
+            ("maximum", 255),
+        )
+    ):
+        raise ModelError(f"{profile_id}: native response status is out of bounds")
+    if response_status["minimum"] > response_status["maximum"]:
+        raise ModelError(f"{profile_id}: native response status range is reversed")
+    data_size = report_format["data_size"]
+    if not isinstance(data_size, dict):
+        raise ModelError(f"{profile_id}: native data size must be an object")
+    _expect_keys(data_size, NATIVE_DATA_SIZE_KEYS, f"{profile_id} native data size")
+    if set(data_size) != NATIVE_DATA_SIZE_KEYS or any(
+        isinstance(data_size[key], bool)
+        or not isinstance(data_size[key], int)
+        or not 0 <= data_size[key] <= maximum
+        for key, maximum in (("offset", value["report_bytes"] - 1), ("maximum", 255))
+    ):
+        raise ModelError(f"{profile_id}: native data size is out of bounds")
+    checksum = report_format["checksum"]
+    if not isinstance(checksum, dict):
+        raise ModelError(f"{profile_id}: native checksum must be an object")
+    _expect_keys(checksum, NATIVE_CHECKSUM_KEYS, f"{profile_id} native checksum")
+    if set(checksum) != NATIVE_CHECKSUM_KEYS or checksum["algorithm"] != "xor8":
+        raise ModelError(f"{profile_id}: native checksum is incomplete or unsupported")
+    for key in ("start_offset", "end_offset_exclusive", "result_offset"):
+        if isinstance(checksum[key], bool) or not isinstance(checksum[key], int):
+            raise ModelError(f"{profile_id}: native checksum {key} is invalid")
+    if not (
+        0 <= checksum["start_offset"] < checksum["end_offset_exclusive"] <= value["report_bytes"]
+        and 0 <= checksum["result_offset"] < value["report_bytes"]
+        and not checksum["start_offset"]
+        <= checksum["result_offset"]
+        < checksum["end_offset_exclusive"]
+    ):
+        raise ModelError(f"{profile_id}: native checksum range is out of bounds")
+    transaction_id = report_format["transaction_id"]
+    if not isinstance(transaction_id, dict):
+        raise ModelError(f"{profile_id}: native transaction id must be an object")
+    _expect_keys(
+        transaction_id,
+        NATIVE_TRANSACTION_ID_KEYS,
+        f"{profile_id} native transaction id",
+    )
+    if set(transaction_id) != NATIVE_TRANSACTION_ID_KEYS or any(
+        isinstance(transaction_id[key], bool)
+        or not isinstance(transaction_id[key], int)
+        or not 0 <= transaction_id[key] <= maximum
+        for key, maximum in (("offset", value["report_bytes"] - 1), ("match_mask", 255))
+    ):
+        raise ModelError(f"{profile_id}: native transaction id is out of bounds")
     ranges = value["match_ranges"]
     if not isinstance(ranges, list) or not 1 <= len(ranges) <= 4:
         raise ModelError(f"{profile_id}: native exchange needs one to four match ranges")

From 849e2fd477f1299f37b07afc4731b2ffabe2c159 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sat, 25 Jul 2026 22:09:04 +0400
Subject: [PATCH 50/67] test: bind native report contract fixtures

---
 .../tests/fixtures/rust-qualified-mouse.json  |  4 +--
 .../tests/fixtures/rust-qualified-pair.json   |  4 +--
 tests/cpp/kernel_profile_table_smoke.cpp      | 36 +++++++++++++++++++
 3 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 553218d..7b69ea1 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
+    "profile_catalog_digest": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2"
+        "digest": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index ff79aad..6432236 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "68c408358f92361f2dfbe461c180cd16eec08924d7c5b22e91753bc299d269ad"
+    "profile_catalog_digest": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "4f469c2f3f7010a79435727ff229a3efedd65c446eb5c98e225dffc0d229ccd2"
+        "digest": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/tests/cpp/kernel_profile_table_smoke.cpp b/tests/cpp/kernel_profile_table_smoke.cpp
index 4e4923d..3117d33 100644
--- a/tests/cpp/kernel_profile_table_smoke.cpp
+++ b/tests/cpp/kernel_profile_table_smoke.cpp
@@ -22,6 +22,23 @@ struct ReceiverMatch
     std::uint32_t native_initial_response_delay_us;
     std::uint32_t native_response_retry_delay_us;
     std::uint16_t native_max_response_attempts;
+    std::uint16_t native_request_status_offset;
+    std::uint8_t native_request_status_value;
+    std::uint16_t native_response_status_offset;
+    std::uint8_t native_response_status_minimum;
+    std::uint8_t native_response_status_maximum;
+    std::uint16_t native_protocol_type_offset;
+    std::uint8_t native_protocol_type_value;
+    std::uint16_t native_data_size_offset;
+    std::uint8_t native_max_data_size;
+    std::uint16_t native_checksum_kind;
+    std::uint16_t native_checksum_start_offset;
+    std::uint16_t native_checksum_end_offset;
+    std::uint16_t native_checksum_result_offset;
+    std::uint16_t native_trailer_offset;
+    std::uint8_t native_trailer_value;
+    std::uint16_t native_transaction_id_offset;
+    std::uint8_t native_transaction_id_match_mask;
     std::uint16_t native_match_range_count;
     NativeMatchRange native_match_ranges[4];
 };
@@ -30,6 +47,8 @@ struct ReceiverMatch
 #define HFX_PAIRING_INVENTORY_RAZER_HYPERFLUX_V2_FEATURE_01_V1 1
 #define HFX_NATIVE_EXCHANGE_NONE 0
 #define HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 1
+#define HFX_NATIVE_CHECKSUM_NONE 0
+#define HFX_NATIVE_CHECKSUM_XOR8 1
 #define HFX_RECEIVER_PROFILE(vendor, product, backend, ...) \
     ReceiverMatch{.vendor_id = vendor, .product_id = product, \
                   .backend_id = backend, __VA_ARGS__},
@@ -52,6 +71,23 @@ int main()
     static_assert(receiver_matches[0].native_initial_response_delay_us == 8000);
     static_assert(receiver_matches[0].native_response_retry_delay_us == 10000);
     static_assert(receiver_matches[0].native_max_response_attempts == 5);
+    static_assert(receiver_matches[0].native_request_status_offset == 0);
+    static_assert(receiver_matches[0].native_request_status_value == 0);
+    static_assert(receiver_matches[0].native_response_status_offset == 0);
+    static_assert(receiver_matches[0].native_response_status_minimum == 1);
+    static_assert(receiver_matches[0].native_response_status_maximum == 5);
+    static_assert(receiver_matches[0].native_protocol_type_offset == 4);
+    static_assert(receiver_matches[0].native_protocol_type_value == 0);
+    static_assert(receiver_matches[0].native_data_size_offset == 5);
+    static_assert(receiver_matches[0].native_max_data_size == 80);
+    static_assert(receiver_matches[0].native_checksum_kind == HFX_NATIVE_CHECKSUM_XOR8);
+    static_assert(receiver_matches[0].native_checksum_start_offset == 2);
+    static_assert(receiver_matches[0].native_checksum_end_offset == 88);
+    static_assert(receiver_matches[0].native_checksum_result_offset == 88);
+    static_assert(receiver_matches[0].native_trailer_offset == 89);
+    static_assert(receiver_matches[0].native_trailer_value == 0);
+    static_assert(receiver_matches[0].native_transaction_id_offset == 1);
+    static_assert(receiver_matches[0].native_transaction_id_match_mask == 0);
     static_assert(receiver_matches[0].native_match_range_count == 2);
     static_assert(receiver_matches[0].native_match_ranges[0].offset == 2);
     static_assert(receiver_matches[0].native_match_ranges[0].length == 2);

From a2c80f5bdfcc06b49f26a65b5f922045e5497e37 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 01:20:53 +0400
Subject: [PATCH 51/67] feat: complete declarative native route integration

---
 README.md                                     |  17 +-
 architecture/constitution.json                |  30 +--
 architecture/repository-atlas.json            | 104 ++++----
 assurance/design-coverage.json                |  34 +--
 assurance/generated/hyperflux-next.spdx.json  |   2 +-
 crates/hfx-bridge/README.md                   |   3 +-
 crates/hfx-bridge/src/backend.rs              |  32 ++-
 crates/hfx-bridge/src/native_projection.rs    |  19 +-
 crates/hfx-bridge/src/native_routes.rs        |  51 ++--
 crates/hfx-bridge/tests/native_projection.rs  |  52 ++--
 crates/hfx-core/README.md                     |   6 +-
 crates/hfx-core/src/leases.rs                 |  17 +-
 crates/hfx-core/tests/leases.rs               | 100 ++++++-
 crates/hfx-daemon/README.md                   |   2 +-
 crates/hfx-domain/src/generated.rs            |  52 +++-
 crates/hfx-integration-model/src/generated.rs |  31 ++-
 crates/hfx-integration-model/tests/catalog.rs |  26 +-
 crates/hfx-ops/src/native_onboarding.rs       |   6 +-
 crates/hfx-profiles/src/native_report.rs      |  15 +-
 crates/hfx-protocol/src/generated.rs          |  22 +-
 crates/hfx-protocol/src/generated_v7.rs       |  22 +-
 crates/hfx-protocol/src/generated_versions.rs |   2 +-
 crates/hfx-protocol/src/wire.rs               |  24 +-
 .../hfx-protocol/tests/wire_and_snapshot.rs   |  38 ++-
 crates/hfx-sdk/README.md                      |   7 +-
 crates/hfx-uhid-relay/src/bridge.rs           | 248 +++++++++++++-----
 crates/hfx-uhid-relay/src/endpoint.rs         |   3 +-
 crates/hfx-uhid-relay/src/runtime.rs          |   3 +-
 crates/hfx-uhid-relay/src/supervisor.rs       | 114 +++++++-
 crates/hfx-uhid-relay/src/uhid.rs             | 101 +++++++
 docs/architecture/bridge-core.md              |  74 +++++-
 docs/architecture/design-book.md              | 127 ++++-----
 docs/architecture/device-knowledge.md         |  31 ++-
 docs/architecture/integrations.md             |  76 +++---
 docs/architecture/kernel.md                   |  91 +++++--
 docs/architecture/openrazer-compatibility.md  |   9 +-
 docs/architecture/persistence.md              |   7 +
 docs/architecture/sdk.md                      |  30 ++-
 docs/generated/architecture.md                |  30 +--
 docs/generated/bridge-protocol-v7.md          |   2 +-
 docs/generated/bridge-protocol.md             |   2 +-
 docs/generated/design-coverage.md             |  86 +++---
 docs/generated/domain-types.md                |   3 +-
 docs/generated/integrations.md                |   5 +-
 docs/generated/kernel-uapi.md                 |   2 +-
 docs/generated/repository-atlas.md            |  78 +++---
 docs/generated/supply-chain.md                |   2 +-
 docs/generated/verification.md                |   2 +-
 docs/user/overview.md                         |  33 ++-
 driver/kernel/README.md                       |   3 +-
 generated/integrations/catalog.json           |  63 +++--
 integrations/README.md                        |   4 +-
 integrations/catalog.json                     |  28 +-
 integrations/openrazer/README.md              |  24 +-
 integrations/openrgb/README.md                |  23 +-
 .../openrgb/razer_feature_transport.hpp       |   5 +
 .../openrgb/src/native_route_session.cpp      |   2 +-
 .../openrgb/src/upstream_razer_registry.cpp   |   2 +-
 integrations/polychromatic/README.md          |  10 +-
 migration/sources.json                        |   2 +-
 packaging/README.md                           |   2 +-
 profiles/README.md                            |   4 +-
 protocol/registry.json                        |   2 +-
 protocol/v7/catalog.json                      |   2 +-
 schemas/domain-catalog.json                   |   3 +-
 schemas/integration-catalog.schema.json       |   4 +-
 schemas/native-route-observation.schema.json  |   2 +-
 sdk/README.md                                 |   4 +-
 sdk/cpp/README.md                             |   8 +-
 .../hyperflux/generated/domain_json.hpp       |  37 ++-
 .../hyperflux/generated/domain_types.hpp      |  24 +-
 .../generated/integration_catalog.hpp         |  26 +-
 .../hyperflux/generated/protocol_json.hpp     |   2 +-
 .../hyperflux/generated/protocol_types.hpp    |   2 +-
 .../hyperflux/generated/protocol_v7_json.hpp  |   2 +-
 .../hyperflux/generated/protocol_v7_types.hpp |   2 +-
 sdk/python/README.md                          |   4 +-
 .../hyperflux_sdk/generated/domain_types.py   |  10 +-
 .../generated/integration_catalog.py          |  39 ++-
 .../hyperflux_sdk/generated/protocol_types.py |   3 +-
 .../generated/protocol_v7_types.py            |   3 +-
 ...rgb_native_plugin_application_contract.cpp |   2 +-
 .../openrgb_native_route_session_contract.cpp |   2 +-
 .../openrgb_native_route_worker_contract.cpp  |   2 +-
 ...gb_upstream_razer_coordinator_contract.cpp |   2 +-
 ...enrgb_upstream_razer_registry_contract.cpp |   4 +-
 tests/cpp/sdk_native_client_contract.cpp      |   2 +-
 tests/test_integrations.py                    |  50 +++-
 tests/test_verify.py                          |  16 ++
 tools/hfxdev/generators/kernel_uapi.py        |   2 +-
 tools/hfxdev/generators/readme.py             |  17 +-
 tools/hfxdev/integrations.py                  |   8 +-
 tools/hfxdev/native_onboarding.py             |   6 +-
 tools/hfxdev/openrazer.py                     |  87 ++++++
 tools/hfxdev/verify.py                        |  99 +++++--
 verification/tests.json                       |   4 +-
 96 files changed, 1810 insertions(+), 717 deletions(-)

diff --git a/README.md b/README.md
index b34dfc3..05c86fd 100644
--- a/README.md
+++ b/README.md
@@ -27,16 +27,19 @@
 
 ```mermaid
 flowchart LR
-    Applications["Applications"] --> SDK["Versioned SDK"]
-    SDK --> Bridge["Bridge and policy authority"]
-    Bridge --> Kernel["Minimal HID transport"]
+    Applications["OpenRazer and OpenRGB"] --> SDK["Versioned native-route SDK"]
+    SDK --> Bridge["Route and exchange authority"]
+    Bridge --> Kernel["Bounded receiver transport"]
     Kernel --> Receiver["HyperFlux receiver and paired devices"]
 ```
 
-Applications own user interaction, layouts, and effects. The SDK owns the typed
-application boundary. The bridge is the sole userspace writer and owns policy,
-qualification, scheduling, restoration, and outcomes. The kernel preserves
-ordinary HID input and transports bounded generation-bound envelopes.
+Applications own model commands, settings, layouts, effects, profiles, and
+persistence. The SDK carries qualified route discovery and exact 90-byte Razer
+Feature exchanges. The bridge is the sole userspace receiver writer and owns
+route qualification, generation safety, NativeControl arbitration, bounded
+dispatch, availability, outcome certainty, and diagnostics. The kernel
+preserves ordinary HID input and transports generation-bound exchanges without
+interpreting device semantics.
 
 ## Current Readiness
 
diff --git a/architecture/constitution.json b/architecture/constitution.json
index 0cf9fef..7e86f47 100644
--- a/architecture/constitution.json
+++ b/architecture/constitution.json
@@ -18,7 +18,7 @@
     },
     {
       "id": "HFX-INV-002",
-      "statement": "Applications and integrations never submit raw HID, USB, sysfs, or receiver report payloads."
+      "statement": "A qualified native integration may submit exactly one fixed upstream Feature report through an opaque route; no application may submit arbitrary USB setup packets, sysfs operations, or receiver carrier frames."
     },
     {
       "id": "HFX-INV-003",
@@ -26,11 +26,11 @@
     },
     {
       "id": "HFX-INV-004",
-      "statement": "Every write is bound to a live receiver generation, qualified route, capability, owner, deadline, and transaction."
+      "statement": "Every native exchange is bound to a live receiver generation, qualified opaque route, declarative report profile, NativeControl owner, deadline, and transaction identity."
     },
     {
       "id": "HFX-INV-005",
-      "statement": "Pairing, route availability, sleep, power state, and connection mode remain separate sourced facts."
+      "statement": "Native availability is only available, temporarily-unavailable, or withdrawn; pairing, silence, and retail sleep or power labels never grant route authority. Only generation-bound explicit route evidence or endpoint-local traffic qualified by the receiver profile may produce available."
     },
     {
       "id": "HFX-INV-006",
@@ -46,7 +46,7 @@
     },
     {
       "id": "HFX-INV-009",
-      "statement": "A partial, uncertain, stale-generation, or health-incomplete operation cannot be reported as successful."
+      "statement": "Only a complete correlated response is matched-response; a possible SET is may-have-been-sent and is never automatically repeated or reported as success."
     },
     {
       "id": "HFX-INV-010",
@@ -64,33 +64,33 @@
   "components": [
     {
       "id": "applications",
-      "owns": ["user workflows", "presentation", "profiles", "effects"],
-      "must_not_own": ["receiver encoding", "qualification", "kernel access"]
+      "owns": ["user workflows", "device commands and settings", "presentation and layouts", "profiles, effects, and persistence"],
+      "must_not_own": ["receiver carrier encoding", "route qualification", "kernel access"]
     },
     {
       "id": "integrations",
-      "owns": ["application contract adaptation", "tested view models"],
-      "must_not_own": ["raw transport", "profile qualification", "global retry policy"]
+      "owns": ["thin Feature-transport adaptation", "application contract adaptation", "tested route view models"],
+      "must_not_own": ["device semantic duplication", "receiver carrier transport", "profile qualification", "uncertain-write retry policy"]
     },
     {
       "id": "sdk",
-      "owns": ["version negotiation", "logical devices", "routes", "capabilities", "events", "leases", "typed errors"],
-      "must_not_own": ["application widgets", "raw socket framing in callers"]
+      "owns": ["version negotiation", "qualified native routes", "availability events", "NativeControl leases", "exact fixed-size Feature exchanges", "typed errors"],
+      "must_not_own": ["application widgets or device commands", "receiver carrier frames", "raw socket framing in callers"]
     },
     {
       "id": "bridge",
-      "owns": ["policy", "profile resolution", "leases", "transactions", "scheduling", "restoration", "diagnostics"],
-      "must_not_own": ["application presentation", "effect mathematics", "arbitrary raw reports"]
+      "owns": ["route qualification", "profile resolution", "NativeControl arbitration", "bounded native transactions and certainty", "availability", "diagnostics", "retained migration fallback"],
+      "must_not_own": ["device commands or settings", "application presentation, effects, profiles, or persistence", "arbitrary USB or receiver reports"]
     },
     {
       "id": "kernel",
-      "owns": ["HID binding", "input preservation", "receiver generations", "passive observations", "exclusive writer session", "bounded envelope transport"],
+      "owns": ["HID binding", "input preservation", "receiver generations", "passive observations", "exclusive writer session", "qualified fixed-size native exchange", "bounded fallback envelopes"],
       "must_not_own": ["retail names", "effects", "profiles", "application ownership", "package repair"]
     },
     {
       "id": "profiles",
-      "owns": ["identity predicates", "qualified capabilities", "semantic mappings", "evidence references", "presentation metadata references"],
-      "must_not_own": ["live observations", "leases", "desired state", "guessed commands"]
+      "owns": ["identity predicates", "native report shape and response matching", "upstream bindings", "route qualification", "evidence references", "retained fallback mappings"],
+      "must_not_own": ["live observations", "leases", "application desired state", "model commands", "guessed transport"]
     },
     {
       "id": "verification",
diff --git a/architecture/repository-atlas.json b/architecture/repository-atlas.json
index b4963ec..8c2927e 100644
--- a/architecture/repository-atlas.json
+++ b/architecture/repository-atlas.json
@@ -117,49 +117,49 @@
     },
     {
       "id": "openrgb-adapter", "title": "OpenRGB adapter", "path": "integrations/openrgb", "category": "applications", "status": "implemented",
-      "purpose": "Projects qualified SDK devices into native OpenRGB controllers while preserving upstream presentation metadata.",
-      "owns": ["OpenRGB controller projection", "UI coordination", "Bounded dispatch queue"],
-      "must_not_own": ["Receiver encoding", "Qualification policy", "Direct USB access"],
-      "inputs": ["SDK snapshots and events", "Qualified profile metadata", "Pinned OpenRGB registry"],
-      "outputs": ["OpenRGB plugin module", "Controller and zone presentation"],
-      "public_contracts": ["SDK-only transport", "One controller per qualified child", "Bounded lifecycle and dispatch"],
-      "canonical_files": ["integrations/openrgb/CMakeLists.txt", "integrations/openrgb/src/openrgb_plugin.cpp", "integrations/openrgb/src/runtime_core.cpp"],
+      "purpose": "Runs pinned upstream Razer controllers over qualified HyperFlux Feature routes while preserving ordinary hidapi devices.",
+      "owns": ["OpenRGB Feature transport adaptation", "Native controller lifecycle", "Serial-proven direct-route precedence"],
+      "must_not_own": ["OpenRGB device semantics", "Receiver qualification", "Direct hidapi transport"],
+      "inputs": ["Protocol-v7 native routes", "Qualified profile metadata", "Pinned OpenRGB Razer registry"],
+      "outputs": ["OpenRGB plugin module", "Upstream-native Razer controllers"],
+      "public_contracts": ["Exact 90-byte Feature exchange", "One controller per qualified child", "Unrelated OpenRGB devices remain untouched"],
+      "canonical_files": ["integrations/openrgb/CMakeLists.txt", "integrations/openrgb/native-route/transform.json", "integrations/openrgb/src/native_plugin_application.cpp", "integrations/openrgb/src/native_route_session.cpp", "integrations/openrgb/src/razer_feature_transport.cpp", "integrations/openrgb/src/openrgb_plugin.cpp"],
       "generated_files": ["integrations/openrgb/README.md"],
-      "verification": ["openrgb-adapter-contracts", "openrgb-thread-sanitizer"],
+      "verification": ["openrgb-native-route-contracts", "openrgb-thread-sanitizer"],
       "limitations": ["Physical OpenRGB behavior remains qualified only for the current public profiles"],
-      "safe_change_workflow": ["Change the narrow controller or runtime owner", "Compile against the exact upstream pin", "Run adapter, sanitizer, SDK, and package contracts"],
+      "safe_change_workflow": ["Change only the Feature transport or route owner", "Compile against the exact upstream pin", "Run native-route, sanitizer, SDK, and package contracts"],
       "related_docs": ["docs/architecture/integrations.md", "docs/generated/integrations.md"],
       "depends_on": ["integrations", "profiles", "sdk-cpp"]
     },
     {
-      "id": "openrazer-adapter", "title": "OpenRazer compatibility adapter", "path": "integrations/openrazer", "category": "applications", "status": "implemented",
-      "purpose": "Provides an isolated compatibility surface for legacy OpenRazer clients without impersonating the system daemon globally.",
-      "owns": ["Private compatibility session", "OpenRazer metadata import", "Legacy client translation"],
-      "must_not_own": ["Global D-Bus names", "Receiver transport", "OpenRazer support authority"],
-      "inputs": ["SDK state", "Pinned OpenRazer metadata", "Compatibility contract"],
-      "outputs": ["Private compatibility service", "Generated presentation metadata"],
-      "public_contracts": ["Opt-in isolation", "SDK-only access", "No suppression of unrelated devices"],
-      "canonical_files": ["integrations/openrazer/import.json", "integrations/openrazer/metadata.json", "integrations/openrazer/compatibility.json", "integrations/openrazer/native-control-policy.json", "integrations/openrazer/native-method-inventory.json"],
+      "id": "openrazer-adapter", "title": "OpenRazer native route", "path": "integrations/openrazer", "category": "applications", "status": "implemented",
+      "purpose": "Extends pinned OpenRazer with trusted feature-only HyperFlux routes while preserving ordinary USB devices and the official daemon API.",
+      "owns": ["Feature-only UHID route contract", "Pinned OpenRazer source transform", "Serial-proven direct-route precedence metadata"],
+      "must_not_own": ["OpenRazer device semantics", "Official daemon identity", "Direct USB transport"],
+      "inputs": ["Protocol-v7 native routes", "Pinned OpenRazer source", "Generated method and probe inventories"],
+      "outputs": ["Hardened UHID relay", "Source-pinned OpenRazer DKMS transform", "Private migration fallback"],
+      "public_contracts": ["Exact Feature SET/GET exchange", "No input collections", "Serial-proven direct USB precedence"],
+      "canonical_files": ["integrations/openrazer/import.json", "integrations/openrazer/metadata.json", "integrations/openrazer/native-control-policy.json", "integrations/openrazer/native-method-inventory.json", "integrations/openrazer/native-probe-catalog.json", "integrations/openrazer/native-route/catalog.json", "integrations/openrazer/native-route/transform.json"],
       "generated_files": ["integrations/openrazer/README.md", "sdk/python/hyperflux_sdk/generated/openrazer_metadata.py"],
-      "verification": ["openrazer-metadata-contracts", "openrazer-compatibility-contracts"],
-      "limitations": ["Compatibility covers modeled client behavior, not every OpenRazer daemon extension"],
-      "safe_change_workflow": ["Update the pinned metadata or compatibility contract", "Regenerate the private adapter", "Run metadata, compatibility, and coexistence tests"],
+      "verification": ["openrazer-metadata-contracts", "openrazer-native-route-contracts", "openrazer-compatibility-contracts"],
+      "limitations": ["Native-route physical method parity remains pending; the private compatibility path is a migration fallback"],
+      "safe_change_workflow": ["Update the pinned source or declarative route contract", "Regenerate the source transform and relay metadata", "Run metadata, native-route, compatibility, and package tests"],
       "related_docs": ["docs/architecture/openrazer-compatibility.md", "docs/generated/integrations.md"],
       "depends_on": ["integrations", "profiles", "sdk-python"]
     },
     {
       "id": "polychromatic-adapter", "title": "Polychromatic adapter", "path": "integrations/polychromatic", "category": "applications", "status": "implemented",
-      "purpose": "Exposes HyperFlux-backed devices to Polychromatic through a native bounded backend and explicit coexistence policy.",
-      "owns": ["Polychromatic backend projection", "Client state mapping", "Backend discovery patch"],
-      "must_not_own": ["OpenRazer global policy", "Raw receiver access", "Profile qualification"],
-      "inputs": ["SDK state", "Generated OpenRazer presentation metadata", "Polychromatic client contract"],
-      "outputs": ["Installable backend", "Typed Polychromatic state"],
-      "public_contracts": ["Native backend discovery", "No unrelated-device suppression", "SDK-only writes"],
+      "purpose": "Retains the SDK-native backend as a migration fallback while Polychromatic uses its ordinary OpenRazer backend for native routes.",
+      "owns": ["Migration backend projection", "Client state mapping", "Backend discovery patch"],
+      "must_not_own": ["OpenRazer device semantics", "Raw receiver access", "Native-route qualification"],
+      "inputs": ["Fallback SDK state", "Generated OpenRazer presentation metadata", "Polychromatic client contract"],
+      "outputs": ["Installable migration backend", "Typed fallback state"],
+      "public_contracts": ["No unrelated-device suppression", "NativeControl prevents competing writes", "Official OpenRazer remains the native route"],
       "canonical_files": ["integrations/polychromatic/pyproject.toml", "integrations/polychromatic/hyperflux_polychromatic/backend.py", "integrations/polychromatic/patches/0001-discover-native-backends.patch"],
       "generated_files": ["integrations/polychromatic/README.md"],
       "verification": ["polychromatic-adapter-contracts"],
-      "limitations": ["Presentation depth is bounded by the current client extension points"],
-      "safe_change_workflow": ["Update the backend contract", "Keep upstream discovery changes minimal", "Run Polychromatic, OpenRazer, and package contracts"],
+      "limitations": ["The custom backend remains installed until native-route physical parity and a separate retirement gate pass"],
+      "safe_change_workflow": ["Update only the migration backend contract", "Keep upstream discovery changes minimal", "Run Polychromatic, OpenRazer, arbitration, and package contracts"],
       "related_docs": ["docs/architecture/integrations.md", "docs/generated/integrations.md"],
       "depends_on": ["openrazer-adapter", "sdk-python"]
     },
@@ -197,12 +197,12 @@
     },
     {
       "id": "core-runtime", "title": "Core policy engine", "path": "crates/hfx-core", "category": "runtime", "status": "implemented",
-      "purpose": "Owns lifecycle policy, receiver registry, leases, transactions, restoration intent, and typed diagnostics.",
-      "owns": ["Core state machines", "Lease and transaction policy", "Restoration intent"],
+      "purpose": "Owns receiver generations, qualified native routes, child-local arbitration, bounded transactions, retained fallback restoration, and typed diagnostics.",
+      "owns": ["Core state machines", "NativeControl and transaction policy", "Retained restoration intent"],
       "must_not_own": ["Socket framing", "Kernel I/O", "Application presentation"],
-      "inputs": ["Typed observations", "Profile decisions", "Clock and persistence ports"],
-      "outputs": ["Deterministic actions", "Events and diagnostics", "Restoration decisions"],
-      "public_contracts": ["Generation-bound state", "Terminal transaction outcomes", "Port-based side effects"],
+      "inputs": ["Typed observations", "Qualified route profiles", "Clock and persistence ports"],
+      "outputs": ["Deterministic route and transaction actions", "Events and diagnostics", "Retained fallback decisions"],
+      "public_contracts": ["Generation-bound native routes", "Child-local NativeControl exclusion", "Terminal transaction certainty", "Port-based side effects"],
       "canonical_files": ["crates/hfx-core/Cargo.toml", "crates/hfx-core/src/lib.rs", "crates/hfx-core/src/coordinator.rs"],
       "generated_files": ["crates/hfx-core/README.md"],
       "verification": ["rust-unit", "formal-model-contracts"],
@@ -213,12 +213,12 @@
     },
     {
       "id": "bridge-runtime", "title": "Bridge runtime", "path": "crates/hfx-bridge", "category": "runtime", "status": "implemented",
-      "purpose": "Adapts the core policy engine to sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.",
-      "owns": ["Bridge actors", "Session registry", "Persistence and RPC adaptation"],
+      "purpose": "Adapts the core to protocol-v7 native routes and exchanges plus retained protocol-v6 sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.",
+      "owns": ["Bridge actors", "Session registry", "Native-route scheduling", "Persistence and RPC adaptation"],
       "must_not_own": ["Core policy duplication", "Kernel report encoding", "Application-specific effects"],
       "inputs": ["Core actions", "SDK protocol frames", "Kernel transport observations"],
-      "outputs": ["Session responses", "State snapshots", "Persisted stable intent"],
-      "public_contracts": ["One bridge authority", "Bounded session registry", "Atomic persistence projection"],
+      "outputs": ["Session responses", "Native route snapshots and exchange outcomes", "Persisted fallback intent"],
+      "public_contracts": ["One bridge authority", "Bounded fair native exchange", "Explicit side-effect certainty", "Atomic fallback persistence projection"],
       "canonical_files": ["crates/hfx-bridge/Cargo.toml", "crates/hfx-bridge/src/lib.rs", "crates/hfx-bridge/src/rpc.rs"],
       "generated_files": ["crates/hfx-bridge/README.md"],
       "verification": ["rust-unit", "simulator-contracts"],
@@ -229,7 +229,7 @@
     },
     {
       "id": "daemon", "title": "Production daemon", "path": "crates/hfx-daemon", "category": "runtime", "status": "implemented",
-      "purpose": "Composes production discovery, configuration, authority, service lifecycle, logging, and restoration around the bridge.",
+      "purpose": "Composes production discovery, configuration, native-route authority, service lifecycle, logging, and the retained restoration fallback around the bridge.",
       "owns": ["Production composition root", "Service lifecycle", "Privilege and socket setup"],
       "must_not_own": ["Core state-machine policy", "Application UI", "Raw application commands"],
       "inputs": ["Runtime configuration", "Kernel transport", "Bridge services"],
@@ -245,12 +245,12 @@
     },
     {
       "id": "rust-sdk", "title": "Rust SDK", "path": "crates/hfx-sdk", "category": "runtime", "status": "implemented",
-      "purpose": "Provides the typed Rust client contract used by production integrations and internal consumers.",
-      "owns": ["Rust client API", "Identity and channel adaptation", "Typed SDK errors"],
-      "must_not_own": ["Application presentation", "Raw receiver reports", "Bridge policy"],
+      "purpose": "Provides the typed Rust client contract for qualified route discovery, bounded native exchanges, and retained semantic consumers.",
+      "owns": ["Rust client API", "Native route and channel adaptation", "Typed SDK errors"],
+      "must_not_own": ["Application presentation", "Device command semantics", "Receiver carrier frames", "Bridge policy"],
       "inputs": ["Versioned protocol", "Domain and profile types", "Local bridge channel"],
-      "outputs": ["Typed logical devices and events", "Lease and lighting requests"],
-      "public_contracts": ["Negotiated protocol", "Logical device identity", "No raw transport escape hatch"],
+      "outputs": ["Typed native routes and availability events", "NativeControl leases and exact Feature exchanges", "Retained semantic requests"],
+      "public_contracts": ["Negotiated protocol", "Opaque generation-bound routes", "Exactly one qualified 90-byte Feature report", "No arbitrary USB or receiver-frame escape hatch"],
       "canonical_files": ["crates/hfx-sdk/Cargo.toml", "crates/hfx-sdk/src/lib.rs", "crates/hfx-sdk/src/client.rs"],
       "generated_files": ["crates/hfx-sdk/README.md"],
       "verification": ["rust-unit", "protocol-contracts"],
@@ -325,12 +325,12 @@
     },
     {
       "id": "kernel-module", "title": "Linux HID kernel module", "path": "driver/kernel", "category": "runtime", "status": "implemented",
-      "purpose": "Binds the receiver, preserves generic input, records passive observations, and transports bounded generation-scoped envelopes.",
-      "owns": ["HID binding", "Passive receiver observations", "Exclusive session enforcement"],
+      "purpose": "Binds the receiver, preserves generic input, records passive observations, performs qualified fixed-size native exchanges, and retains bounded migration envelopes.",
+      "owns": ["HID binding", "Passive receiver observations", "Exclusive session enforcement", "UAPI-v2 native exchange execution"],
       "must_not_own": ["Retail names", "Profiles and effects", "Package repair"],
       "inputs": ["Generated receiver table", "Generated UAPI", "Kernel HID reports"],
-      "outputs": ["Generic input", "Generation state", "Bounded session device"],
-      "public_contracts": ["No input regression", "Passive unknown-device visibility", "Generation invalidation on reconnect"],
+      "outputs": ["Generic input", "Generation state", "Bounded session device", "Correlated native exchange results"],
+      "public_contracts": ["No input regression", "Passive unknown-device visibility", "One SET attempt per native exchange", "Generation invalidation on reconnect"],
       "canonical_files": ["driver/kernel/Makefile", "driver/kernel/hyperflux-next-core.c", "driver/kernel/hyperflux-next-session.c", "driver/kernel/hyperflux-next-transport.c"],
       "generated_files": ["driver/kernel/README.md", "driver/kernel/generated/hyperflux_receiver_profiles.inc", "driver/kernel/hyperflux-next-version.h"],
       "verification": ["kernel-profile-contracts"],
@@ -373,12 +373,12 @@
     },
     {
       "id": "sdk-cpp", "title": "C++ SDK", "path": "sdk/cpp", "category": "applications", "status": "implemented",
-      "purpose": "Provides typed C++ bridge access and generated contracts for native application adapters.",
-      "owns": ["C++ client API", "C++ channel and recovery", "Generated C++ bindings"],
-      "must_not_own": ["OpenRGB widgets", "Raw receiver transport", "Independent schema truth"],
+      "purpose": "Provides typed C++ bridge access for qualified native routes, exact Feature exchanges, and generated adapter contracts.",
+      "owns": ["C++ client API", "C++ native-route channel and recovery", "Generated C++ bindings"],
+      "must_not_own": ["OpenRGB widgets or device commands", "Receiver carrier transport", "Independent schema truth"],
       "inputs": ["Domain, protocol, profile, and error catalogs", "Local bridge channel"],
-      "outputs": ["C++ headers and client library", "Native adapter contract"],
-      "public_contracts": ["Typed logical devices", "Negotiated local protocol", "No raw hardware API"],
+      "outputs": ["C++ headers and client library", "Native route and Feature transport contract"],
+      "public_contracts": ["Typed qualified routes", "Negotiated protocol v7", "Exact 90-byte Feature exchange", "No arbitrary USB or receiver-frame API"],
       "canonical_files": ["sdk/cpp/CMakeLists.txt", "sdk/cpp/include/hyperflux/sdk.hpp", "sdk/cpp/src/client.cpp"],
       "generated_files": ["sdk/cpp/README.md", "sdk/cpp/include/hyperflux/generated/domain_types.hpp", "sdk/cpp/include/hyperflux/generated/profile_catalog.hpp"],
       "verification": ["cpp-sdk-contracts"],
diff --git a/assurance/design-coverage.json b/assurance/design-coverage.json
index 5eabc74..3cda385 100644
--- a/assurance/design-coverage.json
+++ b/assurance/design-coverage.json
@@ -10,25 +10,25 @@
     {"section": 6, "title": "Kernel Responsibility", "status": "software-verified", "owner": "kernel", "evidence": ["docs/architecture/kernel.md", "driver/kernel/hyperflux-next-core.c"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 7, "title": "Bridge Responsibility", "status": "software-verified", "owner": "bridge", "evidence": ["docs/architecture/bridge-core.md", "crates/hfx-bridge/src/backend.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 8, "title": "Strong Domain Types", "status": "software-verified", "owner": "schemas", "evidence": ["schemas/domain-catalog.json", "crates/hfx-domain/src/generated.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 9, "title": "Logical Devices And Routes", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-integration-model/src/view.rs", "crates/hfx-integration-model/tests/view_model.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 10, "title": "Presence State Model", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/src/lifecycle.rs", "crates/hfx-core/tests/lifecycle.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 11, "title": "Wired And Wireless Duplicate Handling", "status": "software-verified", "owner": "integrations", "evidence": ["crates/hfx-integration-model/tests/view_model.rs", "integrations/openrgb/src/inventory_model.cpp"], "remaining": ["Stable cross-route physical identity remains unavailable for models that expose no safe correlator."], "physical_evidence_required": true, "release_blocking": false},
+    {"section": 9, "title": "Inventory And Routes", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-bridge/src/native_routes.rs", "crates/hfx-bridge/src/native_projection.rs", "crates/hfx-bridge/tests/native_projection.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 10, "title": "Presence State Model", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-bridge/src/native_invalidation.rs", "crates/hfx-bridge/tests/native_projection.rs", "crates/hfx-protocol/tests/wire_and_snapshot.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 11, "title": "Wired And Wireless Duplicate Handling", "status": "software-verified", "owner": "integrations", "evidence": ["crates/hfx-uhid-relay/src/direct.rs", "crates/hfx-uhid-relay/src/serial.rs", "integrations/openrgb/src/upstream_razer_registry.cpp", "tests/cpp/openrgb_upstream_razer_registry_contract.cpp"], "remaining": ["Stable cross-route physical identity remains unavailable for models that expose no safe nonempty serial; those routes must remain separate."], "physical_evidence_required": true, "release_blocking": false},
     {"section": 12, "title": "Composable Hardware Profiles", "status": "software-verified", "owner": "profiles", "evidence": ["generated/profiles/catalog.json", "tests/fixtures/generated/profile-compositions.json"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 13, "title": "Hard And Cloth Editions", "status": "partially-implemented", "owner": "profiles", "evidence": ["profiles/surfaces/razer-hyperflux-v2-hard-edition.json", "profiles/candidates/razer-hyperflux-v2-2026-07-13.json"], "remaining": ["The Cloth Edition has no admitted physical evidence and must remain a surface candidate without an invented USB identity."], "physical_evidence_required": true, "release_blocking": true},
-    {"section": 14, "title": "Mat And Receiver Presentation", "status": "software-verified", "owner": "profiles", "evidence": ["docs/generated/supported-hardware.md", "crates/hfx-integration-model/tests/view_model.rs"], "remaining": ["Status-indicator control remains absent until its semantics are independently qualified."], "physical_evidence_required": true, "release_blocking": false},
-    {"section": 15, "title": "Support Levels", "status": "software-verified", "owner": "profiles", "evidence": ["profiles/capabilities.json", "docs/generated/supported-hardware.md"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 16, "title": "Unknown Device Behavior", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-integration-model/tests/view_model.rs", "crates/hfx-sim/tests/state_and_qualification.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 17, "title": "Capability-Based Programming", "status": "software-verified", "owner": "sdk", "evidence": ["profiles/capabilities.json", "protocol/v5/catalog.json"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 18, "title": "OpenRGB Integration", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrgb/src/plugin_coordinator.cpp", "tests/cpp/openrgb_plugin_coordinator_contract.cpp"], "remaining": ["The rewritten integration still requires targeted installed physical qualification before release-candidate promotion."], "physical_evidence_required": true, "release_blocking": true},
-    {"section": 19, "title": "OpenRGB Effects", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrgb/src/runtime_dispatch.cpp", "tests/cpp/openrgb_runtime_worker_contract.cpp"], "remaining": ["Visible latency and continuity on real hardware remain physical release evidence."], "physical_evidence_required": true, "release_blocking": true},
-    {"section": 20, "title": "Static Restoration And Effect Persistence", "status": "software-verified", "owner": "bridge", "evidence": ["docs/architecture/persistence.md", "crates/hfx-core/tests/restoration.rs"], "remaining": ["OpenRGB startup-profile behavior is application-owned and must be qualified with the installed application candidate."], "physical_evidence_required": true, "release_blocking": true},
-    {"section": 21, "title": "OpenRazer Metadata Reuse", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrazer/import.json", "integrations/openrazer/metadata.json"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 22, "title": "Optional org.razer Compatibility Provider", "status": "software-verified", "owner": "integrations", "evidence": ["docs/architecture/openrazer-compatibility.md", "tests/openrazer_compat_contracts.py"], "remaining": ["The private provider is opt-in and intentionally does not claim the official org.razer identity."], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 23, "title": "Native Polychromatic Backend", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/polychromatic/hyperflux_polychromatic/backend.py", "tests/polychromatic_contracts.py"], "remaining": ["Upstream acceptance of the native backend discovery seam is outside this repository."], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 24, "title": "Full Device Settings", "status": "blocked-by-physical-evidence", "owner": "profiles", "evidence": ["profiles/capabilities.json", "profiles/evidence/claims.json"], "remaining": ["DPI, polling, scroll, idle, battery-threshold, macro, gaming-mode, and pairing writes remain unavailable until receiver-side semantics are physically qualified."], "physical_evidence_required": true, "release_blocking": false},
-    {"section": 25, "title": "Ownership Leases", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/src/leases.rs", "crates/hfx-core/tests/leases.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 14, "title": "Mat And Receiver Presentation", "status": "software-verified", "owner": "profiles", "evidence": ["docs/generated/supported-hardware.md", "integrations/openrgb/src/upstream_razer_registry.cpp"], "remaining": ["No mat or status-light native route exists until a source-bound upstream controller and physical transport evidence justify one."], "physical_evidence_required": true, "release_blocking": false},
+    {"section": 15, "title": "Support Levels", "status": "software-verified", "owner": "profiles", "evidence": ["profiles/receivers/razer-hyperflux-v2-1532-00cf.json", "docs/architecture/native-device-onboarding.md", "tests/test_native_onboarding.py"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 16, "title": "Unknown Device Behavior", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-ops/src/native_onboarding.rs", "tools/hfxdev/native_onboarding.py", "tests/test_native_onboarding.py"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 17, "title": "Declarative Transport Profiles", "status": "software-verified", "owner": "profiles", "evidence": ["profiles/children/razer-basilisk-v3-pro-35k-00cd.json", "profiles/children/razer-deathstalker-v2-pro-tkl-0296.json", "tests/test_native_onboarding.py"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 18, "title": "OpenRGB Integration", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrgb/native-route/transform.json", "integrations/openrgb/src/razer_feature_transport.cpp", "tests/cpp/openrgb_razer_feature_transport_contract.cpp"], "remaining": ["The upstream-native controllers require targeted installed physical qualification before release-candidate promotion."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 19, "title": "OpenRGB Effects", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrgb/src/native_route_session.cpp", "tests/cpp/openrgb_native_route_session_contract.cpp"], "remaining": ["Visible latency and continuity through the upstream Effects plugin remain physical release evidence."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 20, "title": "Application-Owned Persistence", "status": "software-verified", "owner": "integrations", "evidence": ["docs/architecture/integrations.md", "integrations/openrgb/src/native_plugin_application.cpp"], "remaining": ["OpenRGB startup-profile and route-return behavior must be qualified with the installed upstream candidate."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 21, "title": "OpenRazer Native Route", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrazer/native-route/catalog.json", "integrations/openrazer/native-route/transform.json", "crates/hfx-uhid-relay/src/lib.rs"], "remaining": ["The source-pinned driver and UHID route require targeted installed physical method parity."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 22, "title": "Migration org.razer Compatibility Provider", "status": "software-verified", "owner": "integrations", "evidence": ["docs/architecture/openrazer-compatibility.md", "tests/openrazer_compat_contracts.py"], "remaining": ["Removal waits for native-route parity and a separate retirement approval."], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 23, "title": "Polychromatic Through OpenRazer", "status": "software-verified", "owner": "integrations", "evidence": ["integrations/openrazer/native-route/transform.json", "integrations/polychromatic/hyperflux_polychromatic/backend.py", "tests/polychromatic_contracts.py"], "remaining": ["The custom backend remains a migration fallback until ordinary OpenRazer-path physical parity passes."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 24, "title": "Upstream Device Settings", "status": "blocked-by-physical-evidence", "owner": "integrations", "evidence": ["integrations/openrazer/native-method-inventory.json", "integrations/openrazer/native-probe-catalog.json"], "remaining": ["Read-only and reversible upstream methods require native-route physical parity; HyperFlux does not reimplement their semantics."], "physical_evidence_required": true, "release_blocking": true},
+    {"section": 25, "title": "Native Control Ownership", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/src/leases.rs", "crates/hfx-core/tests/leases.rs", "crates/hfx-uhid-relay/src/bridge.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 26, "title": "Ownership User Experience", "status": "software-verified", "owner": "integrations", "evidence": ["crates/hfx-integration-model/src/view.rs", "integrations/openrgb/src/plugin_view_model.cpp"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 27, "title": "Atomic Multi-Device Requests", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/tests/leases.rs", "crates/hfx-core/tests/coordinator.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 27, "title": "Atomic Native Exchanges", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-bridge/src/native_exchange.rs", "crates/hfx-kernel-transport/tests/adapter.rs", "crates/hfx-protocol/tests/wire_and_snapshot.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 28, "title": "Schema-First Development", "status": "software-verified", "owner": "schemas", "evidence": ["schemas/domain-catalog.json", "schemas/protocol-catalog.schema.json"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 29, "title": "Generated Code", "status": "software-verified", "owner": "generation", "evidence": ["tools/hfxdev/render.py", "docs/generated/domain-types.md"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 30, "title": "Stable HyperFlux SDK", "status": "software-verified", "owner": "sdk", "evidence": ["crates/hfx-sdk/src/client.rs", "sdk/cpp/include/hyperflux/sdk.hpp", "sdk/python/hyperflux_sdk/client.py"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
@@ -36,7 +36,7 @@
     {"section": 32, "title": "Interfaces And Dependency Injection", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/src/ports.rs", "crates/hfx-sim/src/engine.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 33, "title": "Explicit State Machines", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-core/src/transactions.rs", "crates/hfx-core/tests/transactions.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 34, "title": "Event Subscriptions", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-bridge/src/subscriptions.rs", "crates/hfx-bridge/tests/subscriptions.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
-    {"section": 35, "title": "Bounded Concurrency And Backpressure", "status": "software-verified", "owner": "bridge", "evidence": ["runtime/linux.json", "crates/hfx-core/tests/events_and_diagnostics.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
+    {"section": 35, "title": "Bounded Concurrency And Backpressure", "status": "software-verified", "owner": "bridge", "evidence": ["crates/hfx-bridge/src/native_scheduler.rs", "crates/hfx-bridge/src/native_exchange.rs", "crates/hfx-bridge/tests/native_projection.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 36, "title": "Virtual Receiver", "status": "software-verified", "owner": "verification", "evidence": ["crates/hfx-sim/src/transport.rs", "crates/hfx-sim/tests/transport_and_restore.rs"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 37, "title": "Deterministic Replay", "status": "software-verified", "owner": "verification", "evidence": ["crates/hfx-sim/src/replay.rs", "tests/fixtures/replay/qualified-lifecycle-v1.json"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
     {"section": 38, "title": "One Verification Entry Point", "status": "software-verified", "owner": "verification", "evidence": ["hfx", "tools/hfxdev/cli.py", "tools/hfxdev/verification_run.py"], "remaining": [], "physical_evidence_required": false, "release_blocking": false},
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index aad5c72..81a571f 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/7d3646e6c0c97ff16a7ae093b63c340045896ac6901dec8db6c6919990e4f060",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/0115160d1f0205a27c83807c23c139f4a39882a73bca9bd48d2cb2d88da82112",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
diff --git a/crates/hfx-bridge/README.md b/crates/hfx-bridge/README.md
index e1b4bae..aa2283e 100644
--- a/crates/hfx-bridge/README.md
+++ b/crates/hfx-bridge/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Adapts the core policy engine to sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.
+Adapts the core to protocol-v7 native routes and exchanges plus retained protocol-v6 sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.
 
 `implemented` | `runtime` | Atlas: `bridge-runtime`
 
@@ -16,6 +16,7 @@ Adapts the core policy engine to sessions, persistence, subscriptions, snapshots
 **Owns**
 - Bridge actors
 - Session registry
+- Native-route scheduling
 - Persistence and RPC adaptation
 
 **Does not own**
diff --git a/crates/hfx-bridge/src/backend.rs b/crates/hfx-bridge/src/backend.rs
index 0a0094f..0bb0c44 100644
--- a/crates/hfx-bridge/src/backend.rs
+++ b/crates/hfx-bridge/src/backend.rs
@@ -26,8 +26,8 @@ use hfx_core::{
 };
 use hfx_domain::{
     DeviceKind, EventKind, FindingId, LeaseDurationMs, MonotonicMs, NativeReportHex,
-    NativeRouteAccess, NativeRouteToken, ProjectionRevision, ProtocolErrorKind, QueueCapacity,
-    ReceiverId, ResourceKind, RestoreClaimId, RouteState, StreamEpoch, StreamId,
+    NativeRouteAccess, NativeRouteState, NativeRouteToken, ProjectionRevision, ProtocolErrorKind,
+    QueueCapacity, ReceiverId, ResourceKind, RestoreClaimId, StreamEpoch, StreamId,
 };
 use hfx_errors::ErrorCode;
 use hfx_integration_model::project_integration_view;
@@ -775,7 +775,7 @@ where
                         .route_for_resource(resource)
                         .ok_or_else(profile_failure)?;
                     if route.access != NativeRouteAccess::Qualified
-                        || route.route_state != RouteState::Available
+                        || route.route_state != NativeRouteState::Available
                     {
                         return Err(profile_failure());
                     }
@@ -1122,7 +1122,7 @@ where
         if route.access != NativeRouteAccess::Qualified {
             return self.reject_native_before_set(request, ProtocolErrorKind::UnsupportedFeature);
         }
-        if route.route_state != RouteState::Available {
+        if route.route_state != NativeRouteState::Available {
             return self.reject_native_before_set(request, ProtocolErrorKind::TransportFailure);
         }
         let Some(resource) = route.resource.clone() else {
@@ -1390,10 +1390,14 @@ fn native_route_invalidation(
         Some(route) if route.access != NativeRouteAccess::Qualified => {
             NativeExchangeRejection::RouteWithdrawn
         }
-        Some(route) if route.route_state != RouteState::Available => {
+        Some(route) if route.route_state == NativeRouteState::TemporarilyUnavailable => {
             NativeExchangeRejection::RouteUnavailable
         }
-        Some(_) | None => NativeExchangeRejection::RouteUnavailable,
+        Some(route) if route.route_state == NativeRouteState::Withdrawn => {
+            NativeExchangeRejection::RouteWithdrawn
+        }
+        Some(_) => NativeExchangeRejection::RouteUnavailable,
+        None => NativeExchangeRejection::RouteWithdrawn,
     }
 }
 
@@ -1586,7 +1590,11 @@ mod tests {
         T::try_from(value.to_owned()).expect("test value is canonical")
     }
 
-    fn route(generation: u64, access: NativeRouteAccess, route_state: RouteState) -> NativeRoute {
+    fn route(
+        generation: u64,
+        access: NativeRouteAccess,
+        route_state: NativeRouteState,
+    ) -> NativeRoute {
         NativeRoute {
             receiver_id: text::<ReceiverId>("receiver-1"),
             generation_id: GenerationId::try_from(generation).expect("generation is canonical"),
@@ -1634,14 +1642,14 @@ mod tests {
 
     #[test]
     fn route_invalidation_preserves_generation_availability_and_authority_causes() {
-        let previous = route(1, NativeRouteAccess::Qualified, RouteState::Available);
+        let previous = route(1, NativeRouteAccess::Qualified, NativeRouteState::Available);
         assert_eq!(
             native_route_invalidation(
                 &previous,
                 &[route(
                     2,
                     NativeRouteAccess::Qualified,
-                    RouteState::Available,
+                    NativeRouteState::Available,
                 )],
             ),
             NativeExchangeRejection::StaleGeneration
@@ -1652,7 +1660,7 @@ mod tests {
                 &[route(
                     1,
                     NativeRouteAccess::Qualified,
-                    RouteState::Unavailable,
+                    NativeRouteState::TemporarilyUnavailable,
                 )],
             ),
             NativeExchangeRejection::RouteUnavailable
@@ -1663,14 +1671,14 @@ mod tests {
                 &[route(
                     1,
                     NativeRouteAccess::Candidate,
-                    RouteState::Available,
+                    NativeRouteState::Available,
                 )],
             ),
             NativeExchangeRejection::RouteWithdrawn
         );
         assert_eq!(
             native_route_invalidation(&previous, &[]),
-            NativeExchangeRejection::RouteUnavailable
+            NativeExchangeRejection::RouteWithdrawn
         );
     }
 
diff --git a/crates/hfx-bridge/src/native_projection.rs b/crates/hfx-bridge/src/native_projection.rs
index 3124a48..28725ad 100644
--- a/crates/hfx-bridge/src/native_projection.rs
+++ b/crates/hfx-bridge/src/native_projection.rs
@@ -3,8 +3,8 @@
 use crate::RuntimeProfileAuthority;
 use hfx_core::{EndpointLifecycle, ReceiverLifecycleRegistry};
 use hfx_domain::{
-    ActivityState, NativeProtocolFamily, NativeReportByteCount, NativeRouteAccess, PowerState,
-    RouteKind, RouteState, SleepState, SupportLevel,
+    NativeProtocolFamily, NativeReportByteCount, NativeRouteAccess, NativeRouteState, RouteKind,
+    RouteState, SupportLevel,
 };
 use hfx_protocol::NativeRoute;
 use std::fmt;
@@ -128,19 +128,12 @@ fn native_exchange_is_qualified(profile: &hfx_profiles::RuntimeProfile) -> bool
     })
 }
 
-fn native_route_state(endpoint: &EndpointLifecycle) -> RouteState {
+fn native_route_state(endpoint: &EndpointLifecycle) -> NativeRouteState {
     match endpoint.route().value() {
-        RouteState::Available => RouteState::Available,
-        RouteState::Unavailable => RouteState::Unavailable,
-        RouteState::Stale => RouteState::Stale,
-        RouteState::Unknown if endpoint.power().value() == PowerState::Off => {
-            RouteState::Unavailable
+        RouteState::Available => NativeRouteState::Available,
+        RouteState::Unavailable | RouteState::Stale | RouteState::Unknown => {
+            NativeRouteState::TemporarilyUnavailable
         }
-        RouteState::Unknown if endpoint.activity().value() == ActivityState::Active => {
-            RouteState::Available
-        }
-        RouteState::Unknown if endpoint.sleep().value() == SleepState::Asleep => RouteState::Stale,
-        RouteState::Unknown => RouteState::Unknown,
     }
 }
 
diff --git a/crates/hfx-bridge/src/native_routes.rs b/crates/hfx-bridge/src/native_routes.rs
index dae0ebb..ddcd300 100644
--- a/crates/hfx-bridge/src/native_routes.rs
+++ b/crates/hfx-bridge/src/native_routes.rs
@@ -2,8 +2,9 @@
 
 use crate::{RuntimeIdentityError, RuntimeIdentityIssuer};
 use hfx_domain::{
-    DroppedEventCount, NativeRouteAccess, NativeRouteEventKind, ProjectionRevision, ReceiverId,
-    ResourceKind, SequenceNumber, StreamEpoch, StreamId, SubscriptionId,
+    DroppedEventCount, NativeRouteAccess, NativeRouteEventKind, NativeRouteState,
+    ProjectionRevision, ReceiverId, ResourceKind, SequenceNumber, StreamEpoch, StreamId,
+    SubscriptionId,
 };
 use hfx_protocol::{
     EventCursor, NativeRoute, NativeRouteEvent, NativeRouteEventBatch, NativeRouteInventory,
@@ -163,11 +164,11 @@ impl NativeRouteJournal {
         }
         for (key, old) in previous {
             if !incoming.contains_key(&key) {
-                let mut unavailable = old;
-                unavailable.route_state = hfx_domain::RouteState::Unavailable;
-                unavailable.route_token = None;
-                unavailable.resource = None;
-                self.append(NativeRouteEventKind::Unavailable, unavailable)?;
+                let mut withdrawn = old;
+                withdrawn.route_state = NativeRouteState::Withdrawn;
+                withdrawn.route_token = None;
+                withdrawn.resource = None;
+                self.append(NativeRouteEventKind::Withdrawn, withdrawn)?;
             }
         }
         self.current = incoming;
@@ -181,7 +182,7 @@ impl NativeRouteJournal {
         identities: &mut RuntimeIdentityIssuer,
     ) -> Result<(), NativeRouteJournalError> {
         let writable = route.access == NativeRouteAccess::Qualified
-            && route.route_state == hfx_domain::RouteState::Available;
+            && route.route_state == NativeRouteState::Available;
         if !writable {
             route.route_token = None;
             route.resource = None;
@@ -190,7 +191,7 @@ impl NativeRouteJournal {
         if let Some(previous) = self.current.get(key)
             && previous.generation_id == route.generation_id
             && previous.access == NativeRouteAccess::Qualified
-            && previous.route_state == hfx_domain::RouteState::Available
+            && previous.route_state == NativeRouteState::Available
             && let Some(token) = &previous.route_token
         {
             route.route_token = Some(token.clone());
@@ -340,10 +341,10 @@ impl NativeRouteJournal {
 }
 
 fn route_event_kind(route: &NativeRoute) -> NativeRouteEventKind {
-    if route.route_state == hfx_domain::RouteState::Available {
-        NativeRouteEventKind::Available
-    } else {
-        NativeRouteEventKind::Unavailable
+    match route.route_state {
+        NativeRouteState::Available => NativeRouteEventKind::Available,
+        NativeRouteState::TemporarilyUnavailable => NativeRouteEventKind::TemporarilyUnavailable,
+        NativeRouteState::Withdrawn => NativeRouteEventKind::Withdrawn,
     }
 }
 
@@ -362,7 +363,7 @@ mod tests {
     use crate::{SessionIdentityError, SessionIdentitySource};
     use hfx_domain::{
         DeviceKind, EventBatchLimit, GenerationId, NativeProtocolFamily, NativeReportByteCount,
-        ProductId, RouteState, VendorId,
+        ProductId, VendorId,
     };
 
     #[derive(Debug)]
@@ -399,7 +400,7 @@ mod tests {
         (journal, identities)
     }
 
-    fn route(generation: u64, access: NativeRouteAccess, state: RouteState) -> NativeRoute {
+    fn route(generation: u64, access: NativeRouteAccess, state: NativeRouteState) -> NativeRoute {
         NativeRoute {
             receiver_id: text("receiver-1"),
             generation_id: GenerationId::try_from(generation).expect("generation is valid"),
@@ -425,7 +426,7 @@ mod tests {
                 vec![route(
                     1,
                     NativeRouteAccess::Candidate,
-                    RouteState::Available,
+                    NativeRouteState::Available,
                 )],
                 &mut identities,
             )
@@ -440,7 +441,7 @@ mod tests {
     #[test]
     fn exact_generation_reuses_token_and_replacement_rotates_it() {
         let (mut journal, mut identities) = journal(8);
-        let qualified = route(1, NativeRouteAccess::Qualified, RouteState::Available);
+        let qualified = route(1, NativeRouteAccess::Qualified, NativeRouteState::Available);
         journal
             .synchronize(vec![qualified.clone()], &mut identities)
             .expect("first route synchronizes");
@@ -463,7 +464,7 @@ mod tests {
                 vec![route(
                     2,
                     NativeRouteAccess::Qualified,
-                    RouteState::Available,
+                    NativeRouteState::Available,
                 )],
                 &mut identities,
             )
@@ -485,7 +486,7 @@ mod tests {
                 vec![route(
                     1,
                     NativeRouteAccess::Candidate,
-                    RouteState::Available,
+                    NativeRouteState::Available,
                 )],
                 &mut identities,
             )
@@ -493,7 +494,11 @@ mod tests {
         let old_cursor = journal.cursor();
         journal
             .synchronize(
-                vec![route(1, NativeRouteAccess::Candidate, RouteState::Stale)],
+                vec![route(
+                    1,
+                    NativeRouteAccess::Candidate,
+                    NativeRouteState::TemporarilyUnavailable,
+                )],
                 &mut identities,
             )
             .expect("stale route synchronizes");
@@ -512,7 +517,11 @@ mod tests {
             .expect("bounded events are readable");
         assert!(!batch.cursor_gap);
         assert_eq!(batch.events.len(), 2);
-        assert_eq!(batch.events[1].kind, NativeRouteEventKind::Unavailable);
+        assert_eq!(
+            batch.events[0].kind,
+            NativeRouteEventKind::TemporarilyUnavailable
+        );
+        assert_eq!(batch.events[1].kind, NativeRouteEventKind::Withdrawn);
         assert!(journal.inventory().routes.is_empty());
 
         let beginning = EventCursor {
diff --git a/crates/hfx-bridge/tests/native_projection.rs b/crates/hfx-bridge/tests/native_projection.rs
index 33de043..3babde4 100644
--- a/crates/hfx-bridge/tests/native_projection.rs
+++ b/crates/hfx-bridge/tests/native_projection.rs
@@ -7,8 +7,8 @@ use hfx_core::{
 };
 use hfx_domain::{
     ConnectionMode, DeviceKind, EndpointId, EvidenceClaimId, EvidenceConfidence, GenerationId,
-    LogicalDeviceId, MonotonicMs, NativeRouteAccess, ProductId, RouteKind, RouteState,
-    SequenceNumber, SleepState, VendorId,
+    LogicalDeviceId, MonotonicMs, NativeRouteAccess, NativeRouteState, ProductId, RouteKind,
+    RouteState, SequenceNumber, SleepState, VendorId,
 };
 
 fn text<T>(value: &str) -> T
@@ -41,7 +41,7 @@ fn register_child(
     product_id: u16,
     route: RouteKind,
     sequence: u64,
-    available: bool,
+    route_state: Option<RouteState>,
 ) {
     let device_id: LogicalDeviceId = text(id);
     machine
@@ -72,15 +72,10 @@ fn register_child(
             stamp(sequence + 1),
         )
         .expect("endpoint registers");
-    if available {
+    if let Some(route_state) = route_state {
         machine
-            .observe_route(
-                &device_id,
-                &endpoint_id,
-                RouteState::Available,
-                stamp(sequence + 2),
-            )
-            .expect("route becomes available");
+            .observe_route(&device_id, &endpoint_id, route_state, stamp(sequence + 2))
+            .expect("route state is observed");
     } else {
         machine
             .observe_sleep(
@@ -105,7 +100,7 @@ fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candi
         0x00cd,
         RouteKind::HyperfluxWireless,
         2,
-        true,
+        Some(RouteState::Available),
     );
     register_child(
         &mut machine,
@@ -114,7 +109,16 @@ fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candi
         0x7777,
         RouteKind::HyperfluxWireless,
         10,
-        false,
+        None,
+    );
+    register_child(
+        &mut machine,
+        "known-unavailable",
+        DeviceKind::Mouse,
+        0x00cd,
+        RouteKind::HyperfluxWireless,
+        16,
+        Some(RouteState::Unavailable),
     );
     register_child(
         &mut machine,
@@ -123,7 +127,7 @@ fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candi
         0x00cd,
         RouteKind::DirectUsb,
         20,
-        true,
+        Some(RouteState::Available),
     );
     let mut receivers = ReceiverLifecycleRegistry::default();
     receivers.register(machine).expect("receiver fits");
@@ -138,9 +142,9 @@ fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candi
         .expect("receiver binds");
 
     let routes = project_native_routes(&receivers, &profiles).expect("routes project");
-    assert_eq!(routes.len(), 2);
+    assert_eq!(routes.len(), 3);
     assert_eq!(routes[0].device_id.as_str(), "known-mouse");
-    assert_eq!(routes[0].route_state, RouteState::Available);
+    assert_eq!(routes[0].route_state, NativeRouteState::Available);
     assert_eq!(routes[0].access, NativeRouteAccess::Candidate);
     assert_eq!(routes[0].vendor_id.get(), 0x1532);
     assert_eq!(routes[0].product_id.get(), 0x00cd);
@@ -152,8 +156,18 @@ fn receiver_native_backend_projects_known_and_unknown_wireless_children_as_candi
     assert!(routes[0].route_token.is_none());
     assert!(routes[0].resource.is_none());
 
-    assert_eq!(routes[1].device_id.as_str(), "unknown-keyboard");
-    assert_eq!(routes[1].product_id.get(), 0x7777);
-    assert_eq!(routes[1].route_state, RouteState::Stale);
+    assert_eq!(routes[1].device_id.as_str(), "known-unavailable");
+    assert_eq!(
+        routes[1].route_state,
+        NativeRouteState::TemporarilyUnavailable
+    );
     assert_eq!(routes[1].access, NativeRouteAccess::Candidate);
+
+    assert_eq!(routes[2].device_id.as_str(), "unknown-keyboard");
+    assert_eq!(routes[2].product_id.get(), 0x7777);
+    assert_eq!(
+        routes[2].route_state,
+        NativeRouteState::TemporarilyUnavailable
+    );
+    assert_eq!(routes[2].access, NativeRouteAccess::Candidate);
 }
diff --git a/crates/hfx-core/README.md b/crates/hfx-core/README.md
index cda91a1..55ee47d 100644
--- a/crates/hfx-core/README.md
+++ b/crates/hfx-core/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Owns lifecycle policy, receiver registry, leases, transactions, restoration intent, and typed diagnostics.
+Owns receiver generations, qualified native routes, child-local arbitration, bounded transactions, retained fallback restoration, and typed diagnostics.
 
 `implemented` | `runtime` | Atlas: `core-runtime`
 
@@ -15,8 +15,8 @@ Owns lifecycle policy, receiver registry, leases, transactions, restoration inte
 
 **Owns**
 - Core state machines
-- Lease and transaction policy
-- Restoration intent
+- NativeControl and transaction policy
+- Retained restoration intent
 
 **Does not own**
 - Socket framing
diff --git a/crates/hfx-core/src/leases.rs b/crates/hfx-core/src/leases.rs
index de91f25..bf3e9a0 100644
--- a/crates/hfx-core/src/leases.rs
+++ b/crates/hfx-core/src/leases.rs
@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use hfx_domain::{ClientId, LeaseDurationMs, LeaseId, LeaseState, MonotonicMs, RequestId};
+use hfx_domain::{
+    ClientId, LeaseDurationMs, LeaseId, LeaseState, MonotonicMs, RequestId, ResourceKind,
+};
 use hfx_protocol::{
     LeaseConflict, LeaseGrant, LeaseRequest, LeaseResult, ProtocolValidationError,
     ReleaseLeaseRequest, RenewLeaseRequest, ResourceKey, ResourceOwnershipSnapshot,
@@ -24,6 +26,15 @@ enum LeaseOperation {
     Release(ReleaseLeaseRequest),
 }
 
+fn resources_conflict(requested: &ResourceKey, owned: &ResourceKey) -> bool {
+    requested.receiver_id == owned.receiver_id
+        && requested.generation_id == owned.generation_id
+        && requested.device_id == owned.device_id
+        && (requested.kind == owned.kind
+            || requested.kind == ResourceKind::NativeControl
+            || owned.kind == ResourceKind::NativeControl)
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct LeaseDecision {
     pub result: LeaseResult,
@@ -134,7 +145,9 @@ impl LeaseManager {
             return Err(LeaseManagerError::RequestIdReused);
         }
         if let Some((resource, owner)) = request.resources.iter().find_map(|resource| {
-            let lease_id = self.owners.get(resource)?;
+            let lease_id = self.owners.iter().find_map(|(owned, lease_id)| {
+                resources_conflict(resource, owned).then_some(lease_id)
+            })?;
             let grant = self.leases.get(lease_id)?;
             Some((resource.clone(), grant.client_id.clone()))
         }) {
diff --git a/crates/hfx-core/tests/leases.rs b/crates/hfx-core/tests/leases.rs
index 29e120e..f1517c9 100644
--- a/crates/hfx-core/tests/leases.rs
+++ b/crates/hfx-core/tests/leases.rs
@@ -4,8 +4,20 @@ mod common;
 
 use common::{lease_request, resource, text, time};
 use hfx_core::{LeaseManager, LeaseManagerError};
-use hfx_domain::{LeaseDurationMs, LeaseState};
-use hfx_protocol::{LeaseResult, ReleaseLeaseRequest, RenewLeaseRequest};
+use hfx_domain::{LeaseDurationMs, LeaseState, ResourceKind};
+use hfx_protocol::{LeaseResult, ReleaseLeaseRequest, RenewLeaseRequest, ResourceKey};
+
+fn resource_kind(
+    receiver: &str,
+    generation_id: u64,
+    device: &str,
+    kind: ResourceKind,
+) -> ResourceKey {
+    ResourceKey {
+        kind,
+        ..resource(receiver, generation_id, device)
+    }
+}
 
 #[test]
 fn conflict_grants_none_of_an_atomic_resource_set() {
@@ -73,6 +85,90 @@ fn conflict_is_reported_even_when_the_lease_table_is_full() {
     assert_eq!(detail.conflicting_resource, mouse);
 }
 
+#[test]
+fn native_control_excludes_semantic_resources_only_for_the_same_child_epoch() {
+    for semantic_kind in [
+        ResourceKind::Lighting,
+        ResourceKind::Settings,
+        ResourceKind::Pairing,
+    ] {
+        for (owned_kind, requested_kind) in [
+            (ResourceKind::NativeControl, semantic_kind),
+            (semantic_kind, ResourceKind::NativeControl),
+        ] {
+            let mut manager = LeaseManager::new(4, 8).expect("manager bounds are valid");
+            let owned = resource_kind("receiver-1", 1, "mouse-1", owned_kind);
+            let requested = resource_kind("receiver-1", 1, "mouse-1", requested_kind);
+            manager
+                .acquire(
+                    lease_request("request-owned", "client-owned", vec![owned]),
+                    text("lease-owned"),
+                    time(100),
+                )
+                .expect("first resource is granted");
+
+            let result = manager
+                .acquire(
+                    lease_request(
+                        "request-contender",
+                        "client-contender",
+                        vec![requested.clone()],
+                    ),
+                    text("lease-contender"),
+                    time(101),
+                )
+                .expect("cross-kind ownership conflict is a normal result");
+            let LeaseResult::Conflict(detail) = result else {
+                panic!("native control must exclude same-device semantic writes");
+            };
+            assert_eq!(detail.conflicting_resource, requested);
+        }
+    }
+
+    let mut manager = LeaseManager::new(4, 8).expect("manager bounds are valid");
+    manager
+        .acquire(
+            lease_request(
+                "request-native",
+                "client-native",
+                vec![resource_kind(
+                    "receiver-1",
+                    1,
+                    "mouse-1",
+                    ResourceKind::NativeControl,
+                )],
+            ),
+            text("lease-native"),
+            time(100),
+        )
+        .expect("native resource is granted");
+    for (request_id, resource) in [
+        (
+            "request-sibling",
+            resource_kind("receiver-1", 1, "keyboard-1", ResourceKind::Lighting),
+        ),
+        (
+            "request-generation",
+            resource_kind("receiver-1", 2, "mouse-1", ResourceKind::Lighting),
+        ),
+        (
+            "request-receiver",
+            resource_kind("receiver-2", 1, "mouse-1", ResourceKind::Lighting),
+        ),
+    ] {
+        assert!(matches!(
+            manager
+                .acquire(
+                    lease_request(request_id, request_id, vec![resource]),
+                    text(&format!("lease-{request_id}")),
+                    time(101),
+                )
+                .expect("independent route scope is grantable"),
+            LeaseResult::Granted(_)
+        ));
+    }
+}
+
 #[test]
 fn conflict_history_is_bounded_even_when_every_retained_grant_is_pinned() {
     let mut manager = LeaseManager::new(2, 2).expect("manager bounds are valid");
diff --git a/crates/hfx-daemon/README.md b/crates/hfx-daemon/README.md
index 088250e..fc0b9f7 100644
--- a/crates/hfx-daemon/README.md
+++ b/crates/hfx-daemon/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Composes production discovery, configuration, authority, service lifecycle, logging, and restoration around the bridge.
+Composes production discovery, configuration, native-route authority, service lifecycle, logging, and the retained restoration fallback around the bridge.
 
 `implemented` | `runtime` | Atlas: `daemon`
 
diff --git a/crates/hfx-domain/src/generated.rs b/crates/hfx-domain/src/generated.rs
index b843bcd..fa5af83 100644
--- a/crates/hfx-domain/src/generated.rs
+++ b/crates/hfx-domain/src/generated.rs
@@ -5581,12 +5581,54 @@ impl fmt::Display for NativeRouteAccess {
     }
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
+pub enum NativeRouteState {
+    #[serde(rename = "available")]
+    Available,
+    #[serde(rename = "temporarily-unavailable")]
+    TemporarilyUnavailable,
+    #[serde(rename = "withdrawn")]
+    Withdrawn,
+}
+
+impl NativeRouteState {
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Available => "available",
+            Self::TemporarilyUnavailable => "temporarily-unavailable",
+            Self::Withdrawn => "withdrawn",
+        }
+    }
+}
+
+impl FromStr for NativeRouteState {
+    type Err = DomainValueError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        match value {
+            "available" => Ok(Self::Available),
+            "temporarily-unavailable" => Ok(Self::TemporarilyUnavailable),
+            "withdrawn" => Ok(Self::Withdrawn),
+            _ => Err(DomainValueError::unknown_wire("NativeRouteState")),
+        }
+    }
+}
+
+impl fmt::Display for NativeRouteState {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(self.as_str())
+    }
+}
+
 #[derive(Clone, Copy, Debug, Deserialize, Eq, Hash, Ord, PartialEq, PartialOrd, Serialize)]
 pub enum NativeRouteEventKind {
     #[serde(rename = "available")]
     Available,
-    #[serde(rename = "unavailable")]
-    Unavailable,
+    #[serde(rename = "temporarily-unavailable")]
+    TemporarilyUnavailable,
+    #[serde(rename = "withdrawn")]
+    Withdrawn,
     #[serde(rename = "generation-replaced")]
     GenerationReplaced,
 }
@@ -5596,7 +5638,8 @@ impl NativeRouteEventKind {
     pub const fn as_str(self) -> &'static str {
         match self {
             Self::Available => "available",
-            Self::Unavailable => "unavailable",
+            Self::TemporarilyUnavailable => "temporarily-unavailable",
+            Self::Withdrawn => "withdrawn",
             Self::GenerationReplaced => "generation-replaced",
         }
     }
@@ -5608,7 +5651,8 @@ impl FromStr for NativeRouteEventKind {
     fn from_str(value: &str) -> Result<Self, Self::Err> {
         match value {
             "available" => Ok(Self::Available),
-            "unavailable" => Ok(Self::Unavailable),
+            "temporarily-unavailable" => Ok(Self::TemporarilyUnavailable),
+            "withdrawn" => Ok(Self::Withdrawn),
             "generation-replaced" => Ok(Self::GenerationReplaced),
             _ => Err(DomainValueError::unknown_wire("NativeRouteEventKind")),
         }
diff --git a/crates/hfx-integration-model/src/generated.rs b/crates/hfx-integration-model/src/generated.rs
index 2d74c78..d883a49 100644
--- a/crates/hfx-integration-model/src/generated.rs
+++ b/crates/hfx-integration-model/src/generated.rs
@@ -26,7 +26,7 @@ pub struct AdapterRecord {
 }
 
 pub const INTEGRATION_SOURCE_SHA256: &str =
-    "3f8980c873cd3cf3287cac586ca7512140b76ea3b8ce004149e847ef2caf80b1";
+    "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f";
 
 pub const UPSTREAMS: &[UpstreamRecord] = &[
     UpstreamRecord {
@@ -68,7 +68,7 @@ pub const UPSTREAMS: &[UpstreamRecord] = &[
 pub const ADAPTERS: &[AdapterRecord] = &[
     AdapterRecord {
         id: "openrazer-compatibility",
-        application: "OpenRazer-compatible clients",
+        application: "OpenRazer-compatible clients (migration fallback)",
         kind: "compatibility-service",
         status: "software-verified",
         upstream_ids: &["openrazer"],
@@ -76,26 +76,39 @@ pub const ADAPTERS: &[AdapterRecord] = &[
         feature_families: &["inventory", "lighting", "ownership"],
         coexistence_policy: "private-explicit-service-only",
     },
+    AdapterRecord {
+        id: "openrazer-native-route",
+        application: "OpenRazer and Polychromatic",
+        kind: "transport-adapter",
+        status: "software-verified",
+        upstream_ids: &["openrazer", "polychromatic"],
+        sdk_protocol_versions: &[7],
+        feature_families: &[
+            "availability",
+            "inventory",
+            "native-control",
+            "presentation",
+        ],
+        coexistence_policy: "upstream-transport-extension",
+    },
     AdapterRecord {
         id: "openrgb-native",
         application: "OpenRGB",
         kind: "native-plugin",
-        status: "in-progress",
+        status: "software-verified",
         upstream_ids: &["openrgb"],
-        sdk_protocol_versions: &[5],
+        sdk_protocol_versions: &[7],
         feature_families: &[
-            "effects",
+            "availability",
             "inventory",
-            "lighting",
-            "ownership",
+            "native-control",
             "presentation",
-            "telemetry",
         ],
         coexistence_policy: "application-plugin",
     },
     AdapterRecord {
         id: "polychromatic-native",
-        application: "Polychromatic",
+        application: "Polychromatic (migration fallback)",
         kind: "native-backend",
         status: "software-verified",
         upstream_ids: &["openrazer", "polychromatic"],
diff --git a/crates/hfx-integration-model/tests/catalog.rs b/crates/hfx-integration-model/tests/catalog.rs
index e57dc7a..95d2ab7 100644
--- a/crates/hfx-integration-model/tests/catalog.rs
+++ b/crates/hfx-integration-model/tests/catalog.rs
@@ -11,12 +11,21 @@ fn generated_catalog_keeps_upstreams_exact_and_network_free() {
 }
 
 #[test]
-fn adapters_require_canonical_protocol_v5_views_and_distinct_coexistence_contracts() {
-    assert!(
-        ADAPTERS
-            .iter()
-            .all(|adapter| adapter.sdk_protocol_versions == [5])
-    );
+fn adapters_bind_exact_protocol_generations_and_distinct_coexistence_contracts() {
+    assert_eq!(ADAPTERS.len(), 4);
+    for (id, versions) in [
+        ("openrazer-compatibility", &[5_u16][..]),
+        ("openrazer-native-route", &[7_u16][..]),
+        ("openrgb-native", &[7_u16][..]),
+        ("polychromatic-native", &[5_u16][..]),
+    ] {
+        assert_eq!(
+            adapter_by_id(id)
+                .unwrap_or_else(|| panic!("{id} adapter exists"))
+                .sdk_protocol_versions,
+            versions
+        );
+    }
     assert_eq!(
         adapter_by_id("openrgb-native")
             .expect("OpenRGB adapter exists")
@@ -29,4 +38,9 @@ fn adapters_require_canonical_protocol_v5_views_and_distinct_coexistence_contrac
             .coexistence_policy,
         "private-explicit-service-only"
     );
+    let native =
+        adapter_by_id("openrazer-native-route").expect("OpenRazer native-route adapter exists");
+    assert_eq!(native.kind, "transport-adapter");
+    assert_eq!(native.coexistence_policy, "upstream-transport-extension");
+    assert!(native.feature_families.contains(&"native-control"));
 }
diff --git a/crates/hfx-ops/src/native_onboarding.rs b/crates/hfx-ops/src/native_onboarding.rs
index a778221..1c15f19 100644
--- a/crates/hfx-ops/src/native_onboarding.rs
+++ b/crates/hfx-ops/src/native_onboarding.rs
@@ -232,8 +232,8 @@ mod tests {
     use super::*;
     use hfx_domain::{
         DeviceKind, EndpointId, GenerationId, LogicalDeviceId, NativeProtocolFamily,
-        NativeReportByteCount, NativeRouteAccess, ProductId, ProjectionRevision, ReceiverId,
-        RouteState, SequenceNumber, StreamEpoch, StreamId, VendorId,
+        NativeReportByteCount, NativeRouteAccess, NativeRouteState, ProductId, ProjectionRevision,
+        ReceiverId, SequenceNumber, StreamEpoch, StreamId, VendorId,
     };
     use hfx_protocol::{EventCursor, NativeRoute};
     use std::time::{SystemTime, UNIX_EPOCH};
@@ -263,7 +263,7 @@ mod tests {
                 device_kind: DeviceKind::Mouse,
                 vendor_id: VendorId::try_from(0x1532_u16).expect("vendor is valid"),
                 product_id: ProductId::try_from(0x007b_u16).expect("product is valid"),
-                route_state: RouteState::Available,
+                route_state: NativeRouteState::Available,
                 access: NativeRouteAccess::Candidate,
                 protocol_family: NativeProtocolFamily::try_from(
                     "razer-feature-report-v1".to_owned(),
diff --git a/crates/hfx-profiles/src/native_report.rs b/crates/hfx-profiles/src/native_report.rs
index 190f651..c9dfa82 100644
--- a/crates/hfx-profiles/src/native_report.rs
+++ b/crates/hfx-profiles/src/native_report.rs
@@ -315,7 +315,20 @@ mod tests {
     }
 
     #[test]
-    fn nonterminal_response_status_is_not_a_match() {
+    fn every_device_status_is_matched_without_interpretation() {
+        let request = report(0, 0);
+        for status in 1..=5 {
+            let response = report(status, 0);
+            assert_eq!(
+                native_response_matches(&profile(0), &request, &response),
+                Ok(true),
+                "device status {status} must remain an upstream semantic"
+            );
+        }
+    }
+
+    #[test]
+    fn request_only_status_zero_is_not_a_response() {
         let request = report(0, 0);
         let response = report(0, 0);
         assert_eq!(
diff --git a/crates/hfx-protocol/src/generated.rs b/crates/hfx-protocol/src/generated.rs
index 8963465..e9e7372 100644
--- a/crates/hfx-protocol/src/generated.rs
+++ b/crates/hfx-protocol/src/generated.rs
@@ -9,15 +9,15 @@ use hfx_domain::{
     FrameCount, FrameIndex, FreshnessState, GenerationId, HumanMessage, InventoryAvailability,
     LeaseDurationMs, LeaseId, LeaseState, LedCount, LogicalDeviceId, ModelName, MonotonicMs,
     NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
-    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, NegotiationToken, PairingState,
-    PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId, ProfileDigest, ProfileId,
-    ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolSessionId, ProtocolVersion,
-    QueueAdmission, QueueCapacity, ReceiverId, ReceiverLifecycleState, RequestDigest, RequestId,
-    ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence, ReturnPhase, RouteKind,
-    RouteState, SequenceNumber, ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision,
-    StableLightingMode, StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability,
-    TransactionClass, TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
-    VendorId,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteState, NativeRouteToken, NegotiationToken,
+    PairingState, PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId,
+    ProfileDigest, ProfileId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId,
+    ProtocolSessionId, ProtocolVersion, QueueAdmission, QueueCapacity, ReceiverId,
+    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreDeliveryState,
+    RestoreState, ReturnEvidence, ReturnPhase, RouteKind, RouteState, SequenceNumber,
+    ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision, StableLightingMode,
+    StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability, TransactionClass,
+    TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner, VendorId,
 };
 use serde::{Deserialize, Serialize};
 
@@ -798,8 +798,8 @@ pub struct NativeRoute {
     pub vendor_id: VendorId,
     /// Observed child USB product identifier.
     pub product_id: ProductId,
-    /// Current receiver route evidence.
-    pub route_state: RouteState,
+    /// Current route authority without a sleep, power, readiness, or application-state claim.
+    pub route_state: NativeRouteState,
     /// Evidence-backed tunnel access level.
     pub access: NativeRouteAccess,
     /// Opaque feature-report protocol family.
diff --git a/crates/hfx-protocol/src/generated_v7.rs b/crates/hfx-protocol/src/generated_v7.rs
index 8963465..e9e7372 100644
--- a/crates/hfx-protocol/src/generated_v7.rs
+++ b/crates/hfx-protocol/src/generated_v7.rs
@@ -9,15 +9,15 @@ use hfx_domain::{
     FrameCount, FrameIndex, FreshnessState, GenerationId, HumanMessage, InventoryAvailability,
     LeaseDurationMs, LeaseId, LeaseState, LedCount, LogicalDeviceId, ModelName, MonotonicMs,
     NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
-    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, NegotiationToken, PairingState,
-    PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId, ProfileDigest, ProfileId,
-    ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId, ProtocolSessionId, ProtocolVersion,
-    QueueAdmission, QueueCapacity, ReceiverId, ReceiverLifecycleState, RequestDigest, RequestId,
-    ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence, ReturnPhase, RouteKind,
-    RouteState, SequenceNumber, ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision,
-    StableLightingMode, StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability,
-    TransactionClass, TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner,
-    VendorId,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteState, NativeRouteToken, NegotiationToken,
+    PairingState, PowerState, PresenceState, PresentationKey, PrivacyClass, ProductId,
+    ProfileDigest, ProfileId, ProjectionRevision, ProtocolErrorKind, ProtocolFeatureId,
+    ProtocolSessionId, ProtocolVersion, QueueAdmission, QueueCapacity, ReceiverId,
+    ReceiverLifecycleState, RequestDigest, RequestId, ResourceKind, RestoreDeliveryState,
+    RestoreState, ReturnEvidence, ReturnPhase, RouteKind, RouteState, SequenceNumber,
+    ServerInstanceId, SideEffectCertainty, SleepState, SourceRevision, StableLightingMode,
+    StreamEpoch, StreamId, SubscriptionId, SupportLevel, TelemetryAvailability, TransactionClass,
+    TransactionId, TransactionState, TransportVariant, UpstreamId, UpstreamOwner, VendorId,
 };
 use serde::{Deserialize, Serialize};
 
@@ -798,8 +798,8 @@ pub struct NativeRoute {
     pub vendor_id: VendorId,
     /// Observed child USB product identifier.
     pub product_id: ProductId,
-    /// Current receiver route evidence.
-    pub route_state: RouteState,
+    /// Current route authority without a sleep, power, readiness, or application-state claim.
+    pub route_state: NativeRouteState,
     /// Evidence-backed tunnel access level.
     pub access: NativeRouteAccess,
     /// Opaque feature-report protocol family.
diff --git a/crates/hfx-protocol/src/generated_versions.rs b/crates/hfx-protocol/src/generated_versions.rs
index 5a48be4..949ffe0 100644
--- a/crates/hfx-protocol/src/generated_versions.rs
+++ b/crates/hfx-protocol/src/generated_versions.rs
@@ -108,7 +108,7 @@ pub const GENERATED_PROTOCOL_VERSIONS: &[ProtocolVersionDescriptor] = &[
     },
     ProtocolVersionDescriptor {
         version: 7,
-        catalog_sha256: "39443b1babed1e7f94824dcb3379f9572563263592841fda21378c14aff3bd34",
+        catalog_sha256: "3f5f6145b5abf844321aee3aff8d8eeb4f1f3561aee6deb431209eb42cea4b73",
         catalog_features: v7::SUPPORTED_FEATURES,
         served_features: &[
             "atomic-transactions",
diff --git a/crates/hfx-protocol/src/wire.rs b/crates/hfx-protocol/src/wire.rs
index e11e84f..7c7025d 100644
--- a/crates/hfx-protocol/src/wire.rs
+++ b/crates/hfx-protocol/src/wire.rs
@@ -11,9 +11,9 @@ use crate::{
 };
 use hfx_domain::{
     ConnectionMode, ControllerAvailability, FreshnessState, InventoryAvailability,
-    NativeRouteAccess, NativeRouteEventKind, PairingState, PowerState, PresenceState,
-    ProtocolErrorKind, ProtocolVersion, ReceiverLifecycleState, ResourceKind, RouteKind,
-    RouteState, SideEffectCertainty, SleepState, StableLightingMode, TransactionClass,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteState, PairingState, PowerState,
+    PresenceState, ProtocolErrorKind, ProtocolVersion, ReceiverLifecycleState, ResourceKind,
+    RouteKind, RouteState, SideEffectCertainty, SleepState, StableLightingMode, TransactionClass,
     TransactionState,
 };
 use serde::{Serialize, de::DeserializeOwned};
@@ -235,8 +235,8 @@ fn native_route_identity_precedes(left: &NativeRoute, right: &NativeRoute) -> bo
 }
 
 fn validate_native_route(route: &NativeRoute) -> Result<(), ProtocolWireError> {
-    let writable =
-        route.access == NativeRouteAccess::Qualified && route.route_state == RouteState::Available;
+    let writable = route.access == NativeRouteAccess::Qualified
+        && route.route_state == NativeRouteState::Available;
     if writable != route.route_token.is_some() || writable != route.resource.is_some() {
         return Err(ProtocolWireError::InvalidResponse(
             "native route authority contradicts access or availability",
@@ -322,8 +322,7 @@ fn validate_native_route_event_batch(
         || batch.events.iter().any(|event| {
             event.sequence < batch.oldest_available
                 || event.sequence > batch.latest_available
-                || matches!(event.kind, NativeRouteEventKind::Available)
-                    != (event.route.route_state == RouteState::Available)
+                || !native_event_matches_route(event.kind, event.route.route_state)
         })
         || batch
             .events
@@ -342,6 +341,17 @@ fn validate_native_route_event_batch(
     Ok(())
 }
 
+fn native_event_matches_route(kind: NativeRouteEventKind, state: NativeRouteState) -> bool {
+    match kind {
+        NativeRouteEventKind::Available => state == NativeRouteState::Available,
+        NativeRouteEventKind::TemporarilyUnavailable => {
+            state == NativeRouteState::TemporarilyUnavailable
+        }
+        NativeRouteEventKind::Withdrawn => state == NativeRouteState::Withdrawn,
+        NativeRouteEventKind::GenerationReplaced => true,
+    }
+}
+
 fn request_requires_v7(request: &RpcRequest) -> bool {
     match request {
         RpcRequest::NativeEnumerate(_)
diff --git a/crates/hfx-protocol/tests/wire_and_snapshot.rs b/crates/hfx-protocol/tests/wire_and_snapshot.rs
index 9afa2fa..b874335 100644
--- a/crates/hfx-protocol/tests/wire_and_snapshot.rs
+++ b/crates/hfx-protocol/tests/wire_and_snapshot.rs
@@ -5,8 +5,8 @@ use hfx_domain::{
     ContactState, ControllerAvailability, DeviceKind, EvidenceConfidence, FreshnessState,
     GenerationId, InventoryAvailability, LeaseDurationMs, LedCount, ModelName, MonotonicMs,
     NativeExchangeTimeoutMs, NativeProtocolFamily, NativeReportByteCount, NativeReportHex,
-    NativeRouteAccess, NativeRouteEventKind, NativeRouteToken, PairingState, PowerState,
-    PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
+    NativeRouteAccess, NativeRouteEventKind, NativeRouteState, NativeRouteToken, PairingState,
+    PowerState, PresenceState, ProductId, ProjectionRevision, ProtocolFeatureId, ProtocolVersion,
     ReceiverLifecycleState, ResourceKind, RestoreDeliveryState, RestoreState, ReturnEvidence,
     ReturnPhase, RouteKind, RouteState, SequenceNumber, SleepState, StableLightingMode,
     StreamEpoch, SupportLevel, TelemetryAvailability, TransactionClass, VendorId,
@@ -51,8 +51,9 @@ fn cursor() -> EventCursor {
     }
 }
 
-fn native_route(access: NativeRouteAccess, route_state: RouteState) -> NativeRoute {
-    let writable = access == NativeRouteAccess::Qualified && route_state == RouteState::Available;
+fn native_route(access: NativeRouteAccess, route_state: NativeRouteState) -> NativeRoute {
+    let writable =
+        access == NativeRouteAccess::Qualified && route_state == NativeRouteState::Available;
     NativeRoute {
         receiver_id: text("receiver-1"),
         generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
@@ -729,7 +730,7 @@ fn native_inventory_fails_closed_on_authority_or_identity_contradictions() {
             cursor: cursor(),
             routes: vec![native_route(
                 NativeRouteAccess::Qualified,
-                RouteState::Available,
+                NativeRouteState::Available,
             )],
         },
     });
@@ -751,7 +752,7 @@ fn native_inventory_fails_closed_on_authority_or_identity_contradictions() {
     };
     envelope.result.routes.push(native_route(
         NativeRouteAccess::Qualified,
-        RouteState::Unavailable,
+        NativeRouteState::Withdrawn,
     ));
     assert!(matches!(
         encode_rpc_response_for_version(&duplicate_identity, number(7)),
@@ -773,7 +774,7 @@ fn native_route_events_require_consistent_transitions_and_cursors() {
             events: vec![NativeRouteEvent {
                 sequence: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
                 kind: NativeRouteEventKind::Available,
-                route: native_route(NativeRouteAccess::Qualified, RouteState::Available),
+                route: native_route(NativeRouteAccess::Qualified, NativeRouteState::Available),
             }],
             oldest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
             latest_available: SequenceNumber::try_from(1_u64).expect("sequence is valid"),
@@ -785,11 +786,32 @@ fn native_route_events_require_consistent_transitions_and_cursors() {
     });
     encode_rpc_response_for_version(&response, number(7)).expect("native event batch is valid");
 
+    let mut temporarily_unavailable = response.clone();
+    let RpcResponse::NativeWatchSuccess(envelope) = &mut temporarily_unavailable else {
+        panic!("native event response expected")
+    };
+    envelope.result.events[0].kind = NativeRouteEventKind::TemporarilyUnavailable;
+    envelope.result.events[0].route = native_route(
+        NativeRouteAccess::Qualified,
+        NativeRouteState::TemporarilyUnavailable,
+    );
+    encode_rpc_response_for_version(&temporarily_unavailable, number(7))
+        .expect("temporary route loss is canonical");
+
+    let mut withdrawn = response.clone();
+    let RpcResponse::NativeWatchSuccess(envelope) = &mut withdrawn else {
+        panic!("native event response expected")
+    };
+    envelope.result.events[0].kind = NativeRouteEventKind::Withdrawn;
+    envelope.result.events[0].route =
+        native_route(NativeRouteAccess::Qualified, NativeRouteState::Withdrawn);
+    encode_rpc_response_for_version(&withdrawn, number(7)).expect("route withdrawal is canonical");
+
     let mut contradictory = response;
     let RpcResponse::NativeWatchSuccess(envelope) = &mut contradictory else {
         panic!("native event response expected")
     };
-    envelope.result.events[0].kind = NativeRouteEventKind::Unavailable;
+    envelope.result.events[0].kind = NativeRouteEventKind::Withdrawn;
     assert!(matches!(
         encode_rpc_response_for_version(&contradictory, number(7)),
         Err(ProtocolWireError::InvalidResponse(_))
diff --git a/crates/hfx-sdk/README.md b/crates/hfx-sdk/README.md
index 297bc3c..5e81652 100644
--- a/crates/hfx-sdk/README.md
+++ b/crates/hfx-sdk/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Provides the typed Rust client contract used by production integrations and internal consumers.
+Provides the typed Rust client contract for qualified route discovery, bounded native exchanges, and retained semantic consumers.
 
 `implemented` | `runtime` | Atlas: `rust-sdk`
 
@@ -15,12 +15,13 @@ Provides the typed Rust client contract used by production integrations and inte
 
 **Owns**
 - Rust client API
-- Identity and channel adaptation
+- Native route and channel adaptation
 - Typed SDK errors
 
 **Does not own**
 - Application presentation
-- Raw receiver reports
+- Device command semantics
+- Receiver carrier frames
 - Bridge policy
 
 ## Change Here
diff --git a/crates/hfx-uhid-relay/src/bridge.rs b/crates/hfx-uhid-relay/src/bridge.rs
index 458ff51..7d451c9 100644
--- a/crates/hfx-uhid-relay/src/bridge.rs
+++ b/crates/hfx-uhid-relay/src/bridge.rs
@@ -4,21 +4,20 @@ use crate::uhid::FEATURE_REPORT_BYTES;
 use crate::{SerialFingerprint, SerialQuerySpec};
 use hfx_domain::{
     ClientId, ClientName, LeaseDurationMs, LeaseId, NativeExchangeTimeoutMs, NativeReportHex,
-    NativeRouteAccess, ProtocolFeatureId, ProtocolVersion, RouteState,
+    NativeRouteAccess, NativeRouteState, ProtocolFeatureId, ProtocolVersion,
 };
 use hfx_protocol::{
     CURRENT_PROTOCOL_VERSION, LeaseResult, NativeExchangeResult, NativeRoute,
-    NativeRouteEventBatch, NativeRouteInventory,
+    NativeRouteEventBatch, NativeRouteInventory, ResourceKey,
 };
 use hfx_sdk::{EventSubscription, HyperFluxClient, KernelRequestIdentitySource, SdkClientConfig};
 use std::fmt;
 use std::os::unix::net::UnixStream;
 use std::path::Path;
-use std::time::{Duration, Instant};
+use std::time::Duration;
 
 const NATIVE_FEATURE: &str = "native-receiver-tunnel";
 const LEASE_DURATION_MS: u32 = 30_000;
-const LEASE_RENEW_INTERVAL: Duration = Duration::from_secs(10);
 const SOCKET_TIMEOUT: Duration = Duration::from_secs(3);
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -37,8 +36,6 @@ pub enum NativeBridgeError {
     InvalidRoute,
     InvalidIdentity,
     BridgeUnavailable,
-    LeaseConflict,
-    LeaseRejected,
 }
 
 impl fmt::Display for NativeBridgeError {
@@ -47,8 +44,6 @@ impl fmt::Display for NativeBridgeError {
             Self::InvalidRoute => "native route is not qualified and writable",
             Self::InvalidIdentity => "native relay client identity is invalid",
             Self::BridgeUnavailable => "HyperFlux bridge is unavailable",
-            Self::LeaseConflict => "native route is owned by another application",
-            Self::LeaseRejected => "native route lease was rejected",
         })
     }
 }
@@ -58,12 +53,33 @@ impl std::error::Error for NativeBridgeError {}
 pub struct NativeBridge {
     client: HyperFluxClient<UnixStream, KernelRequestIdentitySource>,
     route: NativeRoute,
-    lease_id: LeaseId,
-    last_lease_renewal: Instant,
     serial_query: SerialQuerySpec,
     observed_serial: Option<SerialFingerprint>,
 }
 
+trait EphemeralExchange {
+    fn acquire(&mut self, resource: ResourceKey) -> Result<LeaseId, ()>;
+    fn exchange_leased(
+        &mut self,
+        lease_id: LeaseId,
+        report: [u8; FEATURE_REPORT_BYTES],
+    ) -> BridgeExchangeResult;
+    fn release(&mut self, lease_id: LeaseId);
+}
+
+fn exchange_ephemeral<C: EphemeralExchange>(
+    channel: &mut C,
+    resource: ResourceKey,
+    report: [u8; FEATURE_REPORT_BYTES],
+) -> BridgeExchangeResult {
+    let Ok(lease_id) = channel.acquire(resource) else {
+        return BridgeExchangeResult::NotSent;
+    };
+    let result = channel.exchange_leased(lease_id.clone(), report);
+    channel.release(lease_id);
+    result
+}
+
 pub struct NativeRouteMonitor {
     client: HyperFluxClient<UnixStream, KernelRequestIdentitySource>,
 }
@@ -114,13 +130,15 @@ impl NativeRouteMonitor {
 }
 
 impl NativeBridge {
-    /// Connects to protocol v7 and acquires the exact route's native-control
-    /// resource before any UHID endpoint becomes visible.
+    /// Connects to protocol v7 and validates the exact native route without
+    /// reserving it for the lifetime of the always-on UHID endpoint.
     ///
     /// # Errors
     ///
-    /// Fails closed for candidate, unavailable, un-tokenized, malformed, or
-    /// already-owned routes and for bridge negotiation failures.
+    /// Fails closed for candidate, unavailable, un-tokenized, malformed routes
+    /// and for bridge negotiation failures. Each Feature exchange obtains and
+    /// releases its own lease so an idle `OpenRazer` endpoint cannot lock out a
+    /// native `OpenRGB` session.
     pub fn connect(
         socket_path: &Path,
         route: NativeRoute,
@@ -135,27 +153,11 @@ impl NativeBridge {
             ClientName::try_from("HyperFlux OpenRazer native relay")
                 .map_err(|_| NativeBridgeError::InvalidIdentity)?,
         )?;
-        let mut client = HyperFluxClient::connect(stream, config, KernelRequestIdentitySource)
-            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
-        let resource = route
-            .resource
-            .clone()
-            .ok_or(NativeBridgeError::InvalidRoute)?;
-        let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS)
-            .map_err(|_| NativeBridgeError::InvalidIdentity)?;
-        let lease = client
-            .acquire_lease(vec![resource], duration)
+        let client = HyperFluxClient::connect(stream, config, KernelRequestIdentitySource)
             .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
-        let lease_id = match lease {
-            LeaseResult::Granted(grant) => grant.lease_id,
-            LeaseResult::Conflict(_) => return Err(NativeBridgeError::LeaseConflict),
-            LeaseResult::Rejected(_) => return Err(NativeBridgeError::LeaseRejected),
-        };
         Ok(Self {
             client,
             route,
-            lease_id,
-            last_lease_renewal: Instant::now(),
             serial_query,
             observed_serial: None,
         })
@@ -165,32 +167,11 @@ impl NativeBridge {
         self.observed_serial.take()
     }
 
-    fn renew_if_due(&mut self) -> Result<(), NativeBridgeError> {
-        if self.last_lease_renewal.elapsed() < LEASE_RENEW_INTERVAL {
-            return Ok(());
-        }
-        let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS)
-            .map_err(|_| NativeBridgeError::InvalidIdentity)?;
-        let result = self
-            .client
-            .renew_lease(self.lease_id.clone(), duration)
-            .map_err(|_| NativeBridgeError::BridgeUnavailable)?;
-        match result {
-            LeaseResult::Granted(_) => {
-                self.last_lease_renewal = Instant::now();
-                Ok(())
-            }
-            LeaseResult::Conflict(_) => Err(NativeBridgeError::LeaseConflict),
-            LeaseResult::Rejected(_) => Err(NativeBridgeError::LeaseRejected),
-        }
-    }
-}
-
-impl BridgeExchange for NativeBridge {
-    fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
-        if self.renew_if_due().is_err() {
-            return BridgeExchangeResult::NotSent;
-        }
+    fn transact_with_lease(
+        &mut self,
+        lease_id: LeaseId,
+        report: [u8; FEATURE_REPORT_BYTES],
+    ) -> BridgeExchangeResult {
         let Some(route_token) = self.route.route_token.clone() else {
             return BridgeExchangeResult::NotSent;
         };
@@ -201,12 +182,10 @@ impl BridgeExchange for NativeBridge {
         let Ok(timeout) = NativeExchangeTimeoutMs::try_from(1_000_u16) else {
             return BridgeExchangeResult::NotSent;
         };
-        let Ok(submission) = self.client.prepare_native_exchange(
-            self.lease_id.clone(),
-            route_token,
-            report,
-            timeout,
-        ) else {
+        let Ok(submission) =
+            self.client
+                .prepare_native_exchange(lease_id, route_token, report, timeout)
+        else {
             return BridgeExchangeResult::NotSent;
         };
         let Ok(outcome) = self.client.native_transact(&submission) else {
@@ -231,9 +210,34 @@ impl BridgeExchange for NativeBridge {
     }
 }
 
-impl Drop for NativeBridge {
-    fn drop(&mut self) {
-        let _ = self.client.release_lease(self.lease_id.clone());
+impl EphemeralExchange for NativeBridge {
+    fn acquire(&mut self, resource: ResourceKey) -> Result<LeaseId, ()> {
+        let duration = LeaseDurationMs::try_from(LEASE_DURATION_MS).map_err(|_| ())?;
+        match self.client.acquire_lease(vec![resource], duration) {
+            Ok(LeaseResult::Granted(grant)) => Ok(grant.lease_id),
+            Ok(LeaseResult::Conflict(_) | LeaseResult::Rejected(_)) | Err(_) => Err(()),
+        }
+    }
+
+    fn exchange_leased(
+        &mut self,
+        lease_id: LeaseId,
+        report: [u8; FEATURE_REPORT_BYTES],
+    ) -> BridgeExchangeResult {
+        self.transact_with_lease(lease_id, report)
+    }
+
+    fn release(&mut self, lease_id: LeaseId) {
+        let _ = self.client.release_lease(lease_id);
+    }
+}
+
+impl BridgeExchange for NativeBridge {
+    fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
+        let Some(resource) = self.route.resource.clone() else {
+            return BridgeExchangeResult::NotSent;
+        };
+        exchange_ephemeral(self, resource, report)
     }
 }
 
@@ -270,7 +274,7 @@ fn client_config(
 
 fn validate_route(route: &NativeRoute) -> Result<(), NativeBridgeError> {
     if route.access != NativeRouteAccess::Qualified
-        || route.route_state != RouteState::Available
+        || route.route_state != NativeRouteState::Available
         || usize::from(route.report_bytes.get()) != FEATURE_REPORT_BYTES
         || route.protocol_family.as_str() != "razer-feature-report-v1"
         || route.route_token.is_none()
@@ -309,3 +313,113 @@ fn hex_nibble(value: u8) -> Option<u8> {
         _ => None,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use hfx_domain::{GenerationId, LogicalDeviceId, ReceiverId, ResourceKind};
+
+    #[derive(Clone, Copy, Debug, Eq, PartialEq)]
+    enum Call {
+        Acquire,
+        Exchange,
+        Release,
+    }
+
+    struct FakeExchange {
+        acquire: Option<Result<LeaseId, ()>>,
+        result: BridgeExchangeResult,
+        calls: Vec<Call>,
+    }
+
+    impl EphemeralExchange for FakeExchange {
+        fn acquire(&mut self, _resource: ResourceKey) -> Result<LeaseId, ()> {
+            self.calls.push(Call::Acquire);
+            self.acquire.take().expect("one acquisition is configured")
+        }
+
+        fn exchange_leased(
+            &mut self,
+            _lease_id: LeaseId,
+            _report: [u8; FEATURE_REPORT_BYTES],
+        ) -> BridgeExchangeResult {
+            self.calls.push(Call::Exchange);
+            self.result
+        }
+
+        fn release(&mut self, _lease_id: LeaseId) {
+            self.calls.push(Call::Release);
+        }
+    }
+
+    fn text<T>(value: &str) -> T
+    where
+        T: TryFrom<String>,
+        T::Error: fmt::Debug,
+    {
+        T::try_from(value.to_owned()).expect("test value is valid")
+    }
+
+    fn resource() -> ResourceKey {
+        ResourceKey {
+            receiver_id: text::<ReceiverId>("receiver-1"),
+            generation_id: GenerationId::try_from(1_u64).expect("generation is valid"),
+            device_id: text::<LogicalDeviceId>("mouse-1"),
+            kind: ResourceKind::NativeControl,
+        }
+    }
+
+    fn fake(result: BridgeExchangeResult) -> FakeExchange {
+        FakeExchange {
+            acquire: Some(Ok(text::<LeaseId>("lease-1"))),
+            result,
+            calls: Vec::new(),
+        }
+    }
+
+    #[test]
+    fn one_atomic_exchange_holds_then_releases_one_ephemeral_lease() {
+        let expected = BridgeExchangeResult::MatchedResponse([0xa5; FEATURE_REPORT_BYTES]);
+        let mut exchange = fake(expected);
+        assert_eq!(
+            exchange_ephemeral(&mut exchange, resource(), [0x42; FEATURE_REPORT_BYTES]),
+            expected
+        );
+        assert_eq!(
+            exchange.calls,
+            vec![Call::Acquire, Call::Exchange, Call::Release]
+        );
+    }
+
+    #[test]
+    fn an_owned_route_is_not_sent_and_never_released_by_the_contender() {
+        let mut exchange = FakeExchange {
+            acquire: Some(Err(())),
+            result: BridgeExchangeResult::MatchedResponse([0; FEATURE_REPORT_BYTES]),
+            calls: Vec::new(),
+        };
+        assert_eq!(
+            exchange_ephemeral(&mut exchange, resource(), [0x42; FEATURE_REPORT_BYTES]),
+            BridgeExchangeResult::NotSent
+        );
+        assert_eq!(exchange.calls, vec![Call::Acquire]);
+    }
+
+    #[test]
+    fn uncertain_and_not_sent_exchanges_still_release_their_lease() {
+        for result in [
+            BridgeExchangeResult::NotSent,
+            BridgeExchangeResult::MayHaveBeenSent,
+        ] {
+            let mut exchange = fake(result);
+            assert_eq!(
+                exchange_ephemeral(&mut exchange, resource(), [0x42; FEATURE_REPORT_BYTES]),
+                result
+            );
+            assert_eq!(
+                exchange.calls,
+                vec![Call::Acquire, Call::Exchange, Call::Release]
+            );
+        }
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/endpoint.rs b/crates/hfx-uhid-relay/src/endpoint.rs
index 1b35d46..7c34ad6 100644
--- a/crates/hfx-uhid-relay/src/endpoint.rs
+++ b/crates/hfx-uhid-relay/src/endpoint.rs
@@ -70,7 +70,8 @@ impl<B: BridgeExchange> FeatureEndpoint<B> {
 
     /// Performs one relay-owned read-only management exchange only when no
     /// `OpenRazer` response is pending. This keeps direct-route identity probing
-    /// serialized with the same native-control lease as normal Feature traffic.
+    /// serialized with the same ephemeral native-control lease discipline as
+    /// normal Feature traffic.
     pub fn management_exchange(
         &mut self,
         report: [u8; FEATURE_REPORT_BYTES],
diff --git a/crates/hfx-uhid-relay/src/runtime.rs b/crates/hfx-uhid-relay/src/runtime.rs
index 0612e92..44f8771 100644
--- a/crates/hfx-uhid-relay/src/runtime.rs
+++ b/crates/hfx-uhid-relay/src/runtime.rs
@@ -314,7 +314,8 @@ impl Drop for RunningEndpoint {
 /// # Errors
 ///
 /// Fails closed on bridge, catalog, supervisor, or UHID errors. Dropping the
-/// session destroys every virtual endpoint and releases every route lease.
+/// session destroys every virtual endpoint. Route leases exist only around an
+/// individual native Feature exchange.
 pub fn run_relay(paths: &RelayPaths, termination: &AtomicBool) -> Result<(), RelayRuntimeError> {
     let catalog = NativeRouteCatalog::load().map_err(|_| RelayRuntimeError::Catalog)?;
     let mut direct_scanner = DirectRouteScanner::new(paths.hid_driver_root.clone());
diff --git a/crates/hfx-uhid-relay/src/supervisor.rs b/crates/hfx-uhid-relay/src/supervisor.rs
index bde8460..97a6148 100644
--- a/crates/hfx-uhid-relay/src/supervisor.rs
+++ b/crates/hfx-uhid-relay/src/supervisor.rs
@@ -3,8 +3,8 @@
 use crate::catalog::{NativeRouteCatalog, NativeRouteRecord};
 use crate::uhid::VirtualDeviceSpec;
 use hfx_domain::{
-    EndpointId, GenerationId, LogicalDeviceId, NativeRouteAccess, NativeRouteEventKind, ReceiverId,
-    ResourceKind, RouteState, SequenceNumber,
+    EndpointId, GenerationId, LogicalDeviceId, NativeRouteAccess, NativeRouteEventKind,
+    NativeRouteState, ReceiverId, ResourceKind, SequenceNumber,
 };
 use hfx_protocol::{NativeRoute, NativeRouteEvent, NativeRouteInventory};
 use sha2::{Digest, Sha256};
@@ -153,7 +153,7 @@ impl RouteSupervisor {
         let identity = RouteIdentity::from(&event.route);
         let mut actions = Vec::new();
         match event.kind {
-            NativeRouteEventKind::Unavailable => {
+            NativeRouteEventKind::TemporarilyUnavailable | NativeRouteEventKind::Withdrawn => {
                 stop_route_family(&mut self.active, &event.route, &mut actions);
             }
             NativeRouteEventKind::GenerationReplaced => {
@@ -196,7 +196,9 @@ fn eligible_route<'a>(
     let Some(record) = catalog.route(route.vendor_id, route.product_id, route.device_kind) else {
         return Ok(None);
     };
-    if route.access != NativeRouteAccess::Qualified || route.route_state != RouteState::Available {
+    if route.access != NativeRouteAccess::Qualified
+        || route.route_state != NativeRouteState::Available
+    {
         return Ok(None);
     }
     let Some(token) = &route.route_token else {
@@ -314,12 +316,13 @@ mod tests {
         product: u16,
         kind: DeviceKind,
         access: NativeRouteAccess,
-        state: RouteState,
+        state: NativeRouteState,
     ) -> NativeRoute {
         let receiver_id = text::<ReceiverId>(receiver);
         let generation_id = GenerationId::try_from(generation).expect("generation is valid");
         let device_id = text::<LogicalDeviceId>(device);
-        let writable = access == NativeRouteAccess::Qualified && state == RouteState::Available;
+        let writable =
+            access == NativeRouteAccess::Qualified && state == NativeRouteState::Available;
         NativeRoute {
             receiver_id: receiver_id.clone(),
             generation_id,
@@ -366,7 +369,7 @@ mod tests {
                             0x00cd,
                             DeviceKind::Mouse,
                             NativeRouteAccess::Candidate,
-                            RouteState::Available,
+                            NativeRouteState::Available,
                         ),
                         route(
                             "receiver-1",
@@ -375,7 +378,7 @@ mod tests {
                             0xffff,
                             DeviceKind::Mouse,
                             NativeRouteAccess::Qualified,
-                            RouteState::Available,
+                            NativeRouteState::Available,
                         ),
                     ],
                 ),
@@ -402,7 +405,7 @@ mod tests {
                             0x00cd,
                             DeviceKind::Mouse,
                             NativeRouteAccess::Qualified,
-                            RouteState::Available,
+                            NativeRouteState::Available,
                         ),
                         route(
                             "receiver-2",
@@ -411,7 +414,7 @@ mod tests {
                             0x00cd,
                             DeviceKind::Mouse,
                             NativeRouteAccess::Qualified,
-                            RouteState::Available,
+                            NativeRouteState::Available,
                         ),
                     ],
                 ),
@@ -437,7 +440,7 @@ mod tests {
                         0x0296,
                         DeviceKind::Keyboard,
                         NativeRouteAccess::Qualified,
-                        RouteState::Available,
+                        NativeRouteState::Available,
                     )],
                 ),
                 &catalog,
@@ -450,7 +453,7 @@ mod tests {
             0x0296,
             DeviceKind::Keyboard,
             NativeRouteAccess::Qualified,
-            RouteState::Available,
+            NativeRouteState::Available,
         );
         let actions = supervisor
             .apply_event(
@@ -467,6 +470,89 @@ mod tests {
         assert_eq!(supervisor.active_identities()[0].generation_id.get(), 2);
     }
 
+    #[test]
+    fn temporary_loss_and_withdrawal_stop_until_a_fresh_available_event() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mut supervisor = RouteSupervisor::default();
+        let available = route(
+            "receiver-1",
+            "mouse-1",
+            1,
+            0x00cd,
+            DeviceKind::Mouse,
+            NativeRouteAccess::Qualified,
+            NativeRouteState::Available,
+        );
+        supervisor
+            .reconcile(&inventory(10, vec![available.clone()]), &catalog)
+            .expect("initial inventory reconciles");
+
+        let temporarily_unavailable = route(
+            "receiver-1",
+            "mouse-1",
+            1,
+            0x00cd,
+            DeviceKind::Mouse,
+            NativeRouteAccess::Qualified,
+            NativeRouteState::TemporarilyUnavailable,
+        );
+        let temporary_actions = supervisor
+            .apply_event(
+                &NativeRouteEvent {
+                    sequence: SequenceNumber::try_from(11_u64).expect("sequence is valid"),
+                    kind: NativeRouteEventKind::TemporarilyUnavailable,
+                    route: temporarily_unavailable,
+                },
+                &catalog,
+            )
+            .expect("temporary route loss applies");
+        assert!(matches!(
+            temporary_actions.as_slice(),
+            [RouteAction::Stop { .. }]
+        ));
+        assert!(supervisor.active_identities().is_empty());
+
+        let return_actions = supervisor
+            .apply_event(
+                &NativeRouteEvent {
+                    sequence: SequenceNumber::try_from(12_u64).expect("sequence is valid"),
+                    kind: NativeRouteEventKind::Available,
+                    route: available,
+                },
+                &catalog,
+            )
+            .expect("available return applies");
+        assert!(matches!(
+            return_actions.as_slice(),
+            [RouteAction::Start { .. }]
+        ));
+
+        let withdrawn = route(
+            "receiver-1",
+            "mouse-1",
+            1,
+            0x00cd,
+            DeviceKind::Mouse,
+            NativeRouteAccess::Qualified,
+            NativeRouteState::Withdrawn,
+        );
+        let withdrawal_actions = supervisor
+            .apply_event(
+                &NativeRouteEvent {
+                    sequence: SequenceNumber::try_from(13_u64).expect("sequence is valid"),
+                    kind: NativeRouteEventKind::Withdrawn,
+                    route: withdrawn,
+                },
+                &catalog,
+            )
+            .expect("route withdrawal applies");
+        assert!(matches!(
+            withdrawal_actions.as_slice(),
+            [RouteAction::Stop { .. }]
+        ));
+        assert!(supervisor.active_identities().is_empty());
+    }
+
     #[test]
     fn malformed_authority_and_noncontiguous_events_fail_closed() {
         let catalog = NativeRouteCatalog::load().expect("catalog loads");
@@ -478,7 +564,7 @@ mod tests {
             0x00cd,
             DeviceKind::Mouse,
             NativeRouteAccess::Qualified,
-            RouteState::Available,
+            NativeRouteState::Available,
         );
         malformed.route_token = None;
         assert_eq!(
@@ -499,7 +585,7 @@ mod tests {
                 0x00cd,
                 DeviceKind::Mouse,
                 NativeRouteAccess::Qualified,
-                RouteState::Available,
+                NativeRouteState::Available,
             ),
         };
         assert_eq!(
diff --git a/crates/hfx-uhid-relay/src/uhid.rs b/crates/hfx-uhid-relay/src/uhid.rs
index 01d329c..231c241 100644
--- a/crates/hfx-uhid-relay/src/uhid.rs
+++ b/crates/hfx-uhid-relay/src/uhid.rs
@@ -59,6 +59,7 @@ impl VirtualDeviceSpec {
                 .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-')
             || descriptor.is_empty()
             || descriptor.len() > HID_MAX_DESCRIPTOR_SIZE
+            || !is_feature_only_descriptor(&descriptor)
         {
             return Err(UhidCodecError::InvalidDeviceSpec);
         }
@@ -287,6 +288,7 @@ fn validate_spec(spec: &VirtualDeviceSpec) -> Result<(), UhidCodecError> {
         || spec.phys.as_bytes().contains(&0)
         || spec.descriptor.is_empty()
         || spec.descriptor.len() > HID_MAX_DESCRIPTOR_SIZE
+        || !is_feature_only_descriptor(&spec.descriptor)
     {
         Err(UhidCodecError::InvalidDeviceSpec)
     } else {
@@ -294,6 +296,58 @@ fn validate_spec(spec: &VirtualDeviceSpec) -> Result<(), UhidCodecError> {
     }
 }
 
+fn is_feature_only_descriptor(descriptor: &[u8]) -> bool {
+    let mut offset = 0;
+    let mut collection_depth = 0_u16;
+    let mut feature_items = 0_u16;
+
+    while offset < descriptor.len() {
+        let prefix = descriptor[offset];
+        if prefix == 0xfe {
+            return false;
+        }
+        let payload_bytes = match prefix & 0x03 {
+            0 => 0,
+            1 => 1,
+            2 => 2,
+            3 => 4,
+            _ => unreachable!(),
+        };
+        let Some(next) = offset.checked_add(1 + payload_bytes) else {
+            return false;
+        };
+        if next > descriptor.len() {
+            return false;
+        }
+
+        let item_type = (prefix >> 2) & 0x03;
+        let tag = prefix >> 4;
+        if item_type == 0 {
+            match tag {
+                0x0a if payload_bytes > 0 => {
+                    let Some(next_depth) = collection_depth.checked_add(1) else {
+                        return false;
+                    };
+                    collection_depth = next_depth;
+                }
+                0x0b if payload_bytes > 0 && collection_depth > 0 => {
+                    let Some(next_items) = feature_items.checked_add(1) else {
+                        return false;
+                    };
+                    feature_items = next_items;
+                }
+                0x0c if payload_bytes == 0 && collection_depth > 0 => {
+                    collection_depth -= 1;
+                }
+                _ => return false,
+            }
+        }
+        offset = next;
+    }
+
+    collection_depth == 0 && feature_items > 0
+}
+
 fn write_c_string(target: &mut [u8], value: &str) -> Result<(), UhidCodecError> {
     if value.len() >= target.len() || value.as_bytes().contains(&0) {
         return Err(UhidCodecError::InvalidReply);
@@ -324,3 +378,50 @@ fn write_u16(bytes: &mut [u8], offset: usize, value: u16) {
 fn write_u32(bytes: &mut [u8], offset: usize, value: u32) {
     bytes[offset..offset + 4].copy_from_slice(&value.to_ne_bytes());
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const FEATURE_ONLY_DESCRIPTOR: &[u8] = &[
+        0x06, 0x00, 0xff, 0x09, 0x01, 0xa1, 0x01, 0x15, 0x00, 0x26, 0xff, 0x00, 0x75, 0x08, 0x95,
+        0x5a, 0xb1, 0x02, 0xc0,
+    ];
+
+    #[test]
+    fn feature_only_descriptor_cannot_create_an_input_node() {
+        assert!(is_feature_only_descriptor(FEATURE_ONLY_DESCRIPTOR));
+        for main_item in [0x81, 0x91] {
+            let mut descriptor = FEATURE_ONLY_DESCRIPTOR.to_vec();
+            descriptor.splice(18..18, [main_item, 0x02]);
+            assert!(!is_feature_only_descriptor(&descriptor));
+            assert_eq!(
+                VirtualDeviceSpec::new(
+                    "Razer test".to_string(),
+                    0x1532,
+                    1,
+                    descriptor,
+                    "test-route",
+                ),
+                Err(UhidCodecError::InvalidDeviceSpec)
+            );
+        }
+    }
+
+    #[test]
+    fn create_encoding_keeps_the_trusted_virtual_feature_identity() {
+        let spec = VirtualDeviceSpec::new(
+            "Razer test".to_string(),
+            0x1532,
+            0x1234,
+            FEATURE_ONLY_DESCRIPTOR.to_vec(),
+            "test-route",
+        )
+        .expect("feature-only descriptor is valid");
+        let encoded = UhidReply::Create(spec).encode().expect("create encodes");
+        assert_eq!(read_u32(&encoded, 0), Some(UHID_CREATE2));
+        assert_eq!(read_u16(&encoded, 262), Some(BUS_VIRTUAL));
+        assert_eq!(read_u32(&encoded, 264), Some(0x1532));
+        assert_eq!(read_u32(&encoded, 268), Some(0x1234));
+    }
+}
diff --git a/docs/architecture/bridge-core.md b/docs/architecture/bridge-core.md
index 8896aa0..968a871 100644
--- a/docs/architecture/bridge-core.md
+++ b/docs/architecture/bridge-core.md
@@ -1,12 +1,12 @@
 # Bridge Core Boundaries
 
-The HyperFlux bridge is the sole userspace policy and write authority between application SDKs and a generation-bound receiver transport. It does not own application presentation, effects, hardware report layouts, or physical qualification claims.
+The HyperFlux bridge is the sole userspace route, arbitration, and receiver-write authority between application SDKs and a generation-bound transport. Its primary protocol-v7 path carries qualified upstream Feature reports without owning device commands, settings, presentation, layouts, effects, persistence, or physical qualification claims.
 
 ## Dependency Direction
 
 ```mermaid
 flowchart LR
-    Apps["Applications"] --> Integrations["Application integrations"]
+    Apps["OpenRazer and OpenRGB"] --> Integrations["Thin transport adapters"]
     Integrations --> SDK["Generated SDK"]
     SDK --> Protocol["Versioned protocol"]
     Bridge["Bridge service"] --> Protocol
@@ -19,6 +19,27 @@ flowchart LR
 
 The protocol, core state machines, and profile registry point inward. Application integrations never become bridge dependencies. Linux ioctl details and raw receiver reports remain behind the concrete kernel adapter.
 
+## Native Tunnel Path
+
+Protocol v7 exposes three narrow operations: enumerate qualified routes, watch
+bounded availability transitions, and exchange one exact 90-byte Feature report
+through a generation-bound opaque route. The bridge validates route authority,
+profile qualification, NativeControl ownership, report shape, deadlines, queue
+admission, and response correlation. It treats the report's device command and
+status as upstream-owned opaque data.
+
+OpenRGB may hold NativeControl for an explicit controller session. The
+feature-only OpenRazer UHID relay acquires the same child-local resource for one
+Feature exchange and releases it afterward, so an idle virtual endpoint cannot
+exclude another application. NativeControl conflicts with the retained semantic
+lighting, settings, and pairing resources for that child only. Siblings, other
+receivers, and newer generations remain independent.
+
+Protocol v6, UAPI v1, semantic carrier encoding, stable-state persistence, and
+restoration remain installed as a noncompeting migration fallback. They are not
+the target architecture and cannot be removed before physical parity, rollback,
+and a separate retirement approval.
+
 ## Distinct Safety Bindings
 
 The following identities solve different problems and must not be merged:
@@ -62,11 +83,28 @@ The Unix transport uses a four-byte unsigned big-endian payload length followed
 
 The length bound is checked before allocation. Requests and responses are validated and serialized through a bounded writer before any bytes are emitted, then written with complete-write semantics and flushed. Framing errors preserve the I/O stage without including payloads, tokens, or private paths. The framing implementation belongs to the protocol crate and is shared by the bridge and every native SDK; neither side maintains a private interpretation of the byte stream.
 
-Framing is not the SDK contract; generated protocol records are. The initial `negotiate` exchange is the deliberately stable base handshake and has one invariant shape across every retained version. A successful response selects one exact frozen version; every later request and response is encoded and decoded only through that version. Version 1 remains read-compatible but cannot submit profileless writes. Version 2 profile-binds writes and conservatively normalizes every `static-lighting` request to semantic Static, including an all-black frame. Version 3 carries explicit per-device Static or Off intent. An explicit Off request therefore fails before emitting bytes on a version 2 connection. A payload from an adjacent version is rejected instead of being guessed from fields.
+Framing is not the SDK contract; generated protocol records are. The initial `negotiate` exchange is the deliberately stable base handshake and has one invariant shape across every retained version. A successful response selects one exact frozen version; every later request and response is encoded and decoded only through that version. Versions 1 through 6 preserve the additive semantic migration contract. Version 7 preserves those records and independently adds qualified native-route enumeration, availability events, NativeControl ownership, and fixed-size Feature exchanges. A payload or method from an adjacent version is rejected instead of being guessed from fields.
 
 One connection runtime owns the dispatcher lifetime. Clean EOF and every terminal framing or write failure converge on the same disconnect path, which revokes session authority before backend cleanup. If transport and cleanup both fail, the typed result preserves both failures rather than hiding one.
 
-## Transaction Meaning
+## Native Exchange Meaning
+
+A native request is admitted only after its route, generation, profile, owner,
+fixed report shape, and deadline agree. The bridge and kernel produce exactly
+one of three terminal certainty classes:
+
+- `not-sent` means SET did not begin;
+- `may-have-been-sent` means SET may have begun and no layer may repeat it
+  automatically;
+- `matched-response` returns the complete correlated 90-byte response without
+  interpreting its device status.
+
+Route-local FIFO ordering, fair sibling dispatch, a capacity of 128 admitted
+native transactions, and one active exchange per receiver keep the path bounded.
+A generation replacement cancels queued work and prevents results from crossing
+routes or generations.
+
+## Semantic Transaction Meaning (Migration Fallback)
 
 A transaction moves through declared states:
 
@@ -90,17 +128,27 @@ stateDiagram-v2
 
 Partial or uncertain transport is never retried automatically. A client resolves an ambiguous response through transaction outcome lookup, not by submitting the write again. A later visible result does not rewrite a terminal timeout history.
 
-## Lifecycle Ingress
+## Passive Inventory And Migration Projection
 
-The bridge accepts passive lifecycle evidence through one typed, generation-checked ingress. Receiver identity, child identity, endpoint registration, pairing, route, power, sleep, activity, mat contact, freshness, and battery values are distinct observations. Unsupported children remain visible but receive no write authority. A malformed, stale, conflicting, or wrong-generation observation changes neither canonical state nor the event stream.
+The bridge accepts passive lifecycle evidence through one typed, generation-checked ingress. Receiver identity, child identity, endpoint registration, pairing, raw route fields, activity, mat contact, freshness, and battery values remain distinct observations. Unsupported children remain visible but receive no write authority. A malformed, stale, conflicting, or wrong-generation observation changes neither canonical state nor the event stream.
 
-Receiver events and child events describe different facts. Receiver suspend emits `receiver-suspended` without rewriting retained child endpoint evidence. Child `available`, `sleeping`, `unavailable`, and `unknown` events are emitted only when child evidence changes the corresponding projected presence. Applications combine the receiver lifecycle and child endpoint facts rather than forcing either one to impersonate the other.
+Native route availability is a deliberately smaller protocol-v7 projection:
+`available`, `temporarily-unavailable`, or `withdrawn`. It is generation-bound
+and does not claim sleep, power-off, child readiness, or visible application
+state. Older semantic snapshots retain their version-6 presence vocabulary for
+compatibility. The native projection consumes only explicit route evidence or
+endpoint-local traffic qualified as route evidence; it never converts pairing,
+silence, sleep, power, or aggregate retail presence into authority.
 
 Generation activation stages lifecycle, profile qualification, old lease revocation, queued transaction revocation, durable restoration reconciliation, and canonical events before committing any volatile owner. Initial discovery emits `receiver-available`. A replacement emits `generation-replaced`; reconnect after a completed removal additionally emits `receiver-available`. Physical disconnect is two-stage: the first transport-confirmed absence moves the generation to `disconnecting`, revokes live authority, terminally reconciles every durable claim for that generation, and emits `receiver-unavailable`; a later observation retires the generation and its profile binding. Ordinary lifecycle observations cannot enter `disconnecting`, so no adapter can bypass revocation.
 
 ## Ownership And Atomicity
 
-Resources are keyed by logical device and generic domain: lighting, settings, or pairing. This supports arbitrary receivers and multiple children without fixed mouse/keyboard slots.
+Resources are keyed by receiver, generation, logical child, and generic domain:
+NativeControl, lighting, settings, or pairing. NativeControl conflicts with all
+three semantic write domains for the same child. This supports arbitrary
+receivers and multiple children without fixed mouse/keyboard slots while
+leaving siblings independent.
 
 Lease acquisition is atomic. If any requested resource is owned by another client, none are granted. Forced takeover is not part of protocol version 1. Read-only snapshots, telemetry, and diagnostics remain shared.
 
@@ -114,6 +162,9 @@ Atomicity describes admission, ownership, ordering, and complete transaction acc
 
 Backpressure is policy-specific:
 
+- native exchanges preserve route-local FIFO ordering, fair sibling service,
+  and immutable deadlines; rejection before SET is `not-sent`, while any
+  uncertainty after SET forbids automatic retry;
 - current unsent effect frames may be coalesced per resource because an older frame is obsolete;
 - static lighting, settings, pairing, and restoration preserve strict order and return busy when their bounded queue cannot accept work;
 - one logical device's outage must not stall its sibling;
@@ -122,7 +173,12 @@ Backpressure is policy-specific:
 
 Every deadline uses an injected monotonic clock. Kernel session expiration may use Linux boottime inside the concrete kernel boundary so suspend remains meaningful. Durable capture timestamps use a separate wall-clock boundary.
 
-## Restoration
+## Semantic Restoration (Migration Fallback)
+
+Native adapters do not use this subsystem. OpenRazer and OpenRGB own settings,
+effects, profiles, and persistence, and resume them as they do for direct
+devices. HyperFlux reports route availability and transports the first upstream
+request without a wake-color timer or child-application claim.
 
 Persistence stores semantic stable intent and exact profile identity. It never stores a live lease, session authorization, route observation, raw frame, or software-effect phase.
 
diff --git a/docs/architecture/design-book.md b/docs/architecture/design-book.md
index 6f9b5f4..08acf3b 100644
--- a/docs/architecture/design-book.md
+++ b/docs/architecture/design-book.md
@@ -10,120 +10,120 @@ The migration must preserve receiver report discoveries, validated identities, L
 We should reject duplicated constants, absolute machine paths, exact device combinations, giant application widgets, test scripts bound to one commit layout, manual lists copied from upstream projects, and validation that repeats twenty minutes of work because of one typo. We should also reject hidden coupling, such as changing OpenRGB presentation and accidentally invalidating package manifests or receiver lifecycle tests. The new repository should preserve observable behavior while redesigning the machinery behind it. Compatibility is valuable; accidental structure is not.
 Chapter II: The Architectural Foundation
 5. Primary Architecture
-The system requires a strict direction of responsibility. Applications may ask for capabilities, colors, settings, and state, but they may not know how receiver commands are encoded. The bridge may understand receiver semantics, but it may not contain OpenRGB widgets or Polychromatic presentation.
+The system requires a strict direction of responsibility. OpenRazer and OpenRGB keep the model-specific commands, capabilities, settings, layouts, effects, and persistence they already use for direct devices. HyperFlux replaces only the missing route through the receiver: it qualifies the child, arbitrates one native owner, carries one fixed upstream Feature report, and returns the matching response without interpreting device semantics.
 ```mermaid
 flowchart TB
     Apps["OpenRGB, Polychromatic, OpenRazer clients, CLI"]
     Integrations["Independent application integrations"]
     SDK["Versioned HyperFlux SDK"]
-    Bridge["Bridge, policy and transaction authority"]
-    Kernel["Minimal Linux HID driver"]
+    Bridge["Route, ownership and exchange authority"]
+    Kernel["Bounded Linux receiver transport"]
     Receiver["HyperFlux receiver and paired devices"]
     Apps --> Integrations --> SDK --> Bridge --> Kernel --> Receiver
 ```
 
 
 
-This structure gives us replaceable applications above a stable hardware foundation. OpenRGB can change its SDK without forcing a kernel redesign, and the receiver protocol can evolve without requiring each application to understand raw reports.
+This structure gives us replaceable applications above a stable hardware foundation. Upstream applications continue to construct standard Razer reports, while the SDK hides local framing and the bridge and kernel hide receiver generations, carrier transport, correlation, and failure certainty.
 6. Kernel Responsibility
-The kernel driver should perform only work that genuinely requires kernel access: binding the verified HID interfaces, preserving ordinary mouse and keyboard input, managing receiver generations, exposing passive observations, enforcing one exclusive writer session, and transporting bounded validated envelopes. It should not implement effects, product names, application ownership, profile migration, user notifications, package repair, or device artwork. Keeping the kernel small reduces crash risk, improves compatibility with future kernels, shortens review, and allows most new functionality to be updated without rebooting.
+The kernel driver should perform only work that genuinely requires kernel access: binding the verified HID interfaces, preserving ordinary mouse and keyboard input, managing receiver generations, exposing passive observations, enforcing one exclusive writer session, and transporting bounded generation-scoped exchanges. UAPI v2 accepts exactly one qualified 90-byte Feature report, begins its SET at most once, acquires one bounded matching response, and reports transport certainty. It should not implement effects, product names, device commands, application ownership, profile migration, user notifications, package repair, or artwork. Keeping the kernel small reduces crash risk, improves compatibility with future kernels, shortens review, and allows most new functionality to be updated without rebooting.
 7. Bridge Responsibility
-The bridge is the sole userspace authority allowed to request hardware writes. It validates the active receiver generation, selected profile, device capability, application ownership, request dimensions, transaction rate, and recovery policy. It also combines passive observations into useful state, schedules competing operations, records structured outcomes, and exposes one stable API to integrations. Because every application passes through the same bridge, safety logic is implemented once instead of being separately approximated in OpenRGB, Polychromatic, and command-line utilities.
+The bridge is the sole userspace authority allowed to request receiver writes. For the native path it validates the exact route token, receiver generation, declarative report profile, NativeControl ownership, fixed report shape, deadline, queue admission, and response correlation. It reports only `not-sent`, `may-have-been-sent`, or `matched-response` and never converts a device status into success or repeats an uncertain SET. Because every application passes through the same bridge, route safety is implemented once while model behavior remains upstream.
 8. Strong Domain Types
-The code should stop passing semantically different facts as interchangeable strings and integers. GenerationId, ReceiverId, LogicalDeviceId, EndpointId, LeaseId, TransactionId, ProductId, BatteryPercent, and DurationMs should be separate types with validation. A battery percentage cannot accidentally become a brightness value; a stale generation cannot be passed where a current generation token is required; a wired PID cannot silently select a wireless carrier. This technique makes illegal operations visible during compilation and turns many runtime surprises into immediate developer errors.
+The code should stop passing semantically different facts as interchangeable strings and integers. GenerationId, ReceiverId, LogicalDeviceId, RouteToken, EndpointId, LeaseId, TransactionId, ProductId, BatteryPercent, and DurationMs should be separate types with validation. A battery percentage cannot accidentally become a brightness value; a stale generation cannot be passed where a current generation token is required; a wired PID cannot silently authorize a wireless route. This technique makes illegal operations visible during compilation and turns many runtime surprises into immediate developer errors.
 Chapter III: Devices, Routes And Truthful State
-9. Logical Devices And Routes
-A physical device and the route used to reach it are different objects. One keyboard may be known through HyperFlux wireless, direct USB, and Bluetooth at different times.
+9. Inventory And Routes
+A paired inventory record and a currently authorized route are different objects. One keyboard may be known to the receiver while direct USB, HyperFlux wireless, or Bluetooth data paths change independently.
 ```mermaid
 flowchart LR
-    Device["Logical keyboard"]
-    Device --> HF["HyperFlux wireless endpoint"]
-    Device --> USB["Direct USB endpoint"]
-    Device --> BT["Bluetooth endpoint"]
-    HF --> HFS["Available, sleeping, unavailable, unknown"]
-    USB --> USBS["Connected or disconnected"]
-    BT --> BTS["Connected, paired or disconnected"]
+    Inventory["Paired inventory record"]
+    Inventory --> HF["Qualified HyperFlux route"]
+    Inventory --> USB["Direct USB data route"]
+    Inventory --> BT["Bluetooth route"]
+    HF --> HFS["available, temporarily-unavailable, withdrawn"]
+    USB --> USBS["Owned by upstream detector"]
+    BT --> BTS["Owned by upstream detector"]
 ```
 
 
 
-This distinction solves the situation where OpenRGB shows a retained HyperFlux wireless controller beside the wired controller even though 2.4 GHz is disabled. The paired keyboard remains part of receiver inventory, but the HyperFlux endpoint should not appear as currently controllable unless the receiver route is usable.
+This distinction prevents paired history from becoming write authority. Inventory can remain useful for diagnostics while a withdrawn HyperFlux route produces no virtual controller. HyperFlux availability does not claim sleep, power-off, physical readiness, or visible application state.
 10. Presence State Model
-Pairing, availability, sleep, power-off, and connection mode must become separate facts. Paired means the receiver remembers the child. Available means current evidence indicates that operations can reach it. Sleeping means the route remains valid but the child is inactive. Unavailable requires explicit route-loss evidence. Unknown means the available observations cannot justify a stronger claim. The system must record the source and confidence of each transition. Ten minutes without mouse motion may suggest inactivity, but it does not prove that the power switch is off.
+Native route state is deliberately smaller than retail-device state. `available` grants a generation-bound route after explicit route evidence or qualified endpoint-local traffic, `temporarily-unavailable` retains a known identity without accepting a transaction, and `withdrawn` records actual removal from the route inventory or generation. Pairing, silence, sleep labels, power labels, passive battery observations, and input activity remain separate facts unless a profile explicitly qualifies the endpoint-local report as route evidence. HyperFlux never promises that availability proves the child will visibly apply a command.
 11. Wired And Wireless Duplicate Handling
-OpenRGB’s native detector owns direct USB devices, while the HyperFlux integration owns receiver-backed endpoints. Deduplication should first correlate stable physical identity, preferably a serial or receiver-provided identifier. Model names and PID families may help explain likely relationships, but they cannot safely merge two devices because a user may own two identical keyboards. When identity is proven and 2.4 GHz is unavailable, only the wired controller should remain. When both routes are genuinely usable, the application should show one logical device with route information or clearly distinguish both endpoints, depending on what OpenRGB’s architecture permits.
+OpenRGB and OpenRazer own direct USB devices, while their HyperFlux transport adapters own receiver-backed routes. Direct USB takes precedence only when a nonempty serial queried from the physical direct route exactly matches the receiver-backed child. HyperFlux withdraws that one virtual route and recreates it after the direct data route disappears. It never deduplicates by PID, model name, or device kind, and a wall-power cable without a data route changes nothing.
 12. Composable Hardware Profiles
 The current style of one receiver plus one exact keyboard plus one exact mouse should be replaced by composition. A qualified receiver profile describes receiver behavior. Independent child profiles describe each keyboard or mouse. A system profile is assembled at runtime from whichever qualified children are actually paired. This permits mouse-only use, keyboard-only use, another supported mouse with the same receiver, and future devices without creating a combinatorial list of every possible pair.
 13. Hard And Cloth Editions
 Hard and Cloth should be modeled as surface variants rather than guessed USB identities. If both products use the same receiver protocol and PID, one receiver profile can support both while optional metadata describes the physical surface. If a future observation proves different hardware behavior, a variant profile can override only the relevant properties. The repository must never invent a PID from a product name or use your Hard Edition as proof that every user owns the same edition.
 14. Mat And Receiver Presentation
-HyperFlux V2 should not appear as an addressable RGB controller unless physical evidence proves that application-controlled lighting exists. The mat and receiver still matter: they provide charging, pairing, transport, receiver identity, and status indicators. Those capabilities belong in the system information model, not necessarily in an RGB device list. Status lighting can eventually receive its own qualified semantic API if it is controllable, but it must not be mixed with mouse and keyboard RGB merely because an upstream page uses ambiguous wording.
+HyperFlux V2 should not appear as an addressable RGB controller unless an upstream application has a real controller and qualified standard report path for it. The mat and receiver still matter as charging, pairing, transport, identity, and diagnostic infrastructure, but those facts do not invent another lighting device. Any future controllable status light must enter through a source-bound upstream model and qualified native report route, not a HyperFlux-specific semantic API or ambiguous product-page wording.
 Chapter IV: Universality And Qualification
 15. Support Levels
-Support should be described per capability rather than by one misleading “supported” label. A device may be identified safely while its lighting protocol remains unknown. Another may have qualified lighting but no proven DPI controls. Useful levels include Candidate, Identified, Read-only, Telemetry-qualified, Lighting-qualified, Settings-qualified, Pairing-qualified, and Production-qualified. Applications expose only the capabilities whose required evidence level has been reached. This produces honest partial support instead of either hiding useful devices or pretending every feature works.
+Support must distinguish upstream model support from HyperFlux transport qualification. A device may be a reviewed candidate or have extensive OpenRazer and OpenRGB knowledge while its receiver route remains non-writable. A native route becomes qualified only when exact receiver-observed identity, source-bound upstream records, a matching fixed report family, response correlation, and physical transport evidence agree. Upstream applications decide which model capabilities to expose after that route exists.
 16. Unknown Device Behavior
-When the receiver reports an unfamiliar child PID, the system should expose safe identity and passive observations where possible. It should not send commands copied from a similar model or assume that matching LED counts imply matching carriers. The user can see that an unqualified device is paired, and a privacy-safe support bundle can collect the information required for investigation. Once its behavior is qualified, adding a profile should unlock capabilities without requiring a new kernel architecture.
-17. Capability-Based Programming
-Applications should ask the SDK whether a logical device supports per_key_rgb, brightness, battery, dpi_stages, scroll_mode, idle_timeout, or another semantic capability. They should not contain long lists such as “if PID equals this model, show this slider.” Device profiles map verified hardware behavior into capabilities; integrations translate capabilities into their own controls. This is the key to universality because a future device with an already-understood capability can reuse existing application behavior.
+When the receiver reports an unfamiliar child PID, the system should expose safe identity and passive observations where possible. It must not send commands copied from a similar model or infer route authority from a support list. Privacy-safe local qualification may propose a declarative route profile. Once unchanged upstream reports and matched responses are proven, promoting a same-protocol device changes profile data and upstream bindings without changing the kernel, bridge engine, SDK transport, relay engine, or application transport abstractions.
+17. Declarative Transport Profiles
+Applications keep their own model capabilities and command logic. HyperFlux profiles declare transport facts such as exact identity, protocol family, fixed report shape, route qualification, and response correlation; they never grant support from a PID list alone. This is the key to universality because another same-protocol device can gain a qualified native route through profile data and upstream bindings without adding model branches to the kernel, bridge, SDK, relay, or application transport adapters.
 Chapter V: Application Integrations
 18. OpenRGB Integration
-OpenRGB should receive qualified logical controllers through a dedicated integration that depends only on the HyperFlux SDK. OpenRGB remains responsible for its model layouts, LED labels, geometry, color editing, profiles, and application behavior. HyperFlux supplies device identity, active routes, capabilities, ownership, and frame delivery. The HyperFlux information page should show paired inventory and technical state, while OpenRGB’s Devices page should represent controllers that are actually meaningful to control. This division prevents the core from becoming a copy of OpenRGB.
+OpenRGB receives qualified native routes through a dedicated integration that depends only on HyperFlux SDK protocol v7. The integration instantiates the pinned upstream Razer controller with an alternate Feature transport; OpenRGB remains responsible for commands, modes, layouts, LED labels, geometry, color editing, profiles, effects, and application behavior. HyperFlux supplies exact wireless identity, route availability, generation safety, and an opaque 90-byte request/response exchange. Ordinary hidapi controllers remain unchanged, and serial-proven direct USB takes precedence over only the matching receiver route.
 19. OpenRGB Effects
-Spectrum Cycling, Rainbow Wave, Breathing, and the broader Effects catalog belong to OpenRGB’s official effect engine. HyperFlux should not recreate or claim those effects. Its responsibility is to transport the generated Direct-mode frames smoothly and safely. The bridge should support batching, frame coalescing, deadlines, and bounded queues so an effect does not become sluggish merely because two devices are updated. Tests should verify animation continuity, sibling-device independence, rescan behavior, reconnect recovery, and transport latency rather than reimplementing effect mathematics.
-20. Static Restoration And Effect Persistence
-Static-state restoration and software-effect persistence are related but different. The bridge can remember stable Static or Off output and reapply it after receiver reconnect or system resume. A software effect is a running OpenRGB computation, so restarting it requires OpenRGB and its saved Effects startup profile. The exact phase need not be preserved; the effect may restart from its beginning. The user interface should explain this distinction plainly instead of presenting one ambiguous “persistence” switch.
-21. OpenRazer Metadata Reuse
-OpenRazer contains valuable knowledge about model names, images, matrices, control vocabulary, and user expectations. The new repository should import that information through a pinned, licensed transformation process rather than manually copying it. However, OpenRazer’s direct-device commands do not automatically work through the HyperFlux receiver. Metadata can tell us that a model conceptually supports DPI stages or Smart Reel, but HyperFlux must still understand and qualify the receiver-side operation before exposing it.
-22. Optional org.razer Compatibility Provider
-Some existing applications understand only OpenRazer’s org.razer D-Bus contract. For those clients, HyperFlux can provide an isolated compatibility service that translates supported methods into SDK operations. It should run on a private or explicitly selected service path, leave the official OpenRazer daemon untouched, and disappear cleanly when unused. It is an interoperability layer, not the central architecture, because forcing every future application through an emulated OpenRazer daemon would constrain HyperFlux to another project’s assumptions.
-23. Native Polychromatic Backend
-Polychromatic should eventually gain a native HyperFlux backend beside its existing OpenRazer backend. The same window can then show direct OpenRazer devices and receiver-backed HyperFlux devices without replacing the official daemon. Polychromatic continues to own its visual design and device-control experience; the backend translates its actions into SDK capabilities. This is more maintainable than runtime monkeypatching and more universal than pretending the HyperFlux receiver itself is an ordinary OpenRazer USB device.
-24. Full Device Settings
-Lighting is only one part of the desired experience. Future qualified capabilities may include DPI stages, independent X/Y DPI, polling rate, acceleration, scroll behavior, Smart Reel, idle timeout, low-battery threshold, gaming mode, macros, brightness, charging state, and pairing. Each capability needs a semantic SDK method, receiver translation, validation rules, diagnostics, simulator behavior, and physical evidence. Unsupported controls remain absent or clearly unavailable rather than performing guessed writes.
+Spectrum Cycling, Rainbow Wave, Breathing, and the broader Effects catalog belong to OpenRGB’s official effect engine. HyperFlux does not recreate or claim those effects. It carries the same upstream-generated Feature reports through a bounded, fair native exchange and returns the matching response unchanged. Tests verify animation continuity, sibling-device independence, rescan behavior, reconnect recovery, and transport latency rather than reimplementing effect mathematics.
+20. Application-Owned Persistence
+Application lighting persistence belongs to OpenRGB. Stable colors, Off, hardware modes, and software-effect startup profiles are represented and resumed by the upstream application exactly as they are for direct devices. HyperFlux reports route loss and return without inventing sleep state, retaining colors, replaying wake frames, or promising a wake-color deadline. Its contract is that the first valid upstream transaction after a writable return is transported without an intentional restoration timer.
+21. OpenRazer Native Route
+OpenRazer contains the device classes, method lists, images, settings, persistence rules, and command construction that its clients already expect. HyperFlux imports source-bound identity and transport facts but does not duplicate those semantics. A narrow pinned source transform lets the official OpenRazer driver send its unchanged 90-byte Feature reports through trusted feature-only UHID routes while preserving the ordinary USB path for direct devices.
+22. Migration org.razer Compatibility Provider
+The private HyperFlux org.razer compatibility provider is retained as a migration fallback while native-route physical parity is incomplete. It is isolated, opt-in, and prevented from competing with a native-control session. Removing it requires complete method and hardware parity plus a separate approval gate; it is not part of the final native path.
+23. Polychromatic Through OpenRazer
+Polychromatic continues to use its ordinary OpenRazer backend, official D-Bus API, device presentation, and controls. Receiver-backed devices appear through the patched OpenRazer transport just like the corresponding wireless class. The custom HyperFlux Polychromatic backend remains only as a noncompeting migration fallback until the same parity and retirement gates pass.
+24. Upstream Device Settings
+Lighting is only one part of the upstream experience. DPI stages, independent X/Y DPI, polling rate, acceleration, scroll behavior, Smart Reel, idle timeout, low-battery threshold, gaming mode, macros, brightness, charging state, pairing, and future model behavior remain owned by OpenRazer or OpenRGB. HyperFlux qualifies whether unchanged reports and matching responses cross a route; it does not add one semantic SDK method or receiver translation per setting. A different report format is an explicit backend requirement rather than a guessed rewrite.
 Chapter VI: Application Ownership
-25. Ownership Leases
-Multiple applications must not continuously overwrite one another. The bridge should issue renewable leases for specific resources: mouse lighting, keyboard lighting, mouse settings, keyboard settings, and receiver pairing.
+25. Native Control Ownership
+Multiple applications must not send native and migration-path commands to the same child concurrently. The bridge issues a generation-bound NativeControl lease for one exact receiver route. It conflicts with retained semantic lighting, settings, and pairing resources for that child only; siblings, other receivers, and newer generations remain independent.
 ```mermaid
 sequenceDiagram
     participant O as OpenRGB
     participant B as HyperFlux Bridge
-    participant P as Polychromatic
-    O->>B: Acquire mouse-lighting
+    participant R as OpenRazer
+    O->>B: Acquire child NativeControl
     B-->>O: Lease granted
-    P->>B: Request mouse color
-    B-->>P: Controlled by OpenRGB
+    R->>B: Acquire the same child
+    B-->>R: Resource busy
     O->>B: Release or disconnect
-    P->>B: Acquire mouse-lighting
-    B-->>P: Lease granted
+    R->>B: Acquire and transact
+    B-->>R: Matched response
 ```
 
 
 
-Read-only discovery, battery, and connection information remain shared. This prevents write conflicts without making applications blind to one another.
+Read-only route discovery, battery, and availability information remain shared. This prevents write conflicts without making applications blind to one another.
 26. Ownership User Experience
-When Polychromatic cannot change the mouse because OpenRGB owns it, controls should be disabled with a direct explanation: “Mouse lighting is controlled by OpenRGB. Release HyperFlux control there or close OpenRGB.” The owner should provide a Release control so users do not need to close an application that is also managing their motherboard or RAM. Closing or crashing the owner releases its leases automatically. Forced takeover should initially be prohibited; a later confirmed takeover feature can be considered after its effects on profiles and running animations are understood.
-27. Atomic Multi-Device Requests
-“Apply All Devices” and synchronized effects must acquire all required resources as one operation. If OpenRGB owns the keyboard but not the mouse, Polychromatic must not update only half of a synchronized request. The bridge either grants the complete lease set or grants none. The same atomic principle applies to transactions: a declared two-frame operation is not considered successful after only one frame. This keeps physical results aligned with what the application promised.
+Adapters surface a stable resource-busy result when another native or migration session owns the same child. Diagnostics identify the owning client without claiming that a particular device setting is controlled. Adapter disconnect, route withdrawal, generation replacement, or an explicit release ends the lease; forced takeover is prohibited.
+27. Atomic Native Exchanges
+Each native exchange is atomic at the route boundary: one SET begins at most once, one matching response is returned at most once, and an uncertain SET is never automatically repeated. Multi-device effects and grouped settings remain application behavior. The bridge preserves bounded per-route FIFO ordering and fair sibling dispatch without interpreting or combining upstream commands.
 Chapter VII: Schemas, SDKs And Reuse
 28. Schema-First Development
 Requests, responses, events, profiles, capabilities, errors, diagnostics, evidence, and test definitions should begin as versioned schemas. The schema is reviewed before implementations diverge. It defines required fields, bounded values, compatibility rules, privacy classifications, and extension points. This replaces informal agreements hidden across Rust, C++, Python, shell, YAML, and documentation.
 29. Generated Code
 A profile compiler should generate Rust types, C++ SDK structures, Python models, kernel tables, validators, documentation tables, and fixtures from canonical sources. Generated files carry source hashes and warnings that they must not be edited manually. CI regenerates them and fails when committed output is stale. A corrected product name or capability identifier is changed once and propagated safely, eliminating the repeated-edit pattern that currently makes small updates dangerous.
 30. Stable HyperFlux SDK
-The SDK is the supported contract for integrations. It exposes logical-device discovery, endpoint state, capability queries, event subscriptions, telemetry, ownership, lighting, settings, restoration, and diagnostics. It hides socket framing, credentials, raw receiver reports, and bridge-internal actors. C++, Rust, and Python clients should share generated protocol types and language-appropriate convenience APIs. An integration should not need to recreate reconnect handling or parse bridge diagnostics manually.
+The SDK is the supported contract for integrations. Protocol v6 preserves logical-device discovery, semantic migration APIs, telemetry, ownership, and diagnostics. Protocol v7 adds qualified native-route enumeration, bounded availability events, NativeControl ownership, and exact fixed-size Feature exchanges while still hiding socket framing, credentials, receiver carrier frames, and bridge-internal actors. C++, Rust, and Python clients share generated protocol types and language-appropriate convenience APIs.
 31. Feature Negotiation
 When a client connects, it announces its protocol range and optional features. The bridge responds with the mutually supported version and capabilities. A newer bridge can continue serving an older OpenRGB plugin when the required contract remains compatible. A genuinely incompatible client receives a clear structured error explaining which component needs updating. This prevents a package upgrade from producing unexplained missing devices because two binaries silently disagree about a field.
 32. Interfaces And Dependency Injection
 Core logic should depend on interfaces such as ReceiverTransport, Clock, ProfileRegistry, LeaseManager, PersistenceStore, and EventSink. Production supplies real implementations; tests supply deterministic substitutes. A simulated clock can advance fourteen minutes instantly. A failing persistence store can reproduce disk errors. A virtual transport can disconnect exactly between two frames. This makes difficult lifecycle paths ordinary automated tests instead of rare manual accidents.
 33. Explicit State Machines
-Receiver lifecycle, device presence, application ownership, transactions, and restoration should each have declared states and valid transitions. A transaction cannot move from Created directly to Delivered; it must be validated, ownership-bound, generation-bound, queued, sent, and terminally recorded. A stale generation cannot return to Active. A released lease cannot authorize another write. Encoding these rules explicitly makes reviews and tests far more reliable than scattered boolean conditions.
+Receiver lifecycle, native-route availability, application ownership, and transactions should each have declared states and valid transitions. The retained semantic restoration fallback has its own isolated state machine until its removal gate passes. A transaction cannot move from Created directly to Delivered; it must be validated, ownership-bound, generation-bound, queued, sent, and terminally recorded. A stale generation cannot return to Active. A released lease cannot authorize another write. Encoding these rules explicitly makes reviews and tests far more reliable than scattered boolean conditions.
 34. Event Subscriptions
-Applications should subscribe to typed events such as DeviceAvailable, DeviceSleeping, BatteryUpdated, OwnershipChanged, GenerationReplaced, and TransactionCompleted. They should not poll several files and independently guess what changed. Events contain sequence numbers and current-state references so a client can detect gaps and request a fresh snapshot. This gives application pages immediate, consistent updates while keeping the bridge as the source of truth.
+Applications subscribe to typed events such as RouteAvailable, RouteTemporarilyUnavailable, RouteWithdrawn, BatteryUpdated, OwnershipChanged, GenerationReplaced, and TransactionCompleted. Availability events do not claim sleep, power-off, or child application state. Events contain sequence numbers and current-state references so a client can detect gaps and request a fresh snapshot.
 35. Bounded Concurrency And Backpressure
-Every queue, journal, event buffer, and effect stream must have a defined limit and overflow policy. High-rate RGB frames may be coalesced when an unsent frame is already obsolete, but configuration operations must retain strict ordering. Slow clients should not block the receiver actor. Logging should never wait forever for an unread pipe. Deadlines, cancellation, priorities, and backpressure turn overload into structured behavior rather than a mysterious freeze.
+Every queue, journal, event buffer, and native route must have a defined limit and overflow policy. Native exchanges retain route-local FIFO ordering, fair sibling service, deadlines, and explicit certainty; once SET starts, an uncertain operation is never coalesced or automatically repeated. Slow clients must not block the receiver actor, and logging must never wait forever for an unread pipe. Backpressure becomes a structured not-sent result before dispatch.
 Chapter VIII: Simulation And Verification
 36. Virtual Receiver
-The simulator should implement the same interface as the real kernel-backed transport. It can create arbitrary receiver generations, pair different children, emit battery reports, place devices to sleep, remove routes, delay responses, corrupt reports, and simulate suspend. Because the bridge cannot tell whether it is connected to real or virtual transport through the interface, almost every policy path can be tested without hardware.
+The simulator should implement the same interface as the real kernel-backed transport. It can create arbitrary receiver generations, pair different children, emit battery reports, withdraw and return routes, delay or mismatch responses, corrupt reports, and simulate suspend. It may replay a captured child-sleep scenario without turning that observation into a production availability claim. Because the bridge cannot tell whether it is connected to real or virtual transport through the interface, almost every policy path can be tested without hardware.
 37. Deterministic Replay
 Privacy-safe structured evidence from physical runs becomes immutable replay fixtures. A fixture can reproduce the exact order of observations that once caused a mouse wake failure or a reconnect-generation bug. Simulated time and deterministic random seeds make failures reproducible. When a defect is fixed, its replay becomes a permanent regression test. Raw serials and unnecessary payloads are excluded so fixtures can safely live in the repository.
 38. One Verification Entry Point
@@ -150,7 +150,7 @@ Some invariants deserve more than examples. A small TLA+ or equivalent model can
 Rust can use Clippy, nextest, proptest, cargo-fuzz, cargo-mutants, cargo-deny, and API compatibility checks. Python can use uv, Ruff, mypy, pytest, and Hypothesis. C++ can use CMake presets, clang-tidy, sanitizers, and Include-What-You-Use. Kernel code can use sparse, Smatch, Coccinelle, KUnit, KASAN, and KCSAN. Tools are adopted because they catch a defined failure class, not merely because they look advanced.
 Chapter IX: User Experience And Diagnostics
 48. Declarative Application UI
-Application interfaces should consume tested view models rather than interpreting raw bridge responses inside large widget classes. The view model decides labels, available actions, ownership, battery freshness, endpoint state, and support level. The widget renders that model. This allows us to test “keyboard is sleeping and controlled by OpenRGB” without launching hardware, and it prevents a visual redesign from changing receiver policy.
+Application interfaces should consume tested view models rather than interpreting raw bridge responses inside large widget classes. The view model decides labels, available actions, ownership, battery freshness, route availability, and qualification level. The widget renders that model. This allows us to test “the keyboard route is temporarily unavailable while OpenRGB retains its profile” without launching hardware, and it prevents a visual redesign from changing receiver policy.
 49. Central Error Catalog
 Every error should be defined once with a stable identifier, severity, technical cause, user explanation, safe action, verification method, privacy classification, and documentation link. Doctor, service logs, OpenRGB, Polychromatic, package hooks, and support bundles all render the same underlying finding. Changing the explanation for a service failure no longer requires editing five separate implementations.
 50. Doctor
@@ -183,18 +183,19 @@ Chapter XII: Migration And Release
 62. Migration Ledger
 Every old component receives an explicit decision and rationale. The ledger records whether it is ported, rewritten, replaced, generated, archived, rejected, or still under investigation. It links old evidence to new tests and names the new architectural owner. This gives the migration an end condition and prevents forgotten scripts or undocumented behavior from resurfacing later.
 63. Shadow Comparison
-Before the new system controls real hardware, it can process recorded observations beside the old implementation and compare decisions: selected profiles, presence states, capabilities, transaction validation, and diagnostic findings. Shadow mode remains read-only. The old and new implementations must never both hold the writer session because comparison must not become competing hardware control.
+Before the new system controls real hardware, it can process recorded observations beside the old implementation and compare selected profiles, route states, transaction validation, certainty, and diagnostic findings. Shadow mode remains read-only. The old and new implementations must never both hold the writer session because comparison must not become competing hardware control.
 64. Migration Order
 The order should reduce uncertainty before moving dangerous behavior.
 ```mermaid
 flowchart LR
     Rules["Architecture constitution"] --> Schemas["Schemas and domain types"]
     Schemas --> Sim["Simulator and replay"]
-    Sim --> Core["Bridge and SDK"]
-    Core --> RGB["OpenRGB migration"]
-    RGB --> Own["Ownership leases"]
-    Own --> Poly["Native Polychromatic"]
-    Poly --> Compat["OpenRazer compatibility"]
+    Sim --> Core["Native exchange core"]
+    Core --> Razer["OpenRazer native route"]
+    Razer --> RGB["OpenRGB native route"]
+    RGB --> Own["Native control arbitration"]
+    Own --> Parity["Physical parity"]
+    Parity --> Compat["Fallback retirement gate"]
     Compat --> Package["Packaging and diagnostics"]
     Package --> HW["Targeted hardware qualification"]
     HW --> RC["Release candidate"]
@@ -202,11 +203,11 @@ flowchart LR
 
 
 
-OpenRGB moves only after the SDK can reproduce existing qualified behavior. Polychromatic begins after ownership exists, preventing two applications from fighting during development.
+Each upstream adapter moves only after the native exchange core and its application-specific transport boundary pass software contracts. Migration fallbacks remain installed but cannot compete with NativeControl. They are removed only after physical parity, rollback, and an explicit retirement approval.
 65. Release Channels
 Development builds may contain incomplete migrations. Nightly builds require complete software verification. Release candidates require installation, upgrade, lifecycle, application, and selected physical evidence. Stable releases require approved evidence, reproducible artifacts, documentation, known-limit declarations, and no unresolved release-blocking findings. A successful compile is never treated as publication authorization.
 66. Limits And Epistemic Honesty
 No architecture can guarantee that every future Razer device uses the same receiver commands. No simulator can prove a previously unseen physical effect. No upstream support list can substitute for transport qualification. The system should make these limits visible through support levels and evidence, not hide them behind broad claims. The innovation is not pretending uncertainty disappears; it is containing uncertainty so one unknown device cannot destabilize proven support.
 67. Final Definition Of Success
-HyperFlux Next succeeds when the foundation is calm even as integrations evolve. Adding a qualified device usually means adding one composable profile, importing presentation metadata, implementing only genuinely new semantic capabilities, and running a short targeted hardware campaign. OpenRGB, Polychromatic, and OpenRazer-compatible clients coexist through explicit ownership. Wired and wireless routes are truthful. Updates preserve configuration and automate everything that is safe. Most failures are caught by simulation before you touch the receiver. Physical validation proves only the remaining unknowns instead of repeating the entire history of the project.
-This is the complete expanded form of all 67 subjects. It explains what each mechanism is, why it exists, how it should behave, how it affects users and developers, and where physical evidence remains necessary.
\ No newline at end of file
+HyperFlux Next succeeds when the foundation is calm even as integrations evolve. Adding a same-protocol device means adding one composable route profile, source-bound upstream bindings, and focused qualification evidence without changing the kernel, bridge engine, SDK transport, relay engine, or application transport abstractions. OpenRGB and OpenRazer-based clients coexist through exact route ownership while direct devices remain untouched. Wired and wireless routes are truthful. Updates preserve configuration and automate everything that is safe. Most failures are caught by simulation before the receiver is touched, and physical validation proves only the remaining transport unknowns.
+This is the complete expanded form of all 67 subjects. It explains what each mechanism is, why it exists, how it should behave, how it affects users and developers, and where physical evidence remains necessary.
diff --git a/docs/architecture/device-knowledge.md b/docs/architecture/device-knowledge.md
index 46bf08d..b44d431 100644
--- a/docs/architecture/device-knowledge.md
+++ b/docs/architecture/device-knowledge.md
@@ -42,21 +42,32 @@ A normalized source record may document:
 - public methods for battery, idle timeout, low-battery threshold, scroll behavior, macros, lighting, and other settings;
 - the exact source file, line, revision, digest, and license expression from which each record came.
 
-This is **source-reviewed knowledge**. It is useful for planning, model presentation, semantic SDK design, simulator scenarios, and capability-gap analysis. It is not proof that the same command or packet works through the HyperFlux mat.
+This is **source-reviewed knowledge**. It is useful for planning, upstream presentation bindings, native-route qualification, simulator scenarios, and capability-gap analysis. It is not proof that the same command or packet works through the HyperFlux mat.
 
-## What Enables A Control
+## What Qualifies A Native Route
 
 `knowledge/capability-map.json` maps upstream method vocabulary to application-neutral semantic capabilities. For example, `get_dpi_xy` and `set_dpi_xy` describe `input.dpi-xy`; they do not prescribe an OpenRazer D-Bus method or an OpenRGB widget.
 
-A setting becomes enabled only when all of these are true:
+That map records planning knowledge and upstream disagreement. It does not make
+the bridge expose one semantic setting at a time. OpenRazer and OpenRGB decide
+which methods and controls their exact upstream device classes provide.
 
-1. The device is linked explicitly in `knowledge/candidate-links.json`.
-2. Runtime identity selects an exact HyperFlux child profile, not merely a similar product name.
-3. The child profile lists every capability required by the semantic setting.
-4. The normal profile compiler has accepted public, device-scoped physical evidence for every write capability.
-5. The bridge exposes the capability through the SDK; application adapters render only that SDK contract.
+A native route becomes writable only when all of these are true:
 
-If any condition is absent, the compiled knowledge can still explain the documented setting, but its `control_state` is `blocked` and names the missing HyperFlux capability.
+1. The device is linked explicitly in `knowledge/candidate-links.json`.
+2. Receiver observations select an exact wireless VID/PID and one exact child
+   profile, not merely a similar product name.
+3. Pinned OpenRazer or OpenRGB records bind that identity to a fixed upstream
+   protocol family and report shape.
+4. Public, device-scoped physical evidence proves that an unchanged upstream
+   report crosses the receiver and returns a matching standard response.
+5. The profile declares response correlation and native qualification, after
+   which protocol v7 exposes only the opaque route and bounded exchange.
+
+If any condition is absent, compiled knowledge can still explain upstream
+features and missing evidence, but production native exchange remains blocked.
+A same-protocol promotion changes profile data, bindings, evidence, and generated
+projections; it does not add model branches to the transport engines.
 
 ## Naga V2 Pro Example
 
@@ -64,7 +75,7 @@ The pinned OpenRazer source documents wired `0x00A7` and wireless `0x00A8` varia
 
 The pinned OpenRGB source independently documents the same PID pair and a two-slot Logo/Numpad presentation. OpenRazer describes a three-slot matrix. The compiler reports that topology disagreement rather than choosing whichever source is convenient.
 
-Today the official mat snapshot can therefore say a Naga V2 Pro is a reviewed candidate with extensive public device knowledge. It cannot expose Naga controls through HyperFlux until an exact receiver-backed identity is observed, its transport families are implemented, and those operations receive physical evidence. Once qualified, every adapter can consume the same semantic SDK capabilities without copying Naga-specific packet logic into OpenRGB, OpenRazer compatibility, or Polychromatic code.
+Today the official mat snapshot can therefore say a Naga V2 Pro is a reviewed candidate with extensive public device knowledge. It cannot expose a writable native route until an exact receiver-backed identity is observed, its standard report family is bound declaratively, and that transport receives physical evidence. Once qualified, OpenRGB and OpenRazer continue to generate the model-specific commands they already own; HyperFlux carries the unchanged reports without copying Naga packet logic into its kernel, bridge, SDK, relay, or application adapters.
 
 ## Update Workflow
 
diff --git a/docs/architecture/integrations.md b/docs/architecture/integrations.md
index 799ab0d..a745b71 100644
--- a/docs/architecture/integrations.md
+++ b/docs/architecture/integrations.md
@@ -1,35 +1,43 @@
 # Integration Boundary
 
-Application adapters consume SDK snapshots through one tested projection. They
-do not decide receiver qualification, infer routes from product names, or turn
-paired inventory into write authority on their own.
+Application adapters consume exact, generation-bound routes through the SDK.
+They do not decide receiver qualification, infer routes from product names, or
+turn paired inventory into write authority on their own.
 
-## Two Views Of Hardware
+## Inventory And Native Routes
 
 The integration model deliberately exposes two related collections:
 
-- **Inventory** preserves paired, sleeping, unavailable, unknown, and
-  unqualified children so diagnostics remain truthful.
-- **Controllers** contains only devices with exact receiver and child profile
-  bindings plus one fresh, usable HyperFlux wireless endpoint.
+- **Inventory** preserves pairing and passive observation facts, including
+  unqualified children, so diagnostics remain truthful. Inventory does not
+  grant a route or claim that a child is asleep or powered off.
+- **Native routes** contain only devices with exact receiver and child profile
+  bindings, a qualified report family, an opaque route token, and one of the
+  protocol-v7 states `available`, `temporarily-unavailable`, or `withdrawn`.
 
-A direct USB route can make a physical device available without making its
-HyperFlux route writable. The device therefore remains in inventory while the
-HyperFlux controller is absent. Native application detectors remain responsible
-for the direct USB controller; HyperFlux never suppresses unrelated devices.
+A direct data route wins only when its nonempty, physically queried serial
+matches the receiver-backed child. HyperFlux then withdraws that one virtual
+route while the upstream application's ordinary detector owns the direct
+controller. A PID, model name, device kind, or wall-power cable is never enough
+to merge routes, and unrelated devices are never suppressed.
 
-Sleeping is different from power-off or route loss. One fresh sleeping receiver
-route retains controller identity so an effect can resume when the device
-returns, but its view disallows immediate submission. Stale, ambiguous, unknown,
-or explicitly unavailable routes grant no controller.
+Availability events report only route authority. They do not assert sleep,
+power-off, child readiness, visible lighting, or application state. Applications
+may retain their own controller and profile state while a route is temporarily
+unavailable, then continue through a newer qualified event.
 
 ## Exact Authority
 
-Every controller carries generation-scoped receiver and child profile bindings,
-the application slot count, semantic capabilities, presentation provenance, and
-one lighting resource key. Ownership is rendered relative to the viewing SDK
-client as unowned, owned by that client, or owned by another client. Available
-actions are derived from those facts; widgets do not recreate the policy.
+Every native route carries generation-scoped receiver and child profile
+bindings, an opaque route token, exact wireless identity, protocol family, and
+one native-control resource. Device semantics do not cross this boundary:
+applications submit an upstream-generated 90-byte Feature report and receive
+the matching response unchanged.
+
+Native control excludes the same child's retained semantic lighting, settings,
+and pairing resources while a native lease is active. Sibling devices and newer
+receiver generations remain independent. This keeps migration fallbacks
+available without letting them compete with an upstream-native session.
 
 Unknown PIDs remain visible with no inherited model, layout, or writable
 capability. Model names and PIDs alone never merge a wired device with a
@@ -38,14 +46,18 @@ exist.
 
 ## Application Responsibilities
 
-OpenRGB owns its model registry, LED labels, geometry, profiles, and effect
-engine. Polychromatic owns its native presentation. The isolated OpenRazer
-compatibility service translates only qualified methods. All three consume the
-same inventory, controller, ownership, and capability semantics while the bridge
-remains the sole userspace hardware writer.
-
-Native application integrations are the normal path. In particular,
-Polychromatic should load the native HyperFlux backend beside its existing
-OpenRazer backend. HyperFlux does not replace or hide the official OpenRazer
-daemon. The optional [OpenRazer compatibility boundary](openrazer-compatibility.md)
-exists only for clients that cannot yet consume a native HyperFlux SDK backend.
+OpenRGB keeps its pinned Razer registry, controller modes, LED labels, geometry,
+profiles, and effect engine. Its HyperFlux plugin replaces only the Feature
+transport for qualified receiver routes; ordinary hidapi controllers are
+unchanged.
+
+OpenRazer keeps its daemon, D-Bus API, Python classes, methods, images, and
+persistence. A source-pinned driver patch accepts trusted feature-only UHID
+devices and sends their reports through protocol v7. Polychromatic therefore
+uses its ordinary OpenRazer backend rather than learning HyperFlux device
+semantics.
+
+The private OpenRazer service and SDK-native Polychromatic backend are retained
+only as migration fallbacks until physical parity and a separate retirement gate
+pass. The bridge remains the sole userspace receiver writer; applications own
+the commands and user experience.
diff --git a/docs/architecture/kernel.md b/docs/architecture/kernel.md
index 1e68a6d..17c44e5 100644
--- a/docs/architecture/kernel.md
+++ b/docs/architecture/kernel.md
@@ -7,7 +7,7 @@ policy, support-list guesses, or active information queries.
 
 ## Responsibilities
 
-The module owns five things that require kernel proximity:
+The module owns six things that require kernel proximity:
 
 1. preserve ordinary HID input with `HID_CONNECT_DEFAULT` and never consume or
    rewrite input reports;
@@ -17,34 +17,47 @@ The module owns five things that require kernel proximity:
    retail-device state;
 4. admit many read-only observers but exactly one `O_RDWR` writer file and one
    expiring generation-bound authorization session;
-5. validate and deliver a bounded set of receiver frames while retaining an
-   exact terminal result journal.
-
-The bridge remains responsible for profile selection, capability qualification,
-logical devices, carrier maps, effects, scheduling policy, leases, persistence,
-retry decisions, and user-facing meaning.
+5. execute one qualified fixed-size native Feature exchange at a time, with one
+   SET attempt, bounded response acquisition, declarative matching, and exact
+   certainty;
+6. retain the version-1 bounded receiver-frame transport and terminal journal
+   as an isolated migration fallback.
+
+For the native path, the bridge remains responsible for exact route identity,
+profile qualification, generation safety, NativeControl leases, bounded fair
+admission, deadlines, and user-facing diagnostics. OpenRazer and OpenRGB remain
+responsible for device commands, settings, layouts, effects, and persistence.
+The kernel treats command content as opaque except for the declarative report
+validation and response-correlation fields needed to transport it safely.
 
 ## Userspace Adapter
 
-The Rust kernel adapter selects an encoder from the qualified receiver
-profile's transport-backend identifier. It resolves each logical child profile
-independently, applies that profile's application-slot-to-carrier map, and
-emits only the bounded physical frames accepted by the kernel UAPI. A receiver
-may therefore carry a mouse, a keyboard, or both without an exact-pair profile.
-Unknown children receive no encoder or write authority.
+The active native path resolves an exact qualified route, fixed report family,
+endpoint slot, route-token digest, generation, and deadline before entering the
+kernel adapter. The adapter submits one 90-byte upstream Feature report through
+UAPI v2 and projects only the kernel's `not-sent`, `may-have-been-sent`, or
+`matched-response` result. It neither constructs device commands nor translates
+LED slots.
+
+The retained UAPI-v1 migration path still selects a receiver encoder, resolves
+each child independently, applies its qualified application-slot-to-carrier map,
+and emits bounded physical frames. That behavior remains available for rollback
+but is prevented from competing with a child-local NativeControl lease. Unknown
+children receive neither a native route nor semantic write authority.
 
-The qualified HW001 encoder preserves the observed two-pass receiver sequence,
+In the migration fallback, the qualified HW001 encoder preserves the observed two-pass receiver sequence,
 inter-frame timing, and mouse carrier correction. It also records which
 physical reports belong to each semantic device frame. Terminal kernel progress
 can therefore be projected conservatively into bridge-level delivery facts
 without confusing a partially delivered keyboard row sequence with a complete
 keyboard update.
 
-Every request digest binds the complete semantic dispatch and every encoded
-frame field. The only unsafe Rust is the private, generated-type ioctl capsule;
-profile resolution, encoding, observation decoding, session renewal, and result
-interpretation remain safe and independently testable through an injected I/O
-port.
+Native request digests bind the route, generation, endpoint, report, deadline,
+and dispatch identity. Legacy request digests continue to bind the complete
+semantic dispatch and every encoded frame field. The only unsafe Rust is the
+private, generated-type ioctl capsule; route and profile resolution, encoding,
+observation decoding, session renewal, and result interpretation remain safe
+and independently testable through an injected I/O port.
 
 ## Lifecycle
 
@@ -78,7 +91,37 @@ battery data.
 
 ## Transport And Outcomes
 
-Userspace supplies only frames produced by a qualified backend encoder. The
+### Native Exchange V2
+
+Userspace supplies exactly one 90-byte report produced by a qualified upstream
+Razer implementation, plus generation, authorization epoch, dispatch nonce,
+deadline, endpoint slot, route-token digest, and request digest. The kernel
+validates the additive UAPI-v2 structure and the receiver profile's fixed report
+shape before reserving a sequence. A per-receiver transport lock permits one
+active exchange and prevents a native operation from interleaving with the
+legacy carrier path.
+
+The SET begins at most once. After it begins, only bounded GET acquisition may
+repeat according to declarative profile timing and response-matching fields.
+The SET is never replayed. A complete matching 90-byte response is returned
+unchanged, including the device's own status; HyperFlux does not reinterpret
+Busy, Failure, or Not Supported as transport success.
+
+The native journal retains 128 complete results and 128 digest-bearing
+tombstones. Exact replay resolves the retained outcome without another SET.
+Generation, route, endpoint, nonce, or digest conflicts fail closed. The three
+certainty classes mean:
+
+- `not-sent`: transport did not begin and an exact retry may be considered by
+  userspace;
+- `may-have-been-sent`: SET may have begun, so no layer may repeat it
+  automatically;
+- `matched-response`: one full response passed declarative correlation and is
+  returned unchanged.
+
+### Semantic Envelope V1 Migration Fallback
+
+Userspace supplies only frames produced by a qualified fallback encoder. The
 kernel validates backend, report kind, exact payload length, reserved bytes,
 geometry, unused bytes, checksum, per-frame delay, aggregate delay, and a zero
 delay after the final frame. One transaction contains at most 16 frames and at
@@ -95,10 +138,10 @@ rotation, so a bridge restart can recover a retained result without inheriting
 the old writer authorization epoch. Reusing a nonce with different content in
 the current kernel session remains a terminal conflict.
 
-On startup, the bridge reconciles durable nonterminal work against this kernel
-journal before admitting new writes. This ordering prevents unrelated traffic
-from aging recoverable outcomes out of the bounded journal during crash
-recovery.
+On startup, the migration runtime reconciles durable nonterminal semantic work
+against this version-1 journal before admitting fallback writes. This ordering
+prevents unrelated traffic from aging recoverable outcomes out of the bounded
+journal during crash recovery.
 
 `succeeded` means every frame was delivered through the receiver USB control
 transfer. It does not claim that a paired child applied the frame or that a
diff --git a/docs/architecture/openrazer-compatibility.md b/docs/architecture/openrazer-compatibility.md
index 49f7abb..88b9160 100644
--- a/docs/architecture/openrazer-compatibility.md
+++ b/docs/architecture/openrazer-compatibility.md
@@ -1,5 +1,12 @@
 # OpenRazer Compatibility Boundary
 
+> **Migration fallback:** this private D-Bus projection is not the final
+> OpenRazer path. The target integration keeps the official OpenRazer daemon,
+> classes, methods, images, persistence, and Polychromatic backend unchanged and
+> replaces only transport through trusted feature-only UHID routes. This fallback
+> remains installed and noncompeting until native-route physical parity,
+> rollback, and a separate retirement approval pass.
+
 The OpenRazer compatibility provider is an optional application adapter. It
 projects an evidence-qualified subset of HyperFlux controllers into the exact
 D-Bus vocabulary expected by pinned OpenRazer 3.x clients. It is not the
@@ -30,7 +37,7 @@ The package installs no D-Bus activation file. The default provider never owns
 and client in an isolated bus and removes both when the client exits. This keeps
 the official daemon and unrelated direct devices untouched.
 
-## Qualified Surface
+## Retained Qualified Surface
 
 An object is exported only when the bridge supplies an exact receiver profile,
 exact child profile, qualified writable route, and the required lighting
diff --git a/docs/architecture/persistence.md b/docs/architecture/persistence.md
index 88a2bcb..829a6ef 100644
--- a/docs/architecture/persistence.md
+++ b/docs/architecture/persistence.md
@@ -1,5 +1,12 @@
 # Bridge Persistence
 
+> **Migration fallback:** this document describes the retained protocol-v6
+> semantic stable-lighting path. Protocol-v7 native routes do not use bridge
+> lighting persistence. OpenRazer and OpenRGB own device settings, effects,
+> profiles, and restart behavior exactly as they do for direct devices. The
+> fallback remains available only for rollback until its explicit retirement
+> gate passes.
+
 The bridge persists only semantic stable-lighting intent, restoration policy, and durable per-device restoration claims. It does not persist sessions, leases, route observations, battery values, raw reports, effect phase, application widgets, or private hardware identifiers.
 
 Persistence is independent of RPC connection sessions. Protocol credentials, internal authorization epochs, leases, and queued requests become invalid when their owning connection ends and never enter the durable document.
diff --git a/docs/architecture/sdk.md b/docs/architecture/sdk.md
index 420515e..a1845e1 100644
--- a/docs/architecture/sdk.md
+++ b/docs/architecture/sdk.md
@@ -15,7 +15,18 @@ The Rust SDK currently owns:
 - typed clean-EOF, framing, server, and attribution failures;
 - ergonomic snapshot, diagnostics, ownership, event, and transaction methods.
 
-The SDK does not own hardware profiles, application presentation, effects, ownership policy, queueing, restoration, or receiver transport. Those remain behind the bridge protocol.
+Protocol v7 additionally gives native integrations typed methods for:
+
+- enumerating qualified routes with exact wireless identity and opaque tokens;
+- watching bounded generation-scoped availability transitions;
+- acquiring and releasing one child-local `NativeControl` lease;
+- exchanging exactly one qualified 90-byte Feature report with an explicit
+  `not-sent`, `may-have-been-sent`, or `matched-response` result.
+
+The SDK does not own hardware profiles, application presentation, device
+commands, effects, persistence, ownership policy, queueing, receiver carrier
+encoding, or kernel transport. It exposes the native tunnel contract while the
+bridge and kernel enforce that contract.
 
 Protocol version 4 adds exact receiver and child profile identities and digests
 to snapshots. This lets an integration construct a profile-bound transaction
@@ -24,6 +35,12 @@ catalog. Versions 1 through 3 remain frozen; their snapshots normalize without
 invented profile digests, so integrations that require writable controllers
 negotiate the `snapshot-profile-bindings` feature.
 
+Protocol version 7 preserves every version-6 semantic migration method and adds
+the `native-receiver-tunnel` feature independently. Native applications submit
+only a fixed report already constructed by their upstream Razer implementation;
+they cannot specify USB control setup fields, receiver carrier frames, or an
+unqualified destination.
+
 ```mermaid
 sequenceDiagram
     participant App as Application integration
@@ -36,11 +53,20 @@ sequenceDiagram
     SDK->>Bridge: exact-version bound request
     Bridge-->>SDK: exact-version typed response
     SDK-->>App: verified snapshot
+    App->>SDK: transact_native(route, report, deadline)
+    SDK->>Bridge: generation-bound Feature exchange
+    Bridge-->>SDK: certainty and matching response
+    SDK-->>App: verified native result
 ```
 
 ## Failure Rules
 
-A response is accepted only when its request ID matches the outstanding call and its server instance matches the negotiated bridge process. Clean EOF is distinct from malformed or truncated input. A current semantic request that cannot be represented by an older selected protocol fails locally before any prefix or payload byte is written.
+A response is accepted only when its request ID matches the outstanding call
+and its server instance matches the negotiated bridge process. Clean EOF is
+distinct from malformed or truncated input. A semantic or native request that
+cannot be represented by the selected protocol fails locally before any prefix
+or payload byte is written. A native result with `may-have-been-sent` is never
+automatically repeated by the SDK.
 
 Dropping or closing the connection does not transfer authority. The bridge revokes the internal session and then releases associated leases and queued work. Applications reconnect and negotiate new credentials rather than reusing old session values.
 
diff --git a/docs/generated/architecture.md b/docs/generated/architecture.md
index 13ab768..311b791 100644
--- a/docs/generated/architecture.md
+++ b/docs/generated/architecture.md
@@ -24,14 +24,14 @@ flowchart TB
 ## Invariants
 
 - `HFX-INV-001` Generic mouse and keyboard input remains independent of optional device-control applications.
-- `HFX-INV-002` Applications and integrations never submit raw HID, USB, sysfs, or receiver report payloads.
+- `HFX-INV-002` A qualified native integration may submit exactly one fixed upstream Feature report through an opaque route; no application may submit arbitrary USB setup packets, sysfs operations, or receiver carrier frames.
 - `HFX-INV-003` One bridge is the sole userspace authority for receiver writes and one renewable lease owns each writable resource.
-- `HFX-INV-004` Every write is bound to a live receiver generation, qualified route, capability, owner, deadline, and transaction.
-- `HFX-INV-005` Pairing, route availability, sleep, power state, and connection mode remain separate sourced facts.
+- `HFX-INV-004` Every native exchange is bound to a live receiver generation, qualified opaque route, declarative report profile, NativeControl owner, deadline, and transaction identity.
+- `HFX-INV-005` Native availability is only available, temporarily-unavailable, or withdrawn; pairing, silence, and retail sleep or power labels never grant route authority. Only generation-bound explicit route evidence or endpoint-local traffic qualified by the receiver profile may produce available.
 - `HFX-INV-006` Unknown devices expose safe identity and passive observations but inherit no writable capability.
 - `HFX-INV-007` Receiver, child, and surface profiles compose independently; no exact mouse and keyboard pair is required.
 - `HFX-INV-008` Every queue, journal, event buffer, frame stream, message, and retry policy is explicitly bounded.
-- `HFX-INV-009` A partial, uncertain, stale-generation, or health-incomplete operation cannot be reported as successful.
+- `HFX-INV-009` Only a complete correlated response is matched-response; a possible SET is may-have-been-sent and is never automatically repeated or reported as success.
 - `HFX-INV-010` Canonical schemas own shared facts; generated bindings and documentation may not drift from them.
 - `HFX-INV-011` Research code, raw captures, private identifiers, machine paths, and watched mission coordinators are not product dependencies.
 - `HFX-INV-012` No compile, test, package, tag, repository, or green workflow alone grants publication authorization.
@@ -40,39 +40,39 @@ flowchart TB
 
 ### Applications
 
-Owns: user workflows, presentation, profiles, effects.
+Owns: user workflows, device commands and settings, presentation and layouts, profiles, effects, and persistence.
 
-Must not own: receiver encoding, qualification, kernel access.
+Must not own: receiver carrier encoding, route qualification, kernel access.
 
 ### Integrations
 
-Owns: application contract adaptation, tested view models.
+Owns: thin Feature-transport adaptation, application contract adaptation, tested route view models.
 
-Must not own: raw transport, profile qualification, global retry policy.
+Must not own: device semantic duplication, receiver carrier transport, profile qualification, uncertain-write retry policy.
 
 ### Sdk
 
-Owns: version negotiation, logical devices, routes, capabilities, events, leases, typed errors.
+Owns: version negotiation, qualified native routes, availability events, NativeControl leases, exact fixed-size Feature exchanges, typed errors.
 
-Must not own: application widgets, raw socket framing in callers.
+Must not own: application widgets or device commands, receiver carrier frames, raw socket framing in callers.
 
 ### Bridge
 
-Owns: policy, profile resolution, leases, transactions, scheduling, restoration, diagnostics.
+Owns: route qualification, profile resolution, NativeControl arbitration, bounded native transactions and certainty, availability, diagnostics, retained migration fallback.
 
-Must not own: application presentation, effect mathematics, arbitrary raw reports.
+Must not own: device commands or settings, application presentation, effects, profiles, or persistence, arbitrary USB or receiver reports.
 
 ### Kernel
 
-Owns: HID binding, input preservation, receiver generations, passive observations, exclusive writer session, bounded envelope transport.
+Owns: HID binding, input preservation, receiver generations, passive observations, exclusive writer session, qualified fixed-size native exchange, bounded fallback envelopes.
 
 Must not own: retail names, effects, profiles, application ownership, package repair.
 
 ### Profiles
 
-Owns: identity predicates, qualified capabilities, semantic mappings, evidence references, presentation metadata references.
+Owns: identity predicates, native report shape and response matching, upstream bindings, route qualification, evidence references, retained fallback mappings.
 
-Must not own: live observations, leases, desired state, guessed commands.
+Must not own: live observations, leases, application desired state, model commands, guessed transport.
 
 ### Verification
 
diff --git a/docs/generated/bridge-protocol-v7.md b/docs/generated/bridge-protocol-v7.md
index b021eff..26e049e 100644
--- a/docs/generated/bridge-protocol-v7.md
+++ b/docs/generated/bridge-protocol-v7.md
@@ -600,7 +600,7 @@ One generation-bound receiver child route without a host device path.
 | `device_kind` | `DeviceKind` | `true` | scalar |
 | `vendor_id` | `VendorId` | `true` | scalar |
 | `product_id` | `ProductId` | `true` | scalar |
-| `route_state` | `RouteState` | `true` | scalar |
+| `route_state` | `NativeRouteState` | `true` | scalar |
 | `access` | `NativeRouteAccess` | `true` | scalar |
 | `protocol_family` | `NativeProtocolFamily` | `true` | scalar |
 | `report_bytes` | `NativeReportByteCount` | `true` | scalar |
diff --git a/docs/generated/bridge-protocol.md b/docs/generated/bridge-protocol.md
index 3ae460a..80a5299 100644
--- a/docs/generated/bridge-protocol.md
+++ b/docs/generated/bridge-protocol.md
@@ -600,7 +600,7 @@ One generation-bound receiver child route without a host device path.
 | `device_kind` | `DeviceKind` | `true` | scalar |
 | `vendor_id` | `VendorId` | `true` | scalar |
 | `product_id` | `ProductId` | `true` | scalar |
-| `route_state` | `RouteState` | `true` | scalar |
+| `route_state` | `NativeRouteState` | `true` | scalar |
 | `access` | `NativeRouteAccess` | `true` | scalar |
 | `protocol_family` | `NativeProtocolFamily` | `true` | scalar |
 | `report_bytes` | `NativeReportByteCount` | `true` | scalar |
diff --git a/docs/generated/design-coverage.md b/docs/generated/design-coverage.md
index b501910..aa1461c 100644
--- a/docs/generated/design-coverage.md
+++ b/docs/generated/design-coverage.md
@@ -23,7 +23,7 @@ Software verification never substitutes for required physical evidence or public
 | 6 | Kernel Responsibility | `software-verified` | `kernel` | no | no |
 | 7 | Bridge Responsibility | `software-verified` | `bridge` | no | no |
 | 8 | Strong Domain Types | `software-verified` | `schemas` | no | no |
-| 9 | Logical Devices And Routes | `software-verified` | `bridge` | no | no |
+| 9 | Inventory And Routes | `software-verified` | `bridge` | no | no |
 | 10 | Presence State Model | `software-verified` | `bridge` | no | no |
 | 11 | Wired And Wireless Duplicate Handling | `software-verified` | `integrations` | required | no |
 | 12 | Composable Hardware Profiles | `software-verified` | `profiles` | no | no |
@@ -31,17 +31,17 @@ Software verification never substitutes for required physical evidence or public
 | 14 | Mat And Receiver Presentation | `software-verified` | `profiles` | required | no |
 | 15 | Support Levels | `software-verified` | `profiles` | no | no |
 | 16 | Unknown Device Behavior | `software-verified` | `bridge` | no | no |
-| 17 | Capability-Based Programming | `software-verified` | `sdk` | no | no |
+| 17 | Declarative Transport Profiles | `software-verified` | `profiles` | no | no |
 | 18 | OpenRGB Integration | `software-verified` | `integrations` | required | yes |
 | 19 | OpenRGB Effects | `software-verified` | `integrations` | required | yes |
-| 20 | Static Restoration And Effect Persistence | `software-verified` | `bridge` | required | yes |
-| 21 | OpenRazer Metadata Reuse | `software-verified` | `integrations` | no | no |
-| 22 | Optional org.razer Compatibility Provider | `software-verified` | `integrations` | no | no |
-| 23 | Native Polychromatic Backend | `software-verified` | `integrations` | no | no |
-| 24 | Full Device Settings | `blocked-by-physical-evidence` | `profiles` | required | no |
-| 25 | Ownership Leases | `software-verified` | `bridge` | no | no |
+| 20 | Application-Owned Persistence | `software-verified` | `integrations` | required | yes |
+| 21 | OpenRazer Native Route | `software-verified` | `integrations` | required | yes |
+| 22 | Migration org.razer Compatibility Provider | `software-verified` | `integrations` | no | no |
+| 23 | Polychromatic Through OpenRazer | `software-verified` | `integrations` | required | yes |
+| 24 | Upstream Device Settings | `blocked-by-physical-evidence` | `integrations` | required | yes |
+| 25 | Native Control Ownership | `software-verified` | `bridge` | no | no |
 | 26 | Ownership User Experience | `software-verified` | `integrations` | no | no |
-| 27 | Atomic Multi-Device Requests | `software-verified` | `bridge` | no | no |
+| 27 | Atomic Native Exchanges | `software-verified` | `bridge` | no | no |
 | 28 | Schema-First Development | `software-verified` | `schemas` | no | no |
 | 29 | Generated Code | `software-verified` | `generation` | no | no |
 | 30 | Stable HyperFlux SDK | `software-verified` | `sdk` | no | no |
@@ -133,23 +133,23 @@ Evidence: [`schemas/domain-catalog.json`](../../schemas/domain-catalog.json), [`
 
 - No remaining gap in the current software scope.
 
-### 9. Logical Devices And Routes
+### 9. Inventory And Routes
 
-Evidence: [`crates/hfx-integration-model/src/view.rs`](../../crates/hfx-integration-model/src/view.rs), [`crates/hfx-integration-model/tests/view_model.rs`](../../crates/hfx-integration-model/tests/view_model.rs).
+Evidence: [`crates/hfx-bridge/src/native_routes.rs`](../../crates/hfx-bridge/src/native_routes.rs), [`crates/hfx-bridge/src/native_projection.rs`](../../crates/hfx-bridge/src/native_projection.rs), [`crates/hfx-bridge/tests/native_projection.rs`](../../crates/hfx-bridge/tests/native_projection.rs).
 
 - No remaining gap in the current software scope.
 
 ### 10. Presence State Model
 
-Evidence: [`crates/hfx-core/src/lifecycle.rs`](../../crates/hfx-core/src/lifecycle.rs), [`crates/hfx-core/tests/lifecycle.rs`](../../crates/hfx-core/tests/lifecycle.rs).
+Evidence: [`crates/hfx-bridge/src/native_invalidation.rs`](../../crates/hfx-bridge/src/native_invalidation.rs), [`crates/hfx-bridge/tests/native_projection.rs`](../../crates/hfx-bridge/tests/native_projection.rs), [`crates/hfx-protocol/tests/wire_and_snapshot.rs`](../../crates/hfx-protocol/tests/wire_and_snapshot.rs).
 
 - No remaining gap in the current software scope.
 
 ### 11. Wired And Wireless Duplicate Handling
 
-Evidence: [`crates/hfx-integration-model/tests/view_model.rs`](../../crates/hfx-integration-model/tests/view_model.rs), [`integrations/openrgb/src/inventory_model.cpp`](../../integrations/openrgb/src/inventory_model.cpp).
+Evidence: [`crates/hfx-uhid-relay/src/direct.rs`](../../crates/hfx-uhid-relay/src/direct.rs), [`crates/hfx-uhid-relay/src/serial.rs`](../../crates/hfx-uhid-relay/src/serial.rs), [`integrations/openrgb/src/upstream_razer_registry.cpp`](../../integrations/openrgb/src/upstream_razer_registry.cpp), [`tests/cpp/openrgb_upstream_razer_registry_contract.cpp`](../../tests/cpp/openrgb_upstream_razer_registry_contract.cpp).
 
-- Stable cross-route physical identity remains unavailable for models that expose no safe correlator.
+- Stable cross-route physical identity remains unavailable for models that expose no safe nonempty serial; those routes must remain separate.
 
 ### 12. Composable Hardware Profiles
 
@@ -165,73 +165,73 @@ Evidence: [`profiles/surfaces/razer-hyperflux-v2-hard-edition.json`](../../profi
 
 ### 14. Mat And Receiver Presentation
 
-Evidence: [`docs/generated/supported-hardware.md`](../../docs/generated/supported-hardware.md), [`crates/hfx-integration-model/tests/view_model.rs`](../../crates/hfx-integration-model/tests/view_model.rs).
+Evidence: [`docs/generated/supported-hardware.md`](../../docs/generated/supported-hardware.md), [`integrations/openrgb/src/upstream_razer_registry.cpp`](../../integrations/openrgb/src/upstream_razer_registry.cpp).
 
-- Status-indicator control remains absent until its semantics are independently qualified.
+- No mat or status-light native route exists until a source-bound upstream controller and physical transport evidence justify one.
 
 ### 15. Support Levels
 
-Evidence: [`profiles/capabilities.json`](../../profiles/capabilities.json), [`docs/generated/supported-hardware.md`](../../docs/generated/supported-hardware.md).
+Evidence: [`profiles/receivers/razer-hyperflux-v2-1532-00cf.json`](../../profiles/receivers/razer-hyperflux-v2-1532-00cf.json), [`docs/architecture/native-device-onboarding.md`](../../docs/architecture/native-device-onboarding.md), [`tests/test_native_onboarding.py`](../../tests/test_native_onboarding.py).
 
 - No remaining gap in the current software scope.
 
 ### 16. Unknown Device Behavior
 
-Evidence: [`crates/hfx-integration-model/tests/view_model.rs`](../../crates/hfx-integration-model/tests/view_model.rs), [`crates/hfx-sim/tests/state_and_qualification.rs`](../../crates/hfx-sim/tests/state_and_qualification.rs).
+Evidence: [`crates/hfx-ops/src/native_onboarding.rs`](../../crates/hfx-ops/src/native_onboarding.rs), [`tools/hfxdev/native_onboarding.py`](../../tools/hfxdev/native_onboarding.py), [`tests/test_native_onboarding.py`](../../tests/test_native_onboarding.py).
 
 - No remaining gap in the current software scope.
 
-### 17. Capability-Based Programming
+### 17. Declarative Transport Profiles
 
-Evidence: [`profiles/capabilities.json`](../../profiles/capabilities.json), [`protocol/v5/catalog.json`](../../protocol/v5/catalog.json).
+Evidence: [`profiles/children/razer-basilisk-v3-pro-35k-00cd.json`](../../profiles/children/razer-basilisk-v3-pro-35k-00cd.json), [`profiles/children/razer-deathstalker-v2-pro-tkl-0296.json`](../../profiles/children/razer-deathstalker-v2-pro-tkl-0296.json), [`tests/test_native_onboarding.py`](../../tests/test_native_onboarding.py).
 
 - No remaining gap in the current software scope.
 
 ### 18. OpenRGB Integration
 
-Evidence: [`integrations/openrgb/src/plugin_coordinator.cpp`](../../integrations/openrgb/src/plugin_coordinator.cpp), [`tests/cpp/openrgb_plugin_coordinator_contract.cpp`](../../tests/cpp/openrgb_plugin_coordinator_contract.cpp).
+Evidence: [`integrations/openrgb/native-route/transform.json`](../../integrations/openrgb/native-route/transform.json), [`integrations/openrgb/src/razer_feature_transport.cpp`](../../integrations/openrgb/src/razer_feature_transport.cpp), [`tests/cpp/openrgb_razer_feature_transport_contract.cpp`](../../tests/cpp/openrgb_razer_feature_transport_contract.cpp).
 
-- The rewritten integration still requires targeted installed physical qualification before release-candidate promotion.
+- The upstream-native controllers require targeted installed physical qualification before release-candidate promotion.
 
 ### 19. OpenRGB Effects
 
-Evidence: [`integrations/openrgb/src/runtime_dispatch.cpp`](../../integrations/openrgb/src/runtime_dispatch.cpp), [`tests/cpp/openrgb_runtime_worker_contract.cpp`](../../tests/cpp/openrgb_runtime_worker_contract.cpp).
+Evidence: [`integrations/openrgb/src/native_route_session.cpp`](../../integrations/openrgb/src/native_route_session.cpp), [`tests/cpp/openrgb_native_route_session_contract.cpp`](../../tests/cpp/openrgb_native_route_session_contract.cpp).
 
-- Visible latency and continuity on real hardware remain physical release evidence.
+- Visible latency and continuity through the upstream Effects plugin remain physical release evidence.
 
-### 20. Static Restoration And Effect Persistence
+### 20. Application-Owned Persistence
 
-Evidence: [`docs/architecture/persistence.md`](../../docs/architecture/persistence.md), [`crates/hfx-core/tests/restoration.rs`](../../crates/hfx-core/tests/restoration.rs).
+Evidence: [`docs/architecture/integrations.md`](../../docs/architecture/integrations.md), [`integrations/openrgb/src/native_plugin_application.cpp`](../../integrations/openrgb/src/native_plugin_application.cpp).
 
-- OpenRGB startup-profile behavior is application-owned and must be qualified with the installed application candidate.
+- OpenRGB startup-profile and route-return behavior must be qualified with the installed upstream candidate.
 
-### 21. OpenRazer Metadata Reuse
+### 21. OpenRazer Native Route
 
-Evidence: [`integrations/openrazer/import.json`](../../integrations/openrazer/import.json), [`integrations/openrazer/metadata.json`](../../integrations/openrazer/metadata.json).
+Evidence: [`integrations/openrazer/native-route/catalog.json`](../../integrations/openrazer/native-route/catalog.json), [`integrations/openrazer/native-route/transform.json`](../../integrations/openrazer/native-route/transform.json), [`crates/hfx-uhid-relay/src/lib.rs`](../../crates/hfx-uhid-relay/src/lib.rs).
 
-- No remaining gap in the current software scope.
+- The source-pinned driver and UHID route require targeted installed physical method parity.
 
-### 22. Optional org.razer Compatibility Provider
+### 22. Migration org.razer Compatibility Provider
 
 Evidence: [`docs/architecture/openrazer-compatibility.md`](../../docs/architecture/openrazer-compatibility.md), [`tests/openrazer_compat_contracts.py`](../../tests/openrazer_compat_contracts.py).
 
-- The private provider is opt-in and intentionally does not claim the official org.razer identity.
+- Removal waits for native-route parity and a separate retirement approval.
 
-### 23. Native Polychromatic Backend
+### 23. Polychromatic Through OpenRazer
 
-Evidence: [`integrations/polychromatic/hyperflux_polychromatic/backend.py`](../../integrations/polychromatic/hyperflux_polychromatic/backend.py), [`tests/polychromatic_contracts.py`](../../tests/polychromatic_contracts.py).
+Evidence: [`integrations/openrazer/native-route/transform.json`](../../integrations/openrazer/native-route/transform.json), [`integrations/polychromatic/hyperflux_polychromatic/backend.py`](../../integrations/polychromatic/hyperflux_polychromatic/backend.py), [`tests/polychromatic_contracts.py`](../../tests/polychromatic_contracts.py).
 
-- Upstream acceptance of the native backend discovery seam is outside this repository.
+- The custom backend remains a migration fallback until ordinary OpenRazer-path physical parity passes.
 
-### 24. Full Device Settings
+### 24. Upstream Device Settings
 
-Evidence: [`profiles/capabilities.json`](../../profiles/capabilities.json), [`profiles/evidence/claims.json`](../../profiles/evidence/claims.json).
+Evidence: [`integrations/openrazer/native-method-inventory.json`](../../integrations/openrazer/native-method-inventory.json), [`integrations/openrazer/native-probe-catalog.json`](../../integrations/openrazer/native-probe-catalog.json).
 
-- DPI, polling, scroll, idle, battery-threshold, macro, gaming-mode, and pairing writes remain unavailable until receiver-side semantics are physically qualified.
+- Read-only and reversible upstream methods require native-route physical parity; HyperFlux does not reimplement their semantics.
 
-### 25. Ownership Leases
+### 25. Native Control Ownership
 
-Evidence: [`crates/hfx-core/src/leases.rs`](../../crates/hfx-core/src/leases.rs), [`crates/hfx-core/tests/leases.rs`](../../crates/hfx-core/tests/leases.rs).
+Evidence: [`crates/hfx-core/src/leases.rs`](../../crates/hfx-core/src/leases.rs), [`crates/hfx-core/tests/leases.rs`](../../crates/hfx-core/tests/leases.rs), [`crates/hfx-uhid-relay/src/bridge.rs`](../../crates/hfx-uhid-relay/src/bridge.rs).
 
 - No remaining gap in the current software scope.
 
@@ -241,9 +241,9 @@ Evidence: [`crates/hfx-integration-model/src/view.rs`](../../crates/hfx-integrat
 
 - No remaining gap in the current software scope.
 
-### 27. Atomic Multi-Device Requests
+### 27. Atomic Native Exchanges
 
-Evidence: [`crates/hfx-core/tests/leases.rs`](../../crates/hfx-core/tests/leases.rs), [`crates/hfx-core/tests/coordinator.rs`](../../crates/hfx-core/tests/coordinator.rs).
+Evidence: [`crates/hfx-bridge/src/native_exchange.rs`](../../crates/hfx-bridge/src/native_exchange.rs), [`crates/hfx-kernel-transport/tests/adapter.rs`](../../crates/hfx-kernel-transport/tests/adapter.rs), [`crates/hfx-protocol/tests/wire_and_snapshot.rs`](../../crates/hfx-protocol/tests/wire_and_snapshot.rs).
 
 - No remaining gap in the current software scope.
 
@@ -291,7 +291,7 @@ Evidence: [`crates/hfx-bridge/src/subscriptions.rs`](../../crates/hfx-bridge/src
 
 ### 35. Bounded Concurrency And Backpressure
 
-Evidence: [`runtime/linux.json`](../../runtime/linux.json), [`crates/hfx-core/tests/events_and_diagnostics.rs`](../../crates/hfx-core/tests/events_and_diagnostics.rs).
+Evidence: [`crates/hfx-bridge/src/native_scheduler.rs`](../../crates/hfx-bridge/src/native_scheduler.rs), [`crates/hfx-bridge/src/native_exchange.rs`](../../crates/hfx-bridge/src/native_exchange.rs), [`crates/hfx-bridge/tests/native_projection.rs`](../../crates/hfx-bridge/tests/native_projection.rs).
 
 - No remaining gap in the current software scope.
 
diff --git a/docs/generated/domain-types.md b/docs/generated/domain-types.md
index 964eb77..72a0b2f 100644
--- a/docs/generated/domain-types.md
+++ b/docs/generated/domain-types.md
@@ -133,4 +133,5 @@ These types prevent semantically different values from being passed interchangea
 - `LeaseOutcome`: `granted`, `conflict`, `rejected`
 - `ErrorSeverity`: `info`, `warning`, `error`, `critical`
 - `NativeRouteAccess`: `qualified`, `candidate`, `backend-required`
-- `NativeRouteEventKind`: `available`, `unavailable`, `generation-replaced`
+- `NativeRouteState`: `available`, `temporarily-unavailable`, `withdrawn`
+- `NativeRouteEventKind`: `available`, `temporarily-unavailable`, `withdrawn`, `generation-replaced`
diff --git a/docs/generated/integrations.md b/docs/generated/integrations.md
index 2954480..9e5f073 100644
--- a/docs/generated/integrations.md
+++ b/docs/generated/integrations.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Integration source: `3f8980c873cd3cf3287cac586ca7512140b76ea3b8ce004149e847ef2caf80b1`
+Integration source: `fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f`
 
 Every adapter uses only the versioned HyperFlux SDK, preserves unrelated application devices, and owns no receiver encoding.
 
@@ -19,7 +19,8 @@ Every adapter uses only the versioned HyperFlux SDK, preserves unrelated applica
 | Adapter | Delivery | Status | Coexistence | Protocols |
 | --- | --- | --- | --- | --- |
 | `openrazer-compatibility` | compatibility-service | software-verified | private-explicit-service-only | v5 |
-| `openrgb-native` | native-plugin | in-progress | application-plugin | v5 |
+| `openrazer-native-route` | transport-adapter | software-verified | upstream-transport-extension | v7 |
+| `openrgb-native` | native-plugin | software-verified | application-plugin | v7 |
 | `polychromatic-native` | native-backend | software-verified | native-backend-beside-existing | v5 |
 
 ## Non-Negotiable Rules
diff --git a/docs/generated/kernel-uapi.md b/docs/generated/kernel-uapi.md
index 4482ceb..52cf41a 100644
--- a/docs/generated/kernel-uapi.md
+++ b/docs/generated/kernel-uapi.md
@@ -36,4 +36,4 @@ The UAPI contains fixed-width values, no pointers, and no application or product
 
 ## Ownership
 
-The kernel owns receiver generations, passive observation sequencing, one writer file, session expiry, revocation, and bounded envelope transport. The bridge owns profile selection, logical-device identities, capabilities, carrier maps, effects, scheduling, and application policy.
+The kernel owns receiver generations, passive observation sequencing, one writer file, session expiry, revocation, bounded legacy envelopes, and qualified fixed-size native exchanges. The bridge owns route qualification, generation-safe NativeControl arbitration, bounded admission, and outcome projection. OpenRazer and OpenRGB own device commands, capabilities, layouts, effects, and persistence.
diff --git a/docs/generated/repository-atlas.md b/docs/generated/repository-atlas.md
index 5f1743c..5bfe9e6 100644
--- a/docs/generated/repository-atlas.md
+++ b/docs/generated/repository-atlas.md
@@ -15,7 +15,7 @@ flowchart LR
     subgraph c_applications["Applications"]
         n_integrations["Application integration catalog"]
         n_openrgb_adapter["OpenRGB adapter"]
-        n_openrazer_adapter["OpenRazer compatibility adapter"]
+        n_openrazer_adapter["OpenRazer native route"]
         n_polychromatic_adapter["Polychromatic adapter"]
         n_device_qualification_console["Device qualification console"]
         n_operations_cli["Operations CLI"]
@@ -164,8 +164,8 @@ Arrows run from a dependency to its direct consumer. They describe responsibilit
 | [Composable hardware profiles](#profiles) | `architecture` | `implemented` | 3 | 11 | `profile-contracts`, `native-onboarding-contracts` |
 | [Device knowledge](#device-knowledge) | `assurance` | `research-boundary` | 2 | 1 | `device-knowledge-contracts`, `native-onboarding-contracts` |
 | [Versioned bridge protocol](#protocol) | `architecture` | `implemented` | 1 | 7 | `protocol-contracts`, `cpp-sdk-contracts` |
-| [OpenRGB adapter](#openrgb-adapter) | `applications` | `implemented` | 3 | 1 | `openrgb-adapter-contracts`, `openrgb-thread-sanitizer` |
-| [OpenRazer compatibility adapter](#openrazer-adapter) | `applications` | `implemented` | 3 | 2 | `openrazer-metadata-contracts`, `openrazer-compatibility-contracts` |
+| [OpenRGB adapter](#openrgb-adapter) | `applications` | `implemented` | 3 | 1 | `openrgb-native-route-contracts`, `openrgb-thread-sanitizer` |
+| [OpenRazer native route](#openrazer-adapter) | `applications` | `implemented` | 3 | 2 | `openrazer-metadata-contracts`, `openrazer-native-route-contracts`, `openrazer-compatibility-contracts` |
 | [Polychromatic adapter](#polychromatic-adapter) | `applications` | `implemented` | 2 | 1 | `polychromatic-adapter-contracts` |
 | [Device qualification console](#device-qualification-console) | `applications` | `implemented` | 3 | 1 | `device-qualification-console-contracts`, `rust-unit`, `package-contracts` |
 | [Rust workspace](#rust-workspace) | `runtime` | `implemented` | 3 | 5 | `rust-format`, `rust-clippy`, `rust-unit` |
@@ -287,13 +287,13 @@ Defines application-neutral adapter identities, upstream pins, coexistence rules
 
 **Depends on:** [Architecture authority](#architecture), [Schema contracts](#schemas)
 
-**Used by:** [Device knowledge](#device-knowledge), [OpenRazer compatibility adapter](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Composable hardware profiles](#profiles), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python)
+**Used by:** [Device knowledge](#device-knowledge), [OpenRazer native route](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Composable hardware profiles](#profiles), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python)
 
 **Canonical sources:** `integrations/catalog.json`.
 
 **Generated projections:** `integrations/README.md`, `generated/integrations/catalog.json`, `docs/generated/integrations.md`.
 
-**Change impact:** Regenerate 3 declared projection(s). Run `integration-contracts`. Review direct consumers: Device knowledge, OpenRazer compatibility adapter, OpenRGB adapter, Composable hardware profiles, C++ SDK, Python SDK.
+**Change impact:** Regenerate 3 declared projection(s). Run `integration-contracts`. Review direct consumers: Device knowledge, OpenRazer native route, OpenRGB adapter, Composable hardware profiles, C++ SDK, Python SDK.
 
 </details>
 
@@ -313,13 +313,13 @@ Composes receiver, surface, and child identities with evidence-bound capabilitie
 
 **Depends on:** [Architecture authority](#architecture), [Schema contracts](#schemas), [Application integration catalog](#integrations)
 
-**Used by:** [Core policy engine](#core-runtime), [Device knowledge](#device-knowledge), [Device qualification console](#device-qualification-console), [Linux HID kernel module](#kernel-module), [OpenRazer compatibility adapter](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Operations CLI](#operations-cli), [Rust SDK](#rust-sdk), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python), [Deterministic simulator](#simulator)
+**Used by:** [Core policy engine](#core-runtime), [Device knowledge](#device-knowledge), [Device qualification console](#device-qualification-console), [Linux HID kernel module](#kernel-module), [OpenRazer native route](#openrazer-adapter), [OpenRGB adapter](#openrgb-adapter), [Operations CLI](#operations-cli), [Rust SDK](#rust-sdk), [C++ SDK](#sdk-cpp), [Python SDK](#sdk-python), [Deterministic simulator](#simulator)
 
 **Canonical sources:** `profiles/capabilities.json`, `profiles/lifecycle-policies.json`, `profiles/evidence/claims.json`, `profiles/receivers/razer-hyperflux-v2-1532-00cf.json`, `profiles/surfaces/razer-hyperflux-v2-hard-edition.json`, `profiles/children/razer-basilisk-v3-pro-35k-00cd.json`, `profiles/children/razer-deathstalker-v2-pro-tkl-0296.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-13.json`, `profiles/candidates/razer-hyperflux-v2-2026-07-21.json`.
 
 **Generated projections:** `profiles/README.md`, `generated/profiles/catalog.json`, `docs/generated/supported-hardware.md`.
 
-**Change impact:** Regenerate 3 declared projection(s). Run `profile-contracts`, `native-onboarding-contracts`. Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
+**Change impact:** Regenerate 3 declared projection(s). Run `profile-contracts`, `native-onboarding-contracts`. Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer native route, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
 
 </details>
 
@@ -383,47 +383,47 @@ Defines bounded request, response, event, negotiation, and compatibility contrac
 
 `integrations/openrgb` · `applications` · `implemented`
 
-Projects qualified SDK devices into native OpenRGB controllers while preserving upstream presentation metadata.
+Runs pinned upstream Razer controllers over qualified HyperFlux Feature routes while preserving ordinary hidapi devices.
 
-**Owns:** OpenRGB controller projection; UI coordination; Bounded dispatch queue.
+**Owns:** OpenRGB Feature transport adaptation; Native controller lifecycle; Serial-proven direct-route precedence.
 
-**Must never own:** Receiver encoding; Qualification policy; Direct USB access.
+**Must never own:** OpenRGB device semantics; Receiver qualification; Direct hidapi transport.
 
 **Depends on:** [Application integration catalog](#integrations), [Composable hardware profiles](#profiles), [C++ SDK](#sdk-cpp)
 
 **Used by:** [Packaging and installation](#packaging)
 
-**Canonical sources:** `integrations/openrgb/CMakeLists.txt`, `integrations/openrgb/src/openrgb_plugin.cpp`, `integrations/openrgb/src/runtime_core.cpp`.
+**Canonical sources:** `integrations/openrgb/CMakeLists.txt`, `integrations/openrgb/native-route/transform.json`, `integrations/openrgb/src/native_plugin_application.cpp`, `integrations/openrgb/src/native_route_session.cpp`, `integrations/openrgb/src/razer_feature_transport.cpp`, `integrations/openrgb/src/openrgb_plugin.cpp`.
 
 **Generated projections:** `integrations/openrgb/README.md`.
 
-**Change impact:** Regenerate 1 declared projection(s). Run `openrgb-adapter-contracts`, `openrgb-thread-sanitizer`. Review direct consumers: Packaging and installation.
+**Change impact:** Regenerate 1 declared projection(s). Run `openrgb-native-route-contracts`, `openrgb-thread-sanitizer`. Review direct consumers: Packaging and installation.
 
 </details>
 
 <a id="openrazer-adapter"></a>
 <details>
-<summary><strong>OpenRazer compatibility adapter</strong> · applications · implemented</summary>
+<summary><strong>OpenRazer native route</strong> · applications · implemented</summary>
 
-### OpenRazer compatibility adapter
+### OpenRazer native route
 
 `integrations/openrazer` · `applications` · `implemented`
 
-Provides an isolated compatibility surface for legacy OpenRazer clients without impersonating the system daemon globally.
+Extends pinned OpenRazer with trusted feature-only HyperFlux routes while preserving ordinary USB devices and the official daemon API.
 
-**Owns:** Private compatibility session; OpenRazer metadata import; Legacy client translation.
+**Owns:** Feature-only UHID route contract; Pinned OpenRazer source transform; Serial-proven direct-route precedence metadata.
 
-**Must never own:** Global D-Bus names; Receiver transport; OpenRazer support authority.
+**Must never own:** OpenRazer device semantics; Official daemon identity; Direct USB transport.
 
 **Depends on:** [Application integration catalog](#integrations), [Composable hardware profiles](#profiles), [Python SDK](#sdk-python)
 
 **Used by:** [Packaging and installation](#packaging), [Polychromatic adapter](#polychromatic-adapter)
 
-**Canonical sources:** `integrations/openrazer/import.json`, `integrations/openrazer/metadata.json`, `integrations/openrazer/compatibility.json`, `integrations/openrazer/native-control-policy.json`, `integrations/openrazer/native-method-inventory.json`.
+**Canonical sources:** `integrations/openrazer/import.json`, `integrations/openrazer/metadata.json`, `integrations/openrazer/native-control-policy.json`, `integrations/openrazer/native-method-inventory.json`, `integrations/openrazer/native-probe-catalog.json`, `integrations/openrazer/native-route/catalog.json`, `integrations/openrazer/native-route/transform.json`.
 
 **Generated projections:** `integrations/openrazer/README.md`, `sdk/python/hyperflux_sdk/generated/openrazer_metadata.py`.
 
-**Change impact:** Regenerate 2 declared projection(s). Run `openrazer-metadata-contracts`, `openrazer-compatibility-contracts`. Review direct consumers: Packaging and installation, Polychromatic adapter.
+**Change impact:** Regenerate 2 declared projection(s). Run `openrazer-metadata-contracts`, `openrazer-native-route-contracts`, `openrazer-compatibility-contracts`. Review direct consumers: Packaging and installation, Polychromatic adapter.
 
 </details>
 
@@ -435,13 +435,13 @@ Provides an isolated compatibility surface for legacy OpenRazer clients without
 
 `integrations/polychromatic` · `applications` · `implemented`
 
-Exposes HyperFlux-backed devices to Polychromatic through a native bounded backend and explicit coexistence policy.
+Retains the SDK-native backend as a migration fallback while Polychromatic uses its ordinary OpenRazer backend for native routes.
 
-**Owns:** Polychromatic backend projection; Client state mapping; Backend discovery patch.
+**Owns:** Migration backend projection; Client state mapping; Backend discovery patch.
 
-**Must never own:** OpenRazer global policy; Raw receiver access; Profile qualification.
+**Must never own:** OpenRazer device semantics; Raw receiver access; Native-route qualification.
 
-**Depends on:** [OpenRazer compatibility adapter](#openrazer-adapter), [Python SDK](#sdk-python)
+**Depends on:** [OpenRazer native route](#openrazer-adapter), [Python SDK](#sdk-python)
 
 **Used by:** [Packaging and installation](#packaging)
 
@@ -513,9 +513,9 @@ Coordinates the Rust dependency graph and compile-time ownership boundaries acro
 
 `crates/hfx-core` · `runtime` · `implemented`
 
-Owns lifecycle policy, receiver registry, leases, transactions, restoration intent, and typed diagnostics.
+Owns receiver generations, qualified native routes, child-local arbitration, bounded transactions, retained fallback restoration, and typed diagnostics.
 
-**Owns:** Core state machines; Lease and transaction policy; Restoration intent.
+**Owns:** Core state machines; NativeControl and transaction policy; Retained restoration intent.
 
 **Must never own:** Socket framing; Kernel I/O; Application presentation.
 
@@ -539,9 +539,9 @@ Owns lifecycle policy, receiver registry, leases, transactions, restoration inte
 
 `crates/hfx-bridge` · `runtime` · `implemented`
 
-Adapts the core policy engine to sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.
+Adapts the core to protocol-v7 native routes and exchanges plus retained protocol-v6 sessions, persistence, subscriptions, snapshots, and bounded RPC dispatch.
 
-**Owns:** Bridge actors; Session registry; Persistence and RPC adaptation.
+**Owns:** Bridge actors; Session registry; Native-route scheduling; Persistence and RPC adaptation.
 
 **Must never own:** Core policy duplication; Kernel report encoding; Application-specific effects.
 
@@ -565,7 +565,7 @@ Adapts the core policy engine to sessions, persistence, subscriptions, snapshots
 
 `crates/hfx-daemon` · `runtime` · `implemented`
 
-Composes production discovery, configuration, authority, service lifecycle, logging, and restoration around the bridge.
+Composes production discovery, configuration, native-route authority, service lifecycle, logging, and the retained restoration fallback around the bridge.
 
 **Owns:** Production composition root; Service lifecycle; Privilege and socket setup.
 
@@ -591,11 +591,11 @@ Composes production discovery, configuration, authority, service lifecycle, logg
 
 `crates/hfx-sdk` · `runtime` · `implemented`
 
-Provides the typed Rust client contract used by production integrations and internal consumers.
+Provides the typed Rust client contract for qualified route discovery, bounded native exchanges, and retained semantic consumers.
 
-**Owns:** Rust client API; Identity and channel adaptation; Typed SDK errors.
+**Owns:** Rust client API; Native route and channel adaptation; Typed SDK errors.
 
-**Must never own:** Application presentation; Raw receiver reports; Bridge policy.
+**Must never own:** Application presentation; Device command semantics; Receiver carrier frames; Bridge policy.
 
 **Depends on:** [Rust workspace](#rust-workspace), [Versioned bridge protocol](#protocol), [Composable hardware profiles](#profiles)
 
@@ -721,9 +721,9 @@ Defines additive generated userspace ABIs and the strict boundary around the in-
 
 `driver/kernel` · `runtime` · `implemented`
 
-Binds the receiver, preserves generic input, records passive observations, and transports bounded generation-scoped envelopes.
+Binds the receiver, preserves generic input, records passive observations, performs qualified fixed-size native exchanges, and retains bounded migration envelopes.
 
-**Owns:** HID binding; Passive receiver observations; Exclusive session enforcement.
+**Owns:** HID binding; Passive receiver observations; Exclusive session enforcement; UAPI-v2 native exchange execution.
 
 **Must never own:** Retail names; Profiles and effects; Package repair.
 
@@ -779,7 +779,7 @@ Builds reproducible distribution artifacts and a canonical installed root from e
 
 **Must never own:** Runtime naming duplicates; Hidden post-install writes; Publication authorization.
 
-**Depends on:** [Production daemon](#daemon), [Linux HID kernel module](#kernel-module), [Linux runtime authority](#runtime-config), [OpenRGB adapter](#openrgb-adapter), [OpenRazer compatibility adapter](#openrazer-adapter), [Polychromatic adapter](#polychromatic-adapter), [Device qualification console](#device-qualification-console)
+**Depends on:** [Production daemon](#daemon), [Linux HID kernel module](#kernel-module), [Linux runtime authority](#runtime-config), [OpenRGB adapter](#openrgb-adapter), [OpenRazer native route](#openrazer-adapter), [Polychromatic adapter](#polychromatic-adapter), [Device qualification console](#device-qualification-console)
 
 **Used by:** None
 
@@ -799,11 +799,11 @@ Builds reproducible distribution artifacts and a canonical installed root from e
 
 `sdk/cpp` · `applications` · `implemented`
 
-Provides typed C++ bridge access and generated contracts for native application adapters.
+Provides typed C++ bridge access for qualified native routes, exact Feature exchanges, and generated adapter contracts.
 
-**Owns:** C++ client API; C++ channel and recovery; Generated C++ bindings.
+**Owns:** C++ client API; C++ native-route channel and recovery; Generated C++ bindings.
 
-**Must never own:** OpenRGB widgets; Raw receiver transport; Independent schema truth.
+**Must never own:** OpenRGB widgets or device commands; Receiver carrier transport; Independent schema truth.
 
 **Depends on:** [Versioned bridge protocol](#protocol), [Composable hardware profiles](#profiles), [Application integration catalog](#integrations)
 
@@ -833,13 +833,13 @@ Provides typed Python bridge access and generated contracts for scripting and Py
 
 **Depends on:** [Versioned bridge protocol](#protocol), [Composable hardware profiles](#profiles), [Application integration catalog](#integrations)
 
-**Used by:** [OpenRazer compatibility adapter](#openrazer-adapter), [Polychromatic adapter](#polychromatic-adapter), [Contract tests](#tests)
+**Used by:** [OpenRazer native route](#openrazer-adapter), [Polychromatic adapter](#polychromatic-adapter), [Contract tests](#tests)
 
 **Canonical sources:** `sdk/python/pyproject.toml`, `sdk/python/hyperflux_sdk/client.py`, `sdk/python/hyperflux_sdk/lighting.py`.
 
 **Generated projections:** `sdk/python/README.md`, `sdk/python/hyperflux_sdk/generated/domain_types.py`, `sdk/python/hyperflux_sdk/generated/profile_catalog.py`.
 
-**Change impact:** Regenerate 3 declared projection(s). Run `python-unit`, `protocol-contracts`. Review direct consumers: OpenRazer compatibility adapter, Polychromatic adapter, Contract tests.
+**Change impact:** Regenerate 3 declared projection(s). Run `python-unit`, `protocol-contracts`. Review direct consumers: OpenRazer native route, Polychromatic adapter, Contract tests.
 
 </details>
 
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index 6d0d96c..ee4fcdc 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `7d3646e6c0c97ff16a7ae093b63c340045896ac6901dec8db6c6919990e4f060`
+- Authority SHA-256: `0115160d1f0205a27c83807c23c139f4a39882a73bca9bd48d2cb2d88da82112`
 
 ## License Policy
 
diff --git a/docs/generated/verification.md b/docs/generated/verification.md
index 1212f64..3a4ec15 100644
--- a/docs/generated/verification.md
+++ b/docs/generated/verification.md
@@ -36,7 +36,7 @@ Every current node is software-only and has zero hardware-write authority.
 | 27 | `openrgb-adapter-contracts` | `integrations` | `none` | `false` | 300s | `rerun` |
 | 28 | `polychromatic-adapter-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
 | 29 | `openrazer-compatibility-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
-| 30 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 60s | `rerun` |
+| 30 | `openrazer-native-route-contracts` | `integrations` | `none` | `false` | 180s | `rerun` |
 | 31 | `migration-shadow-contracts` | `migration` | `none` | `false` | 120s | `rerun` |
 | 32 | `openrgb-native-route-contracts` | `integrations` | `none` | `false` | 360s | `rerun` |
 | 33 | `openrgb-thread-sanitizer` | `integrations` | `none` | `false` | 300s | `rerun` |
diff --git a/docs/user/overview.md b/docs/user/overview.md
index cca3686..52859c4 100644
--- a/docs/user/overview.md
+++ b/docs/user/overview.md
@@ -1,15 +1,21 @@
 # HyperFlux Next
 
-HyperFlux Next is a clean Linux foundation for supported devices connected
-through the Razer HyperFlux V2 receiver and mat. It presents each qualified
-mouse or keyboard to applications while the receiver and mat remain the shared
-transport layer.
+HyperFlux Next is a thin Linux transport bridge for supported devices connected
+through the Razer HyperFlux V2 receiver and mat. It gives upstream applications
+a qualified route to each paired mouse or keyboard while the receiver and mat
+remain the shared physical transport.
 
 The product is deliberately split into layers. The kernel driver preserves HID
-input and exposes a bounded receiver session. The local bridge owns
-qualification, application ownership, transactions, restoration, and
-diagnostics. Application adapters use the versioned SDK and do not send raw USB
-or HID reports.
+input and exposes bounded receiver exchanges. The local bridge owns exact route
+identity, qualification, generations, NativeControl arbitration, transaction
+certainty, availability, and diagnostics. Thin application adapters use the
+versioned SDK to carry one qualified 90-byte Razer Feature report and its
+matching response; they cannot submit arbitrary USB setup packets or receiver
+carrier frames.
+
+OpenRazer and OpenRGB remain responsible for device commands, capabilities,
+images, layouts, DPI, polling, macros, lighting modes, effects, profiles, and
+persistence. HyperFlux does not recreate those model semantics.
 
 > **Current state:** this is a public, evidence-bound pre-release source
 > repository. It is not an authorized release, package channel, or supported
@@ -17,10 +23,13 @@ or HID reports.
 
 ## What Users Eventually Gain
 
-- truthful discovery of independently paired devices;
-- exact qualified names, layouts, zones, and battery observations;
-- application lighting through OpenRGB and native compatibility adapters;
-- stable lighting restoration after qualified lifecycle events;
+- truthful discovery of independently paired routes and exact wireless VID/PID;
+- upstream names, layouts, zones, settings, and effects through their original
+  OpenRazer and OpenRGB implementations;
+- bounded bidirectional request/response transport with explicit failure
+  certainty and no automatic retry after a possible write;
+- generation-safe availability and serial-proven direct-USB handoff without
+  suppressing unrelated devices;
 - one understandable Doctor result and privacy-safe support evidence;
 - updates that distinguish userspace changes from kernel activation.
 
diff --git a/driver/kernel/README.md b/driver/kernel/README.md
index 20c2b95..ea0db8e 100644
--- a/driver/kernel/README.md
+++ b/driver/kernel/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Binds the receiver, preserves generic input, records passive observations, and transports bounded generation-scoped envelopes.
+Binds the receiver, preserves generic input, records passive observations, performs qualified fixed-size native exchanges, and retains bounded migration envelopes.
 
 `implemented` | `runtime` | Atlas: `kernel-module`
 
@@ -17,6 +17,7 @@ Binds the receiver, preserves generic input, records passive observations, and t
 - HID binding
 - Passive receiver observations
 - Exclusive session enforcement
+- UAPI-v2 native exchange execution
 
 **Does not own**
 - Retail names
diff --git a/generated/integrations/catalog.json b/generated/integrations/catalog.json
index 5e9e02c..b39b58b 100644
--- a/generated/integrations/catalog.json
+++ b/generated/integrations/catalog.json
@@ -1,7 +1,7 @@
 {
   "adapters": [
     {
-      "application": "OpenRazer-compatible clients",
+      "application": "OpenRazer-compatible clients (migration fallback)",
       "coexistence_policy": "private-explicit-service-only",
       "feature_families": [
         "inventory",
@@ -29,34 +29,63 @@
         "openrazer"
       ]
     },
+    {
+      "application": "OpenRazer and Polychromatic",
+      "coexistence_policy": "upstream-transport-extension",
+      "feature_families": [
+        "availability",
+        "inventory",
+        "native-control",
+        "presentation"
+      ],
+      "id": "openrazer-native-route",
+      "kind": "transport-adapter",
+      "must_not_own": [
+        "device commands, capabilities, images, or persistence",
+        "official OpenRazer daemon or D-Bus API",
+        "ordinary direct-USB devices"
+      ],
+      "owns": [
+        "feature-only UHID endpoint lifecycle",
+        "serial-proven direct-route precedence",
+        "trusted OpenRazer transport adaptation"
+      ],
+      "sdk_protocol_versions": [
+        7
+      ],
+      "status": "software-verified",
+      "transport_access": "sdk-only",
+      "unrelated_device_policy": "preserve",
+      "upstream_ids": [
+        "openrazer",
+        "polychromatic"
+      ]
+    },
     {
       "application": "OpenRGB",
       "coexistence_policy": "application-plugin",
       "feature_families": [
-        "effects",
+        "availability",
         "inventory",
-        "lighting",
-        "ownership",
-        "presentation",
-        "telemetry"
+        "native-control",
+        "presentation"
       ],
       "id": "openrgb-native",
       "kind": "native-plugin",
       "must_not_own": [
-        "effect mathematics",
-        "raw receiver transport",
-        "receiver qualification",
-        "unrelated OpenRGB devices"
+        "device models, layouts, zones, modes, effects, or persistence",
+        "direct USB hidapi transport",
+        "unrelated OpenRGB controllers"
       ],
       "owns": [
-        "OpenRGB contract adaptation",
-        "OpenRGB controller lifecycle",
-        "tested OpenRGB view model"
+        "feature transport adaptation for qualified receiver routes",
+        "native controller registration lifecycle",
+        "serial-proven direct-route precedence"
       ],
       "sdk_protocol_versions": [
-        5
+        7
       ],
-      "status": "in-progress",
+      "status": "software-verified",
       "transport_access": "sdk-only",
       "unrelated_device_policy": "preserve",
       "upstream_ids": [
@@ -64,7 +93,7 @@
       ]
     },
     {
-      "application": "Polychromatic",
+      "application": "Polychromatic (migration fallback)",
       "coexistence_policy": "native-backend-beside-existing",
       "feature_families": [
         "inventory",
@@ -99,7 +128,7 @@
     }
   ],
   "schema": "hyperflux-integration-catalog-v1",
-  "source_sha256": "3f8980c873cd3cf3287cac586ca7512140b76ea3b8ce004149e847ef2caf80b1",
+  "source_sha256": "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f",
   "upstreams": [
     {
       "api_contract": "org.razer 3.x metadata and D-Bus vocabulary",
diff --git a/integrations/README.md b/integrations/README.md
index 57c7cb0..8b464c4 100644
--- a/integrations/README.md
+++ b/integrations/README.md
@@ -35,11 +35,11 @@ Before opening a pull request:
 
 - Regenerate 3 declared projection(s).
 - Run `integration-contracts`.
-- Review direct consumers: Device knowledge, OpenRazer compatibility adapter, OpenRGB adapter, Composable hardware profiles, C++ SDK, Python SDK.
+- Review direct consumers: Device knowledge, OpenRazer native route, OpenRGB adapter, Composable hardware profiles, C++ SDK, Python SDK.
 
 ## Relationships
 
 - **Depends on:** [Architecture authority](../architecture/README.md), [Schema contracts](../schemas/README.md)
-- **Used by:** [Device knowledge](../knowledge/README.md), [OpenRazer compatibility adapter](openrazer/README.md), [OpenRGB adapter](openrgb/README.md), [Composable hardware profiles](../profiles/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md)
+- **Used by:** [Device knowledge](../knowledge/README.md), [OpenRazer native route](openrazer/README.md), [OpenRGB adapter](openrgb/README.md), [Composable hardware profiles](../profiles/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md)
 
 See the [Repository Atlas](../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/integrations/catalog.json b/integrations/catalog.json
index f5cc090..620de82 100644
--- a/integrations/catalog.json
+++ b/integrations/catalog.json
@@ -39,7 +39,7 @@
   "adapters": [
     {
       "id": "openrazer-compatibility",
-      "application": "OpenRazer-compatible clients",
+      "application": "OpenRazer-compatible clients (migration fallback)",
       "kind": "compatibility-service",
       "status": "software-verified",
       "upstream_ids": ["openrazer"],
@@ -51,23 +51,37 @@
       "owns": ["private compatibility service lifecycle", "qualified method translation"],
       "must_not_own": ["official org.razer daemon identity", "raw receiver transport", "unrelated OpenRazer devices"]
     },
+    {
+      "id": "openrazer-native-route",
+      "application": "OpenRazer and Polychromatic",
+      "kind": "transport-adapter",
+      "status": "software-verified",
+      "upstream_ids": ["openrazer", "polychromatic"],
+      "sdk_protocol_versions": [7],
+      "feature_families": ["availability", "inventory", "native-control", "presentation"],
+      "transport_access": "sdk-only",
+      "unrelated_device_policy": "preserve",
+      "coexistence_policy": "upstream-transport-extension",
+      "owns": ["feature-only UHID endpoint lifecycle", "serial-proven direct-route precedence", "trusted OpenRazer transport adaptation"],
+      "must_not_own": ["device commands, capabilities, images, or persistence", "official OpenRazer daemon or D-Bus API", "ordinary direct-USB devices"]
+    },
     {
       "id": "openrgb-native",
       "application": "OpenRGB",
       "kind": "native-plugin",
-      "status": "in-progress",
+      "status": "software-verified",
       "upstream_ids": ["openrgb"],
-      "sdk_protocol_versions": [5],
-      "feature_families": ["effects", "inventory", "lighting", "ownership", "presentation", "telemetry"],
+      "sdk_protocol_versions": [7],
+      "feature_families": ["availability", "inventory", "native-control", "presentation"],
       "transport_access": "sdk-only",
       "unrelated_device_policy": "preserve",
       "coexistence_policy": "application-plugin",
-      "owns": ["OpenRGB contract adaptation", "OpenRGB controller lifecycle", "tested OpenRGB view model"],
-      "must_not_own": ["effect mathematics", "raw receiver transport", "receiver qualification", "unrelated OpenRGB devices"]
+      "owns": ["feature transport adaptation for qualified receiver routes", "native controller registration lifecycle", "serial-proven direct-route precedence"],
+      "must_not_own": ["device models, layouts, zones, modes, effects, or persistence", "direct USB hidapi transport", "unrelated OpenRGB controllers"]
     },
     {
       "id": "polychromatic-native",
-      "application": "Polychromatic",
+      "application": "Polychromatic (migration fallback)",
       "kind": "native-backend",
       "status": "software-verified",
       "upstream_ids": ["openrazer", "polychromatic"],
diff --git a/integrations/openrazer/README.md b/integrations/openrazer/README.md
index dd42b92..bb43386 100644
--- a/integrations/openrazer/README.md
+++ b/integrations/openrazer/README.md
@@ -1,8 +1,8 @@
-# OpenRazer compatibility adapter
+# OpenRazer native route
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Provides an isolated compatibility surface for legacy OpenRazer clients without impersonating the system daemon globally.
+Extends pinned OpenRazer with trusted feature-only HyperFlux routes while preserving ordinary USB devices and the official daemon API.
 
 `implemented` | `applications` | Atlas: `openrazer-adapter`
 
@@ -14,31 +14,33 @@ Provides an isolated compatibility surface for legacy OpenRazer clients without
 ## Scope
 
 **Owns**
-- Private compatibility session
-- OpenRazer metadata import
-- Legacy client translation
+- Feature-only UHID route contract
+- Pinned OpenRazer source transform
+- Serial-proven direct-route precedence metadata
 
 **Does not own**
-- Global D-Bus names
-- Receiver transport
-- OpenRazer support authority
+- OpenRazer device semantics
+- Official daemon identity
+- Direct USB transport
 
 ## Change Here
 
 - [`integrations/openrazer/import.json`](import.json)
 - [`integrations/openrazer/metadata.json`](metadata.json)
-- [`integrations/openrazer/compatibility.json`](compatibility.json)
 - [`integrations/openrazer/native-control-policy.json`](native-control-policy.json)
 - [`integrations/openrazer/native-method-inventory.json`](native-method-inventory.json)
+- [`integrations/openrazer/native-probe-catalog.json`](native-probe-catalog.json)
+- [`integrations/openrazer/native-route/catalog.json`](native-route/catalog.json)
+- [`integrations/openrazer/native-route/transform.json`](native-route/transform.json)
 
 ## Verification
 
-Run `openrazer-metadata-contracts` `openrazer-compatibility-contracts` after changing this area.
+Run `openrazer-metadata-contracts` `openrazer-native-route-contracts` `openrazer-compatibility-contracts` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 2 declared projection(s).
-- Run `openrazer-metadata-contracts`, `openrazer-compatibility-contracts`.
+- Run `openrazer-metadata-contracts`, `openrazer-native-route-contracts`, `openrazer-compatibility-contracts`.
 - Review direct consumers: Packaging and installation, Polychromatic adapter.
 
 ## Relationships
diff --git a/integrations/openrgb/README.md b/integrations/openrgb/README.md
index 4470c7e..1262842 100644
--- a/integrations/openrgb/README.md
+++ b/integrations/openrgb/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Projects qualified SDK devices into native OpenRGB controllers while preserving upstream presentation metadata.
+Runs pinned upstream Razer controllers over qualified HyperFlux Feature routes while preserving ordinary hidapi devices.
 
 `implemented` | `applications` | Atlas: `openrgb-adapter`
 
@@ -14,29 +14,32 @@ Projects qualified SDK devices into native OpenRGB controllers while preserving
 ## Scope
 
 **Owns**
-- OpenRGB controller projection
-- UI coordination
-- Bounded dispatch queue
+- OpenRGB Feature transport adaptation
+- Native controller lifecycle
+- Serial-proven direct-route precedence
 
 **Does not own**
-- Receiver encoding
-- Qualification policy
-- Direct USB access
+- OpenRGB device semantics
+- Receiver qualification
+- Direct hidapi transport
 
 ## Change Here
 
 - [`integrations/openrgb/CMakeLists.txt`](CMakeLists.txt)
+- [`integrations/openrgb/native-route/transform.json`](native-route/transform.json)
+- [`integrations/openrgb/src/native_plugin_application.cpp`](src/native_plugin_application.cpp)
+- [`integrations/openrgb/src/native_route_session.cpp`](src/native_route_session.cpp)
+- [`integrations/openrgb/src/razer_feature_transport.cpp`](src/razer_feature_transport.cpp)
 - [`integrations/openrgb/src/openrgb_plugin.cpp`](src/openrgb_plugin.cpp)
-- [`integrations/openrgb/src/runtime_core.cpp`](src/runtime_core.cpp)
 
 ## Verification
 
-Run `openrgb-adapter-contracts` `openrgb-thread-sanitizer` after changing this area.
+Run `openrgb-native-route-contracts` `openrgb-thread-sanitizer` after changing this area.
 
 Before opening a pull request:
 
 - Regenerate 1 declared projection(s).
-- Run `openrgb-adapter-contracts`, `openrgb-thread-sanitizer`.
+- Run `openrgb-native-route-contracts`, `openrgb-thread-sanitizer`.
 - Review direct consumers: Packaging and installation.
 
 ## Relationships
diff --git a/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp b/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
index 7965916..a15c46e 100644
--- a/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
+++ b/integrations/openrgb/include/hyperflux/openrgb/razer_feature_transport.hpp
@@ -15,6 +15,11 @@ namespace hyperflux::openrgb::native
 inline constexpr std::size_t razer_hid_report_bytes = 91;
 inline constexpr std::size_t razer_native_report_bytes = 90;
 
+static_assert(sizeof(razer_report) == razer_hid_report_bytes);
+static_assert(offsetof(razer_report, report_id) == 0);
+static_assert(offsetof(razer_report, status) == 1);
+static_assert(razer_hid_report_bytes == razer_native_report_bytes + 1);
+
 enum class NativeExchangeCertainty
 {
     NotSent,
diff --git a/integrations/openrgb/src/native_route_session.cpp b/integrations/openrgb/src/native_route_session.cpp
index 9af9788..829ef01 100644
--- a/integrations/openrgb/src/native_route_session.cpp
+++ b/integrations/openrgb/src/native_route_session.cpp
@@ -43,7 +43,7 @@ sdk::Result<T> checked_domain(Value value, std::string_view label)
 
 bool route_is_usable(const v7::NativeRoute& route)
 {
-    return route.route_state == RouteState::Available
+    return route.route_state == NativeRouteState::Available
         && route.access == NativeRouteAccess::Qualified
         && route.protocol_family.value() == "razer-feature-report-v1"
         && route.report_bytes.value() == razer_native_report_bytes
diff --git a/integrations/openrgb/src/upstream_razer_registry.cpp b/integrations/openrgb/src/upstream_razer_registry.cpp
index b1f125c..0a5614f 100644
--- a/integrations/openrgb/src/upstream_razer_registry.cpp
+++ b/integrations/openrgb/src/upstream_razer_registry.cpp
@@ -440,7 +440,7 @@ std::uintptr_t UpstreamRazerControllerRegistry::controller_identity(
 
 bool is_eligible_upstream_razer_route(const v7::NativeRoute& route) noexcept
 {
-    return route.route_state == RouteState::Available
+    return route.route_state == NativeRouteState::Available
         && route.access == NativeRouteAccess::Qualified
         && route.protocol_family.value() == "razer-feature-report-v1"
         && route.report_bytes.value() == razer_native_report_bytes
diff --git a/integrations/polychromatic/README.md b/integrations/polychromatic/README.md
index cb1eaaf..aefd958 100644
--- a/integrations/polychromatic/README.md
+++ b/integrations/polychromatic/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Exposes HyperFlux-backed devices to Polychromatic through a native bounded backend and explicit coexistence policy.
+Retains the SDK-native backend as a migration fallback while Polychromatic uses its ordinary OpenRazer backend for native routes.
 
 `implemented` | `applications` | Atlas: `polychromatic-adapter`
 
@@ -14,14 +14,14 @@ Exposes HyperFlux-backed devices to Polychromatic through a native bounded backe
 ## Scope
 
 **Owns**
-- Polychromatic backend projection
+- Migration backend projection
 - Client state mapping
 - Backend discovery patch
 
 **Does not own**
-- OpenRazer global policy
+- OpenRazer device semantics
 - Raw receiver access
-- Profile qualification
+- Native-route qualification
 
 ## Change Here
 
@@ -41,7 +41,7 @@ Before opening a pull request:
 
 ## Relationships
 
-- **Depends on:** [OpenRazer compatibility adapter](../openrazer/README.md), [Python SDK](../../sdk/python/README.md)
+- **Depends on:** [OpenRazer native route](../openrazer/README.md), [Python SDK](../../sdk/python/README.md)
 - **Used by:** [Packaging and installation](../../packaging/README.md)
 
 See the [Repository Atlas](../../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/migration/sources.json b/migration/sources.json
index e96e3d7..9d8bd77 100644
--- a/migration/sources.json
+++ b/migration/sources.json
@@ -7,7 +7,7 @@
       "kind": "imported-document",
       "role": "governing product design",
       "imported_path": "docs/architecture/design-book.md",
-      "sha256": "37e177e4983375673ad26945b5c772254151e4de44e43aba3aedfec6ef9d161d"
+      "sha256": "4cd2bb31b51649423bb6b6691601b1b2b75ed65e1a5a5156df959a31bd8289b9"
     },
     {
       "id": "device-knowledge-research",
diff --git a/packaging/README.md b/packaging/README.md
index dad9976..4e8616c 100644
--- a/packaging/README.md
+++ b/packaging/README.md
@@ -40,7 +40,7 @@ Before opening a pull request:
 
 ## Relationships
 
-- **Depends on:** [Production daemon](../crates/hfx-daemon/README.md), [Linux HID kernel module](../driver/kernel/README.md), [Linux runtime authority](../runtime/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [OpenRazer compatibility adapter](../integrations/openrazer/README.md), [Polychromatic adapter](../integrations/polychromatic/README.md), [Device qualification console](../apps/device-qualification/README.md)
+- **Depends on:** [Production daemon](../crates/hfx-daemon/README.md), [Linux HID kernel module](../driver/kernel/README.md), [Linux runtime authority](../runtime/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [OpenRazer native route](../integrations/openrazer/README.md), [Polychromatic adapter](../integrations/polychromatic/README.md), [Device qualification console](../apps/device-qualification/README.md)
 - **Used by:** None
 
 See the [Repository Atlas](../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/profiles/README.md b/profiles/README.md
index 8f708b2..ac9cb5c 100644
--- a/profiles/README.md
+++ b/profiles/README.md
@@ -43,11 +43,11 @@ Before opening a pull request:
 
 - Regenerate 3 declared projection(s).
 - Run `profile-contracts`, `native-onboarding-contracts`.
-- Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer compatibility adapter, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
+- Review direct consumers: Core policy engine, Device knowledge, Device qualification console, Linux HID kernel module, OpenRazer native route, OpenRGB adapter, Operations CLI, Rust SDK, C++ SDK, Python SDK, Deterministic simulator.
 
 ## Relationships
 
 - **Depends on:** [Architecture authority](../architecture/README.md), [Schema contracts](../schemas/README.md), [Application integration catalog](../integrations/README.md)
-- **Used by:** [Core policy engine](../crates/hfx-core/README.md), [Device knowledge](../knowledge/README.md), [Device qualification console](../apps/device-qualification/README.md), [Linux HID kernel module](../driver/kernel/README.md), [OpenRazer compatibility adapter](../integrations/openrazer/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [Operations CLI](../crates/hfx-ops/README.md), [Rust SDK](../crates/hfx-sdk/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md), [Deterministic simulator](../crates/hfx-sim/README.md)
+- **Used by:** [Core policy engine](../crates/hfx-core/README.md), [Device knowledge](../knowledge/README.md), [Device qualification console](../apps/device-qualification/README.md), [Linux HID kernel module](../driver/kernel/README.md), [OpenRazer native route](../integrations/openrazer/README.md), [OpenRGB adapter](../integrations/openrgb/README.md), [Operations CLI](../crates/hfx-ops/README.md), [Rust SDK](../crates/hfx-sdk/README.md), [C++ SDK](../sdk/cpp/README.md), [Python SDK](../sdk/python/README.md), [Deterministic simulator](../crates/hfx-sim/README.md)
 
 See the [Repository Atlas](../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/protocol/registry.json b/protocol/registry.json
index b044af3..dfb4a63 100644
--- a/protocol/registry.json
+++ b/protocol/registry.json
@@ -42,7 +42,7 @@
     {
       "version": 7,
       "catalog": "v7/catalog.json",
-      "sha256": "39443b1babed1e7f94824dcb3379f9572563263592841fda21378c14aff3bd34",
+      "sha256": "3f5f6145b5abf844321aee3aff8d8eeb4f1f3561aee6deb431209eb42cea4b73",
       "served_features": ["atomic-transactions", "event-subscriptions", "integration-view-projection", "native-receiver-tunnel", "ownership-leases", "profile-bound-transactions", "return-lifecycle-projection", "semantic-stable-lighting", "snapshot-profile-bindings", "structured-diagnostics"]
     }
   ]
diff --git a/protocol/v7/catalog.json b/protocol/v7/catalog.json
index 833feb5..a697668 100644
--- a/protocol/v7/catalog.json
+++ b/protocol/v7/catalog.json
@@ -519,7 +519,7 @@
         {"name": "device_kind", "type": "DeviceKind", "required": true, "many": false, "max_items": null, "description": "Observed child device category."},
         {"name": "vendor_id", "type": "VendorId", "required": true, "many": false, "max_items": null, "description": "Observed child USB vendor identifier."},
         {"name": "product_id", "type": "ProductId", "required": true, "many": false, "max_items": null, "description": "Observed child USB product identifier."},
-        {"name": "route_state", "type": "RouteState", "required": true, "many": false, "max_items": null, "description": "Current receiver route evidence."},
+        {"name": "route_state", "type": "NativeRouteState", "required": true, "many": false, "max_items": null, "description": "Current route authority without a sleep, power, readiness, or application-state claim."},
         {"name": "access", "type": "NativeRouteAccess", "required": true, "many": false, "max_items": null, "description": "Evidence-backed tunnel access level."},
         {"name": "protocol_family", "type": "NativeProtocolFamily", "required": true, "many": false, "max_items": null, "description": "Opaque feature-report protocol family."},
         {"name": "report_bytes", "type": "NativeReportByteCount", "required": true, "many": false, "max_items": null, "description": "Exact native report size."},
diff --git a/schemas/domain-catalog.json b/schemas/domain-catalog.json
index aa95e5b..f876731 100644
--- a/schemas/domain-catalog.json
+++ b/schemas/domain-catalog.json
@@ -123,6 +123,7 @@
     {"name": "LeaseOutcome", "values": ["granted", "conflict", "rejected"]},
     {"name": "ErrorSeverity", "values": ["info", "warning", "error", "critical"]},
     {"name": "NativeRouteAccess", "values": ["qualified", "candidate", "backend-required"]},
-    {"name": "NativeRouteEventKind", "values": ["available", "unavailable", "generation-replaced"]}
+    {"name": "NativeRouteState", "values": ["available", "temporarily-unavailable", "withdrawn"]},
+    {"name": "NativeRouteEventKind", "values": ["available", "temporarily-unavailable", "withdrawn", "generation-replaced"]}
   ]
 }
diff --git a/schemas/integration-catalog.schema.json b/schemas/integration-catalog.schema.json
index 7dff51a..0794947 100644
--- a/schemas/integration-catalog.schema.json
+++ b/schemas/integration-catalog.schema.json
@@ -40,14 +40,14 @@
         "properties": {
           "id": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"},
           "application": {"type": "string", "minLength": 1, "maxLength": 96},
-          "kind": {"enum": ["native-plugin", "native-backend", "compatibility-service"]},
+          "kind": {"enum": ["native-plugin", "native-backend", "compatibility-service", "transport-adapter"]},
           "status": {"enum": ["planned", "in-progress", "software-verified", "hardware-qualified"]},
           "upstream_ids": {"type": "array", "minItems": 1, "maxItems": 4, "uniqueItems": true, "items": {"type": "string"}},
           "sdk_protocol_versions": {"type": "array", "minItems": 1, "maxItems": 8, "uniqueItems": true, "items": {"type": "integer", "minimum": 1, "maximum": 65535}},
           "feature_families": {"type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"type": "string", "pattern": "^[a-z][a-z0-9-]{0,63}$"}},
           "transport_access": {"const": "sdk-only"},
           "unrelated_device_policy": {"const": "preserve"},
-          "coexistence_policy": {"enum": ["application-plugin", "native-backend-beside-existing", "private-explicit-service-only"]},
+          "coexistence_policy": {"enum": ["application-plugin", "native-backend-beside-existing", "private-explicit-service-only", "upstream-transport-extension"]},
           "owns": {"type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 128}},
           "must_not_own": {"type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"type": "string", "minLength": 1, "maxLength": 128}}
         }
diff --git a/schemas/native-route-observation.schema.json b/schemas/native-route-observation.schema.json
index dba8a45..dc80140 100644
--- a/schemas/native-route-observation.schema.json
+++ b/schemas/native-route-observation.schema.json
@@ -15,7 +15,7 @@
     "product_id": {"type": "integer", "minimum": 0, "maximum": 65535},
     "device_kind": {"enum": ["mouse", "keyboard"]},
     "route_kind": {"const": "hyperflux-wireless"},
-    "route_state": {"enum": ["available", "stale", "unavailable", "unknown"]},
+    "route_state": {"enum": ["available", "temporarily-unavailable", "withdrawn"]},
     "access": {"enum": ["candidate", "qualified", "backend-required"]},
     "protocol_family": {"type": "string", "minLength": 1, "maxLength": 64},
     "report_bytes": {"type": "integer", "minimum": 1, "maximum": 4096},
diff --git a/sdk/README.md b/sdk/README.md
index 08a6c32..2b339b7 100644
--- a/sdk/README.md
+++ b/sdk/README.md
@@ -8,14 +8,14 @@ This is a structural collection, not a second source of truth. Follow the author
 
 | Area | Purpose |
 | --- | --- |
-| [C++ SDK](cpp/README.md) | Provides typed C++ bridge access and generated contracts for native application adapters. |
+| [C++ SDK](cpp/README.md) | Provides typed C++ bridge access for qualified native routes, exact Feature exchanges, and generated adapter contracts. |
 | [Python SDK](python/README.md) | Provides typed Python bridge access and generated contracts for scripting and Python application adapters. |
 
 ## Authorities
 
 | Owner | Canonical inputs | Generated outputs |
 | --- | ---: | ---: |
-| [OpenRazer compatibility adapter](../integrations/openrazer/README.md) | 0 | 1 |
+| [OpenRazer native route](../integrations/openrazer/README.md) | 0 | 1 |
 | [C++ SDK](cpp/README.md) | 3 | 3 |
 | [Python SDK](python/README.md) | 3 | 3 |
 
diff --git a/sdk/cpp/README.md b/sdk/cpp/README.md
index f98457c..7a14ff9 100644
--- a/sdk/cpp/README.md
+++ b/sdk/cpp/README.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate` from `architecture/repository-atlas.json`. Do not edit manually.
 
-Provides typed C++ bridge access and generated contracts for native application adapters.
+Provides typed C++ bridge access for qualified native routes, exact Feature exchanges, and generated adapter contracts.
 
 `implemented` | `applications` | Atlas: `sdk-cpp`
 
@@ -15,12 +15,12 @@ Provides typed C++ bridge access and generated contracts for native application
 
 **Owns**
 - C++ client API
-- C++ channel and recovery
+- C++ native-route channel and recovery
 - Generated C++ bindings
 
 **Does not own**
-- OpenRGB widgets
-- Raw receiver transport
+- OpenRGB widgets or device commands
+- Receiver carrier transport
 - Independent schema truth
 
 ## Change Here
diff --git a/sdk/cpp/include/hyperflux/generated/domain_json.hpp b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
index 918dff9..1d520cd 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_json.hpp
@@ -2779,6 +2779,35 @@ template<>
     return Json(std::string(to_string(value)));
 }
 
+template<>
+[[nodiscard]] inline NativeRouteState decode<NativeRouteState>(const Json& value)
+{
+    if(!value.is_string())
+    {
+        throw CodecError("expected NativeRouteState wire string");
+    }
+    const auto wire = value.get<std::string>();
+    if(wire == "available")
+    {
+        return NativeRouteState::Available;
+    }
+    if(wire == "temporarily-unavailable")
+    {
+        return NativeRouteState::TemporarilyUnavailable;
+    }
+    if(wire == "withdrawn")
+    {
+        return NativeRouteState::Withdrawn;
+    }
+    throw CodecError("unknown NativeRouteState wire value");
+}
+
+template<>
+[[nodiscard]] inline Json encode<NativeRouteState>(const NativeRouteState& value)
+{
+    return Json(std::string(to_string(value)));
+}
+
 template<>
 [[nodiscard]] inline NativeRouteEventKind decode<NativeRouteEventKind>(const Json& value)
 {
@@ -2791,9 +2820,13 @@ template<>
     {
         return NativeRouteEventKind::Available;
     }
-    if(wire == "unavailable")
+    if(wire == "temporarily-unavailable")
+    {
+        return NativeRouteEventKind::TemporarilyUnavailable;
+    }
+    if(wire == "withdrawn")
     {
-        return NativeRouteEventKind::Unavailable;
+        return NativeRouteEventKind::Withdrawn;
     }
     if(wire == "generation-replaced")
     {
diff --git a/sdk/cpp/include/hyperflux/generated/domain_types.hpp b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
index 65e6ae9..956ceb1 100644
--- a/sdk/cpp/include/hyperflux/generated/domain_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/domain_types.hpp
@@ -2694,10 +2694,29 @@ enum class NativeRouteAccess
     return "unknown";
 }
 
+enum class NativeRouteState
+{
+    Available,
+    TemporarilyUnavailable,
+    Withdrawn,
+};
+
+[[nodiscard]] constexpr std::string_view to_string(NativeRouteState value)
+{
+    switch(value)
+    {
+        case NativeRouteState::Available: return "available";
+        case NativeRouteState::TemporarilyUnavailable: return "temporarily-unavailable";
+        case NativeRouteState::Withdrawn: return "withdrawn";
+    }
+    return "unknown";
+}
+
 enum class NativeRouteEventKind
 {
     Available,
-    Unavailable,
+    TemporarilyUnavailable,
+    Withdrawn,
     GenerationReplaced,
 };
 
@@ -2706,7 +2725,8 @@ enum class NativeRouteEventKind
     switch(value)
     {
         case NativeRouteEventKind::Available: return "available";
-        case NativeRouteEventKind::Unavailable: return "unavailable";
+        case NativeRouteEventKind::TemporarilyUnavailable: return "temporarily-unavailable";
+        case NativeRouteEventKind::Withdrawn: return "withdrawn";
         case NativeRouteEventKind::GenerationReplaced: return "generation-replaced";
     }
     return "unknown";
diff --git a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
index e2c5988..4aa5c5b 100644
--- a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
@@ -33,7 +33,7 @@ struct AdapterRecord
     std::string_view coexistence_policy;
 };
 
-inline constexpr std::string_view integration_source_sha256 = "3f8980c873cd3cf3287cac586ca7512140b76ea3b8ce004149e847ef2caf80b1";
+inline constexpr std::string_view integration_source_sha256 = "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f";
 
 inline constexpr std::array<std::string_view, 2> upstream_uses_0 {{"compatibility-contract", "metadata-import"}};
 inline constexpr std::array<std::string_view, 3> upstream_uses_1 {{"effect-engine", "model-layout-registry", "plugin-build-contract"}};
@@ -41,12 +41,15 @@ inline constexpr std::array<std::string_view, 2> upstream_uses_2 {{"backend-cont
 inline constexpr std::array<std::string_view, 1> adapter_upstreams_0 {{"openrazer"}};
 inline constexpr std::array<std::uint16_t, 1> adapter_protocols_0 {{5}};
 inline constexpr std::array<std::string_view, 3> adapter_features_0 {{"inventory", "lighting", "ownership"}};
-inline constexpr std::array<std::string_view, 1> adapter_upstreams_1 {{"openrgb"}};
-inline constexpr std::array<std::uint16_t, 1> adapter_protocols_1 {{5}};
-inline constexpr std::array<std::string_view, 6> adapter_features_1 {{"effects", "inventory", "lighting", "ownership", "presentation", "telemetry"}};
-inline constexpr std::array<std::string_view, 2> adapter_upstreams_2 {{"openrazer", "polychromatic"}};
-inline constexpr std::array<std::uint16_t, 1> adapter_protocols_2 {{5}};
-inline constexpr std::array<std::string_view, 5> adapter_features_2 {{"inventory", "lighting", "ownership", "presentation", "telemetry"}};
+inline constexpr std::array<std::string_view, 2> adapter_upstreams_1 {{"openrazer", "polychromatic"}};
+inline constexpr std::array<std::uint16_t, 1> adapter_protocols_1 {{7}};
+inline constexpr std::array<std::string_view, 4> adapter_features_1 {{"availability", "inventory", "native-control", "presentation"}};
+inline constexpr std::array<std::string_view, 1> adapter_upstreams_2 {{"openrgb"}};
+inline constexpr std::array<std::uint16_t, 1> adapter_protocols_2 {{7}};
+inline constexpr std::array<std::string_view, 4> adapter_features_2 {{"availability", "inventory", "native-control", "presentation"}};
+inline constexpr std::array<std::string_view, 2> adapter_upstreams_3 {{"openrazer", "polychromatic"}};
+inline constexpr std::array<std::uint16_t, 1> adapter_protocols_3 {{5}};
+inline constexpr std::array<std::string_view, 5> adapter_features_3 {{"inventory", "lighting", "ownership", "presentation", "telemetry"}};
 
 inline constexpr std::array<UpstreamRecord, 3> upstreams {{
     {"openrazer", "OpenRazer", "https://github.com/openrazer/openrazer.git", "3.12.1-41-g6820f9d", "6820f9da169d354bc7e6e93a0aa8683a6bb75792", "GPL-2.0-or-later AND CC-BY-SA-4.0", "org.razer 3.x metadata and D-Bus vocabulary", upstream_uses_0},
@@ -54,10 +57,11 @@ inline constexpr std::array<UpstreamRecord, 3> upstreams {{
     {"polychromatic", "Polychromatic", "https://github.com/polychromatic/polychromatic.git", "0.9.7-7-g716737b", "716737bf444ab7e962f4d3b7a5188b2f07c0c4a1", "GPL-3.0-only", "Polychromatic 0.9 native backend contract", upstream_uses_2},
 }};
 
-inline constexpr std::array<AdapterRecord, 3> adapters {{
-    {"openrazer-compatibility", "OpenRazer-compatible clients", "compatibility-service", "software-verified", adapter_upstreams_0, adapter_protocols_0, adapter_features_0, "private-explicit-service-only"},
-    {"openrgb-native", "OpenRGB", "native-plugin", "in-progress", adapter_upstreams_1, adapter_protocols_1, adapter_features_1, "application-plugin"},
-    {"polychromatic-native", "Polychromatic", "native-backend", "software-verified", adapter_upstreams_2, adapter_protocols_2, adapter_features_2, "native-backend-beside-existing"},
+inline constexpr std::array<AdapterRecord, 4> adapters {{
+    {"openrazer-compatibility", "OpenRazer-compatible clients (migration fallback)", "compatibility-service", "software-verified", adapter_upstreams_0, adapter_protocols_0, adapter_features_0, "private-explicit-service-only"},
+    {"openrazer-native-route", "OpenRazer and Polychromatic", "transport-adapter", "software-verified", adapter_upstreams_1, adapter_protocols_1, adapter_features_1, "upstream-transport-extension"},
+    {"openrgb-native", "OpenRGB", "native-plugin", "software-verified", adapter_upstreams_2, adapter_protocols_2, adapter_features_2, "application-plugin"},
+    {"polychromatic-native", "Polychromatic (migration fallback)", "native-backend", "software-verified", adapter_upstreams_3, adapter_protocols_3, adapter_features_3, "native-backend-beside-existing"},
 }};
 
 [[nodiscard]] constexpr const UpstreamRecord* upstream_by_id(std::string_view id)
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
index 9e51edb..9032730 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_json.hpp
@@ -1523,7 +1523,7 @@ template<>
         decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
         decode<::hyperflux::VendorId>(required_field(value, "vendor_id")),
         decode<::hyperflux::ProductId>(required_field(value, "product_id")),
-        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::NativeRouteState>(required_field(value, "route_state")),
         decode<::hyperflux::NativeRouteAccess>(required_field(value, "access")),
         decode<::hyperflux::NativeProtocolFamily>(required_field(value, "protocol_family")),
         decode<::hyperflux::NativeReportByteCount>(required_field(value, "report_bytes")),
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
index 2935c5b..a84011a 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_types.hpp
@@ -485,7 +485,7 @@ struct NativeRoute
     DeviceKind device_kind;
     VendorId vendor_id;
     ProductId product_id;
-    RouteState route_state;
+    NativeRouteState route_state;
     NativeRouteAccess access;
     NativeProtocolFamily protocol_family;
     NativeReportByteCount report_bytes;
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
index adca140..bb59292 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v7_json.hpp
@@ -1523,7 +1523,7 @@ template<>
         decode<::hyperflux::DeviceKind>(required_field(value, "device_kind")),
         decode<::hyperflux::VendorId>(required_field(value, "vendor_id")),
         decode<::hyperflux::ProductId>(required_field(value, "product_id")),
-        decode<::hyperflux::RouteState>(required_field(value, "route_state")),
+        decode<::hyperflux::NativeRouteState>(required_field(value, "route_state")),
         decode<::hyperflux::NativeRouteAccess>(required_field(value, "access")),
         decode<::hyperflux::NativeProtocolFamily>(required_field(value, "protocol_family")),
         decode<::hyperflux::NativeReportByteCount>(required_field(value, "report_bytes")),
diff --git a/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp b/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
index b99d15b..e6d666b 100644
--- a/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
+++ b/sdk/cpp/include/hyperflux/generated/protocol_v7_types.hpp
@@ -485,7 +485,7 @@ struct NativeRoute
     DeviceKind device_kind;
     VendorId vendor_id;
     ProductId product_id;
-    RouteState route_state;
+    NativeRouteState route_state;
     NativeRouteAccess access;
     NativeProtocolFamily protocol_family;
     NativeReportByteCount report_bytes;
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 2bc0de1..9c80018 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -37,11 +37,11 @@ Before opening a pull request:
 
 - Regenerate 3 declared projection(s).
 - Run `python-unit`, `protocol-contracts`.
-- Review direct consumers: OpenRazer compatibility adapter, Polychromatic adapter, Contract tests.
+- Review direct consumers: OpenRazer native route, Polychromatic adapter, Contract tests.
 
 ## Relationships
 
 - **Depends on:** [Versioned bridge protocol](../../protocol/README.md), [Composable hardware profiles](../../profiles/README.md), [Application integration catalog](../../integrations/README.md)
-- **Used by:** [OpenRazer compatibility adapter](../../integrations/openrazer/README.md), [Polychromatic adapter](../../integrations/polychromatic/README.md), [Contract tests](../../tests/README.md)
+- **Used by:** [OpenRazer native route](../../integrations/openrazer/README.md), [Polychromatic adapter](../../integrations/polychromatic/README.md), [Contract tests](../../tests/README.md)
 
 See the [Repository Atlas](../../docs/generated/repository-atlas.md) for files, generated projections, contracts, and limitations.
diff --git a/sdk/python/hyperflux_sdk/generated/domain_types.py b/sdk/python/hyperflux_sdk/generated/domain_types.py
index 5ad5c1c..ae5332c 100644
--- a/sdk/python/hyperflux_sdk/generated/domain_types.py
+++ b/sdk/python/hyperflux_sdk/generated/domain_types.py
@@ -1190,9 +1190,16 @@ class NativeRouteAccess(str, Enum):
     BACKEND_REQUIRED = "backend-required"
 
 
+class NativeRouteState(str, Enum):
+    AVAILABLE = "available"
+    TEMPORARILY_UNAVAILABLE = "temporarily-unavailable"
+    WITHDRAWN = "withdrawn"
+
+
 class NativeRouteEventKind(str, Enum):
     AVAILABLE = "available"
-    UNAVAILABLE = "unavailable"
+    TEMPORARILY_UNAVAILABLE = "temporarily-unavailable"
+    WITHDRAWN = "withdrawn"
     GENERATION_REPLACED = "generation-replaced"
 
 
@@ -1314,5 +1321,6 @@ class NativeRouteEventKind(str, Enum):
     "LeaseOutcome",
     "ErrorSeverity",
     "NativeRouteAccess",
+    "NativeRouteState",
     "NativeRouteEventKind",
 ]
diff --git a/sdk/python/hyperflux_sdk/generated/integration_catalog.py b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
index e68decc..9bf4340 100644
--- a/sdk/python/hyperflux_sdk/generated/integration_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-INTEGRATION_CATALOG: Final = {'adapters': [{'application': 'OpenRazer-compatible clients',
+INTEGRATION_CATALOG: Final = {'adapters': [{'application': 'OpenRazer-compatible clients (migration fallback)',
                'coexistence_policy': 'private-explicit-service-only',
                'feature_families': ['inventory', 'lighting', 'ownership'],
                'id': 'openrazer-compatibility',
@@ -18,22 +18,39 @@
                'transport_access': 'sdk-only',
                'unrelated_device_policy': 'preserve',
                'upstream_ids': ['openrazer']},
+              {'application': 'OpenRazer and Polychromatic',
+               'coexistence_policy': 'upstream-transport-extension',
+               'feature_families': ['availability', 'inventory', 'native-control', 'presentation'],
+               'id': 'openrazer-native-route',
+               'kind': 'transport-adapter',
+               'must_not_own': ['device commands, capabilities, images, or persistence',
+                                'official OpenRazer daemon or D-Bus API',
+                                'ordinary direct-USB devices'],
+               'owns': ['feature-only UHID endpoint lifecycle',
+                        'serial-proven direct-route precedence',
+                        'trusted OpenRazer transport adaptation'],
+               'sdk_protocol_versions': [7],
+               'status': 'software-verified',
+               'transport_access': 'sdk-only',
+               'unrelated_device_policy': 'preserve',
+               'upstream_ids': ['openrazer', 'polychromatic']},
               {'application': 'OpenRGB',
                'coexistence_policy': 'application-plugin',
-               'feature_families': ['effects', 'inventory', 'lighting', 'ownership', 'presentation', 'telemetry'],
+               'feature_families': ['availability', 'inventory', 'native-control', 'presentation'],
                'id': 'openrgb-native',
                'kind': 'native-plugin',
-               'must_not_own': ['effect mathematics',
-                                'raw receiver transport',
-                                'receiver qualification',
-                                'unrelated OpenRGB devices'],
-               'owns': ['OpenRGB contract adaptation', 'OpenRGB controller lifecycle', 'tested OpenRGB view model'],
-               'sdk_protocol_versions': [5],
-               'status': 'in-progress',
+               'must_not_own': ['device models, layouts, zones, modes, effects, or persistence',
+                                'direct USB hidapi transport',
+                                'unrelated OpenRGB controllers'],
+               'owns': ['feature transport adaptation for qualified receiver routes',
+                        'native controller registration lifecycle',
+                        'serial-proven direct-route precedence'],
+               'sdk_protocol_versions': [7],
+               'status': 'software-verified',
                'transport_access': 'sdk-only',
                'unrelated_device_policy': 'preserve',
                'upstream_ids': ['openrgb']},
-              {'application': 'Polychromatic',
+              {'application': 'Polychromatic (migration fallback)',
                'coexistence_policy': 'native-backend-beside-existing',
                'feature_families': ['inventory', 'lighting', 'ownership', 'presentation', 'telemetry'],
                'id': 'polychromatic-native',
@@ -51,7 +68,7 @@
                'unrelated_device_policy': 'preserve',
                'upstream_ids': ['openrazer', 'polychromatic']}],
  'schema': 'hyperflux-integration-catalog-v1',
- 'source_sha256': '3f8980c873cd3cf3287cac586ca7512140b76ea3b8ce004149e847ef2caf80b1',
+ 'source_sha256': 'fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f',
  'upstreams': [{'api_contract': 'org.razer 3.x metadata and D-Bus vocabulary',
                 'build_network_access': False,
                 'commit': '6820f9da169d354bc7e6e93a0aa8683a6bb75792',
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_types.py b/sdk/python/hyperflux_sdk/generated/protocol_types.py
index 677d4ed..ebead1e 100644
--- a/sdk/python/hyperflux_sdk/generated/protocol_types.py
+++ b/sdk/python/hyperflux_sdk/generated/protocol_types.py
@@ -46,6 +46,7 @@
     NativeReportHex,
     NativeRouteAccess,
     NativeRouteEventKind,
+    NativeRouteState,
     NativeRouteToken,
     NegotiationToken,
     PairingState,
@@ -567,7 +568,7 @@ class NativeRoute:
     device_kind: DeviceKind
     vendor_id: VendorId
     product_id: ProductId
-    route_state: RouteState
+    route_state: NativeRouteState
     access: NativeRouteAccess
     protocol_family: NativeProtocolFamily
     report_bytes: NativeReportByteCount
diff --git a/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py b/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
index 677d4ed..ebead1e 100644
--- a/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
+++ b/sdk/python/hyperflux_sdk/generated/protocol_v7_types.py
@@ -46,6 +46,7 @@
     NativeReportHex,
     NativeRouteAccess,
     NativeRouteEventKind,
+    NativeRouteState,
     NativeRouteToken,
     NegotiationToken,
     PairingState,
@@ -567,7 +568,7 @@ class NativeRoute:
     device_kind: DeviceKind
     vendor_id: VendorId
     product_id: ProductId
-    route_state: RouteState
+    route_state: NativeRouteState
     access: NativeRouteAccess
     protocol_family: NativeProtocolFamily
     report_bytes: NativeReportByteCount
diff --git a/tests/cpp/openrgb_native_plugin_application_contract.cpp b/tests/cpp/openrgb_native_plugin_application_contract.cpp
index 3ca84a7..6803f85 100644
--- a/tests/cpp/openrgb_native_plugin_application_contract.cpp
+++ b/tests/cpp/openrgb_native_plugin_application_contract.cpp
@@ -89,7 +89,7 @@ hyperflux::v7::NativeRoute route(
         kind,
         number<VendorId>(0x1532),
         number<ProductId>(product_id),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
diff --git a/tests/cpp/openrgb_native_route_session_contract.cpp b/tests/cpp/openrgb_native_route_session_contract.cpp
index 06c8fd8..a86f623 100644
--- a/tests/cpp/openrgb_native_route_session_contract.cpp
+++ b/tests/cpp/openrgb_native_route_session_contract.cpp
@@ -66,7 +66,7 @@ hyperflux::v7::NativeRoute route()
         DeviceKind::Mouse,
         number<VendorId>(0x1532),
         number<ProductId>(0x00cd),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
diff --git a/tests/cpp/openrgb_native_route_worker_contract.cpp b/tests/cpp/openrgb_native_route_worker_contract.cpp
index 7fa3c15..7072330 100644
--- a/tests/cpp/openrgb_native_route_worker_contract.cpp
+++ b/tests/cpp/openrgb_native_route_worker_contract.cpp
@@ -69,7 +69,7 @@ hyperflux::v7::NativeRoute route(std::string_view device_id, std::uint16_t produ
         kind,
         number<VendorId>(0x1532),
         number<ProductId>(product_id),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
diff --git a/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp b/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
index 8642654..23b6f90 100644
--- a/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
+++ b/tests/cpp/openrgb_upstream_razer_coordinator_contract.cpp
@@ -79,7 +79,7 @@ hyperflux::v7::NativeRoute route(
         kind,
         number<VendorId>(0x1532),
         number<ProductId>(product_id),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
diff --git a/tests/cpp/openrgb_upstream_razer_registry_contract.cpp b/tests/cpp/openrgb_upstream_razer_registry_contract.cpp
index 43b082f..7724913 100644
--- a/tests/cpp/openrgb_upstream_razer_registry_contract.cpp
+++ b/tests/cpp/openrgb_upstream_razer_registry_contract.cpp
@@ -63,7 +63,7 @@ hyperflux::v7::NativeRoute route(
         kind,
         number<VendorId>(0x1532),
         number<ProductId>(product_id),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
@@ -287,7 +287,7 @@ int main()
     auto candidate = keyboard;
     candidate.access = NativeRouteAccess::Candidate;
     auto unavailable = mouse;
-    unavailable.route_state = RouteState::Unavailable;
+    unavailable.route_state = NativeRouteState::TemporarilyUnavailable;
     auto filtered = registry.apply_routes({candidate, unavailable});
     if(!filtered || filtered.value().removed != 2 || registry.size() != 0
        || !host.registered.empty())
diff --git a/tests/cpp/sdk_native_client_contract.cpp b/tests/cpp/sdk_native_client_contract.cpp
index 2d27a77..55bd988 100644
--- a/tests/cpp/sdk_native_client_contract.cpp
+++ b/tests/cpp/sdk_native_client_contract.cpp
@@ -79,7 +79,7 @@ hyperflux::v7::NativeRoute route()
         DeviceKind::Mouse,
         number<VendorId>(0x1532),
         number<ProductId>(0x00cd),
-        RouteState::Available,
+        NativeRouteState::Available,
         NativeRouteAccess::Qualified,
         text<NativeProtocolFamily>("razer-feature-report-v1"),
         number<NativeReportByteCount>(90),
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 34bb102..99722a4 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -41,6 +41,7 @@
     load_import_selection,
     load_imported_metadata,
     transformed_metadata,
+    verify_global_event_file_matcher,
 )
 from hfxdev.openrazer_native_route import (
     load_native_route_catalog,
@@ -75,13 +76,38 @@ def test_catalog_is_deterministic_pinned_and_network_independent(self) -> None:
         )
 
     def test_every_adapter_is_sdk_only_and_preserves_unrelated_devices(self) -> None:
+        expected_protocols = {
+            "openrazer-compatibility": [5],
+            "openrazer-native-route": [7],
+            "openrgb-native": [7],
+            "polychromatic-native": [5],
+        }
         for adapter in self.catalog["adapters"]:
             self.assertEqual(adapter["transport_access"], "sdk-only")
             self.assertEqual(adapter["unrelated_device_policy"], "preserve")
-            self.assertEqual(adapter["sdk_protocol_versions"], [5])
+            self.assertEqual(
+                adapter["sdk_protocol_versions"], expected_protocols[adapter["id"]]
+            )
             self.assertTrue(adapter["owns"])
             self.assertTrue(adapter["must_not_own"])
 
+    def test_native_routes_own_transport_while_upstreams_keep_device_semantics(self) -> None:
+        adapters = {value["id"]: value for value in self.catalog["adapters"]}
+        openrazer = adapters["openrazer-native-route"]
+        self.assertEqual(openrazer["kind"], "transport-adapter")
+        self.assertEqual(openrazer["coexistence_policy"], "upstream-transport-extension")
+        self.assertIn("native-control", openrazer["feature_families"])
+        self.assertTrue(
+            any("device commands" in value for value in openrazer["must_not_own"])
+        )
+
+        openrgb = adapters["openrgb-native"]
+        self.assertEqual(openrgb["status"], "software-verified")
+        self.assertIn("native-control", openrgb["feature_families"])
+        self.assertTrue(
+            any("device models" in value for value in openrgb["must_not_own"])
+        )
+
     def test_child_presentation_matches_one_canonical_upstream_pin(self) -> None:
         upstreams = {value["id"]: value for value in self.catalog["upstreams"]}
         for profile in load_profile_inputs(ROOT).profiles:
@@ -335,6 +361,28 @@ def test_openrazer_event_matcher_resolves_inheritance_without_execution(self) ->
             )
             self.assertEqual(effective_event_regex(path, "Child"), "root-event")
 
+    def test_openrazer_global_event_binding_is_structural_and_fail_closed(self) -> None:
+        valid = "\n".join(
+            (
+                "import os",
+                "class RazerDevice:",
+                "    def __init__(self):",
+                "        self.event_files = []",
+                "        search_dir = '/dev/input/by-id/'",
+                "        for event_file in os.listdir(search_dir):",
+                "            if self.EVENT_FILE_REGEX.match(event_file):",
+                "                self.event_files.append(os.path.join(search_dir, event_file))",
+            )
+        )
+        with TemporaryDirectory() as directory:
+            path = Path(directory) / "device_base.py"
+            path.write_text(valid, encoding="utf-8")
+            verify_global_event_file_matcher(path)
+
+            path.write_text(valid.replace("/dev/input/by-id/", "input"), encoding="utf-8")
+            with self.assertRaisesRegex(ModelError, "global event-file matcher"):
+                verify_global_event_file_matcher(path)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_verify.py b/tests/test_verify.py
index a124168..f3791e1 100644
--- a/tests/test_verify.py
+++ b/tests/test_verify.py
@@ -12,6 +12,7 @@
 from tools.hfxdev.model import ModelError
 from tools.hfxdev.verify import (
     _check_build_cache_clock,
+    _kernel_build_directories,
     _python_sdk_license_files,
     _resolve_schema_reference,
     _run_openrgb_adapter_contracts,
@@ -21,6 +22,21 @@
 
 
 class VerificationGuardTests(unittest.TestCase):
+    def test_kernel_build_directories_deduplicate_resolved_aliases(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            canonical = root / "kernel-headers"
+            canonical.mkdir()
+            (canonical / "Makefile").write_text("# fixture\n", encoding="utf-8")
+            alias = root / "kernel-headers-alias"
+            alias.symlink_to(canonical, target_is_directory=True)
+
+            with patch.dict(
+                os.environ,
+                {"HFX_KERNEL_BUILD_DIRS": os.pathsep.join((str(canonical), str(alias)))},
+            ):
+                self.assertEqual(_kernel_build_directories(), [canonical])
+
     def test_python_sdk_license_uses_the_canonical_version_neutral_root(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
diff --git a/tools/hfxdev/generators/kernel_uapi.py b/tools/hfxdev/generators/kernel_uapi.py
index 131abc0..3e5ce90 100644
--- a/tools/hfxdev/generators/kernel_uapi.py
+++ b/tools/hfxdev/generators/kernel_uapi.py
@@ -307,7 +307,7 @@ def markdown(source: KernelUapiSource) -> str:
             "",
             "## Ownership",
             "",
-            "The kernel owns receiver generations, passive observation sequencing, one writer file, session expiry, revocation, and bounded envelope transport. The bridge owns profile selection, logical-device identities, capabilities, carrier maps, effects, scheduling, and application policy.",
+            "The kernel owns receiver generations, passive observation sequencing, one writer file, session expiry, revocation, bounded legacy envelopes, and qualified fixed-size native exchanges. The bridge owns route qualification, generation-safe NativeControl arbitration, bounded admission, and outcome projection. OpenRazer and OpenRGB own device commands, capabilities, layouts, effects, and persistence.",
             "",
         ]
     )
diff --git a/tools/hfxdev/generators/readme.py b/tools/hfxdev/generators/readme.py
index 1145025..e0b82f5 100644
--- a/tools/hfxdev/generators/readme.py
+++ b/tools/hfxdev/generators/readme.py
@@ -70,16 +70,19 @@ def markdown(
 
 ```mermaid
 flowchart LR
-    Applications["Applications"] --> SDK["Versioned SDK"]
-    SDK --> Bridge["Bridge and policy authority"]
-    Bridge --> Kernel["Minimal HID transport"]
+    Applications["OpenRazer and OpenRGB"] --> SDK["Versioned native-route SDK"]
+    SDK --> Bridge["Route and exchange authority"]
+    Bridge --> Kernel["Bounded receiver transport"]
     Kernel --> Receiver["HyperFlux receiver and paired devices"]
 ```
 
-Applications own user interaction, layouts, and effects. The SDK owns the typed
-application boundary. The bridge is the sole userspace writer and owns policy,
-qualification, scheduling, restoration, and outcomes. The kernel preserves
-ordinary HID input and transports bounded generation-bound envelopes.
+Applications own model commands, settings, layouts, effects, profiles, and
+persistence. The SDK carries qualified route discovery and exact 90-byte Razer
+Feature exchanges. The bridge is the sole userspace receiver writer and owns
+route qualification, generation safety, NativeControl arbitration, bounded
+dispatch, availability, outcome certainty, and diagnostics. The kernel
+preserves ordinary HID input and transports generation-bound exchanges without
+interpreting device semantics.
 
 ## Current Readiness
 
diff --git a/tools/hfxdev/integrations.py b/tools/hfxdev/integrations.py
index f899cb4..686b35e 100644
--- a/tools/hfxdev/integrations.py
+++ b/tools/hfxdev/integrations.py
@@ -42,12 +42,18 @@
     "owns",
     "must_not_own",
 }
-ADAPTER_KINDS = {"native-plugin", "native-backend", "compatibility-service"}
+ADAPTER_KINDS = {
+    "compatibility-service",
+    "native-backend",
+    "native-plugin",
+    "transport-adapter",
+}
 ADAPTER_STATUSES = {"planned", "in-progress", "software-verified", "hardware-qualified"}
 COEXISTENCE_POLICIES = {
     "application-plugin",
     "native-backend-beside-existing",
     "private-explicit-service-only",
+    "upstream-transport-extension",
 }
 DBUS_NAME = re.compile(r"^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)+$")
 OBJECT_PATH = re.compile(r"^(/[A-Za-z_][A-Za-z0-9_]*)+$")
diff --git a/tools/hfxdev/native_onboarding.py b/tools/hfxdev/native_onboarding.py
index d342bfa..e2c2f01 100644
--- a/tools/hfxdev/native_onboarding.py
+++ b/tools/hfxdev/native_onboarding.py
@@ -200,7 +200,11 @@ def validate_route_observation(value: dict[str, Any]) -> None:
         raise ModelError("native route observation device kind is unsupported")
     if value["route_kind"] != "hyperflux-wireless":
         raise ModelError("native route observation is not receiver-backed")
-    if value["route_state"] not in {"available", "stale", "unavailable", "unknown"}:
+    if value["route_state"] not in {
+        "available",
+        "temporarily-unavailable",
+        "withdrawn",
+    }:
         raise ModelError("native route observation state is invalid")
     if value["access"] not in {"candidate", "qualified", "backend-required"}:
         raise ModelError("native route observation access is invalid")
diff --git a/tools/hfxdev/openrazer.py b/tools/hfxdev/openrazer.py
index c75965a..8dfdea3 100644
--- a/tools/hfxdev/openrazer.py
+++ b/tools/hfxdev/openrazer.py
@@ -603,6 +603,93 @@ def resolve(name: str, visited: set[str]) -> str | None:
     return result
 
 
+def verify_global_event_file_matcher(source: Path) -> None:
+    """Verify OpenRazer still binds device objects to global input events.
+
+    The HyperFlux UHID object intentionally exposes only the Feature transport.
+    Macro and ripple events therefore continue to come from the existing
+    physical input node selected by OpenRazer's global ``/dev/input/by-id``
+    scan.  Inspect the pinned source structurally so formatting-only upstream
+    changes do not invalidate the contract.
+    """
+
+    try:
+        tree = ast.parse(source.read_text(encoding="utf-8"), filename=str(source))
+    except (OSError, SyntaxError) as error:
+        raise ModelError(f"cannot parse OpenRazer event binding source: {error}") from error
+    device_class = next(
+        (
+            node
+            for node in tree.body
+            if isinstance(node, ast.ClassDef) and node.name == "RazerDevice"
+        ),
+        None,
+    )
+    initializer = next(
+        (
+            node
+            for node in getattr(device_class, "body", ())
+            if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef))
+            and node.name == "__init__"
+        ),
+        None,
+    )
+    if initializer is None:
+        raise ModelError("OpenRazer global event binding initializer is missing")
+
+    def dotted_name(node: ast.AST) -> str | None:
+        parts: list[str] = []
+        while isinstance(node, ast.Attribute):
+            parts.append(node.attr)
+            node = node.value
+        if isinstance(node, ast.Name):
+            parts.append(node.id)
+            return ".".join(reversed(parts))
+        return None
+
+    constants = {
+        node.value
+        for node in ast.walk(initializer)
+        if isinstance(node, ast.Constant) and isinstance(node.value, str)
+    }
+    calls = [node for node in ast.walk(initializer) if isinstance(node, ast.Call)]
+    has_global_scan = any(
+        dotted_name(call.func) == "os.listdir"
+        and len(call.args) == 1
+        and isinstance(call.args[0], ast.Name)
+        and call.args[0].id == "search_dir"
+        for call in calls
+    )
+    has_upstream_match = any(
+        dotted_name(call.func) == "self.EVENT_FILE_REGEX.match"
+        and len(call.args) == 1
+        and isinstance(call.args[0], ast.Name)
+        and call.args[0].id == "event_file"
+        for call in calls
+    )
+    has_global_append = any(
+        dotted_name(call.func) == "self.event_files.append"
+        and len(call.args) == 1
+        and isinstance(call.args[0], ast.Call)
+        and dotted_name(call.args[0].func) == "os.path.join"
+        and len(call.args[0].args) == 2
+        and isinstance(call.args[0].args[0], ast.Name)
+        and call.args[0].args[0].id == "search_dir"
+        and isinstance(call.args[0].args[1], ast.Name)
+        and call.args[0].args[1].id == "event_file"
+        for call in calls
+    )
+    if (
+        "/dev/input/by-id/" not in constants
+        or not has_global_scan
+        or not has_upstream_match
+        or not has_global_append
+    ):
+        raise ModelError(
+            "OpenRazer no longer binds device objects through its global event-file matcher"
+        )
+
+
 def extract_openrazer_catalog(
     source_root: Path,
     *,
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 48d8831..d8eb0d3 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -41,6 +41,7 @@
     extract_openrazer_catalog,
     load_imported_metadata,
     transformed_metadata,
+    verify_global_event_file_matcher,
 )
 from .openrazer_native_route import (
     load_native_deployment,
@@ -422,6 +423,37 @@ def _remove_expected_kernel_source_link(module_directory: Path) -> None:
         raise ModelError("kernel build left an unexpected source-tree artifact")
 
 
+def _kernel_build_directories() -> list[Path]:
+    configured = os.environ.get("HFX_KERNEL_BUILD_DIRS")
+    if configured:
+        build_directories = [Path(value) for value in configured.split(os.pathsep) if value]
+    else:
+        running = Path("/lib/modules") / os.uname().release / "build"
+        if (running / "Makefile").is_file():
+            build_directories = [running]
+        else:
+            build_directories = sorted(
+                path
+                for root_path in (Path("/lib/modules"), Path("/usr/lib/modules"))
+                if root_path.is_dir()
+                for path in root_path.glob("*/build")
+                if (path / "Makefile").is_file()
+            )
+    if not build_directories:
+        raise ModelError("kernel module verification has no configured header directory")
+    unique_build_directories: list[Path] = []
+    resolved_directories: set[Path] = set()
+    for build_directory in build_directories:
+        if not build_directory.is_absolute() or not (build_directory / "Makefile").is_file():
+            raise ModelError(f"kernel header directory is unavailable: {build_directory}")
+        resolved = build_directory.resolve()
+        if resolved in resolved_directories:
+            continue
+        resolved_directories.add(resolved)
+        unique_build_directories.append(build_directory)
+    return unique_build_directories
+
+
 def _run_kernel_profile_contracts(root: Path, node: TestNode) -> None:
     kernel_binary = root / "build" / "kernel-profile-table-smoke"
     kernel_binary.parent.mkdir(parents=True, exist_ok=True)
@@ -493,30 +525,12 @@ def _run_kernel_profile_contracts(root: Path, node: TestNode) -> None:
         node.timeout_seconds,
     )
 
-    configured = os.environ.get("HFX_KERNEL_BUILD_DIRS")
-    if configured:
-        build_directories = [Path(value) for value in configured.split(os.pathsep) if value]
-    else:
-        running = Path("/lib/modules") / os.uname().release / "build"
-        if (running / "Makefile").is_file():
-            build_directories = [running]
-        else:
-            build_directories = sorted(
-                path
-                for root_path in (Path("/lib/modules"), Path("/usr/lib/modules"))
-                if root_path.is_dir()
-                for path in root_path.glob("*/build")
-                if (path / "Makefile").is_file()
-            )
-    if not build_directories:
-        raise ModelError("kernel module verification has no configured header directory")
+    build_directories = _kernel_build_directories()
     source_directory = root / "driver" / "kernel"
     source_link = source_directory / "source"
     if source_link.exists() or source_link.is_symlink():
         raise ModelError("kernel source tree contains an unexpected build artifact")
     for build_directory in build_directories:
-        if not build_directory.is_absolute() or not (build_directory / "Makefile").is_file():
-            raise ModelError(f"kernel header directory is unavailable: {build_directory}")
         label = build_directory.resolve().parent.name
         output_directory = root / "build" / "kernel" / label
         if output_directory.exists():
@@ -646,7 +660,7 @@ def _run_openrazer_metadata_contracts(root: Path, _node: TestNode) -> None:
         )
 
 
-def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
+def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
     source = _openrazer_source(root)
     deployment = load_native_deployment(root)
     build_directory = root / "build" / "openrazer-native-route-contracts"
@@ -670,6 +684,10 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
     if (prepared.root / ".git").exists():
         raise ModelError("OpenRazer native source output copied upstream Git metadata")
 
+    verify_global_event_file_matcher(
+        source / "daemon" / "openrazer_daemon" / "hardware" / "device_base.py"
+    )
+
     route_catalog = load_native_route_catalog(root)
     if route_catalog != transformed_native_route_catalog(root, source):
         raise ModelError(
@@ -744,6 +762,47 @@ def _run_openrazer_native_route_contracts(root: Path, _node: TestNode) -> None:
         if "razer_hyperflux_error_is_uncertain(err)" not in source_text:
             raise ModelError(f"OpenRazer native {driver} can retry an uncertain transaction")
 
+    prepared_driver = prepared.root / "driver"
+    prepared_source_link = prepared_driver / "source"
+    if prepared_source_link.exists() or prepared_source_link.is_symlink():
+        raise ModelError("prepared OpenRazer source contains an unexpected build artifact")
+    kernel_output_root = root / "build" / "openrazer-native-kernel-contracts"
+    if kernel_output_root.exists():
+        shutil.rmtree(kernel_output_root)
+    for build_directory in _kernel_build_directories():
+        label = build_directory.resolve().parent.name
+        module_directory = kernel_output_root / label / "driver"
+        shutil.copytree(prepared_driver, module_directory, symlinks=True)
+        _run_command(
+            root,
+            [
+                "make",
+                "-C",
+                str(build_directory),
+                f"M={module_directory}",
+                "clean",
+            ],
+            f"OpenRazer native kernel verification copy cleanup ({label})",
+            node.timeout_seconds,
+        )
+        _remove_expected_kernel_source_link(module_directory)
+        _run_command(
+            root,
+            [
+                "make",
+                "-C",
+                str(build_directory),
+                f"M={module_directory}",
+                "W=1",
+                "modules",
+            ],
+            f"OpenRazer native kernel module build ({label})",
+            node.timeout_seconds,
+        )
+        _remove_expected_kernel_source_link(module_directory)
+        if prepared_source_link.exists() or prepared_source_link.is_symlink():
+            raise ModelError("OpenRazer verification modified its prepared source tree")
+
     service = (
         root / "packaging" / "generated" / deployment.relay.service_unit
     ).read_text(encoding="utf-8")
diff --git a/verification/tests.json b/verification/tests.json
index 05b53cb..00a4056 100644
--- a/verification/tests.json
+++ b/verification/tests.json
@@ -170,8 +170,8 @@
       "required_capabilities": ["openrazer-source"],
       "hardware_requirement": "none",
       "writes_hardware": false,
-      "expected_duration_seconds": 2,
-      "timeout_seconds": 60,
+      "expected_duration_seconds": 30,
+      "timeout_seconds": 180,
       "dependencies": ["openrazer-metadata-contracts", "rust-unit"],
       "isolation": "exclusive-process",
       "cache_inputs": [

From d70d0ecd1c2f16a4d8a62154a573e45853f03143 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 01:45:16 +0400
Subject: [PATCH 52/67] build: keep operations binaries within budget

---
 Cargo.toml                                   |  7 ++++++
 assurance/generated/hyperflux-next.spdx.json |  2 +-
 docs/generated/installation.md               |  2 +-
 docs/generated/supply-chain.md               |  2 +-
 packaging/generated/install-plan.json        |  6 ++---
 packaging/install.json                       |  4 ++--
 schemas/install-manifest.schema.json         |  2 +-
 tests/test_install.py                        | 25 ++++++++++----------
 tools/hfxdev/install.py                      |  2 +-
 9 files changed, 29 insertions(+), 23 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 8134122..2a92e1d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -23,6 +23,13 @@ unsafe_code = "deny"
 all = "deny"
 pedantic = "deny"
 
+[profile.operations]
+inherits = "release"
+codegen-units = 1
+lto = "thin"
+panic = "abort"
+strip = "symbols"
+
 [profile.relay]
 inherits = "release"
 codegen-units = 1
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 81a571f..c28f78e 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/0115160d1f0205a27c83807c23c139f4a39882a73bca9bd48d2cb2d88da82112",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/ed5da28eb8ace3468707af05fdb8abe79c22544786b46b0527e46f5a3653a4f6",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index ba6d3d2..41e42f6 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical manifest digest: `3bc579591d6c7b722cf28bf6dbffe6246f31e86068d4c3b593ab60bfca47edd3`.
+Canonical manifest digest: `a569e731ee83bb7eb8adba97d0e90868d97977a57a8672710c0ce24176a727ee`.
 
 Package: `hyperflux-next-linux` `0.0.0-dev.1` release `1`.
 
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index ee4fcdc..0ad7fe5 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `0115160d1f0205a27c83807c23c139f4a39882a73bca9bd48d2cb2d88da82112`
+- Authority SHA-256: `ed5da28eb8ace3468707af05fdb8abe79c22544786b46b0527e46f5a3653a4f6`
 
 ## License Policy
 
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 2176d34..f8ad2df 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -1,6 +1,6 @@
 {
   "schema": "hyperflux-compiled-install-plan-v1",
-  "install_manifest_sha256": "3bc579591d6c7b722cf28bf6dbffe6246f31e86068d4c3b593ab60bfca47edd3",
+  "install_manifest_sha256": "a569e731ee83bb7eb8adba97d0e90868d97977a57a8672710c0ce24176a727ee",
   "product": {
     "name": "hyperflux-next-linux",
     "version": "0.0.0-dev.1",
@@ -29,7 +29,7 @@
       "required": true,
       "package": "hfx-ops",
       "target": "hyperfluxctl",
-      "profile": "release",
+      "profile": "operations",
       "destination": "/usr/bin/hyperfluxctl",
       "mode": "0755"
     },
@@ -39,7 +39,7 @@
       "required": true,
       "package": "hfx-ops",
       "target": "hyperflux-next-activate",
-      "profile": "release",
+      "profile": "operations",
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-activate",
       "mode": "0755"
     },
diff --git a/packaging/install.json b/packaging/install.json
index 6ec103c..9e078fd 100644
--- a/packaging/install.json
+++ b/packaging/install.json
@@ -23,7 +23,7 @@
       "kind": "cargo-binary",
       "package": "hfx-ops",
       "target": "hyperfluxctl",
-      "profile": "release",
+      "profile": "operations",
       "destination": "@operations_cli_path@",
       "mode": "0755",
       "required": true
@@ -33,7 +33,7 @@
       "kind": "cargo-binary",
       "package": "hfx-ops",
       "target": "hyperflux-next-activate",
-      "profile": "release",
+      "profile": "operations",
       "destination": "@activation_utility_path@",
       "mode": "0755",
       "required": true
diff --git a/schemas/install-manifest.schema.json b/schemas/install-manifest.schema.json
index f0cefa3..a2614a4 100644
--- a/schemas/install-manifest.schema.json
+++ b/schemas/install-manifest.schema.json
@@ -74,7 +74,7 @@
         "kind": {"const": "cargo-binary"},
         "package": {"$ref": "#/$defs/identifier"},
         "target": {"$ref": "#/$defs/identifier"},
-        "profile": {"enum": ["release", "relay"]},
+        "profile": {"enum": ["release", "operations", "relay"]},
         "destination": {"$ref": "#/$defs/destination"},
         "mode": {"const": "0755"},
         "required": {"const": true}
diff --git a/tests/test_install.py b/tests/test_install.py
index 40813f5..af4a28c 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -65,7 +65,7 @@ def test_runtime_destinations_and_dkms_source_are_derived(self) -> None:
         self.assertIn(f"{source_directory}/dkms.conf", destinations)
         self.assertIn(f"{source_directory}/hyperflux-next-core.c", destinations)
 
-    def test_only_the_feature_relay_uses_the_thin_process_profile(self) -> None:
+    def test_rust_installables_use_role_specific_release_profiles(self) -> None:
         cargo_profiles = {
             build.id: build.cargo_profile
             for build in self.manifest.builds
@@ -75,22 +75,21 @@ def test_only_the_feature_relay_uses_the_thin_process_profile(self) -> None:
             cargo_profiles,
             {
                 "bridge-daemon": "release",
-                "operations-cli": "release",
-                "activation-utility": "release",
+                "operations-cli": "operations",
+                "activation-utility": "operations",
                 "openrazer-native-relay": "relay",
             },
         )
         cargo = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
-        self.assertEqual(
-            cargo["profile"]["relay"],
-            {
-                "inherits": "release",
-                "codegen-units": 1,
-                "lto": "thin",
-                "panic": "abort",
-                "strip": "symbols",
-            },
-        )
+        optimized = {
+            "inherits": "release",
+            "codegen-units": 1,
+            "lto": "thin",
+            "panic": "abort",
+            "strip": "symbols",
+        }
+        self.assertEqual(cargo["profile"]["operations"], optimized)
+        self.assertEqual(cargo["profile"]["relay"], optimized)
 
     def test_python_sdk_license_is_generated_from_repository_authority(self) -> None:
         self.assertEqual(
diff --git a/tools/hfxdev/install.py b/tools/hfxdev/install.py
index d770079..a25ceb0 100644
--- a/tools/hfxdev/install.py
+++ b/tools/hfxdev/install.py
@@ -29,7 +29,7 @@
     "mode",
     "required",
 }
-CARGO_PROFILES = {"release", "relay"}
+CARGO_PROFILES = {"operations", "release", "relay"}
 CMAKE_KEYS = {
     "id",
     "kind",

From c21ddd7ceee97b5cb80587937c448cc5c7ac0303 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 08:16:50 +0400
Subject: [PATCH 53/67] Fix native relay module preflight ordering

---
 docs/generated/openrazer-native-deployment.md         |  2 +-
 .../generated/hyperflux-next-openrazer-relay.service  |  1 -
 tests/test_integrations.py                            | 10 ++++++++++
 tools/hfxdev/generators/openrazer_native.py           |  7 +++----
 tools/hfxdev/verify.py                                | 11 +++++++++--
 5 files changed, 23 insertions(+), 8 deletions(-)

diff --git a/docs/generated/openrazer-native-deployment.md b/docs/generated/openrazer-native-deployment.md
index a012eaa..edf7512 100644
--- a/docs/generated/openrazer-native-deployment.md
+++ b/docs/generated/openrazer-native-deployment.md
@@ -13,7 +13,7 @@ Canonical deployment digest: `8940c61d14a234049e1226d046b0ba41745d5ae69c387ba0c8
 | Bridge socket | `/run/hyperflux-next/bridge.sock` |
 | Exclusive kernel interface | `/dev/uhid` |
 
-The static relay service is pulled in by the bridge service. It runs as root only because `/dev/uhid` remains unavailable to ordinary users, drops every Linux capability, and can access only the bridge socket and UHID device. A read-only preflight refuses to create virtual endpoints while an older transformed driver module remains loaded.
+The static relay service is pulled in by the bridge service. It runs as root only because `/dev/uhid` remains unavailable to ordinary users, drops every Linux capability, and can access only the bridge socket and UHID device. The bridge's start-preparation unit performs the read-only transformed-driver preflight before this sealed relay namespace is entered.
 
 ## OpenRazer Driver Replacement
 
diff --git a/packaging/generated/hyperflux-next-openrazer-relay.service b/packaging/generated/hyperflux-next-openrazer-relay.service
index 4488907..557a754 100644
--- a/packaging/generated/hyperflux-next-openrazer-relay.service
+++ b/packaging/generated/hyperflux-next-openrazer-relay.service
@@ -11,7 +11,6 @@ ConditionPathExists=/dev/uhid
 Type=simple
 User=root
 Group=root
-ExecStartPre=/usr/lib/hyperflux-next/hyperflux-next-activate check-openrazer-driver
 ExecStart=/usr/lib/hyperflux-next/hyperflux-next-uhid-relay --socket /run/hyperflux-next/bridge.sock --uhid /dev/uhid
 UMask=0077
 Restart=on-failure
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 99722a4..0dcb8f0 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -48,6 +48,9 @@
     transformed_native_route_catalog,
 )
 from hfxdev.generators.integrations import python_openrazer_metadata
+from hfxdev.generators.openrazer_native import relay_service
+from hfxdev.linux_runtime import load_linux_runtime
+from hfxdev.openrazer_native_route import load_native_deployment
 from hfxdev.profiles import load_profile_inputs
 
 
@@ -263,6 +266,13 @@ def test_openrazer_native_route_catalog_is_fully_authority_bound(self) -> None:
             direct = probes_by_profile[route["profile_id"]]["direct_usb_reference"]
             self.assertEqual(route["direct_data_product_ids"], [direct["product_id"]])
 
+    def test_openrazer_relay_keeps_module_preflight_outside_its_sealed_namespace(self) -> None:
+        runtime = load_linux_runtime(ROOT)
+        service = relay_service(load_native_deployment(ROOT), runtime)
+        self.assertIn(f"Requires={runtime.bridge.service_unit}", service)
+        self.assertIn("ProtectKernelModules=yes", service)
+        self.assertNotIn("ExecStartPre=", service)
+
     def test_openrazer_native_route_catalog_matches_exact_checkout_when_available(self) -> None:
         source_value = os.environ.get("HFX_OPENRAZER_SOURCE_DIR")
         if source_value is None:
diff --git a/tools/hfxdev/generators/openrazer_native.py b/tools/hfxdev/generators/openrazer_native.py
index b21c344..ebd62c8 100644
--- a/tools/hfxdev/generators/openrazer_native.py
+++ b/tools/hfxdev/generators/openrazer_native.py
@@ -49,7 +49,6 @@ def relay_service(
             "Type=simple",
             "User=root",
             "Group=root",
-            f"ExecStartPre={runtime.operations.activation_path} check-openrazer-driver",
             f"ExecStart={relay.executable_path} --socket {bridge.socket_path} "
             f"--uhid {relay.uhid_device}",
             "UMask=0077",
@@ -111,9 +110,9 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
             "",
             "The static relay service is pulled in by the bridge service. It runs as root only "
             "because `/dev/uhid` remains unavailable to ordinary users, drops every Linux "
-            "capability, and can access only the bridge socket and UHID device. A read-only "
-            "preflight refuses to create virtual endpoints while an older transformed driver "
-            "module remains loaded.",
+            "capability, and can access only the bridge socket and UHID device. The bridge's "
+            "start-preparation unit performs the read-only transformed-driver preflight before "
+            "this sealed relay namespace is entered.",
             "",
             "## OpenRazer Driver Replacement",
             "",
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index d8eb0d3..da1b443 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -814,10 +814,14 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
         "DevicePolicy=closed",
         f"DeviceAllow={deployment.relay.uhid_device} rw",
         f"PartOf={runtime.bridge.service_unit}",
-        f"ExecStartPre={runtime.operations.activation_path} check-openrazer-driver",
+        "ProtectKernelModules=yes",
     )
     if any(marker not in service for marker in required_service):
         raise ModelError("OpenRazer native relay service sandbox is incomplete")
+    if "ExecStartPre=" in service:
+        raise ModelError(
+            "OpenRazer native relay repeats module inspection inside its sealed namespace"
+        )
     if "PrivateDevices=yes" in service or "SupplementaryGroups=" in service:
         raise ModelError("OpenRazer native relay exposes a broader device boundary")
     rust_deployment = (
@@ -841,8 +845,11 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
     if (
         deployment.relay.service_unit not in bridge_service
         or f"Before=" not in bridge_service
+        or f"Requires={runtime.operations.activation_service_unit}" not in bridge_service
     ):
-        raise ModelError("bridge lifecycle does not pull in the OpenRazer native relay")
+        raise ModelError(
+            "bridge lifecycle does not order activation before the OpenRazer native relay"
+        )
     install = load_install_manifest(root)
     if (
         install.build("openrazer-native-driver").destination

From f9d4598999d2db0091859b24d60b26ff3bba0ff7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 10:17:29 +0400
Subject: [PATCH 54/67] feat(native): add bounded read-only parity qualifier

---
 Cargo.lock                                    |   3 +
 assurance/generated/hyperflux-next.spdx.json  |  17 +-
 crates/hfx-uhid-relay/Cargo.toml              |   7 +
 crates/hfx-uhid-relay/src/catalog.rs          | 462 +++++++++---
 crates/hfx-uhid-relay/src/lib.rs              |  10 +-
 crates/hfx-uhid-relay/src/qualification.rs    | 376 +++++++++
 .../src/qualification_runtime.rs              | 714 ++++++++++++++++++
 crates/hfx-uhid-relay/src/qualifier_main.rs   | 181 +++++
 crates/hfx-uhid-relay/src/runtime.rs          |  60 +-
 docs/generated/installation.md                |   5 +-
 docs/generated/supply-chain.md                |   2 +-
 packaging/generated/install-plan.json         |  12 +-
 packaging/install.json                        |  10 +
 tests/test_install.py                         |   1 +
 tests/test_native_live_parity.py              | 255 +++++++
 tests/test_package_pipeline.py                |   2 +-
 tools/hfxdev/cli.py                           |  35 +
 tools/hfxdev/native_live_parity.py            | 521 +++++++++++++
 tools/hfxdev/native_parity.py                 | 277 +++++++
 19 files changed, 2791 insertions(+), 159 deletions(-)
 create mode 100644 crates/hfx-uhid-relay/src/qualification.rs
 create mode 100644 crates/hfx-uhid-relay/src/qualification_runtime.rs
 create mode 100644 crates/hfx-uhid-relay/src/qualifier_main.rs
 create mode 100644 tests/test_native_live_parity.py
 create mode 100644 tools/hfxdev/native_live_parity.py

diff --git a/Cargo.lock b/Cargo.lock
index f7870d5..3a01cff 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -223,7 +223,10 @@ dependencies = [
 name = "hfx-uhid-relay"
 version = "0.0.0-dev.1"
 dependencies = [
+ "hfx-daemon",
  "hfx-domain",
+ "hfx-kernel-transport",
+ "hfx-profiles",
  "hfx-protocol",
  "hfx-runtime",
  "hfx-sdk",
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index c28f78e..5e3accd 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/ed5da28eb8ace3468707af05fdb8abe79c22544786b46b0527e46f5a3653a4f6",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/28d7686f8ab617943f82bca2e058891c70608adbbbaf6dd0c1f09fb8c4257e9c",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
@@ -1595,11 +1595,26 @@
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Cargo-sha2-0.11.0"
     },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-daemon-0.0.0-dev.1"
+    },
     {
       "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
       "relationshipType": "DEPENDS_ON",
       "relatedSpdxElement": "SPDXRef-Cargo-hfx-domain-0.0.0-dev.1"
     },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-kernel-transport-0.0.0-dev.1"
+    },
+    {
+      "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
+      "relationshipType": "DEPENDS_ON",
+      "relatedSpdxElement": "SPDXRef-Cargo-hfx-profiles-0.0.0-dev.1"
+    },
     {
       "spdxElementId": "SPDXRef-Cargo-hfx-uhid-relay-0.0.0-dev.1",
       "relationshipType": "DEPENDS_ON",
diff --git a/crates/hfx-uhid-relay/Cargo.toml b/crates/hfx-uhid-relay/Cargo.toml
index 1989ea7..25917b1 100644
--- a/crates/hfx-uhid-relay/Cargo.toml
+++ b/crates/hfx-uhid-relay/Cargo.toml
@@ -8,6 +8,9 @@ publish.workspace = true
 
 [dependencies]
 hfx-domain = { path = "../hfx-domain" }
+hfx-daemon = { path = "../hfx-daemon" }
+hfx-kernel-transport = { path = "../hfx-kernel-transport" }
+hfx-profiles = { path = "../hfx-profiles" }
 hfx-protocol = { path = "../hfx-protocol" }
 hfx-runtime = { path = "../hfx-runtime" }
 hfx-sdk = { path = "../hfx-sdk" }
@@ -23,3 +26,7 @@ workspace = true
 [[bin]]
 name = "hyperflux-next-uhid-relay"
 path = "src/main.rs"
+
+[[bin]]
+name = "hyperflux-next-native-qualifier"
+path = "src/qualifier_main.rs"
diff --git a/crates/hfx-uhid-relay/src/catalog.rs b/crates/hfx-uhid-relay/src/catalog.rs
index 0abdc81..5036058 100644
--- a/crates/hfx-uhid-relay/src/catalog.rs
+++ b/crates/hfx-uhid-relay/src/catalog.rs
@@ -33,6 +33,43 @@ pub struct NativeRouteRecord {
     pub direct_data_product_ids: Vec<ProductId>,
     pub event_file_regex: String,
     pub serial_query: SerialQuerySpec,
+    pub qualification_probes: Vec<NativeQualificationProbe>,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct NativeQualificationProbe {
+    pub method: String,
+    pub privacy: String,
+    pub attribute: String,
+    pub response_summary: String,
+    pub comparison: String,
+    pub command_class: u8,
+    pub command_id: u8,
+    pub data_size: u8,
+    pub arguments: Vec<u8>,
+    pub normalized_sha256: String,
+}
+
+impl NativeQualificationProbe {
+    #[must_use]
+    pub fn matches(&self, report: &[u8; 90]) -> bool {
+        if report[0] != 0
+            || report[1] == 0
+            || report[2] != 0
+            || report[3] != 0
+            || report[4] != 0
+            || report[5] != self.data_size
+            || report[6] != self.command_class
+            || report[7] != self.command_id
+            || report[89] != 0
+            || report[88] != report_crc(report)
+        {
+            return false;
+        }
+        let argument_count = usize::from(self.data_size);
+        report[8..8 + argument_count] == self.arguments
+            && report[8 + argument_count..88].iter().all(|byte| *byte == 0)
+    }
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -41,6 +78,7 @@ pub struct NativeRouteCatalog {
     protocol_family: NativeProtocolFamily,
     descriptor: Vec<u8>,
     phys_prefix: String,
+    qualification_maximum_attempts: u8,
     routes: Vec<NativeRouteRecord>,
 }
 
@@ -65,7 +103,7 @@ impl fmt::Display for NativeRouteCatalogError {
             Self::InvalidRoute => "OpenRazer native route is invalid",
             Self::DuplicateRoute => "OpenRazer native route identity is duplicated",
             Self::ProbeCatalogDrift => {
-                "OpenRazer serial probe no longer matches the native-route catalog"
+                "OpenRazer qualification probes no longer match the native-route catalog"
             }
         })
     }
@@ -182,10 +220,10 @@ struct ProbeRequestDocument {
     crc_recomputed_by_upstream: bool,
 }
 
-struct BoundSerialProbe {
+struct BoundProbeDevice {
     wireless_identity: ProbeIdentityDocument,
     direct_usb_reference: ProbeIdentityDocument,
-    query: SerialQuerySpec,
+    probes: Vec<NativeQualificationProbe>,
 }
 
 impl NativeRouteCatalog {
@@ -195,101 +233,17 @@ impl NativeRouteCatalog {
     ///
     /// Fails closed when metadata, transport, or route identity drifts.
     pub fn load() -> Result<Self, NativeRouteCatalogError> {
-        let document: CatalogDocument =
-            serde_json::from_str(CATALOG_JSON).map_err(|_| NativeRouteCatalogError::InvalidJson)?;
-        if document.schema != EXPECTED_SCHEMA
-            || document.schema_ref != "../../../schemas/openrazer-native-route-catalog.schema.json"
-            || document.upstream_commit.len() != 40
-        {
-            return Err(NativeRouteCatalogError::InvalidSchema);
-        }
-        let metadata_digest = hex_sha256(METADATA_JSON.as_bytes());
-        if document.metadata_sha256 != metadata_digest {
-            return Err(NativeRouteCatalogError::MetadataDrift);
-        }
-        let descriptor = decode_hex(&document.transport.descriptor_hex)
-            .ok_or(NativeRouteCatalogError::InvalidTransport)?;
-        if document.transport.report_bytes != 90
-            || descriptor != EXPECTED_DESCRIPTOR
-            || document.transport.descriptor_sha256 != hex_sha256(&descriptor)
-            || document.transport.phys_prefix != "hyperflux-next/native/v1/"
-        {
-            return Err(NativeRouteCatalogError::InvalidTransport);
-        }
-        let protocol_family = NativeProtocolFamily::try_from(document.transport.protocol_family)
-            .map_err(|_| NativeRouteCatalogError::InvalidTransport)?;
-        let serial_probes = load_serial_probes(&document.upstream_commit)?;
-        let mut identities = BTreeSet::new();
-        let mut profiles = BTreeSet::new();
-        let mut routes = Vec::with_capacity(document.routes.len());
-        for route in document.routes {
-            let device_kind = match route.device_kind.as_str() {
-                "mouse" if route.driver_family == "razermouse" => DeviceKind::Mouse,
-                "keyboard" if route.driver_family == "razerkbd" => DeviceKind::Keyboard,
-                _ => return Err(NativeRouteCatalogError::InvalidRoute),
-            };
-            if route.profile_id.is_empty()
-                || route.model_name.is_empty()
-                || route.model_name.len() >= 128
-                || route.source.path.is_empty()
-                || route.source.class_name.is_empty()
-                || route.source.sha256.len() != 64
-                || route.direct_data_product_ids.is_empty()
-                || route.event_file_regex.is_empty()
-            {
-                return Err(NativeRouteCatalogError::InvalidRoute);
-            }
-            if !identities.insert((route.vendor_id, route.wireless_product_id, device_kind))
-                || !profiles.insert(route.profile_id.clone())
-            {
-                return Err(NativeRouteCatalogError::DuplicateRoute);
-            }
-            let vendor_id = VendorId::try_from(route.vendor_id)
-                .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
-            let wireless_product_id = ProductId::try_from(route.wireless_product_id)
-                .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
-            let direct_data_product_ids = route
-                .direct_data_product_ids
-                .iter()
-                .copied()
-                .map(|product| {
-                    ProductId::try_from(product).map_err(|_| NativeRouteCatalogError::InvalidRoute)
-                })
-                .collect::<Result<Vec<_>, _>>()?;
-            let serial_probe = serial_probes
-                .get(&route.profile_id)
-                .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
-            validate_probe_identity(&route, device_kind, &direct_data_product_ids, serial_probe)?;
-            routes.push(NativeRouteRecord {
-                profile_id: route.profile_id,
-                vendor_id,
-                wireless_product_id,
-                model_name: route.model_name,
-                device_kind,
-                driver_family: route.driver_family,
-                source_path: route.source.path,
-                source_class: route.source.class_name,
-                source_sha256: route.source.sha256,
-                direct_data_product_ids,
-                event_file_regex: route.event_file_regex,
-                serial_query: serial_probe.query.clone(),
-            });
-        }
-        if routes.len() != serial_probes.len() {
-            return Err(NativeRouteCatalogError::ProbeCatalogDrift);
-        }
-        routes.sort_by_key(|route| {
-            (
-                route.vendor_id,
-                route.wireless_product_id,
-                route.device_kind,
-            )
-        });
+        let document = load_catalog_document()?;
+        let (descriptor, protocol_family) = validate_transport(&document.transport)?;
+        let (bound_probes, qualification_maximum_attempts) =
+            load_qualification_probes(&document.upstream_commit)?;
+        let routes = bind_routes(document.routes, &bound_probes)?;
         Ok(Self {
             upstream_commit: document.upstream_commit,
             protocol_family,
             descriptor,
             phys_prefix: document.transport.phys_prefix,
+            qualification_maximum_attempts,
             routes,
         })
     }
@@ -313,6 +267,13 @@ impl NativeRouteCatalog {
         &self.routes
     }
 
+    #[must_use]
+    pub fn profile(&self, profile_id: &str) -> Option<&NativeRouteRecord> {
+        self.routes
+            .iter()
+            .find(|route| route.profile_id == profile_id)
+    }
+
     #[must_use]
     pub fn descriptor(&self) -> &[u8] {
         &self.descriptor
@@ -332,11 +293,147 @@ impl NativeRouteCatalog {
     pub fn upstream_commit(&self) -> &str {
         &self.upstream_commit
     }
+
+    #[must_use]
+    pub const fn qualification_maximum_attempts(&self) -> u8 {
+        self.qualification_maximum_attempts
+    }
+}
+
+fn load_catalog_document() -> Result<CatalogDocument, NativeRouteCatalogError> {
+    let document: CatalogDocument =
+        serde_json::from_str(CATALOG_JSON).map_err(|_| NativeRouteCatalogError::InvalidJson)?;
+    if document.schema != EXPECTED_SCHEMA
+        || document.schema_ref != "../../../schemas/openrazer-native-route-catalog.schema.json"
+        || document.upstream_commit.len() != 40
+    {
+        return Err(NativeRouteCatalogError::InvalidSchema);
+    }
+    if document.metadata_sha256 != hex_sha256(METADATA_JSON.as_bytes()) {
+        return Err(NativeRouteCatalogError::MetadataDrift);
+    }
+    Ok(document)
+}
+
+fn validate_transport(
+    transport: &TransportDocument,
+) -> Result<(Vec<u8>, NativeProtocolFamily), NativeRouteCatalogError> {
+    let descriptor =
+        decode_hex(&transport.descriptor_hex).ok_or(NativeRouteCatalogError::InvalidTransport)?;
+    if transport.report_bytes != 90
+        || descriptor != EXPECTED_DESCRIPTOR
+        || transport.descriptor_sha256 != hex_sha256(&descriptor)
+        || transport.phys_prefix != "hyperflux-next/native/v1/"
+    {
+        return Err(NativeRouteCatalogError::InvalidTransport);
+    }
+    let protocol_family = NativeProtocolFamily::try_from(transport.protocol_family.clone())
+        .map_err(|_| NativeRouteCatalogError::InvalidTransport)?;
+    Ok((descriptor, protocol_family))
 }
 
-fn load_serial_probes(
+fn bind_routes(
+    route_documents: Vec<RouteDocument>,
+    bound_probes: &BTreeMap<String, BoundProbeDevice>,
+) -> Result<Vec<NativeRouteRecord>, NativeRouteCatalogError> {
+    let mut identities = BTreeSet::new();
+    let mut profiles = BTreeSet::new();
+    let mut routes = Vec::with_capacity(route_documents.len());
+    for route in route_documents {
+        let device_kind = route_device_kind(&route)?;
+        if !identities.insert((route.vendor_id, route.wireless_product_id, device_kind))
+            || !profiles.insert(route.profile_id.clone())
+        {
+            return Err(NativeRouteCatalogError::DuplicateRoute);
+        }
+        let bound = bound_probes
+            .get(&route.profile_id)
+            .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
+        routes.push(bind_route(route, device_kind, bound)?);
+    }
+    if routes.len() != bound_probes.len() {
+        return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+    }
+    routes.sort_by_key(|route| {
+        (
+            route.vendor_id,
+            route.wireless_product_id,
+            route.device_kind,
+        )
+    });
+    Ok(routes)
+}
+
+fn route_device_kind(route: &RouteDocument) -> Result<DeviceKind, NativeRouteCatalogError> {
+    match route.device_kind.as_str() {
+        "mouse" if route.driver_family == "razermouse" => Ok(DeviceKind::Mouse),
+        "keyboard" if route.driver_family == "razerkbd" => Ok(DeviceKind::Keyboard),
+        _ => Err(NativeRouteCatalogError::InvalidRoute),
+    }
+}
+
+fn bind_route(
+    route: RouteDocument,
+    device_kind: DeviceKind,
+    bound: &BoundProbeDevice,
+) -> Result<NativeRouteRecord, NativeRouteCatalogError> {
+    if route.profile_id.is_empty()
+        || route.model_name.is_empty()
+        || route.model_name.len() >= 128
+        || route.source.path.is_empty()
+        || route.source.class_name.is_empty()
+        || route.source.sha256.len() != 64
+        || route.direct_data_product_ids.is_empty()
+        || route.event_file_regex.is_empty()
+    {
+        return Err(NativeRouteCatalogError::InvalidRoute);
+    }
+    let vendor_id =
+        VendorId::try_from(route.vendor_id).map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
+    let wireless_product_id = ProductId::try_from(route.wireless_product_id)
+        .map_err(|_| NativeRouteCatalogError::InvalidRoute)?;
+    let direct_data_product_ids = route
+        .direct_data_product_ids
+        .iter()
+        .copied()
+        .map(|product| {
+            ProductId::try_from(product).map_err(|_| NativeRouteCatalogError::InvalidRoute)
+        })
+        .collect::<Result<Vec<_>, _>>()?;
+    validate_probe_identity(&route, device_kind, &direct_data_product_ids, bound)?;
+    let serial = bound
+        .probes
+        .iter()
+        .find(|probe| probe.method == "get_serial")
+        .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
+    let serial_query = SerialQuerySpec::new(
+        serial.command_class,
+        serial.command_id,
+        serial.data_size,
+        serial.arguments.clone(),
+        serial.normalized_sha256.clone(),
+    )
+    .map_err(|_| NativeRouteCatalogError::ProbeCatalogDrift)?;
+    Ok(NativeRouteRecord {
+        profile_id: route.profile_id,
+        vendor_id,
+        wireless_product_id,
+        model_name: route.model_name,
+        device_kind,
+        driver_family: route.driver_family,
+        source_path: route.source.path,
+        source_class: route.source.class_name,
+        source_sha256: route.source.sha256,
+        direct_data_product_ids,
+        event_file_regex: route.event_file_regex,
+        serial_query,
+        qualification_probes: bound.probes.clone(),
+    })
+}
+
+fn load_qualification_probes(
     expected_commit: &str,
-) -> Result<BTreeMap<String, BoundSerialProbe>, NativeRouteCatalogError> {
+) -> Result<(BTreeMap<String, BoundProbeDevice>, u8), NativeRouteCatalogError> {
     let document: ProbeCatalogDocument = serde_json::from_str(PROBE_CATALOG_JSON)
         .map_err(|_| NativeRouteCatalogError::InvalidJson)?;
     if document.schema != EXPECTED_PROBE_SCHEMA
@@ -347,42 +444,83 @@ fn load_serial_probes(
     {
         return Err(NativeRouteCatalogError::ProbeCatalogDrift);
     }
-    let mut probes = BTreeMap::new();
+    let mut devices = BTreeMap::new();
     for device in document.devices {
-        let mut serials = device
-            .probes
-            .into_iter()
-            .filter(|probe| probe.method == "get_serial");
-        let serial = serials
-            .next()
-            .ok_or(NativeRouteCatalogError::ProbeCatalogDrift)?;
-        if serials.next().is_some()
-            || serial.privacy != "redacted-equality-only"
-            || serial.driver.attribute != "device_serial"
-            || serial.driver.reader != "razer_attr_read_device_serial"
-            || serial.driver.request_owner != "razer_attr_read_device_serial"
-            || serial.response_summary != "redacted-serial-equality"
-            || serial.comparison != "redacted-equality"
-            || !serial.request.transaction_id_from_upstream
-            || !serial.request.crc_recomputed_by_upstream
+        let mut methods = BTreeSet::new();
+        let mut attributes = BTreeSet::new();
+        let mut qualification_probes = Vec::with_capacity(device.probes.len());
+        for probe in device.probes {
+            if probe.method.is_empty()
+                || probe.method.len() > 128
+                || !methods.insert(probe.method.clone())
+                || probe.privacy.is_empty()
+                || probe.driver.attribute.is_empty()
+                || !attributes.insert(probe.driver.attribute.clone())
+                || probe.driver.reader.is_empty()
+                || probe.driver.request_owner.is_empty()
+                || probe.response_summary.is_empty()
+                || !matches!(
+                    probe.comparison.as_str(),
+                    "exact-semantic" | "domain-valid" | "redacted-equality"
+                )
+                || probe.request.command_id < 0x80
+                || usize::from(probe.request.data_size) != probe.request.arguments.len()
+                || probe.request.data_size > 80
+                || probe.request.normalized_sha256.len() != 64
+                || !probe
+                    .request
+                    .normalized_sha256
+                    .bytes()
+                    .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+                || !probe.request.transaction_id_from_upstream
+                || !probe.request.crc_recomputed_by_upstream
+            {
+                return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+            }
+            let mut normalized = [0_u8; 90];
+            normalized[5] = probe.request.data_size;
+            normalized[6] = probe.request.command_class;
+            normalized[7] = probe.request.command_id;
+            normalized[8..8 + probe.request.arguments.len()]
+                .copy_from_slice(&probe.request.arguments);
+            if probe.request.normalized_sha256 != hex_sha256(&normalized) {
+                return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+            }
+            qualification_probes.push(NativeQualificationProbe {
+                method: probe.method,
+                privacy: probe.privacy,
+                attribute: probe.driver.attribute,
+                response_summary: probe.response_summary,
+                comparison: probe.comparison,
+                command_class: probe.request.command_class,
+                command_id: probe.request.command_id,
+                data_size: probe.request.data_size,
+                arguments: probe.request.arguments,
+                normalized_sha256: probe.request.normalized_sha256,
+            });
+        }
+        if qualification_probes.is_empty() {
+            return Err(NativeRouteCatalogError::ProbeCatalogDrift);
+        }
+        let serials = qualification_probes
+            .iter()
+            .filter(|probe| probe.method == "get_serial")
+            .collect::<Vec<_>>();
+        if serials.len() != 1
+            || serials[0].privacy != "redacted-equality-only"
+            || serials[0].attribute != "device_serial"
+            || serials[0].response_summary != "redacted-serial-equality"
+            || serials[0].comparison != "redacted-equality"
         {
             return Err(NativeRouteCatalogError::ProbeCatalogDrift);
         }
-        let query = SerialQuerySpec::new(
-            serial.request.command_class,
-            serial.request.command_id,
-            serial.request.data_size,
-            serial.request.arguments,
-            serial.request.normalized_sha256,
-        )
-        .map_err(|_| NativeRouteCatalogError::ProbeCatalogDrift)?;
-        if probes
+        if devices
             .insert(
                 device.profile_id,
-                BoundSerialProbe {
+                BoundProbeDevice {
                     wireless_identity: device.wireless_identity,
                     direct_usb_reference: device.direct_usb_reference,
-                    query,
+                    probes: qualification_probes,
                 },
             )
             .is_some()
@@ -390,14 +528,14 @@ fn load_serial_probes(
             return Err(NativeRouteCatalogError::ProbeCatalogDrift);
         }
     }
-    Ok(probes)
+    Ok((devices, document.busy_retry.maximum_attempts))
 }
 
 fn validate_probe_identity(
     route: &RouteDocument,
     device_kind: DeviceKind,
     direct_products: &[ProductId],
-    probe: &BoundSerialProbe,
+    probe: &BoundProbeDevice,
 ) -> Result<(), NativeRouteCatalogError> {
     let expected_kind = match device_kind {
         DeviceKind::Mouse => "mouse",
@@ -424,6 +562,12 @@ fn validate_probe_identity(
     Ok(())
 }
 
+fn report_crc(report: &[u8; 90]) -> u8 {
+    report[2..88]
+        .iter()
+        .fold(0_u8, |checksum, byte| checksum ^ byte)
+}
+
 fn decode_hex(value: &str) -> Option<Vec<u8>> {
     if !value.len().is_multiple_of(2) || !value.bytes().all(|byte| byte.is_ascii_hexdigit()) {
         return None;
@@ -456,3 +600,71 @@ fn hex_sha256(value: &[u8]) -> String {
     }
     output
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn upstream_request(probe: &NativeQualificationProbe, transaction_id: u8) -> [u8; 90] {
+        let mut report = [0_u8; 90];
+        report[1] = transaction_id;
+        report[5] = probe.data_size;
+        report[6] = probe.command_class;
+        report[7] = probe.command_id;
+        report[8..8 + probe.arguments.len()].copy_from_slice(&probe.arguments);
+        report[88] = report_crc(&report);
+        report
+    }
+
+    #[test]
+    fn generated_catalog_exposes_every_bounded_read_probe() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let mouse = catalog
+            .profile("child.razer.basilisk-v3-pro-35k.00cd")
+            .expect("mouse exists");
+        let keyboard = catalog
+            .profile("child.razer.deathstalker-v2-pro-tkl.0296")
+            .expect("keyboard exists");
+        assert_eq!(mouse.qualification_probes.len(), 16);
+        assert_eq!(keyboard.qualification_probes.len(), 9);
+        assert!(
+            mouse
+                .qualification_probes
+                .iter()
+                .all(|probe| probe.command_id >= 0x80)
+        );
+        assert!(
+            keyboard
+                .qualification_probes
+                .iter()
+                .all(|probe| probe.command_id >= 0x80)
+        );
+    }
+
+    #[test]
+    fn matcher_accepts_only_the_exact_upstream_read_signature() {
+        let catalog = NativeRouteCatalog::load().expect("catalog loads");
+        let probe = &catalog.routes()[0].qualification_probes[0];
+        let request = upstream_request(probe, 0x1f);
+        assert!(probe.matches(&request));
+
+        let mut zero_transaction = request;
+        zero_transaction[1] = 0;
+        zero_transaction[88] = report_crc(&zero_transaction);
+        assert!(!probe.matches(&zero_transaction));
+
+        let mut changed_argument = request;
+        changed_argument[8] ^= 1;
+        changed_argument[88] = report_crc(&changed_argument);
+        assert!(!probe.matches(&changed_argument));
+
+        let mut write_direction = request;
+        write_direction[7] &= 0x7f;
+        write_direction[88] = report_crc(&write_direction);
+        assert!(!probe.matches(&write_direction));
+
+        let mut bad_crc = request;
+        bad_crc[88] ^= 1;
+        assert!(!probe.matches(&bad_crc));
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/lib.rs b/crates/hfx-uhid-relay/src/lib.rs
index 346a560..d4029dc 100644
--- a/crates/hfx-uhid-relay/src/lib.rs
+++ b/crates/hfx-uhid-relay/src/lib.rs
@@ -11,6 +11,8 @@ mod bridge;
 mod catalog;
 mod direct;
 mod endpoint;
+mod qualification;
+mod qualification_runtime;
 mod runtime;
 mod serial;
 mod supervisor;
@@ -19,11 +21,17 @@ mod uhid;
 pub use bridge::{
     BridgeExchange, BridgeExchangeResult, NativeBridge, NativeBridgeError, NativeRouteMonitor,
 };
-pub use catalog::{NativeRouteCatalog, NativeRouteCatalogError, NativeRouteRecord};
+pub use catalog::{
+    NativeQualificationProbe, NativeRouteCatalog, NativeRouteCatalogError, NativeRouteRecord,
+};
 pub use direct::{
     DirectRouteScanError, DirectRouteScanner, DirectRouteSnapshot, DirectRouteTransition,
 };
 pub use endpoint::{EndpointError, FeatureEndpoint, FeatureEndpointState};
+pub use qualification_runtime::{
+    NATIVE_QUALIFICATION_APPROVAL, QualificationRunConfig, QualificationRunPaths,
+    QualificationRuntimeError, run_qualification,
+};
 pub use runtime::{RelayPaths, RelayRuntimeError, run_relay};
 pub use serial::{SerialFingerprint, SerialQueryError, SerialQuerySpec, fingerprint_serial_bytes};
 pub use supervisor::{RouteAction, RouteIdentity, RouteSupervisor, RouteSupervisorError};
diff --git a/crates/hfx-uhid-relay/src/qualification.rs b/crates/hfx-uhid-relay/src/qualification.rs
new file mode 100644
index 0000000..826ec14
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/qualification.rs
@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::{BridgeExchange, BridgeExchangeResult, FEATURE_REPORT_BYTES, NativeQualificationProbe};
+use hfx_kernel_transport::{
+    KernelIo, KernelReceiverTransport, KernelTransportError, NativeEndpointLane,
+    NativeExchangeCertainty, NativeExchangeOutcome, NativeExchangeRequest,
+};
+use serde::Serialize;
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+const QUALIFICATION_TIMEOUT: Duration = Duration::from_secs(1);
+const MAX_QUALIFICATION_EVENTS: usize = 128;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub(crate) enum QualificationExchangeCertainty {
+    NotSent,
+    MayHaveBeenSent,
+    MatchedResponse,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(crate) struct QualificationExchangeRecord {
+    pub sequence: u64,
+    pub method: Option<String>,
+    pub attempt: u8,
+    pub request: [u8; FEATURE_REPORT_BYTES],
+    pub certainty: QualificationExchangeCertainty,
+    pub transport_errno: i32,
+    pub response: Option<[u8; FEATURE_REPORT_BYTES]>,
+}
+
+pub(crate) trait QualificationNativeTransport {
+    fn exchange(
+        &mut self,
+        request: &NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError>;
+}
+
+impl<I: KernelIo> QualificationNativeTransport for KernelReceiverTransport<I> {
+    fn exchange(
+        &mut self,
+        request: &NativeExchangeRequest,
+    ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+        self.native_exchange(request)
+    }
+}
+
+/// Temporary candidate-route transport used only by the supervised parity tool.
+///
+/// The production bridge remains the sole issuer of native route tokens. This
+/// transport instead accepts only exact read signatures embedded from the
+/// pinned `OpenRazer` source and binds every exchange to one endpoint lane and
+/// one short-lived kernel writer session.
+pub(crate) struct QualificationBridge<T> {
+    transport: T,
+    endpoint: NativeEndpointLane,
+    route_token_digest: [u8; 32],
+    probes: Vec<NativeQualificationProbe>,
+    maximum_attempts: u8,
+    attempts: BTreeMap<String, u8>,
+    next_nonce: u64,
+    records: Vec<QualificationExchangeRecord>,
+}
+
+impl<T: QualificationNativeTransport> QualificationBridge<T> {
+    #[must_use]
+    pub fn new(
+        transport: T,
+        endpoint: NativeEndpointLane,
+        route_token_digest: [u8; 32],
+        probes: Vec<NativeQualificationProbe>,
+        maximum_attempts: u8,
+    ) -> Option<Self> {
+        (!probes.is_empty()
+            && (1..=5).contains(&maximum_attempts)
+            && route_token_digest.iter().any(|byte| *byte != 0))
+        .then_some(Self {
+            transport,
+            endpoint,
+            route_token_digest,
+            probes,
+            maximum_attempts,
+            attempts: BTreeMap::new(),
+            next_nonce: 1,
+            records: Vec::with_capacity(MAX_QUALIFICATION_EVENTS),
+        })
+    }
+
+    #[must_use]
+    pub fn records(&self) -> &[QualificationExchangeRecord] {
+        &self.records
+    }
+
+    #[must_use]
+    pub fn all_methods_observed(&self) -> bool {
+        self.probes.iter().all(|probe| {
+            self.records.iter().any(|record| {
+                record.method.as_deref() == Some(probe.method.as_str())
+                    && record.certainty == QualificationExchangeCertainty::MatchedResponse
+                    && record
+                        .response
+                        .as_ref()
+                        .is_some_and(|response| response[0] != 1)
+            })
+        })
+    }
+
+    fn record(
+        &mut self,
+        method: Option<String>,
+        attempt: u8,
+        request: [u8; FEATURE_REPORT_BYTES],
+        certainty: QualificationExchangeCertainty,
+        transport_errno: i32,
+        response: Option<[u8; FEATURE_REPORT_BYTES]>,
+    ) {
+        if self.records.len() >= MAX_QUALIFICATION_EVENTS {
+            return;
+        }
+        let sequence = u64::try_from(self.records.len())
+            .unwrap_or(u64::MAX)
+            .saturating_add(1);
+        self.records.push(QualificationExchangeRecord {
+            sequence,
+            method,
+            attempt,
+            request,
+            certainty,
+            transport_errno,
+            response,
+        });
+    }
+
+    fn matching_method(&self, report: &[u8; FEATURE_REPORT_BYTES]) -> Option<String> {
+        let mut matches = self.probes.iter().filter(|probe| probe.matches(report));
+        let method = matches.next()?.method.clone();
+        matches.next().is_none().then_some(method)
+    }
+
+    fn prepare_exchange(
+        &mut self,
+        report: [u8; FEATURE_REPORT_BYTES],
+    ) -> Option<(String, u8, NativeExchangeRequest)> {
+        if self.records.len() >= MAX_QUALIFICATION_EVENTS {
+            return None;
+        }
+        let Some(method) = self.matching_method(&report) else {
+            self.record(
+                None,
+                0,
+                report,
+                QualificationExchangeCertainty::NotSent,
+                0,
+                None,
+            );
+            return None;
+        };
+        let previous_attempt = self.attempts.get(&method).copied().unwrap_or(0);
+        if previous_attempt >= self.maximum_attempts {
+            self.record(
+                Some(method),
+                previous_attempt.saturating_add(1),
+                report,
+                QualificationExchangeCertainty::NotSent,
+                0,
+                None,
+            );
+            return None;
+        }
+        let attempt = previous_attempt.saturating_add(1);
+        self.attempts.insert(method.clone(), attempt);
+        let nonce = self.next_nonce;
+        let Some(next_nonce) = nonce.checked_add(1) else {
+            self.record(
+                Some(method),
+                attempt,
+                report,
+                QualificationExchangeCertainty::NotSent,
+                0,
+                None,
+            );
+            return None;
+        };
+        self.next_nonce = next_nonce;
+        let request = NativeExchangeRequest {
+            dispatch_nonce: nonce,
+            endpoint: self.endpoint,
+            route_token_digest: self.route_token_digest,
+            report,
+            timeout: QUALIFICATION_TIMEOUT,
+        };
+        Some((method, attempt, request))
+    }
+
+    fn complete_exchange(
+        &mut self,
+        method: String,
+        attempt: u8,
+        report: [u8; FEATURE_REPORT_BYTES],
+        outcome: Result<NativeExchangeOutcome, KernelTransportError>,
+    ) -> BridgeExchangeResult {
+        let (certainty, transport_errno, response, result) = match outcome {
+            Ok(outcome) => match (outcome.certainty, outcome.response) {
+                (NativeExchangeCertainty::MatchedResponse, Some(response)) => (
+                    QualificationExchangeCertainty::MatchedResponse,
+                    outcome.transport_errno,
+                    Some(response),
+                    BridgeExchangeResult::MatchedResponse(response),
+                ),
+                (NativeExchangeCertainty::NotSent, None) => (
+                    QualificationExchangeCertainty::NotSent,
+                    outcome.transport_errno,
+                    None,
+                    BridgeExchangeResult::NotSent,
+                ),
+                _ => (
+                    QualificationExchangeCertainty::MayHaveBeenSent,
+                    outcome.transport_errno,
+                    None,
+                    BridgeExchangeResult::MayHaveBeenSent,
+                ),
+            },
+            Err(error) if error.failure_facts().automatic_retry_safe => (
+                QualificationExchangeCertainty::NotSent,
+                0,
+                None,
+                BridgeExchangeResult::NotSent,
+            ),
+            Err(_) => (
+                QualificationExchangeCertainty::MayHaveBeenSent,
+                0,
+                None,
+                BridgeExchangeResult::MayHaveBeenSent,
+            ),
+        };
+        self.record(
+            Some(method),
+            attempt,
+            report,
+            certainty,
+            transport_errno,
+            response,
+        );
+        result
+    }
+}
+
+impl<T: QualificationNativeTransport> BridgeExchange for QualificationBridge<T> {
+    fn exchange(&mut self, report: [u8; FEATURE_REPORT_BYTES]) -> BridgeExchangeResult {
+        let Some((method, attempt, request)) = self.prepare_exchange(report) else {
+            return BridgeExchangeResult::NotSent;
+        };
+        let outcome = self.transport.exchange(&request);
+        self.complete_exchange(method, attempt, report, outcome)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::VecDeque;
+
+    struct FakeTransport {
+        outcomes: VecDeque<NativeExchangeOutcome>,
+        requests: Vec<NativeExchangeRequest>,
+    }
+
+    impl QualificationNativeTransport for FakeTransport {
+        fn exchange(
+            &mut self,
+            request: &NativeExchangeRequest,
+        ) -> Result<NativeExchangeOutcome, KernelTransportError> {
+            self.requests.push(request.clone());
+            Ok(self.outcomes.pop_front().expect("an outcome is configured"))
+        }
+    }
+
+    fn probe() -> NativeQualificationProbe {
+        NativeQualificationProbe {
+            method: "get_firmware".to_owned(),
+            privacy: "summary-only".to_owned(),
+            attribute: "firmware_version".to_owned(),
+            response_summary: "firmware-version".to_owned(),
+            comparison: "exact-semantic".to_owned(),
+            command_class: 0,
+            command_id: 0x81,
+            data_size: 2,
+            arguments: vec![0, 0],
+            normalized_sha256: "0".repeat(64),
+        }
+    }
+
+    fn report() -> [u8; FEATURE_REPORT_BYTES] {
+        let mut report = [0_u8; FEATURE_REPORT_BYTES];
+        report[1] = 0x1f;
+        report[5] = 2;
+        report[7] = 0x81;
+        report[88] = report[2..88]
+            .iter()
+            .fold(0_u8, |checksum, byte| checksum ^ byte);
+        report
+    }
+
+    fn outcome(response: [u8; FEATURE_REPORT_BYTES]) -> NativeExchangeOutcome {
+        NativeExchangeOutcome {
+            authorization_epoch: 1,
+            kernel_sequence: 1,
+            dispatch_nonce: 1,
+            endpoint: NativeEndpointLane::Pointer,
+            route_token_digest: [0x44; 32],
+            request_digest: [0x55; 32],
+            certainty: NativeExchangeCertainty::MatchedResponse,
+            transport_errno: 0,
+            response: Some(response),
+        }
+    }
+
+    #[test]
+    fn exact_read_report_crosses_transport_once_and_is_recorded() {
+        let response = [0x22; FEATURE_REPORT_BYTES];
+        let transport = FakeTransport {
+            outcomes: vec![outcome(response)].into(),
+            requests: Vec::new(),
+        };
+        let mut bridge = QualificationBridge::new(
+            transport,
+            NativeEndpointLane::Pointer,
+            [0x44; 32],
+            vec![probe()],
+            5,
+        )
+        .expect("bridge is valid");
+        assert_eq!(
+            bridge.exchange(report()),
+            BridgeExchangeResult::MatchedResponse(response)
+        );
+        assert_eq!(bridge.transport.requests.len(), 1);
+        assert_eq!(bridge.records().len(), 1);
+        assert_eq!(
+            bridge.records()[0].certainty,
+            QualificationExchangeCertainty::MatchedResponse
+        );
+    }
+
+    #[test]
+    fn unknown_or_sixth_report_never_reaches_kernel_transport() {
+        let transport = FakeTransport {
+            outcomes: (0..5).map(|_| outcome([2; 90])).collect(),
+            requests: Vec::new(),
+        };
+        let mut bridge = QualificationBridge::new(
+            transport,
+            NativeEndpointLane::Pointer,
+            [0x44; 32],
+            vec![probe()],
+            5,
+        )
+        .expect("bridge is valid");
+        let mut unknown = report();
+        unknown[7] = 0x01;
+        unknown[88] = unknown[2..88]
+            .iter()
+            .fold(0_u8, |checksum, byte| checksum ^ byte);
+        assert_eq!(bridge.exchange(unknown), BridgeExchangeResult::NotSent);
+        for _ in 0..5 {
+            assert!(matches!(
+                bridge.exchange(report()),
+                BridgeExchangeResult::MatchedResponse(_)
+            ));
+        }
+        assert_eq!(bridge.exchange(report()), BridgeExchangeResult::NotSent);
+        assert_eq!(bridge.transport.requests.len(), 5);
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/qualification_runtime.rs b/crates/hfx-uhid-relay/src/qualification_runtime.rs
new file mode 100644
index 0000000..c7c20ea
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/qualification_runtime.rs
@@ -0,0 +1,714 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+use crate::qualification::{QualificationBridge, QualificationExchangeRecord};
+use crate::runtime::RunningEndpoint;
+use crate::{NativeRouteCatalog, NativeRouteRecord, RelayPaths, VirtualDeviceSpec};
+use hfx_daemon::{
+    EndpointCandidate, EndpointDiscovery, derive_capability_digest, generate_daemon_nonce,
+};
+use hfx_domain::{DeviceKind, GenerationId, ProfileId, ReceiverId};
+use hfx_kernel_transport::{
+    HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE, HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+    HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID, HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT,
+    KernelObservationReader, KernelReceiverTransport, KernelSessionMaterial, LinuxKernelIo,
+    NativeEndpointLane, RawKernelObservation,
+};
+use hfx_profiles::RuntimeProfileCatalog;
+use hfx_runtime::KERNEL_SESSION_DURATION_MS;
+use rustix::fs::{Mode, OFlags, open};
+use serde::Serialize;
+use sha2::{Digest, Sha256};
+use std::fmt;
+use std::fs::{File, remove_file};
+use std::io::{BufWriter, Write};
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::thread;
+use std::time::{Duration, Instant};
+
+pub const NATIVE_QUALIFICATION_APPROVAL: &str =
+    "approve HyperFlux Next restoration-isolated bounded read-only native parity probes";
+
+const SOURCE_REVISION_BYTES: usize = 40;
+const SHA256_HEX_BYTES: usize = 64;
+const MAXIMUM_RUNTIME: Duration = Duration::from_mins(2);
+const IDENTITY_WAIT: Duration = Duration::from_secs(2);
+const LOOP_INTERVAL: Duration = Duration::from_millis(2);
+const MAXIMUM_IDENTITY_BATCHES: usize = 64;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct QualificationRunPaths {
+    pub device_directory: PathBuf,
+    pub sysfs_misc_directory: PathBuf,
+    pub uhid_device: PathBuf,
+    pub raw_directory: PathBuf,
+    pub raw_output: PathBuf,
+}
+
+impl QualificationRunPaths {
+    #[must_use]
+    pub fn linux(raw_output: PathBuf) -> Self {
+        Self {
+            device_directory: PathBuf::from("/dev"),
+            sysfs_misc_directory: PathBuf::from("/sys/class/misc"),
+            uhid_device: PathBuf::from("/dev/uhid"),
+            raw_directory: PathBuf::from("/dev/shm"),
+            raw_output,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct QualificationRunConfig {
+    pub profile_id: String,
+    pub expected_generation: u64,
+    pub source_revision: String,
+    pub package_sha256: String,
+    pub approval_text: String,
+    pub timeout: Duration,
+    pub paths: QualificationRunPaths,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum QualificationRuntimeError {
+    Approval,
+    Binding,
+    Catalog,
+    Endpoint,
+    Generation,
+    Identity,
+    Profile,
+    RawOutput,
+    Runtime,
+    WriterBusy,
+    Incomplete,
+}
+
+impl fmt::Display for QualificationRuntimeError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(match self {
+            Self::Approval => "the exact read-only qualification approval is missing",
+            Self::Binding => "qualification source or package binding is invalid",
+            Self::Catalog => "the source-bound native qualification catalog is invalid",
+            Self::Endpoint => "the exact receiver endpoint is unavailable",
+            Self::Generation => "the receiver generation differs from the approved generation",
+            Self::Identity => "the candidate child identity is absent or contradictory",
+            Self::Profile => "the requested candidate profile is invalid",
+            Self::RawOutput => "the private ephemeral qualification output is invalid",
+            Self::Runtime => "the bounded native qualification runtime failed",
+            Self::WriterBusy => "another receiver writer is active",
+            Self::Incomplete => "the bounded read-only qualification probe set is incomplete",
+        })
+    }
+}
+
+impl std::error::Error for QualificationRuntimeError {}
+
+#[derive(Serialize)]
+struct RawQualificationDocument {
+    schema: &'static str,
+    source_revision: String,
+    package_sha256: String,
+    profile_id: String,
+    receiver_generation: u64,
+    read_only: bool,
+    completed: bool,
+    records: Vec<RawQualificationRecord>,
+}
+
+#[derive(Serialize)]
+struct RawQualificationRecord {
+    sequence: u64,
+    method: Option<String>,
+    attempt: u8,
+    request_hex: String,
+    certainty: crate::qualification::QualificationExchangeCertainty,
+    transport_errno: i32,
+    response_hex: Option<String>,
+}
+
+struct PrivateRawOutput {
+    path: PathBuf,
+    file: File,
+    preserved: bool,
+}
+
+struct PreparedQualification {
+    native_catalog: NativeRouteCatalog,
+    route: NativeRouteRecord,
+    transport: KernelReceiverTransport<LinuxKernelIo>,
+    endpoint_lane: NativeEndpointLane,
+}
+
+impl PrivateRawOutput {
+    fn create(paths: &QualificationRunPaths) -> Result<Self, QualificationRuntimeError> {
+        validate_raw_output_path(paths)?;
+        let descriptor = open(
+            &paths.raw_output,
+            OFlags::WRONLY | OFlags::CREATE | OFlags::EXCL | OFlags::CLOEXEC | OFlags::NOFOLLOW,
+            Mode::RUSR | Mode::WUSR,
+        )
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+        Ok(Self {
+            path: paths.raw_output.clone(),
+            file: File::from(descriptor),
+            preserved: false,
+        })
+    }
+
+    fn file_mut(&mut self) -> &mut File {
+        &mut self.file
+    }
+
+    fn preserve(&mut self) {
+        self.preserved = true;
+    }
+}
+
+impl Drop for PrivateRawOutput {
+    fn drop(&mut self) {
+        if !self.preserved {
+            let _ = remove_file(&self.path);
+        }
+    }
+}
+
+impl From<QualificationExchangeRecord> for RawQualificationRecord {
+    fn from(value: QualificationExchangeRecord) -> Self {
+        Self {
+            sequence: value.sequence,
+            method: value.method,
+            attempt: value.attempt,
+            request_hex: hex(&value.request),
+            certainty: value.certainty,
+            transport_errno: value.transport_errno,
+            response_hex: value.response.map(|response| hex(&response)),
+        }
+    }
+}
+
+/// Runs one generation-bound, read-only candidate qualification endpoint.
+///
+/// # Errors
+///
+/// Fails closed before creating a UHID endpoint when approval, source binding,
+/// receiver generation, writer exclusivity, or candidate identity is invalid.
+pub fn run_qualification(
+    config: &QualificationRunConfig,
+    termination: &AtomicBool,
+) -> Result<(), QualificationRuntimeError> {
+    validate_config(config)?;
+    let prepared = prepare_qualification(config)?;
+    let mut raw_output = PrivateRawOutput::create(&config.paths)?;
+    let (completed, records) = execute_qualification(config, termination, prepared)?;
+    write_raw_document(raw_output.file_mut(), config, completed, records)?;
+    raw_output.preserve();
+    if completed {
+        println!(
+            "HFX_NATIVE_QUALIFIER_COMPLETE profile={}",
+            config.profile_id
+        );
+        Ok(())
+    } else {
+        Err(QualificationRuntimeError::Incomplete)
+    }
+}
+
+fn prepare_qualification(
+    config: &QualificationRunConfig,
+) -> Result<PreparedQualification, QualificationRuntimeError> {
+    let native_catalog =
+        NativeRouteCatalog::load().map_err(|_| QualificationRuntimeError::Catalog)?;
+    let route = native_catalog
+        .profile(&config.profile_id)
+        .ok_or(QualificationRuntimeError::Profile)?
+        .clone();
+    let runtime_catalog =
+        RuntimeProfileCatalog::load().map_err(|_| QualificationRuntimeError::Catalog)?;
+    let child_profile_id = ProfileId::try_from(route.profile_id.as_str())
+        .map_err(|_| QualificationRuntimeError::Profile)?;
+    let child = runtime_catalog
+        .child(route.wireless_product_id)
+        .filter(|profile| profile.profile_id == child_profile_id)
+        .ok_or(QualificationRuntimeError::Profile)?;
+    if child.device_kind != route.device_kind {
+        return Err(QualificationRuntimeError::Profile);
+    }
+    let (candidate, reader) = find_receiver_endpoint(config, &runtime_catalog)?;
+    let endpoint_lane = endpoint_lane(route.device_kind)?;
+    let transport = open_qualification_transport(
+        config,
+        &candidate,
+        &reader,
+        runtime_catalog,
+        endpoint_lane,
+        route.wireless_product_id.get(),
+    )?;
+    Ok(PreparedQualification {
+        native_catalog,
+        route,
+        transport,
+        endpoint_lane,
+    })
+}
+
+fn find_receiver_endpoint(
+    config: &QualificationRunConfig,
+    runtime_catalog: &RuntimeProfileCatalog,
+) -> Result<(EndpointCandidate, KernelObservationReader<LinuxKernelIo>), QualificationRuntimeError>
+{
+    let discovery = EndpointDiscovery::new(
+        config.paths.device_directory.clone(),
+        config.paths.sysfs_misc_directory.clone(),
+    );
+    let mut matching = discovery
+        .scan()
+        .map_err(|_| QualificationRuntimeError::Endpoint)?
+        .into_iter()
+        .filter_map(|candidate| {
+            let reader = KernelObservationReader::open(&candidate.device_path).ok()?;
+            let binding = reader.binding();
+            (binding.generation_id.get() == config.expected_generation
+                && runtime_catalog
+                    .receiver(binding.vendor_id, binding.product_id)
+                    .is_some())
+            .then_some((candidate, reader))
+        })
+        .collect::<Vec<_>>();
+    if matching.len() != 1 {
+        return Err(QualificationRuntimeError::Endpoint);
+    }
+    matching.pop().ok_or(QualificationRuntimeError::Endpoint)
+}
+
+fn open_qualification_transport(
+    config: &QualificationRunConfig,
+    candidate: &EndpointCandidate,
+    reader: &KernelObservationReader<LinuxKernelIo>,
+    runtime_catalog: RuntimeProfileCatalog,
+    endpoint_lane: NativeEndpointLane,
+    expected_product_id: u16,
+) -> Result<KernelReceiverTransport<LinuxKernelIo>, QualificationRuntimeError> {
+    let binding = reader.binding();
+    if binding.generation_id.get() != config.expected_generation {
+        return Err(QualificationRuntimeError::Generation);
+    }
+    if binding.flags.writer_open() || binding.flags.session_active() {
+        return Err(QualificationRuntimeError::WriterBusy);
+    }
+    if binding.flags.disconnecting() || binding.flags.suspended() || binding.bound_interfaces == 0 {
+        return Err(QualificationRuntimeError::Endpoint);
+    }
+    let receiver = runtime_catalog
+        .receiver(binding.vendor_id, binding.product_id)
+        .ok_or(QualificationRuntimeError::Profile)?;
+    let baseline = reader
+        .read_observations(0)
+        .map_err(|_| QualificationRuntimeError::Endpoint)?
+        .latest_sequence;
+    let generation = GenerationId::try_from(config.expected_generation)
+        .map_err(|_| QualificationRuntimeError::Generation)?;
+    let receiver_id = ReceiverId::try_from(format!("qualification-receiver-g{}", generation.get()))
+        .map_err(|_| QualificationRuntimeError::Binding)?;
+    let material = KernelSessionMaterial {
+        receiver_id,
+        generation_id: generation,
+        receiver_profile_id: receiver.profile_id.clone(),
+        receiver_profile_digest: receiver.runtime_digest.clone(),
+        capability_digest: derive_capability_digest(&runtime_catalog, receiver)
+            .map_err(|_| QualificationRuntimeError::Binding)?,
+        daemon_nonce: generate_daemon_nonce().map_err(|_| QualificationRuntimeError::Binding)?,
+        session_duration: Duration::from_millis(KERNEL_SESSION_DURATION_MS),
+    };
+    let transport =
+        KernelReceiverTransport::open(&candidate.device_path, runtime_catalog, material)
+            .map_err(|_| QualificationRuntimeError::WriterBusy)?;
+    await_candidate_identity(&transport, baseline, endpoint_lane, expected_product_id)?;
+    Ok(transport)
+}
+
+fn execute_qualification(
+    config: &QualificationRunConfig,
+    termination: &AtomicBool,
+    prepared: PreparedQualification,
+) -> Result<(bool, Vec<QualificationExchangeRecord>), QualificationRuntimeError> {
+    let PreparedQualification {
+        native_catalog,
+        route,
+        transport,
+        endpoint_lane,
+    } = prepared;
+    let route_digest = qualification_route_digest(config, endpoint_lane);
+    let bridge = QualificationBridge::new(
+        transport,
+        endpoint_lane,
+        route_digest,
+        route.qualification_probes.clone(),
+        native_catalog.qualification_maximum_attempts(),
+    )
+    .ok_or(QualificationRuntimeError::Catalog)?;
+    let device = VirtualDeviceSpec::new(
+        route.model_name,
+        route.vendor_id.get(),
+        route.wireless_product_id.get(),
+        native_catalog.descriptor().to_vec(),
+        &qualification_instance_label(config),
+    )
+    .map_err(|_| QualificationRuntimeError::Profile)?;
+    let relay_paths = RelayPaths {
+        bridge_socket: PathBuf::new(),
+        uhid_device: config.paths.uhid_device.clone(),
+        hid_driver_root: PathBuf::new(),
+    };
+    let mut endpoint = RunningEndpoint::create(&relay_paths, bridge, device)
+        .map_err(|_| QualificationRuntimeError::Runtime)?;
+    println!(
+        "HFX_NATIVE_QUALIFIER_READY profile={} methods={}",
+        config.profile_id,
+        route.qualification_probes.len()
+    );
+    std::io::stdout()
+        .flush()
+        .map_err(|_| QualificationRuntimeError::Runtime)?;
+
+    let deadline = Instant::now() + config.timeout;
+    let mut completed = false;
+    while !termination.load(Ordering::Relaxed) && Instant::now() < deadline {
+        endpoint
+            .step()
+            .map_err(|_| QualificationRuntimeError::Runtime)?;
+        if endpoint.bridge_mut().all_methods_observed() {
+            completed = true;
+            break;
+        }
+        thread::sleep(LOOP_INTERVAL);
+    }
+    let records = endpoint.bridge_mut().records().to_vec();
+    endpoint.destroy();
+    Ok((completed, records))
+}
+
+fn validate_config(config: &QualificationRunConfig) -> Result<(), QualificationRuntimeError> {
+    if config.approval_text != NATIVE_QUALIFICATION_APPROVAL {
+        return Err(QualificationRuntimeError::Approval);
+    }
+    if config.expected_generation == 0
+        || config.timeout.is_zero()
+        || config.timeout > MAXIMUM_RUNTIME
+        || !is_lower_hex(&config.source_revision, SOURCE_REVISION_BYTES)
+        || !is_lower_hex(&config.package_sha256, SHA256_HEX_BYTES)
+    {
+        return Err(QualificationRuntimeError::Binding);
+    }
+    let embedded = option_env!("HFX_SOURCE_REVISION").ok_or(QualificationRuntimeError::Binding)?;
+    if embedded != config.source_revision {
+        return Err(QualificationRuntimeError::Binding);
+    }
+    validate_raw_output_path(&config.paths)
+}
+
+fn validate_raw_output_path(
+    paths: &QualificationRunPaths,
+) -> Result<(), QualificationRuntimeError> {
+    let raw_directory = paths
+        .raw_directory
+        .canonicalize()
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+    let parent = paths
+        .raw_output
+        .parent()
+        .ok_or(QualificationRuntimeError::RawOutput)?
+        .canonicalize()
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+    let file_name = paths
+        .raw_output
+        .file_name()
+        .and_then(|value| value.to_str())
+        .ok_or(QualificationRuntimeError::RawOutput)?;
+    let has_json_extension = paths
+        .raw_output
+        .extension()
+        .and_then(|value| value.to_str())
+        .is_some_and(|extension| extension.eq_ignore_ascii_case("json"));
+    if parent != raw_directory
+        || !file_name.starts_with("hyperflux-next-native-parity-")
+        || !has_json_extension
+        || !file_name.bytes().all(|byte| {
+            byte.is_ascii_lowercase() || byte.is_ascii_digit() || matches!(byte, b'-' | b'.')
+        })
+    {
+        return Err(QualificationRuntimeError::RawOutput);
+    }
+    Ok(())
+}
+
+fn endpoint_lane(device_kind: DeviceKind) -> Result<NativeEndpointLane, QualificationRuntimeError> {
+    match device_kind {
+        DeviceKind::Mouse => Ok(NativeEndpointLane::Pointer),
+        DeviceKind::Keyboard => Ok(NativeEndpointLane::Keyboard),
+        _ => Err(QualificationRuntimeError::Profile),
+    }
+}
+
+fn lane_number(endpoint: NativeEndpointLane) -> u32 {
+    match endpoint {
+        NativeEndpointLane::Pointer => HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+        NativeEndpointLane::Keyboard => HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE,
+    }
+}
+
+fn await_candidate_identity(
+    transport: &KernelReceiverTransport<LinuxKernelIo>,
+    mut cursor: u64,
+    endpoint: NativeEndpointLane,
+    expected_product_id: u16,
+) -> Result<(), QualificationRuntimeError> {
+    let deadline = Instant::now() + IDENTITY_WAIT;
+    for _ in 0..MAXIMUM_IDENTITY_BATCHES {
+        let batch = transport
+            .read_observations(cursor)
+            .map_err(|_| QualificationRuntimeError::Identity)?;
+        if batch.cursor_gap {
+            return Err(QualificationRuntimeError::Identity);
+        }
+        if identity_is_exact(&batch.observations, endpoint, expected_product_id)? {
+            return Ok(());
+        }
+        cursor = batch.latest_sequence.max(cursor);
+        if Instant::now() >= deadline {
+            break;
+        }
+        thread::sleep(Duration::from_millis(10));
+    }
+    Err(QualificationRuntimeError::Identity)
+}
+
+fn identity_is_exact(
+    observations: &[RawKernelObservation],
+    endpoint: NativeEndpointLane,
+    expected_product_id: u16,
+) -> Result<bool, QualificationRuntimeError> {
+    let lane = lane_number(endpoint);
+    let mut found = false;
+    for observation in observations
+        .iter()
+        .filter(|item| item.endpoint_slot == lane)
+    {
+        if observation.kind == HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT {
+            return Err(QualificationRuntimeError::Identity);
+        }
+        if observation.kind == HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID {
+            if observation.value != u32::from(expected_product_id) {
+                return Err(QualificationRuntimeError::Identity);
+            }
+            found = true;
+        }
+    }
+    Ok(found)
+}
+
+fn qualification_route_digest(
+    config: &QualificationRunConfig,
+    endpoint: NativeEndpointLane,
+) -> [u8; 32] {
+    let mut digest = Sha256::new();
+    digest.update(b"hyperflux-native-qualification-route-v1\0");
+    digest.update(config.source_revision.as_bytes());
+    digest.update(config.package_sha256.as_bytes());
+    digest.update(config.expected_generation.to_le_bytes());
+    digest.update(lane_number(endpoint).to_le_bytes());
+    digest.update(config.profile_id.as_bytes());
+    digest.finalize().into()
+}
+
+fn qualification_instance_label(config: &QualificationRunConfig) -> String {
+    let mut digest = Sha256::new();
+    digest.update(b"hyperflux-native-qualification-instance-v1\0");
+    digest.update(config.source_revision.as_bytes());
+    digest.update(config.expected_generation.to_le_bytes());
+    digest.update(config.profile_id.as_bytes());
+    let digest = digest.finalize();
+    format!("qualify-{}", hex(&digest[..8]))
+}
+
+fn write_raw_document(
+    file: &mut File,
+    config: &QualificationRunConfig,
+    completed: bool,
+    records: Vec<QualificationExchangeRecord>,
+) -> Result<(), QualificationRuntimeError> {
+    let document = RawQualificationDocument {
+        schema: "hyperflux-native-qualification-raw-v1",
+        source_revision: config.source_revision.clone(),
+        package_sha256: config.package_sha256.clone(),
+        profile_id: config.profile_id.clone(),
+        receiver_generation: config.expected_generation,
+        read_only: true,
+        completed,
+        records: records.into_iter().map(Into::into).collect(),
+    };
+    let mut writer = BufWriter::new(file);
+    serde_json::to_writer(&mut writer, &document)
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+    writer
+        .write_all(b"\n")
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+    writer
+        .flush()
+        .map_err(|_| QualificationRuntimeError::RawOutput)?;
+    writer
+        .get_ref()
+        .sync_all()
+        .map_err(|_| QualificationRuntimeError::RawOutput)
+}
+
+fn is_lower_hex(value: &str, length: usize) -> bool {
+    value.len() == length
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_hexdigit() && !byte.is_ascii_uppercase())
+}
+
+fn hex(bytes: &[u8]) -> String {
+    let mut value = String::with_capacity(bytes.len() * 2);
+    for byte in bytes {
+        use std::fmt::Write as _;
+        let _ = write!(value, "{byte:02x}");
+    }
+    value
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use std::sync::atomic::{AtomicU64, Ordering};
+
+    static TEST_ID: AtomicU64 = AtomicU64::new(1);
+
+    struct TempDirectory(PathBuf);
+
+    impl TempDirectory {
+        fn create() -> Self {
+            let id = TEST_ID.fetch_add(1, Ordering::Relaxed);
+            let path = std::env::temp_dir()
+                .join(format!("hyperflux-native-raw-{}-{id}", std::process::id()));
+            fs::create_dir(&path).expect("temporary directory is created");
+            Self(path)
+        }
+
+        fn paths(&self, name: &str) -> QualificationRunPaths {
+            QualificationRunPaths {
+                device_directory: self.0.clone(),
+                sysfs_misc_directory: self.0.clone(),
+                uhid_device: self.0.join("uhid"),
+                raw_directory: self.0.clone(),
+                raw_output: self.0.join(name),
+            }
+        }
+    }
+
+    impl Drop for TempDirectory {
+        fn drop(&mut self) {
+            let _ = fs::remove_dir_all(&self.0);
+        }
+    }
+
+    fn observation(kind: u32, lane: u32, value: u32) -> RawKernelObservation {
+        RawKernelObservation {
+            sequence: 1,
+            observed_boottime_ns: 1,
+            kind,
+            endpoint_slot: lane,
+            source: 1,
+            confidence: 3,
+            value,
+            auxiliary: 0,
+        }
+    }
+
+    #[test]
+    fn exact_identity_accepts_only_the_target_lane_and_pid() {
+        assert_eq!(
+            identity_is_exact(
+                &[observation(
+                    HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID,
+                    HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                    0x00cd,
+                )],
+                NativeEndpointLane::Pointer,
+                0x00cd,
+            ),
+            Ok(true)
+        );
+        assert_eq!(
+            identity_is_exact(
+                &[observation(
+                    HFX_UAPI_OBSERVATION_KIND_ENDPOINT_PRODUCT_ID,
+                    HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                    0x0296,
+                )],
+                NativeEndpointLane::Pointer,
+                0x00cd,
+            ),
+            Err(QualificationRuntimeError::Identity)
+        );
+        assert_eq!(
+            identity_is_exact(
+                &[observation(
+                    HFX_UAPI_OBSERVATION_KIND_IDENTITY_CONFLICT,
+                    HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE,
+                    0,
+                )],
+                NativeEndpointLane::Pointer,
+                0x00cd,
+            ),
+            Err(QualificationRuntimeError::Identity)
+        );
+    }
+
+    #[test]
+    fn route_digest_is_bound_to_generation_profile_and_lane() {
+        let paths = QualificationRunPaths::linux(PathBuf::from(
+            "/dev/shm/hyperflux-next-native-parity-test.json",
+        ));
+        let config = QualificationRunConfig {
+            profile_id: "child.razer.mouse.0001".to_owned(),
+            expected_generation: 7,
+            source_revision: "a".repeat(40),
+            package_sha256: "b".repeat(64),
+            approval_text: NATIVE_QUALIFICATION_APPROVAL.to_owned(),
+            timeout: Duration::from_secs(1),
+            paths,
+        };
+        let pointer = qualification_route_digest(&config, NativeEndpointLane::Pointer);
+        let keyboard = qualification_route_digest(&config, NativeEndpointLane::Keyboard);
+        let mut newer = config.clone();
+        newer.expected_generation += 1;
+        assert_ne!(pointer, keyboard);
+        assert_ne!(
+            pointer,
+            qualification_route_digest(&newer, NativeEndpointLane::Pointer)
+        );
+        assert!(pointer.iter().any(|byte| *byte != 0));
+    }
+
+    #[test]
+    fn private_raw_output_is_deleted_on_failure_and_kept_only_when_preserved() {
+        let directory = TempDirectory::create();
+        let failure_paths = directory.paths("hyperflux-next-native-parity-failure.json");
+        {
+            let _output = PrivateRawOutput::create(&failure_paths).expect("output is reserved");
+            assert!(failure_paths.raw_output.is_file());
+        }
+        assert!(!failure_paths.raw_output.exists());
+
+        let success_paths = directory.paths("hyperflux-next-native-parity-success.json");
+        {
+            let mut output = PrivateRawOutput::create(&success_paths).expect("output is reserved");
+            output.preserve();
+        }
+        assert!(success_paths.raw_output.is_file());
+        fs::remove_file(success_paths.raw_output).expect("preserved fixture is removed");
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/qualifier_main.rs b/crates/hfx-uhid-relay/src/qualifier_main.rs
new file mode 100644
index 0000000..560a0bf
--- /dev/null
+++ b/crates/hfx-uhid-relay/src/qualifier_main.rs
@@ -0,0 +1,181 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#![forbid(unsafe_code)]
+
+use hfx_runtime::{PRODUCT_DISPLAY_NAME, PRODUCT_VERSION};
+use hfx_uhid_relay::{QualificationRunConfig, QualificationRunPaths, run_qualification};
+use signal_hook::{consts::TERM_SIGNALS, flag, low_level};
+use std::path::PathBuf;
+use std::process::ExitCode;
+use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+use std::time::Duration;
+
+const USAGE: &str = "Usage: hyperflux-next-native-qualifier --profile PROFILE_ID --expected-generation N --source-revision SHA1 --package-sha256 SHA256 --raw-output /dev/shm/hyperflux-next-native-parity-NAME.json --timeout-seconds N --approval-text TEXT";
+
+#[derive(Debug, Eq, PartialEq)]
+enum Command {
+    Run(Box<QualificationRunConfig>),
+    Help,
+    Version,
+}
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            eprintln!("HFX-NATIVE-QUALIFIER-001: {error}");
+            ExitCode::FAILURE
+        }
+    }
+}
+
+fn run() -> Result<(), String> {
+    match parse_arguments(std::env::args().skip(1))? {
+        Command::Help => {
+            println!("{PRODUCT_DISPLAY_NAME} native qualifier {PRODUCT_VERSION}\n\n{USAGE}");
+            Ok(())
+        }
+        Command::Version => {
+            println!("{PRODUCT_VERSION}");
+            Ok(())
+        }
+        Command::Run(config) => run_with_signals(&config),
+    }
+}
+
+fn run_with_signals(config: &QualificationRunConfig) -> Result<(), String> {
+    let termination = Arc::new(AtomicBool::new(false));
+    let mut registrations = Vec::new();
+    for signal in TERM_SIGNALS {
+        registrations.push(
+            flag::register(*signal, Arc::clone(&termination))
+                .map_err(|_| "termination signal registration failed".to_owned())?,
+        );
+    }
+    let result = run_qualification(config, termination.as_ref()).map_err(|error| error.to_string());
+    for registration in registrations {
+        let _ = low_level::unregister(registration);
+    }
+    result
+}
+
+fn parse_arguments(arguments: impl IntoIterator<Item = String>) -> Result<Command, String> {
+    let arguments = arguments.into_iter().collect::<Vec<_>>();
+    match arguments.as_slice() {
+        [flag] if flag == "--help" || flag == "-h" => return Ok(Command::Help),
+        [flag] if flag == "--version" => return Ok(Command::Version),
+        _ => {}
+    }
+    if arguments.len() % 2 != 0 {
+        return Err(USAGE.to_owned());
+    }
+    let mut profile_id = None;
+    let mut expected_generation = None;
+    let mut source_revision = None;
+    let mut package_sha256 = None;
+    let mut raw_output = None;
+    let mut timeout = None;
+    let mut approval_text = None;
+    for pair in arguments.chunks_exact(2) {
+        let slot = match pair[0].as_str() {
+            "--profile" => &mut profile_id,
+            "--expected-generation" => &mut expected_generation,
+            "--source-revision" => &mut source_revision,
+            "--package-sha256" => &mut package_sha256,
+            "--raw-output" => &mut raw_output,
+            "--timeout-seconds" => &mut timeout,
+            "--approval-text" => &mut approval_text,
+            _ => return Err(format!("unknown option: {}\n{USAGE}", pair[0])),
+        };
+        if slot.replace(pair[1].clone()).is_some() {
+            return Err(format!("{} may be provided only once\n{USAGE}", pair[0]));
+        }
+    }
+    let profile_id = profile_id.ok_or_else(|| USAGE.to_owned())?;
+    let expected_generation = expected_generation
+        .ok_or_else(|| USAGE.to_owned())?
+        .parse::<u64>()
+        .map_err(|_| USAGE.to_owned())?;
+    let source_revision = source_revision.ok_or_else(|| USAGE.to_owned())?;
+    let package_sha256 = package_sha256.ok_or_else(|| USAGE.to_owned())?;
+    let raw_output = PathBuf::from(raw_output.ok_or_else(|| USAGE.to_owned())?);
+    if !raw_output.is_absolute() {
+        return Err(USAGE.to_owned());
+    }
+    let timeout = timeout
+        .ok_or_else(|| USAGE.to_owned())?
+        .parse::<u64>()
+        .map(Duration::from_secs)
+        .map_err(|_| USAGE.to_owned())?;
+    let approval_text = approval_text.ok_or_else(|| USAGE.to_owned())?;
+    Ok(Command::Run(Box::new(QualificationRunConfig {
+        profile_id,
+        expected_generation,
+        source_revision,
+        package_sha256,
+        approval_text,
+        timeout,
+        paths: QualificationRunPaths::linux(raw_output),
+    })))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn valid_arguments() -> Vec<String> {
+        [
+            "--profile",
+            "child.razer.mouse.0001",
+            "--expected-generation",
+            "7",
+            "--source-revision",
+            "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            "--package-sha256",
+            "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            "--raw-output",
+            "/dev/shm/hyperflux-next-native-parity-test.json",
+            "--timeout-seconds",
+            "30",
+            "--approval-text",
+            "approve HyperFlux Next restoration-isolated bounded read-only native parity probes",
+        ]
+        .into_iter()
+        .map(str::to_owned)
+        .collect()
+    }
+
+    #[test]
+    fn exact_complete_argument_set_parses() {
+        let Command::Run(config) = parse_arguments(valid_arguments()).expect("arguments parse")
+        else {
+            panic!("expected run command");
+        };
+        assert_eq!(config.expected_generation, 7);
+        assert_eq!(config.timeout, Duration::from_secs(30));
+        assert_eq!(
+            config.paths.raw_output,
+            PathBuf::from("/dev/shm/hyperflux-next-native-parity-test.json")
+        );
+    }
+
+    #[test]
+    fn missing_duplicate_unknown_and_relative_arguments_fail() {
+        let mut missing = valid_arguments();
+        missing.truncate(missing.len() - 2);
+        let mut duplicate = valid_arguments();
+        duplicate.extend(["--profile".to_owned(), "other".to_owned()]);
+        let mut unknown = valid_arguments();
+        unknown[0] = "--other".to_owned();
+        let mut relative = valid_arguments();
+        let output = relative
+            .iter()
+            .position(|value| value == "--raw-output")
+            .expect("output option exists");
+        relative[output + 1] = "relative.json".to_owned();
+        for arguments in [missing, duplicate, unknown, relative] {
+            assert!(parse_arguments(arguments).is_err());
+        }
+    }
+}
diff --git a/crates/hfx-uhid-relay/src/runtime.rs b/crates/hfx-uhid-relay/src/runtime.rs
index 44f8771..fb09ad0 100644
--- a/crates/hfx-uhid-relay/src/runtime.rs
+++ b/crates/hfx-uhid-relay/src/runtime.rs
@@ -82,17 +82,17 @@ struct PendingWrite {
     offset: usize,
 }
 
-struct RunningEndpoint {
+pub(crate) struct RunningEndpoint<B: crate::BridgeExchange> {
     file: File,
-    endpoint: FeatureEndpoint<NativeBridge>,
+    endpoint: FeatureEndpoint<B>,
     pending: VecDeque<PendingWrite>,
     destroyed: bool,
 }
 
-impl RunningEndpoint {
-    fn create(
+impl<B: crate::BridgeExchange> RunningEndpoint<B> {
+    pub(crate) fn create(
         paths: &RelayPaths,
-        bridge: NativeBridge,
+        bridge: B,
         device: VirtualDeviceSpec,
     ) -> Result<Self, RelayRuntimeError> {
         let mut file = open_uhid(&paths.uhid_device)?;
@@ -107,25 +107,7 @@ impl RunningEndpoint {
         })
     }
 
-    fn query_serial(&mut self, query: &SerialQuerySpec) -> Option<SerialFingerprint> {
-        let request = query.request();
-        let fingerprint = match self.endpoint.management_exchange(request)? {
-            BridgeExchangeResult::MatchedResponse(response) => {
-                query.fingerprint_response(&request, &response)
-            }
-            BridgeExchangeResult::NotSent | BridgeExchangeResult::MayHaveBeenSent => None,
-        };
-        self.endpoint
-            .bridge_mut()
-            .take_observed_serial()
-            .or(fingerprint)
-    }
-
-    fn take_observed_serial(&mut self) -> Option<SerialFingerprint> {
-        self.endpoint.bridge_mut().take_observed_serial()
-    }
-
-    fn step(&mut self) -> Result<(), RelayRuntimeError> {
+    pub(crate) fn step(&mut self) -> Result<(), RelayRuntimeError> {
         self.flush()?;
         let mut bytes = [0_u8; UHID_EVENT_BYTES];
         loop {
@@ -179,10 +161,14 @@ impl RunningEndpoint {
         Ok(())
     }
 
-    fn destroy(mut self) {
+    pub(crate) fn destroy(mut self) {
         self.destroy_inner();
     }
 
+    pub(crate) fn bridge_mut(&mut self) -> &mut B {
+        self.endpoint.bridge_mut()
+    }
+
     fn destroy_inner(&mut self) {
         if self.destroyed {
             return;
@@ -196,12 +182,32 @@ impl RunningEndpoint {
     }
 }
 
+impl RunningEndpoint<NativeBridge> {
+    fn query_serial(&mut self, query: &SerialQuerySpec) -> Option<SerialFingerprint> {
+        let request = query.request();
+        let fingerprint = match self.endpoint.management_exchange(request)? {
+            BridgeExchangeResult::MatchedResponse(response) => {
+                query.fingerprint_response(&request, &response)
+            }
+            BridgeExchangeResult::NotSent | BridgeExchangeResult::MayHaveBeenSent => None,
+        };
+        self.endpoint
+            .bridge_mut()
+            .take_observed_serial()
+            .or(fingerprint)
+    }
+
+    fn take_observed_serial(&mut self) -> Option<SerialFingerprint> {
+        self.endpoint.bridge_mut().take_observed_serial()
+    }
+}
+
 struct ManagedRoute {
     route: NativeRoute,
     record: NativeRouteRecord,
     device: VirtualDeviceSpec,
     serial_fingerprint: Option<SerialFingerprint>,
-    endpoint: Option<RunningEndpoint>,
+    endpoint: Option<RunningEndpoint<NativeBridge>>,
     next_serial_query: Instant,
 }
 
@@ -303,7 +309,7 @@ impl ManagedRoute {
     }
 }
 
-impl Drop for RunningEndpoint {
+impl<B: crate::BridgeExchange> Drop for RunningEndpoint<B> {
     fn drop(&mut self) {
         self.destroy_inner();
     }
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 41e42f6..4c6e753 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical manifest digest: `a569e731ee83bb7eb8adba97d0e90868d97977a57a8672710c0ce24176a727ee`.
+Canonical manifest digest: `1733db54a95a302e1b849aa84fe5f551cab85209db93439c451b86de241d746b`.
 
 Package: `hyperflux-next-linux` `0.0.0-dev.1` release `1`.
 
@@ -19,7 +19,7 @@ Package hooks prepare system metadata and delegate compatibility decisions to th
 
 ## Build Products
 
-The canonical plan contains `6` required and `3` optional build products.
+The canonical plan contains `7` required and `3` optional build products.
 
 | Component | Kind | Required | Destination or distribution |
 | --- | --- | --- | --- |
@@ -27,6 +27,7 @@ The canonical plan contains `6` required and `3` optional build products.
 | `operations-cli` | `cargo-binary` | yes | `/usr/bin/hyperfluxctl` |
 | `activation-utility` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-activate` |
 | `openrazer-native-relay` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-uhid-relay` |
+| `native-readonly-qualifier` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-native-qualifier` |
 | `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.1` |
 | `openrgb-native` | `cmake-module` | no | `/usr/lib/openrgb/plugins/hyperflux-next-openrgb.so` |
 | `python-sdk` | `python-project` | yes | `hyperflux-next-sdk` |
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index 0ad7fe5..3bddc07 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `ed5da28eb8ace3468707af05fdb8abe79c22544786b46b0527e46f5a3653a4f6`
+- Authority SHA-256: `28d7686f8ab617943f82bca2e058891c70608adbbbaf6dd0c1f09fb8c4257e9c`
 
 ## License Policy
 
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index f8ad2df..1d20c25 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -1,6 +1,6 @@
 {
   "schema": "hyperflux-compiled-install-plan-v1",
-  "install_manifest_sha256": "a569e731ee83bb7eb8adba97d0e90868d97977a57a8672710c0ce24176a727ee",
+  "install_manifest_sha256": "1733db54a95a302e1b849aa84fe5f551cab85209db93439c451b86de241d746b",
   "product": {
     "name": "hyperflux-next-linux",
     "version": "0.0.0-dev.1",
@@ -53,6 +53,16 @@
       "destination": "/usr/lib/hyperflux-next/hyperflux-next-uhid-relay",
       "mode": "0755"
     },
+    {
+      "id": "native-readonly-qualifier",
+      "kind": "cargo-binary",
+      "required": true,
+      "package": "hfx-uhid-relay",
+      "target": "hyperflux-next-native-qualifier",
+      "profile": "relay",
+      "destination": "/usr/lib/hyperflux-next/hyperflux-next-native-qualifier",
+      "mode": "0755"
+    },
     {
       "id": "openrazer-native-driver",
       "kind": "source-transform",
diff --git a/packaging/install.json b/packaging/install.json
index 9e078fd..6c00b50 100644
--- a/packaging/install.json
+++ b/packaging/install.json
@@ -48,6 +48,16 @@
       "mode": "0755",
       "required": true
     },
+    {
+      "id": "native-readonly-qualifier",
+      "kind": "cargo-binary",
+      "package": "hfx-uhid-relay",
+      "target": "hyperflux-next-native-qualifier",
+      "profile": "relay",
+      "destination": "/usr/lib/hyperflux-next/hyperflux-next-native-qualifier",
+      "mode": "0755",
+      "required": true
+    },
     {
       "id": "openrazer-native-driver",
       "kind": "source-transform",
diff --git a/tests/test_install.py b/tests/test_install.py
index af4a28c..bf3e191 100644
--- a/tests/test_install.py
+++ b/tests/test_install.py
@@ -78,6 +78,7 @@ def test_rust_installables_use_role_specific_release_profiles(self) -> None:
                 "operations-cli": "operations",
                 "activation-utility": "operations",
                 "openrazer-native-relay": "relay",
+                "native-readonly-qualifier": "relay",
             },
         )
         cargo = tomllib.loads((ROOT / "Cargo.toml").read_text(encoding="utf-8"))
diff --git a/tests/test_native_live_parity.py b/tests/test_native_live_parity.py
new file mode 100644
index 0000000..54c2480
--- /dev/null
+++ b/tests/test_native_live_parity.py
@@ -0,0 +1,255 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import hashlib
+import json
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import Mock, patch
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+
+from hfxdev.model import ModelError
+import hfxdev.native_live_parity as native_live
+from hfxdev.native_live_parity import _feature_only_has_no_input_nodes
+from hfxdev.native_parity import (
+    build_live_parity_evidence,
+    build_offline_parity_evidence,
+    canonical_request,
+)
+from hfxdev.native_probe import load_native_probe_catalog
+
+
+PROFILE = "child.razer.basilisk-v3-pro-35k.00cd"
+REVISION = "a" * 40
+PACKAGE_SHA256 = "b" * 64
+
+
+def _crc(report: bytes | bytearray) -> int:
+    value = 0
+    for byte in report[2:88]:
+        value ^= byte
+    return value
+
+
+def _response(request: bytes, arguments: bytes, *, status: int = 2) -> bytes:
+    report = bytearray(90)
+    report[0] = status
+    report[1] = request[1]
+    report[2:4] = request[2:4]
+    report[5] = len(arguments)
+    report[6:8] = request[6:8]
+    report[8 : 8 + len(arguments)] = arguments
+    report[88] = _crc(report)
+    return bytes(report)
+
+
+def _words(value: bytes) -> str:
+    return " ".join(value[index : index + 4].hex() for index in range(0, len(value), 4))
+
+
+def _capture(request: bytes, response: bytes) -> str:
+    return "\n".join(
+        (
+            f"ffff000000000001 1000 S Co:3:012:0 s 21 09 0300 0000 005a 90 = {_words(request)}",
+            "ffff000000000001 1001 C Co:3:012:0 0 90 >",
+            "ffff000000000002 1002 S Ci:3:012:0 s a1 01 0300 0000 005a 90 <",
+            f"ffff000000000002 1003 C Ci:3:012:0 0 90 = {_words(response)}",
+            "",
+        )
+    )
+
+
+def _probe(method: str) -> dict:
+    catalog = load_native_probe_catalog(ROOT)
+    profile = next(item for item in catalog["devices"] if item["profile_id"] == PROFILE)
+    return next(item for item in profile["probes"] if item["method"] == method)
+
+
+def _raw_record(method: str, request: bytes, response: bytes) -> dict:
+    return {
+        "sequence": 1,
+        "method": method,
+        "attempt": 1,
+        "request_hex": request.hex(),
+        "certainty": "matched-response",
+        "transport_errno": 0,
+        "response_hex": response.hex(),
+    }
+
+
+def _raw(records: list[dict]) -> dict:
+    return {
+        "schema": "hyperflux-native-qualification-raw-v1",
+        "source_revision": REVISION,
+        "package_sha256": PACKAGE_SHA256,
+        "profile_id": PROFILE,
+        "receiver_generation": 7,
+        "read_only": True,
+        "completed": False,
+        "records": records,
+    }
+
+
+class NativeLiveParityTests(unittest.TestCase):
+    def _direct_firmware_evidence(self) -> dict:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x1F)
+        response = _response(request, bytes((2, 51)))
+        with TemporaryDirectory() as directory:
+            direct = Path(directory) / "direct.txt"
+            direct.write_text(_capture(request, response), encoding="utf-8")
+            return build_offline_parity_evidence(
+                ROOT,
+                profile_id=PROFILE,
+                direct_capture=direct,
+                created_at="2026-07-26T00:00:00Z",
+                source_revision=REVISION,
+            )
+
+    def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((2, 51)))
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_firmware_evidence(),
+            raw_qualification=_raw([_raw_record("get_firmware", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            created_at="2026-07-26T00:01:00Z",
+            source_revision=REVISION,
+        )
+        self.assertIn("get_firmware", evidence["coverage"]["passed"])
+        self.assertTrue(evidence["safety"]["read_only"])
+        self.assertFalse(evidence["safety"]["raw_reports_persisted"])
+        serialized = json.dumps(evidence)
+        self.assertNotIn(request.hex(), serialized)
+        self.assertNotIn(response.hex(), serialized)
+
+    def test_unclassified_sent_request_and_rewritten_read_fail_closed(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((2, 51)))
+        unknown = _raw_record("get_firmware", request, response)
+        unknown["method"] = None
+        with self.assertRaises(ModelError):
+            build_live_parity_evidence(
+                ROOT,
+                profile_id=PROFILE,
+                direct_evidence=self._direct_firmware_evidence(),
+                raw_qualification=_raw([unknown]),
+                package_sha256=PACKAGE_SHA256,
+                receiver_generation=7,
+                source_revision=REVISION,
+            )
+        changed = bytearray(request)
+        changed[8] ^= 1
+        changed[88] = _crc(changed)
+        with self.assertRaises(ModelError):
+            build_live_parity_evidence(
+                ROOT,
+                profile_id=PROFILE,
+                direct_evidence=self._direct_firmware_evidence(),
+                raw_qualification=_raw(
+                    [_raw_record("get_firmware", bytes(changed), response)]
+                ),
+                package_sha256=PACKAGE_SHA256,
+                receiver_generation=7,
+                source_revision=REVISION,
+            )
+
+    def test_feature_only_topology_rejects_any_input_collection(self) -> None:
+        with TemporaryDirectory() as directory:
+            endpoint = Path(directory) / "endpoint"
+            endpoint.mkdir()
+            self.assertTrue(_feature_only_has_no_input_nodes(endpoint))
+            (endpoint / "input0").mkdir()
+            self.assertFalse(_feature_only_has_no_input_nodes(endpoint))
+
+    def test_ephemeral_raw_capture_is_deleted_even_when_supervision_fails(self) -> None:
+        with TemporaryDirectory() as directory:
+            raw = Path(directory) / "raw.json"
+            with patch.object(native_live, "_safe_raw_path", return_value=raw):
+                with self.assertRaisesRegex(RuntimeError, "supervisor failed"):
+                    with native_live._ephemeral_raw_path() as path:
+                        path.write_text("private", encoding="utf-8")
+                        raise RuntimeError("supervisor failed")
+            self.assertFalse(raw.exists())
+
+    def test_service_isolation_rejects_an_active_production_service(self) -> None:
+        inactive = Mock(returncode=3)
+        with patch.object(native_live.subprocess, "run", return_value=inactive) as run:
+            native_live._require_isolated_services()
+        self.assertEqual(run.call_count, len(native_live.INACTIVE_SERVICES))
+
+        active = Mock(returncode=0)
+        with patch.object(native_live.subprocess, "run", return_value=active):
+            with self.assertRaisesRegex(ModelError, "must be stopped"):
+                native_live._require_isolated_services()
+
+    def test_installed_qualifier_must_match_the_exact_candidate_package(self) -> None:
+        with TemporaryDirectory() as directory:
+            package = Path(directory) / "candidate.pkg.tar.zst"
+            qualifier = Path(directory) / "qualifier"
+            package.write_bytes(b"candidate package")
+            qualifier.write_bytes(b"source-bound qualifier")
+            package_digest = hashlib.sha256(package.read_bytes()).hexdigest()
+            qualifier_digest = hashlib.sha256(qualifier.read_bytes()).hexdigest()
+            with patch.object(native_live, "QUALIFIER_PATH", qualifier), patch.object(
+                native_live, "_package_member_digest", return_value=qualifier_digest
+            ):
+                native_live._verify_candidate_package(package, package_digest)
+                qualifier.write_bytes(b"different installed qualifier")
+                with self.assertRaisesRegex(ModelError, "differs from the candidate package"):
+                    native_live._verify_candidate_package(package, package_digest)
+
+    def test_only_cataloged_attributes_are_triggered(self) -> None:
+        profile = {
+            "probes": [
+                {"method": "get_firmware", "driver": {"attribute": "firmware_version"}},
+                {"method": "get_battery", "driver": {"attribute": "battery"}},
+            ]
+        }
+        process = Mock()
+        process.poll.return_value = None
+        completed = Mock(returncode=0, stderr=b"")
+        with TemporaryDirectory() as directory, patch.object(
+            native_live.shutil, "which", return_value="/usr/bin/cat"
+        ), patch.object(native_live.subprocess, "run", return_value=completed) as run:
+            entry = Path(directory)
+            result = native_live._trigger_probe_attributes(entry, profile, 5, process)
+        self.assertEqual(result, {"get_firmware": True, "get_battery": True})
+        self.assertEqual(
+            [call.args[0] for call in run.call_args_list],
+            [
+                ["/usr/bin/cat", str(entry / "firmware_version")],
+                ["/usr/bin/cat", str(entry / "battery")],
+            ],
+        )
+
+    def test_qualifier_command_binds_every_approved_material(self) -> None:
+        raw = Path("/dev/shm/hyperflux-next-native-parity-test.json")
+        command = native_live._qualifier_command(
+            profile_id=PROFILE,
+            expected_generation=7,
+            revision=REVISION,
+            package_sha256=PACKAGE_SHA256,
+            raw_path=raw,
+            timeout_seconds=90,
+            approval_text=native_live.READ_ONLY_APPROVAL,
+        )
+        self.assertEqual(command[0], str(native_live.QUALIFIER_PATH))
+        for value in (PROFILE, "7", REVISION, PACKAGE_SHA256, str(raw), "90"):
+            self.assertIn(value, command)
+        self.assertEqual(command[-1], native_live.READ_ONLY_APPROVAL)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index 0e1ec5a..e859ddf 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -303,7 +303,7 @@ def test_artifact_manifest_binds_every_declared_build(self) -> None:
                 return_value=("a" * 40, 1_700_000_000),
             ):
                 artifacts = load_artifact_set(ROOT, path)
-            self.assertEqual(len(artifacts.artifacts), 9)
+            self.assertEqual(len(artifacts.artifacts), 10)
             self.assertFalse(artifacts.omitted)
 
     def test_artifact_tamper_is_rejected_before_staging(self) -> None:
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 6a3b35c..70ffa94 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -15,6 +15,7 @@
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
 from .native_control import write_native_method_inventory
+from .native_live_parity import run_live_parity
 from .native_onboarding import (
     build_draft_from_file,
     build_promotion_from_files,
@@ -129,6 +130,18 @@ def _parser() -> argparse.ArgumentParser:
     parity.add_argument("--direct-capture", required=True, type=Path)
     parity.add_argument("--receiver-capture", type=Path)
     parity.add_argument("--receiver-result", type=Path)
+    live_parity = native_commands.add_parser(
+        "live-parity",
+        help="run one restoration-isolated read-only candidate parity session",
+    )
+    live_parity.add_argument("--profile", required=True)
+    live_parity.add_argument("--direct-evidence", required=True, type=Path)
+    live_parity.add_argument("--package", required=True, type=Path)
+    live_parity.add_argument("--package-sha256", required=True)
+    live_parity.add_argument("--expected-generation", required=True, type=int)
+    live_parity.add_argument("--approval-text", required=True)
+    live_parity.add_argument("--user", required=True)
+    live_parity.add_argument("--timeout-seconds", type=int, default=90)
     native_openrazer = native_commands.add_parser(
         "prepare-openrazer",
         help="prepare the source-bound OpenRazer native transport tree",
@@ -356,6 +369,28 @@ def main(arguments: list[str] | None = None) -> int:
                 )
                 print(f"Privacy-safe evidence: {destination}")
                 return 0
+            if args.native_command == "live-parity":
+                result = run_live_parity(
+                    root,
+                    profile_id=args.profile,
+                    direct_evidence_path=args.direct_evidence,
+                    package=args.package,
+                    package_sha256=args.package_sha256,
+                    expected_generation=args.expected_generation,
+                    approval_text=args.approval_text,
+                    user=args.user,
+                    timeout_seconds=args.timeout_seconds,
+                )
+                print(f"Native transport parity: {result.conclusion}")
+                print(
+                    "Coverage: "
+                    f"{len(result.passed)} passed, "
+                    f"{len(result.missing)} incomplete, "
+                    f"{len(result.failed)} failed"
+                )
+                print(f"Privacy-safe evidence: {result.evidence_path}")
+                print(f"Source-bound run: {result.run_path}")
+                return 0
             if args.native_command == "prepare-openrazer":
                 prepared = prepare_openrazer_native_source(
                     root, args.source, args.output
diff --git a/tools/hfxdev/native_live_parity.py b/tools/hfxdev/native_live_parity.py
new file mode 100644
index 0000000..766a4b1
--- /dev/null
+++ b/tools/hfxdev/native_live_parity.py
@@ -0,0 +1,521 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+from dataclasses import dataclass
+from datetime import UTC, datetime
+import hashlib
+import json
+import os
+from pathlib import Path
+import pwd
+import re
+import selectors
+import shutil
+import stat
+import subprocess
+import time
+from typing import Any
+
+from .model import ModelError, sha256_file
+from .native_parity import (
+    build_live_parity_evidence,
+    validate_parity_evidence,
+    write_parity_evidence,
+)
+from .native_probe import load_native_probe_catalog
+from .openrazer_native_route import load_native_route_catalog
+from .private_artifact import write_new_private_json
+
+
+QUALIFIER_PATH = Path("/usr/lib/hyperflux-next/hyperflux-next-native-qualifier")
+QUALIFIER_PACKAGE_MEMBER = "usr/lib/hyperflux-next/hyperflux-next-native-qualifier"
+READ_ONLY_APPROVAL = (
+    "approve HyperFlux Next restoration-isolated bounded read-only native parity probes"
+)
+LIVE_RESULT_SCHEMA = "hyperflux-native-live-parity-result-v1"
+RAW_PREFIX = "hyperflux-next-native-parity-"
+MAX_PRIVATE_JSON_BYTES = 1024 * 1024
+MAX_BINARY_BYTES = 32 * 1024 * 1024
+MAX_PROCESS_OUTPUT_BYTES = 64 * 1024
+SHA256_PATTERN = re.compile(r"[0-9a-f]{64}\Z")
+SOURCE_REVISION_PATTERN = re.compile(r"[0-9a-f]{40}\Z")
+VIRTUAL_HID_PATTERN = re.compile(r"0006:([0-9A-Fa-f]{4}):([0-9A-Fa-f]{4})\.[0-9A-Fa-f]{4}\Z")
+INACTIVE_SERVICES = (
+    "hyperflux-next-bridge.service",
+    "hyperflux-next-openrazer-relay.service",
+)
+
+
+@dataclass(frozen=True)
+class LiveParityResult:
+    evidence_path: Path
+    run_path: Path
+    conclusion: str
+    passed: tuple[str, ...]
+    missing: tuple[str, ...]
+    failed: tuple[str, ...]
+
+
+def _git_revision(root: Path) -> str:
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "HEAD"],
+            cwd=root,
+            check=True,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=10,
+        )
+        status = subprocess.run(
+            ["git", "status", "--porcelain"],
+            cwd=root,
+            check=True,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=10,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot bind live parity to source: {error}") from error
+    revision = result.stdout.strip()
+    if SOURCE_REVISION_PATTERN.fullmatch(revision) is None or status.stdout:
+        raise ModelError("live parity requires one exact clean source revision")
+    return revision
+
+
+def _read_private_json(path: Path, *, maximum_bytes: int = MAX_PRIVATE_JSON_BYTES) -> dict[str, Any]:
+    candidate = path.expanduser()
+    if candidate.is_symlink():
+        raise ModelError("private qualification input may not be a symbolic link")
+    try:
+        metadata = candidate.stat()
+    except OSError as error:
+        raise ModelError(f"cannot inspect private qualification input: {error}") from error
+    if (
+        not stat.S_ISREG(metadata.st_mode)
+        or metadata.st_size > maximum_bytes
+        or stat.S_IMODE(metadata.st_mode) & 0o077
+    ):
+        raise ModelError("private qualification input is not a bounded 0600 regular file")
+    try:
+        value = json.loads(candidate.read_text(encoding="utf-8"))
+    except (OSError, UnicodeError, json.JSONDecodeError) as error:
+        raise ModelError(f"cannot read private qualification input: {error}") from error
+    if not isinstance(value, dict):
+        raise ModelError("private qualification input must be a JSON object")
+    return value
+
+
+def _bounded_process_output(value: str) -> str:
+    encoded = value.encode("utf-8", errors="replace")
+    if len(encoded) > MAX_PROCESS_OUTPUT_BYTES:
+        raise ModelError("native qualifier output exceeded its bound")
+    return value.strip()
+
+
+def _package_member_digest(package: Path) -> str:
+    bsdtar = shutil.which("bsdtar")
+    if bsdtar is None:
+        raise ModelError("bsdtar is required to verify the installed qualifier")
+    for member in (QUALIFIER_PACKAGE_MEMBER, f"./{QUALIFIER_PACKAGE_MEMBER}"):
+        try:
+            result = subprocess.run(
+                [bsdtar, "-xOf", str(package), member],
+                check=False,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                timeout=30,
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot inspect candidate package: {error}") from error
+        if result.returncode == 0:
+            if not 0 < len(result.stdout) <= MAX_BINARY_BYTES:
+                raise ModelError("packaged native qualifier has an invalid size")
+            return hashlib.sha256(result.stdout).hexdigest()
+    raise ModelError("candidate package does not contain the native qualifier")
+
+
+def _verify_candidate_package(package: Path, expected_sha256: str) -> None:
+    if SHA256_PATTERN.fullmatch(expected_sha256) is None:
+        raise ModelError("candidate package digest is invalid")
+    candidate = package.expanduser()
+    if candidate.is_symlink() or not candidate.is_file():
+        raise ModelError("candidate package must be a regular file")
+    if sha256_file(candidate) != expected_sha256:
+        raise ModelError("candidate package digest differs from the reviewed value")
+    if QUALIFIER_PATH.is_symlink() or not QUALIFIER_PATH.is_file():
+        raise ModelError("the installed native qualifier is unavailable")
+    packaged = _package_member_digest(candidate)
+    if sha256_file(QUALIFIER_PATH) != packaged:
+        raise ModelError("the installed native qualifier differs from the candidate package")
+
+
+def _require_isolated_services() -> None:
+    for service in INACTIVE_SERVICES:
+        try:
+            result = subprocess.run(
+                ["systemctl", "is-active", "--quiet", service],
+                check=False,
+                stdout=subprocess.DEVNULL,
+                stderr=subprocess.DEVNULL,
+                timeout=10,
+            )
+        except (OSError, subprocess.SubprocessError) as error:
+            raise ModelError(f"cannot inspect qualification service isolation: {error}") from error
+        if result.returncode == 0:
+            raise ModelError(
+                "production bridge and native relay must be stopped before read-only qualification"
+            )
+
+
+def _profile_authority(
+    root: Path, profile_id: str
+) -> tuple[dict[str, Any], dict[str, Any], dict[str, Any]]:
+    probes = load_native_probe_catalog(root)
+    routes = load_native_route_catalog(root)
+    probe_matches = [item for item in probes["devices"] if item["profile_id"] == profile_id]
+    route_matches = [item for item in routes["routes"] if item["profile_id"] == profile_id]
+    if len(probe_matches) != 1 or len(route_matches) != 1:
+        raise ModelError("live parity profile is not an exact native-route candidate")
+    return probes, probe_matches[0], route_matches[0]
+
+
+def _wait_for_ready(process: subprocess.Popen[str], timeout_seconds: float) -> str:
+    if process.stdout is None:
+        raise ModelError("native qualifier output channel is unavailable")
+    selector = selectors.DefaultSelector()
+    selector.register(process.stdout, selectors.EVENT_READ)
+    deadline = time.monotonic() + timeout_seconds
+    lines: list[str] = []
+    try:
+        while time.monotonic() < deadline:
+            if process.poll() is not None:
+                remainder = process.stdout.read()
+                if remainder:
+                    lines.append(remainder)
+                break
+            events = selector.select(timeout=0.1)
+            for key, _mask in events:
+                line = key.fileobj.readline()
+                if not line:
+                    continue
+                lines.append(line)
+                if line.startswith("HFX_NATIVE_QUALIFIER_READY "):
+                    return _bounded_process_output("".join(lines))
+    finally:
+        selector.close()
+    raise ModelError("native qualifier did not reach its bounded ready state")
+
+
+def _read_bounded_uevent(path: Path) -> str:
+    try:
+        metadata = path.stat()
+        if not stat.S_ISREG(metadata.st_mode) or metadata.st_size > 16 * 1024:
+            raise ModelError("virtual HID identity metadata is invalid")
+        return path.read_text(encoding="utf-8")
+    except (OSError, UnicodeError) as error:
+        raise ModelError(f"cannot inspect virtual HID identity: {error}") from error
+
+
+def _find_virtual_device(route: dict[str, Any], timeout_seconds: float) -> Path:
+    driver_root = Path("/sys/bus/hid/drivers") / route["driver_family"]
+    deadline = time.monotonic() + timeout_seconds
+    expected_vendor = route["vendor_id"]
+    expected_product = route["wireless_product_id"]
+    while time.monotonic() < deadline:
+        matches: list[Path] = []
+        try:
+            entries = tuple(driver_root.iterdir())
+        except OSError:
+            entries = ()
+        for entry in entries:
+            match = VIRTUAL_HID_PATTERN.fullmatch(entry.name)
+            if match is None:
+                continue
+            vendor = int(match.group(1), 16)
+            product = int(match.group(2), 16)
+            if (vendor, product) != (expected_vendor, expected_product):
+                continue
+            uevent = _read_bounded_uevent(entry / "uevent")
+            if any(
+                line.startswith("HID_PHYS=hyperflux-next/native/v1/qualify-")
+                for line in uevent.splitlines()
+            ):
+                matches.append(entry)
+        if len(matches) == 1:
+            return matches[0]
+        if len(matches) > 1:
+            raise ModelError("more than one exact qualification HID endpoint appeared")
+        time.sleep(0.05)
+    raise ModelError("the exact qualification HID endpoint did not appear")
+
+
+def _feature_only_has_no_input_nodes(entry: Path) -> bool:
+    try:
+        target = entry.resolve(strict=True)
+        return not any(
+            path.is_dir() and (path.name == "input" or path.name.startswith("input"))
+            for path in target.rglob("*")
+        )
+    except OSError as error:
+        raise ModelError(f"cannot verify feature-only HID topology: {error}") from error
+
+
+def _trigger_probe_attributes(
+    entry: Path,
+    profile: dict[str, Any],
+    maximum_attempts: int,
+    process: subprocess.Popen[str],
+) -> dict[str, bool]:
+    cat = shutil.which("cat")
+    if cat is None:
+        raise ModelError("cat is required to trigger OpenRazer read attributes")
+    results: dict[str, bool] = {}
+    for probe in profile["probes"]:
+        method = probe["method"]
+        attribute = entry / probe["driver"]["attribute"]
+        success = False
+        for _attempt in range(maximum_attempts):
+            if process.poll() is not None:
+                break
+            try:
+                read = subprocess.run(
+                    [cat, str(attribute)],
+                    check=False,
+                    stdout=subprocess.DEVNULL,
+                    stderr=subprocess.PIPE,
+                    timeout=8,
+                )
+            except subprocess.TimeoutExpired:
+                continue
+            except OSError as error:
+                raise ModelError(f"cannot trigger source-bound OpenRazer attribute: {error}") from error
+            if len(read.stderr) > MAX_PROCESS_OUTPUT_BYTES:
+                raise ModelError("OpenRazer attribute error output exceeded its bound")
+            if read.returncode == 0:
+                success = True
+                break
+            time.sleep(0.02)
+        results[method] = success
+    return results
+
+
+def _terminate_process(process: subprocess.Popen[str]) -> None:
+    if process.poll() is not None:
+        return
+    process.terminate()
+    try:
+        process.wait(timeout=3)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait(timeout=3)
+
+
+def _wait_for_completion(process: subprocess.Popen[str], timeout_seconds: float) -> tuple[str, str]:
+    try:
+        stdout, stderr = process.communicate(timeout=timeout_seconds)
+    except subprocess.TimeoutExpired:
+        _terminate_process(process)
+        stdout, stderr = process.communicate(timeout=1)
+    return _bounded_process_output(stdout), _bounded_process_output(stderr)
+
+
+def _safe_raw_path() -> Path:
+    nonce = os.urandom(12).hex()
+    return Path("/dev/shm") / f"{RAW_PREFIX}{nonce}.json"
+
+
+@contextmanager
+def _ephemeral_raw_path() -> Iterator[Path]:
+    path = _safe_raw_path()
+    try:
+        yield path
+    finally:
+        path.unlink(missing_ok=True)
+
+
+def _user_cache(user: str, leaf: str) -> tuple[Path, int, int]:
+    try:
+        account = pwd.getpwnam(user)
+    except KeyError as error:
+        raise ModelError("live parity output user does not exist") from error
+    if account.pw_uid == 0:
+        raise ModelError("live parity output must belong to a non-root operator")
+    return Path(account.pw_dir) / ".cache" / "hyperflux-next" / leaf, account.pw_uid, account.pw_gid
+
+
+def _drop_to_operator(user: str, uid: int, gid: int) -> None:
+    try:
+        os.initgroups(user, gid)
+        os.setgid(gid)
+        os.setuid(uid)
+    except OSError as error:
+        raise ModelError(f"cannot drop native parity output to the operator: {error}") from error
+    if os.geteuid() != uid or os.getegid() != gid:
+        raise ModelError("native parity output privilege drop did not become exact")
+
+
+def _qualifier_command(
+    *,
+    profile_id: str,
+    expected_generation: int,
+    revision: str,
+    package_sha256: str,
+    raw_path: Path,
+    timeout_seconds: int,
+    approval_text: str,
+) -> list[str]:
+    return [
+        str(QUALIFIER_PATH),
+        "--profile",
+        profile_id,
+        "--expected-generation",
+        str(expected_generation),
+        "--source-revision",
+        revision,
+        "--package-sha256",
+        package_sha256,
+        "--raw-output",
+        str(raw_path),
+        "--timeout-seconds",
+        str(timeout_seconds),
+        "--approval-text",
+        approval_text,
+    ]
+
+
+def run_live_parity(
+    root: Path,
+    *,
+    profile_id: str,
+    direct_evidence_path: Path,
+    package: Path,
+    package_sha256: str,
+    expected_generation: int,
+    approval_text: str,
+    user: str,
+    timeout_seconds: int = 90,
+) -> LiveParityResult:
+    """Run one exact, restoration-isolated, read-only receiver parity session."""
+
+    if os.geteuid() != 0:
+        raise ModelError("live native parity must run as root")
+    if approval_text != READ_ONLY_APPROVAL:
+        raise ModelError("the exact read-only native parity approval is missing")
+    if not 10 <= timeout_seconds <= 120 or not 1 <= expected_generation < 2**63:
+        raise ModelError("live native parity generation or timeout is invalid")
+    revision = _git_revision(root)
+    _verify_candidate_package(package, package_sha256)
+    _require_isolated_services()
+    probes, profile, route = _profile_authority(root, profile_id)
+    direct_evidence = _read_private_json(direct_evidence_path)
+    validate_parity_evidence(direct_evidence)
+    parity_cache, uid, gid = _user_cache(user, "native-transport-parity")
+    run_cache, _uid, _gid = _user_cache(user, "native-live-parity")
+    process: subprocess.Popen[str] | None = None
+    raw_qualification: dict[str, Any] | None = None
+    attribute_results: dict[str, bool] = {}
+    no_input_nodes = False
+    qualifier_stdout = ""
+    qualifier_stderr = ""
+    with _ephemeral_raw_path() as raw_path:
+        command = _qualifier_command(
+            profile_id=profile_id,
+            expected_generation=expected_generation,
+            revision=revision,
+            package_sha256=package_sha256,
+            raw_path=raw_path,
+            timeout_seconds=timeout_seconds,
+            approval_text=approval_text,
+        )
+        try:
+            process = subprocess.Popen(
+                command,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                bufsize=1,
+            )
+            qualifier_stdout = _wait_for_ready(process, 10)
+            entry = _find_virtual_device(route, 10)
+            no_input_nodes = _feature_only_has_no_input_nodes(entry)
+            if not no_input_nodes:
+                raise ModelError("qualification UHID endpoint created an input collection")
+            attribute_results = _trigger_probe_attributes(
+                entry,
+                profile,
+                probes["busy_retry"]["maximum_attempts"],
+                process,
+            )
+            final_stdout, qualifier_stderr = _wait_for_completion(process, 10)
+            qualifier_stdout = "\n".join(
+                value for value in (qualifier_stdout, final_stdout) if value
+            )
+            raw_qualification = _read_private_json(raw_path)
+        finally:
+            if process is not None:
+                _terminate_process(process)
+    if raw_path.exists():
+        raise ModelError("ephemeral native qualification capture was not deleted")
+    if raw_qualification is None:
+        raise ModelError("native qualifier produced no sanitizable capture")
+
+    timestamp = datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    evidence = build_live_parity_evidence(
+        root,
+        profile_id=profile_id,
+        direct_evidence=direct_evidence,
+        raw_qualification=raw_qualification,
+        package_sha256=package_sha256,
+        receiver_generation=expected_generation,
+        created_at=timestamp,
+        source_revision=revision,
+    )
+    _drop_to_operator(user, uid, gid)
+    evidence_path = write_parity_evidence(evidence, cache_root=parity_cache)
+    coverage = evidence["coverage"]
+    run_result = {
+        "schema": LIVE_RESULT_SCHEMA,
+        "created_at": timestamp,
+        "source_revision": revision,
+        "package_sha256": package_sha256,
+        "profile_id": profile_id,
+        "receiver_generation": expected_generation,
+        "read_only": True,
+        "production_services_isolated": True,
+        "feature_only_no_input_nodes": no_input_nodes,
+        "methods_triggered": [
+            {"method": method, "attribute_read_succeeded": attribute_results.get(method, False)}
+            for method in coverage["required"]
+        ],
+        "qualifier_completed": raw_qualification["completed"],
+        "qualifier_exit_code": process.returncode if process is not None else None,
+        "qualifier_ready_recorded": "HFX_NATIVE_QUALIFIER_READY " in qualifier_stdout,
+        "qualifier_error_recorded": bool(qualifier_stderr),
+        "ephemeral_raw_deleted": True,
+        "parity_sha256": sha256_file(evidence_path),
+        "conclusion": evidence["conclusion"],
+        "coverage": coverage,
+        "network_upload": False,
+        "settings_changed": False,
+        "rgb_changed": False,
+    }
+    stamp = re.sub(r"[^0-9TZ]", "", timestamp)
+    safe_profile = re.sub(r"[^a-z0-9.-]", "-", profile_id)
+    run_path = write_new_private_json(
+        run_cache,
+        f"{stamp}-{safe_profile}.json",
+        run_result,
+    )
+    return LiveParityResult(
+        evidence_path=evidence_path,
+        run_path=run_path,
+        conclusion=evidence["conclusion"],
+        passed=tuple(coverage["passed"]),
+        missing=tuple(coverage["missing"]),
+        failed=tuple(coverage["failed"]),
+    )
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index 59b65e6..4f5bb68 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -20,6 +20,7 @@
 
 
 EVIDENCE_SCHEMA = "hyperflux-native-transport-parity-evidence-v1"
+RAW_QUALIFICATION_SCHEMA = "hyperflux-native-qualification-raw-v1"
 USBMON_LIMIT_BYTES = 16 * 1024 * 1024
 USBMON_LIMIT_LINES = 65536
 PIPE_PATTERN = re.compile(r"C[oi]:(?P<bus>[0-9]+):(?P<device>[0-9]+):(?P<endpoint>[0-9]+)\Z")
@@ -29,6 +30,7 @@
 PROFILE_PATTERN = re.compile(r"child\.[a-z0-9.-]+\Z")
 SUCCESS_STATUS = 2
 COMPARISONS = {"exact-semantic", "domain-valid", "redacted-equality"}
+QUALIFICATION_CERTAINTIES = {"not-sent", "may-have-been-sent", "matched-response"}
 
 
 @dataclass(frozen=True)
@@ -352,6 +354,281 @@ def _match_exchanges(
     return matched
 
 
+def _validate_raw_qualification(
+    value: dict[str, Any],
+    *,
+    profile_id: str,
+    source_revision: str,
+    package_sha256: str,
+    receiver_generation: int,
+) -> None:
+    if not isinstance(value, dict) or set(value) != {
+        "schema",
+        "source_revision",
+        "package_sha256",
+        "profile_id",
+        "receiver_generation",
+        "read_only",
+        "completed",
+        "records",
+    }:
+        raise ModelError("native qualification raw capture is malformed")
+    if (
+        value["schema"] != RAW_QUALIFICATION_SCHEMA
+        or value["profile_id"] != profile_id
+        or value["source_revision"] != source_revision
+        or value["package_sha256"] != package_sha256
+        or value["receiver_generation"] != receiver_generation
+        or value["read_only"] is not True
+        or not isinstance(value["completed"], bool)
+    ):
+        raise ModelError("native qualification raw capture binding is invalid")
+    records = value["records"]
+    if not isinstance(records, list) or len(records) > 128:
+        raise ModelError("native qualification raw capture is not bounded")
+    expected_sequence = 1
+    for record in records:
+        if not isinstance(record, dict) or set(record) != {
+            "sequence",
+            "method",
+            "attempt",
+            "request_hex",
+            "certainty",
+            "transport_errno",
+            "response_hex",
+        }:
+            raise ModelError("native qualification raw record is malformed")
+        method = record["method"]
+        request_hex = record["request_hex"]
+        response_hex = record["response_hex"]
+        if (
+            record["sequence"] != expected_sequence
+            or (method is not None and (
+                not isinstance(method, str) or METHOD_PATTERN.fullmatch(method) is None
+            ))
+            or not _bounded_int(record["attempt"], 0, 6)
+            or not isinstance(request_hex, str)
+            or re.fullmatch(r"[0-9a-f]{180}", request_hex) is None
+            or record["certainty"] not in QUALIFICATION_CERTAINTIES
+            or not isinstance(record["transport_errno"], int)
+            or not -(2**31) <= record["transport_errno"] < 2**31
+            or (
+                response_hex is not None
+                and (
+                    not isinstance(response_hex, str)
+                    or re.fullmatch(r"[0-9a-f]{180}", response_hex) is None
+                )
+            )
+        ):
+            raise ModelError("native qualification raw record value is invalid")
+        if method is None and (
+            record["certainty"] != "not-sent" or response_hex is not None
+        ):
+            raise ModelError("an unclassified qualification request crossed transport")
+        if record["certainty"] == "matched-response" and response_hex is None:
+            raise ModelError("matched qualification response is absent")
+        if record["certainty"] != "matched-response" and response_hex is not None:
+            raise ModelError("non-matched qualification record contains a response")
+        expected_sequence += 1
+
+
+def _raw_receiver_matches(
+    profile: dict[str, Any], raw: dict[str, Any]
+) -> dict[str, list[MatchedExchange]]:
+    probes = {probe["method"]: probe for probe in profile["probes"]}
+    matched: dict[str, list[MatchedExchange]] = {}
+    for record in raw["records"]:
+        method = record["method"]
+        if method is None or record["certainty"] != "matched-response":
+            continue
+        probe = probes.get(method)
+        if probe is None:
+            raise ModelError("native qualification raw method is not source-bound")
+        request = bytes.fromhex(record["request_hex"])
+        response = bytes.fromhex(record["response_hex"])
+        if not _request_matches_signature(probe, request):
+            raise ModelError("native qualification request differs from its upstream signature")
+        canonical = canonical_request(probe, request[1])
+        if request != canonical:
+            raise ModelError("native qualification request was rewritten")
+        summary, semantic, serial = _semantic_summary(probe["response_summary"], response)
+        item = MatchedExchange(
+            method=method,
+            probe=probe,
+            exchange=UsbmonExchange(
+                timestamp_us=record["sequence"],
+                bus=0,
+                device=0,
+                interface=0,
+                request=request,
+                request_length=REPORT_SIZE,
+                response=response,
+                response_length=REPORT_SIZE,
+            ),
+            canonical_request=canonical,
+            request_complete=True,
+            request_exact=True,
+            response_structural=_response_is_structural(request, response),
+            response_complete=True,
+            summary=summary,
+            semantic_value=semantic,
+            serial_value=serial,
+        )
+        matched.setdefault(method, []).append(item)
+    return matched
+
+
+def _semantic_parity_from_evidence(
+    probe: dict[str, Any],
+    direct: dict[str, Any] | None,
+    receiver: MatchedExchange,
+) -> bool | None:
+    if direct is None:
+        return None
+    response = direct["response"]
+    if (
+        response["status"] != SUCCESS_STATUS
+        or response["structural_match"] is not True
+        or response["complete_capture"] is not True
+    ):
+        return None
+    comparison = probe["comparison"]
+    direct_summary = response["summary"]
+    if comparison == "redacted-equality":
+        return None
+    if comparison == "domain-valid":
+        return bool(
+            direct_summary.get("available") is True
+            and receiver.summary.get("available") is True
+        )
+    if comparison == "exact-semantic":
+        return direct_summary == receiver.summary
+    raise ModelError("native qualification comparison policy is unsupported")
+
+
+def build_live_parity_evidence(
+    root: Path,
+    *,
+    profile_id: str,
+    direct_evidence: dict[str, Any],
+    raw_qualification: dict[str, Any],
+    package_sha256: str,
+    receiver_generation: int,
+    created_at: str | None = None,
+    source_revision: str | None = None,
+) -> dict[str, Any]:
+    """Sanitize one ephemeral receiver qualification into canonical parity evidence."""
+
+    catalog = load_native_probe_catalog(root)
+    profile = _profile(catalog, profile_id)
+    revision = source_revision or _git_revision(root)
+    if SOURCE_REVISION_PATTERN.fullmatch(revision) is None:
+        raise ModelError("native live parity source revision is invalid")
+    if SHA256_PATTERN.fullmatch(package_sha256) is None:
+        raise ModelError("native live parity package digest is invalid")
+    if not _bounded_int(receiver_generation, 1, 2**63 - 1):
+        raise ModelError("native live parity receiver generation is invalid")
+    validate_parity_evidence(direct_evidence)
+    if (
+        direct_evidence["profile_id"] != profile_id
+        or direct_evidence["upstream_commit"] != catalog["upstream"]["commit"]
+        or direct_evidence["catalog_sha256"]
+        != sha256_file(root / "integrations" / "openrazer" / "native-probe-catalog.json")
+    ):
+        raise ModelError("direct semantic reference differs from the live probe authority")
+    _validate_raw_qualification(
+        raw_qualification,
+        profile_id=profile_id,
+        source_revision=revision,
+        package_sha256=package_sha256,
+        receiver_generation=receiver_generation,
+    )
+    receiver_matches = _raw_receiver_matches(profile, raw_qualification)
+    direct_by_method = {
+        observation["method"]: observation
+        for observation in direct_evidence["observations"]
+        if observation["origin"] == "direct-semantic-reference"
+    }
+    maximum_attempts = catalog["busy_retry"]["maximum_attempts"]
+    required = [probe["method"] for probe in profile["probes"]]
+    probes = {probe["method"]: probe for probe in profile["probes"]}
+    observations: list[dict[str, Any]] = []
+    receiver_observations: dict[str, dict[str, Any]] = {}
+    for method in required:
+        direct = direct_by_method.get(method)
+        if direct is not None:
+            observations.append(direct)
+        routed = receiver_matches.get(method, [])
+        if not routed:
+            continue
+        receiver = _receiver_observation(routed, None, maximum_attempts)
+        receiver["receiver_comparison"]["semantic_parity"] = (
+            _semantic_parity_from_evidence(probes[method], direct, routed[-1])
+        )
+        receiver_observations[method] = receiver
+        observations.append(receiver)
+
+    passed: list[str] = []
+    failed: list[str] = []
+    for method in required:
+        receiver = receiver_observations.get(method)
+        if receiver is None:
+            continue
+        comparison = receiver["receiver_comparison"]
+        states = tuple(
+            comparison[field]
+            for field in ("unchanged_request", "standard_response", "semantic_parity")
+        )
+        if all(state is True for state in states):
+            passed.append(method)
+        elif any(state is False for state in states):
+            failed.append(method)
+    missing = [method for method in required if method not in passed and method not in failed]
+    backend_required = any(
+        observation["receiver_comparison"][field] is False
+        for observation in receiver_observations.values()
+        for field in ("unchanged_request", "standard_response")
+    )
+    conclusion = (
+        "backend-required"
+        if backend_required
+        else "passed"
+        if not missing and not failed
+        else "incomplete"
+    )
+    timestamp = created_at or datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    evidence = {
+        "$schema": "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json",
+        "schema": EVIDENCE_SCHEMA,
+        "created_at": timestamp,
+        "source_revision": revision,
+        "profile_id": profile_id,
+        "upstream_commit": catalog["upstream"]["commit"],
+        "catalog_sha256": sha256_file(
+            root / "integrations" / "openrazer" / "native-probe-catalog.json"
+        ),
+        "safety": {
+            "read_only": True,
+            "settings_changed": False,
+            "serials_persisted": False,
+            "raw_reports_persisted": False,
+            "private_paths_persisted": False,
+            "network_upload": False,
+            "file_mode": "0600",
+        },
+        "observations": observations,
+        "coverage": {
+            "required": required,
+            "passed": passed,
+            "missing": missing,
+            "failed": failed,
+        },
+        "conclusion": conclusion,
+    }
+    validate_parity_evidence(evidence)
+    return evidence
+
+
 def _request_evidence(item: MatchedExchange) -> dict[str, Any]:
     request = item.probe["request"]
     observed = item.exchange.request if item.request_complete else item.canonical_request

From 0d33f3a5b2283f0b4c7a6d493851922a945857b0 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 11:05:18 +0400
Subject: [PATCH 55/67] fix(native): retry qualifier reads only after busy

---
 crates/hfx-uhid-relay/src/qualification.rs | 95 +++++++++++++++++++++-
 1 file changed, 92 insertions(+), 3 deletions(-)

diff --git a/crates/hfx-uhid-relay/src/qualification.rs b/crates/hfx-uhid-relay/src/qualification.rs
index 826ec14..ce938b4 100644
--- a/crates/hfx-uhid-relay/src/qualification.rs
+++ b/crates/hfx-uhid-relay/src/qualification.rs
@@ -6,11 +6,12 @@ use hfx_kernel_transport::{
     NativeExchangeCertainty, NativeExchangeOutcome, NativeExchangeRequest,
 };
 use serde::Serialize;
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 use std::time::Duration;
 
 const QUALIFICATION_TIMEOUT: Duration = Duration::from_secs(1);
 const MAX_QUALIFICATION_EVENTS: usize = 128;
+const DEVICE_STATUS_BUSY: u8 = 1;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
 #[serde(rename_all = "kebab-case")]
@@ -60,6 +61,7 @@ pub(crate) struct QualificationBridge<T> {
     probes: Vec<NativeQualificationProbe>,
     maximum_attempts: u8,
     attempts: BTreeMap<String, u8>,
+    terminal_methods: BTreeSet<String>,
     next_nonce: u64,
     records: Vec<QualificationExchangeRecord>,
 }
@@ -83,6 +85,7 @@ impl<T: QualificationNativeTransport> QualificationBridge<T> {
             probes,
             maximum_attempts,
             attempts: BTreeMap::new(),
+            terminal_methods: BTreeSet::new(),
             next_nonce: 1,
             records: Vec::with_capacity(MAX_QUALIFICATION_EVENTS),
         })
@@ -102,7 +105,7 @@ impl<T: QualificationNativeTransport> QualificationBridge<T> {
                     && record
                         .response
                         .as_ref()
-                        .is_some_and(|response| response[0] != 1)
+                        .is_some_and(|response| response[0] != DEVICE_STATUS_BUSY)
             })
         })
     }
@@ -158,6 +161,17 @@ impl<T: QualificationNativeTransport> QualificationBridge<T> {
             return None;
         };
         let previous_attempt = self.attempts.get(&method).copied().unwrap_or(0);
+        if self.terminal_methods.contains(&method) {
+            self.record(
+                Some(method),
+                previous_attempt.saturating_add(1),
+                report,
+                QualificationExchangeCertainty::NotSent,
+                0,
+                None,
+            );
+            return None;
+        }
         if previous_attempt >= self.maximum_attempts {
             self.record(
                 Some(method),
@@ -235,6 +249,13 @@ impl<T: QualificationNativeTransport> QualificationBridge<T> {
                 BridgeExchangeResult::MayHaveBeenSent,
             ),
         };
+        let retry_allowed = certainty == QualificationExchangeCertainty::MatchedResponse
+            && response
+                .as_ref()
+                .is_some_and(|value| value[0] == DEVICE_STATUS_BUSY);
+        if !retry_allowed {
+            self.terminal_methods.insert(method.clone());
+        }
         self.record(
             Some(method),
             attempt,
@@ -347,7 +368,7 @@ mod tests {
     #[test]
     fn unknown_or_sixth_report_never_reaches_kernel_transport() {
         let transport = FakeTransport {
-            outcomes: (0..5).map(|_| outcome([2; 90])).collect(),
+            outcomes: (0..5).map(|_| outcome([DEVICE_STATUS_BUSY; 90])).collect(),
             requests: Vec::new(),
         };
         let mut bridge = QualificationBridge::new(
@@ -373,4 +394,72 @@ mod tests {
         assert_eq!(bridge.exchange(report()), BridgeExchangeResult::NotSent);
         assert_eq!(bridge.transport.requests.len(), 5);
     }
+
+    #[test]
+    fn only_busy_response_permits_one_more_transport_attempt() {
+        let mut success = [0_u8; FEATURE_REPORT_BYTES];
+        success[0] = 2;
+        let transport = FakeTransport {
+            outcomes: vec![outcome([DEVICE_STATUS_BUSY; 90]), outcome(success)].into(),
+            requests: Vec::new(),
+        };
+        let mut bridge = QualificationBridge::new(
+            transport,
+            NativeEndpointLane::Pointer,
+            [0x44; 32],
+            vec![probe()],
+            5,
+        )
+        .expect("bridge is valid");
+
+        assert!(matches!(
+            bridge.exchange(report()),
+            BridgeExchangeResult::MatchedResponse(response)
+                if response[0] == DEVICE_STATUS_BUSY
+        ));
+        assert!(matches!(
+            bridge.exchange(report()),
+            BridgeExchangeResult::MatchedResponse(response) if response[0] == 2
+        ));
+        assert_eq!(bridge.exchange(report()), BridgeExchangeResult::NotSent);
+        assert_eq!(bridge.transport.requests.len(), 2);
+        assert_eq!(
+            bridge.records()[2].certainty,
+            QualificationExchangeCertainty::NotSent
+        );
+    }
+
+    #[test]
+    fn uncertain_outcome_permanently_blocks_automatic_retry() {
+        let transport = FakeTransport {
+            outcomes: vec![NativeExchangeOutcome {
+                authorization_epoch: 1,
+                kernel_sequence: 1,
+                dispatch_nonce: 1,
+                endpoint: NativeEndpointLane::Pointer,
+                route_token_digest: [0x44; 32],
+                request_digest: [0x55; 32],
+                certainty: NativeExchangeCertainty::MayHaveBeenSent,
+                transport_errno: 0,
+                response: None,
+            }]
+            .into(),
+            requests: Vec::new(),
+        };
+        let mut bridge = QualificationBridge::new(
+            transport,
+            NativeEndpointLane::Pointer,
+            [0x44; 32],
+            vec![probe()],
+            5,
+        )
+        .expect("bridge is valid");
+
+        assert_eq!(
+            bridge.exchange(report()),
+            BridgeExchangeResult::MayHaveBeenSent
+        );
+        assert_eq!(bridge.exchange(report()), BridgeExchangeResult::NotSent);
+        assert_eq!(bridge.transport.requests.len(), 1);
+    }
 }

From b00f8441032a554e38aec60d60bb2542ca3e3cf0 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 11:57:41 +0400
Subject: [PATCH 56/67] fix(native): preserve terminal device status parity

---
 tests/test_native_live_parity.py | 156 ++++++++++++++++++++++++++++++-
 tests/test_native_parity.py      |  80 ++++++++++++++++
 tools/hfxdev/native_parity.py    | 113 ++++++++++++++++------
 3 files changed, 317 insertions(+), 32 deletions(-)

diff --git a/tests/test_native_live_parity.py b/tests/test_native_live_parity.py
index 54c2480..74d44fb 100644
--- a/tests/test_native_live_parity.py
+++ b/tests/test_native_live_parity.py
@@ -97,20 +97,38 @@ def _raw(records: list[dict]) -> dict:
 
 
 class NativeLiveParityTests(unittest.TestCase):
-    def _direct_firmware_evidence(self) -> dict:
-        probe = _probe("get_firmware")
+    def _direct_method_evidence(
+        self,
+        method: str,
+        arguments: bytes,
+        *,
+        status: int = 2,
+        complete_capture: bool = True,
+    ) -> dict:
+        probe = _probe(method)
         request = canonical_request(probe, 0x1F)
-        response = _response(request, bytes((2, 51)))
+        response = _response(request, arguments, status=status)
         with TemporaryDirectory() as directory:
             direct = Path(directory) / "direct.txt"
             direct.write_text(_capture(request, response), encoding="utf-8")
-            return build_offline_parity_evidence(
+            evidence = build_offline_parity_evidence(
                 ROOT,
                 profile_id=PROFILE,
                 direct_capture=direct,
                 created_at="2026-07-26T00:00:00Z",
                 source_revision=REVISION,
             )
+        observation = next(
+            item
+            for item in evidence["observations"]
+            if item["method"] == method
+            and item["origin"] == "direct-semantic-reference"
+        )
+        observation["response"]["complete_capture"] = complete_capture
+        return evidence
+
+    def _direct_firmware_evidence(self) -> dict:
+        return self._direct_method_evidence("get_firmware", bytes((2, 51)))
 
     def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
         probe = _probe("get_firmware")
@@ -133,6 +151,136 @@ def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
         self.assertNotIn(request.hex(), serialized)
         self.assertNotIn(response.hex(), serialized)
 
+    def test_source_bound_semantic_reference_does_not_require_raw_direct_report(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((2, 51)))
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_method_evidence(
+                "get_firmware", bytes((2, 51)), complete_capture=False
+            ),
+            raw_qualification=_raw([_raw_record("get_firmware", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        self.assertIn("get_firmware", evidence["coverage"]["passed"])
+
+    def test_matching_terminal_failure_is_preserved_as_transport_parity(self) -> None:
+        probe = _probe("get_brightness")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((0,)), status=3)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_method_evidence(
+                "get_brightness", bytes((0,)), status=3, complete_capture=False
+            ),
+            raw_qualification=_raw([_raw_record("get_brightness", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        routed = next(
+            item
+            for item in evidence["observations"]
+            if item["method"] == "get_brightness"
+            and item["origin"] == "receiver-route"
+        )
+        self.assertEqual(
+            routed["receiver_comparison"],
+            {
+                "attempts": 1,
+                "unchanged_request": True,
+                "standard_response": True,
+                "semantic_parity": True,
+            },
+        )
+        self.assertIn("get_brightness", evidence["coverage"]["passed"])
+        self.assertNotEqual(evidence["conclusion"], "backend-required")
+
+    def test_terminal_status_mismatch_is_semantic_failure_not_backend_rewrite(self) -> None:
+        probe = _probe("get_brightness")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((0,)), status=5)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_method_evidence(
+                "get_brightness", bytes((0,)), status=3, complete_capture=False
+            ),
+            raw_qualification=_raw([_raw_record("get_brightness", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        self.assertIn("get_brightness", evidence["coverage"]["failed"])
+        self.assertEqual(evidence["conclusion"], "incomplete")
+
+    def test_matching_terminal_status_with_different_exact_summary_fails_semantics(self) -> None:
+        probe = _probe("get_brightness")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((1,)), status=3)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_method_evidence(
+                "get_brightness", bytes((0,)), status=3, complete_capture=False
+            ),
+            raw_qualification=_raw([_raw_record("get_brightness", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        self.assertIn("get_brightness", evidence["coverage"]["failed"])
+        self.assertEqual(evidence["conclusion"], "incomplete")
+
+    def test_final_busy_response_remains_incomplete(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x9F)
+        response = _response(request, bytes((0, 0)), status=1)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_firmware_evidence(),
+            raw_qualification=_raw([_raw_record("get_firmware", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        routed = next(
+            item
+            for item in evidence["observations"]
+            if item["method"] == "get_firmware"
+            and item["origin"] == "receiver-route"
+        )
+        self.assertIsNone(routed["receiver_comparison"]["standard_response"])
+        self.assertIsNone(routed["receiver_comparison"]["semantic_parity"])
+        self.assertIn("get_firmware", evidence["coverage"]["missing"])
+        self.assertEqual(evidence["conclusion"], "incomplete")
+
+    def test_malformed_receiver_response_requires_a_backend(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x9F)
+        response = bytearray(_response(request, bytes((2, 51))))
+        response[1] ^= 1
+        response[88] = _crc(response)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=self._direct_firmware_evidence(),
+            raw_qualification=_raw(
+                [_raw_record("get_firmware", request, bytes(response))]
+            ),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        self.assertIn("get_firmware", evidence["coverage"]["failed"])
+        self.assertEqual(evidence["conclusion"], "backend-required")
+
     def test_unclassified_sent_request_and_rewritten_read_fail_closed(self) -> None:
         probe = _probe("get_firmware")
         request = canonical_request(probe, 0x9F)
diff --git a/tests/test_native_parity.py b/tests/test_native_parity.py
index a810287..0c40099 100644
--- a/tests/test_native_parity.py
+++ b/tests/test_native_parity.py
@@ -111,6 +111,57 @@ def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> Non
             },
         )
 
+    def test_matching_terminal_failure_is_transport_parity_offline(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((0, 0)), status=3)
+        receiver_response = _response(receiver_request, bytes((0, 0)), status=3)
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        self.assertIn("get_firmware", evidence["coverage"]["passed"])
+        routed = next(
+            value
+            for value in evidence["observations"]
+            if value["method"] == "get_firmware" and value["origin"] == "receiver-route"
+        )
+        self.assertTrue(routed["receiver_comparison"]["standard_response"])
+        self.assertTrue(routed["receiver_comparison"]["semantic_parity"])
+
+    def test_matching_terminal_domain_status_does_not_compare_undefined_payloads(self) -> None:
+        probe = _probe(self.mouse_profile, "get_battery")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((0, 128)), status=3)
+        receiver_response = _response(receiver_request, bytes((0, 144)), status=3)
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            direct = root / "direct.txt"
+            receiver = root / "receiver.txt"
+            direct.write_text(_capture(direct_request, direct_response, device=12))
+            receiver.write_text(_capture(receiver_request, receiver_response, device=11))
+            evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=self.mouse_profile,
+                direct_capture=direct,
+                receiver_capture=receiver,
+                created_at="2026-07-25T00:00:00Z",
+                source_revision=REVISION,
+            )
+        self.assertIn("get_battery", evidence["coverage"]["passed"])
+
     def test_complete_request_rewrite_requires_a_backend(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
@@ -268,6 +319,35 @@ def test_parser_rejects_unmatched_or_nonstandard_reports(self) -> None:
             with self.assertRaisesRegex(ModelError, "unmatched"):
                 parse_usbmon_capture(capture)
 
+    def test_request_marker_and_out_of_range_status_are_not_standard_responses(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        direct_request = canonical_request(probe, 0x1F)
+        receiver_request = canonical_request(probe, 0x9F)
+        direct_response = _response(direct_request, bytes((2, 51)))
+        for status in (0, 6):
+            with self.subTest(status=status), TemporaryDirectory() as directory:
+                root = Path(directory)
+                direct = root / "direct.txt"
+                receiver = root / "receiver.txt"
+                direct.write_text(_capture(direct_request, direct_response, device=12))
+                receiver.write_text(
+                    _capture(
+                        receiver_request,
+                        _response(receiver_request, bytes((2, 51)), status=status),
+                        device=11,
+                    )
+                )
+                evidence = build_offline_parity_evidence(
+                    ROOT,
+                    profile_id=self.mouse_profile,
+                    direct_capture=direct,
+                    receiver_capture=receiver,
+                    created_at="2026-07-25T00:00:00Z",
+                    source_revision=REVISION,
+                )
+            self.assertIn("get_firmware", evidence["coverage"]["failed"])
+            self.assertEqual(evidence["conclusion"], "backend-required")
+
     def test_writer_rederives_claims_and_rejects_symlink_cache_roots(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         request = canonical_request(probe, 0x1F)
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index 4f5bb68..fa15547 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -28,7 +28,10 @@
 SOURCE_REVISION_PATTERN = re.compile(r"[0-9a-f]{40}\Z")
 METHOD_PATTERN = re.compile(r"[a-z][a-z0-9_]{0,127}\Z")
 PROFILE_PATTERN = re.compile(r"child\.[a-z0-9.-]+\Z")
+BUSY_STATUS = 1
 SUCCESS_STATUS = 2
+RESPONSE_STATUS_MINIMUM = 1
+RESPONSE_STATUS_MAXIMUM = 5
 COMPARISONS = {"exact-semantic", "domain-valid", "redacted-equality"}
 QUALIFICATION_CERTAINTIES = {"not-sent", "may-have-been-sent", "matched-response"}
 
@@ -229,6 +232,8 @@ def _request_matches_signature(probe: dict[str, Any], request: bytes) -> bool:
 def _response_is_structural(request: bytes, response: bytes) -> bool:
     if len(request) < 8 or len(response) < 8:
         return False
+    if not RESPONSE_STATUS_MINIMUM <= response[0] <= RESPONSE_STATUS_MAXIMUM:
+        return False
     if response[1] != request[1] or response[2:4] != request[2:4]:
         return False
     if response[6] != request[6] or response[7] != request[7]:
@@ -478,34 +483,78 @@ def _raw_receiver_matches(
     return matched
 
 
-def _semantic_parity_from_evidence(
+def _standard_terminal_response(item: MatchedExchange) -> bool | None:
+    if not item.response_complete:
+        return None
+    if not item.response_structural:
+        return False
+    if item.exchange.response[0] == BUSY_STATUS:
+        return None
+    return True
+
+
+def _semantic_summary_parity(
     probe: dict[str, Any],
-    direct: dict[str, Any] | None,
-    receiver: MatchedExchange,
+    *,
+    direct_status: int,
+    direct_structural: bool,
+    direct_summary: dict[str, Any],
+    receiver_status: int,
+    receiver_structural: bool,
+    receiver_summary: dict[str, Any],
 ) -> bool | None:
-    if direct is None:
-        return None
-    response = direct["response"]
-    if (
-        response["status"] != SUCCESS_STATUS
-        or response["structural_match"] is not True
-        or response["complete_capture"] is not True
-    ):
+    if not direct_structural or not receiver_structural:
+        return False
+    if BUSY_STATUS in {direct_status, receiver_status}:
         return None
+    if direct_status != receiver_status:
+        return False
+
     comparison = probe["comparison"]
-    direct_summary = response["summary"]
     if comparison == "redacted-equality":
         return None
+    if direct_status != SUCCESS_STATUS:
+        if comparison == "domain-valid":
+            return True
+        if comparison == "exact-semantic":
+            return direct_summary == receiver_summary
+        raise ModelError("native qualification comparison policy is unsupported")
     if comparison == "domain-valid":
-        return bool(
-            direct_summary.get("available") is True
-            and receiver.summary.get("available") is True
-        )
+        if (
+            direct_summary.get("available") is not True
+            or receiver_summary.get("available") is not True
+        ):
+            return None
+        return True
     if comparison == "exact-semantic":
-        return direct_summary == receiver.summary
+        if (
+            direct_summary.get("available") is not True
+            or receiver_summary.get("available") is not True
+        ):
+            return None
+        return direct_summary == receiver_summary
     raise ModelError("native qualification comparison policy is unsupported")
 
 
+def _semantic_parity_from_evidence(
+    probe: dict[str, Any],
+    direct: dict[str, Any] | None,
+    receiver: MatchedExchange,
+) -> bool | None:
+    if direct is None or not receiver.response_complete:
+        return None
+    response = direct["response"]
+    return _semantic_summary_parity(
+        probe,
+        direct_status=response["status"],
+        direct_structural=response["structural_match"],
+        direct_summary=response["summary"],
+        receiver_status=receiver.exchange.response[0],
+        receiver_structural=receiver.response_structural,
+        receiver_summary=receiver.summary,
+    )
+
+
 def build_live_parity_evidence(
     root: Path,
     *,
@@ -686,26 +735,34 @@ def _receiver_observation(
     else:
         unchanged = None
 
-    standard: bool | None
-    if final.response_complete:
-        standard = final.response_structural and final.exchange.response[0] == SUCCESS_STATUS
-    else:
-        standard = None
+    standard = _standard_terminal_response(final)
 
     semantic_parity: bool | None = None
     if direct is not None:
         comparison = final.probe["comparison"]
-        if comparison == "redacted-equality":
+        direct_status = direct.exchange.response[0]
+        receiver_status = final.exchange.response[0]
+        if (
+            direct.response_structural
+            and final.response_structural
+            and direct_status == SUCCESS_STATUS
+            and receiver_status == SUCCESS_STATUS
+            and comparison == "redacted-equality"
+        ):
             if final.serial_value is not None and direct.serial_value is not None:
                 semantic_parity = secrets.compare_digest(
                     final.serial_value, direct.serial_value
                 )
-        elif comparison == "domain-valid":
-            semantic_parity = (
-                final.semantic_value is not None and direct.semantic_value is not None
+        else:
+            semantic_parity = _semantic_summary_parity(
+                final.probe,
+                direct_status=direct_status,
+                direct_structural=direct.response_structural,
+                direct_summary=direct.summary,
+                receiver_status=receiver_status,
+                receiver_structural=final.response_structural,
+                receiver_summary=final.summary,
             )
-        elif final.semantic_value is not None and direct.semantic_value is not None:
-            semantic_parity = final.semantic_value == direct.semantic_value
 
     return {
         "method": final.method,

From 47ea56c075362d82e9ec99648c7e57c22b7928d7 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 13:50:39 +0400
Subject: [PATCH 57/67] feat(native): add declarative receiver route selectors

---
 .../tests/fixtures/rust-qualified-mouse.json  |   4 +-
 .../tests/fixtures/rust-qualified-pair.json   |   4 +-
 crates/hfx-profiles/src/generated.rs          |  28 ++-
 crates/hfx-profiles/src/lib.rs                |   3 +-
 crates/hfx-profiles/src/native_report.rs      | 163 +++++++++++++++++-
 .../decisions/declarative-route-selector.md   |  61 +++++++
 docs/architecture/design-book.md              |   8 +-
 docs/architecture/device-knowledge.md         |   7 +-
 docs/architecture/kernel.md                   |  19 +-
 docs/architecture/native-device-onboarding.md |   2 +-
 docs/generated/supported-hardware.md          |   4 +-
 .../generated/hyperflux_receiver_profiles.inc |   6 +-
 driver/kernel/hyperflux-next-native.c         | 115 +++++++++++-
 driver/kernel/hyperflux-next-profile.h        |   9 +
 generated/knowledge/catalog.json              |   2 +-
 generated/profiles/catalog.json               |  12 +-
 migration/sources.json                        |   2 +-
 .../razer-hyperflux-v2-1532-00cf.json         |   8 +-
 schemas/hardware-profile.schema.json          |  12 ++
 ...tive-transport-parity-evidence.schema.json |  32 +++-
 .../hyperflux/generated/profile_catalog.hpp   |   6 +-
 .../generated/profile_catalog.py              |  12 +-
 tests/cpp/kernel_profile_table_smoke.cpp      |  10 ++
 .../generated/profile-compositions.json       |   2 +-
 tests/test_kernel_driver.py                   |  20 +++
 tests/test_native_live_parity.py              |  28 ++-
 tests/test_native_parity.py                   |  72 +++++++-
 tests/test_profiles.py                        |  30 ++++
 tools/hfxdev/generators/profiles.py           |  60 ++++++-
 tools/hfxdev/native_parity.py                 | 145 +++++++++++++++-
 tools/hfxdev/profiles.py                      |  37 +++-
 31 files changed, 847 insertions(+), 76 deletions(-)
 create mode 100644 docs/architecture/decisions/declarative-route-selector.md

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 7b69ea1..5084881 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
+    "profile_catalog_digest": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01"
+        "digest": "164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 6432236..2bae859 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
+    "profile_catalog_digest": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
   },
   "receivers": [
     {
@@ -26,7 +26,7 @@
       "product_id": 207,
       "profile": {
         "id": "receiver.razer.hyperflux-v2.1532-00cf",
-        "digest": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01"
+        "digest": "164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11"
       },
       "lifecycle": "active",
       "devices": [
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 55f519b..2498b82 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343
+// Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -156,6 +156,19 @@ pub struct NativeTransactionIdRecord {
     pub match_mask: u8,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeRouteSelectorField {
+    TransactionId,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeRouteSelectorRecord {
+    pub field: NativeRouteSelectorField,
+    pub pointer_lane: u8,
+    pub keyboard_lane: u8,
+    pub restore_original_response: bool,
+}
+
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct NativeReportFormatRecord {
     pub request_status: NativeByteValueRecord,
@@ -177,6 +190,7 @@ pub struct NativeExchangeRecord {
     pub response_retry_delay_us: u32,
     pub max_response_attempts: u8,
     pub report_format: NativeReportFormatRecord,
+    pub route_selector: Option<NativeRouteSelectorRecord>,
     pub match_ranges: &'static [NativeMatchRangeRecord],
 }
 
@@ -207,7 +221,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343";
+    "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
@@ -608,8 +622,8 @@ pub const PROFILES: &[ProfileRecord] = &[
     },
     ProfileRecord {
         id: "receiver.razer.hyperflux-v2.1532-00cf",
-        runtime_sha256: "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01",
-        revision: 3,
+        runtime_sha256: "164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11",
+        revision: 4,
         profile_kind: ProfileKind::Receiver,
         device_kind: DeviceKind::Receiver,
         vendor_id: Some(5426),
@@ -664,6 +678,12 @@ pub const PROFILES: &[ProfileRecord] = &[
                     match_mask: 0,
                 },
             },
+            route_selector: Some(NativeRouteSelectorRecord {
+                field: NativeRouteSelectorField::TransactionId,
+                pointer_lane: 31,
+                keyboard_lane: 159,
+                restore_original_response: true,
+            }),
             match_ranges: NATIVE_MATCH_RANGES_2,
         }),
         lighting: None,
diff --git a/crates/hfx-profiles/src/lib.rs b/crates/hfx-profiles/src/lib.rs
index ab822f0..f31ed40 100644
--- a/crates/hfx-profiles/src/lib.rs
+++ b/crates/hfx-profiles/src/lib.rs
@@ -12,6 +12,7 @@ pub use catalog::{
 };
 pub use generated::*;
 pub use native_report::{
-    NativeReportValidationError, native_response_matches, validate_native_exchange_record,
+    NativeReportValidationError, NativeRouteLane, NativeRouteRewrite, native_response_matches,
+    restore_native_response, route_native_request, validate_native_exchange_record,
     validate_native_request, validate_native_response,
 };
diff --git a/crates/hfx-profiles/src/native_report.rs b/crates/hfx-profiles/src/native_report.rs
index c9dfa82..8822d1e 100644
--- a/crates/hfx-profiles/src/native_report.rs
+++ b/crates/hfx-profiles/src/native_report.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::{NativeChecksumAlgorithm, NativeExchangeRecord};
+use crate::{NativeChecksumAlgorithm, NativeExchangeRecord, NativeRouteSelectorField};
 use std::fmt;
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
@@ -15,6 +15,19 @@ pub enum NativeReportValidationError {
     InvalidTrailer,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum NativeRouteLane {
+    Pointer,
+    Keyboard,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct NativeRouteRewrite {
+    pub application_selector: u8,
+    pub receiver_selector: u8,
+    pub translated: bool,
+}
+
 impl fmt::Display for NativeReportValidationError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter.write_str(match self {
@@ -64,6 +77,15 @@ pub fn validate_native_exchange_record(
     {
         return Err(NativeReportValidationError::InvalidProfile);
     }
+    if let Some(selector) = profile.route_selector
+        && (!matches!(selector.field, NativeRouteSelectorField::TransactionId)
+            || selector.pointer_lane == 0
+            || selector.keyboard_lane == 0
+            || selector.pointer_lane == selector.keyboard_lane
+            || !selector.restore_original_response)
+    {
+        return Err(NativeReportValidationError::InvalidProfile);
+    }
     let mut previous_end = 0_usize;
     for range in profile.match_ranges {
         let offset = usize::from(range.offset);
@@ -143,6 +165,73 @@ pub fn native_response_matches(
     }))
 }
 
+/// Rewrites only the receiver-profile route selector while retaining the
+/// application-owned command bytes and original selector for response repair.
+///
+/// # Errors
+///
+/// Returns a typed structural error before mutating malformed input.
+pub fn route_native_request(
+    profile: &NativeExchangeRecord,
+    lane: NativeRouteLane,
+    report: &mut [u8],
+) -> Result<NativeRouteRewrite, NativeReportValidationError> {
+    validate_native_request(profile, report)?;
+    let offset = usize::from(profile.report_format.transaction_id.offset);
+    let application_selector = report[offset];
+    let Some(selector) = profile.route_selector else {
+        return Ok(NativeRouteRewrite {
+            application_selector,
+            receiver_selector: application_selector,
+            translated: false,
+        });
+    };
+    let receiver_selector = match lane {
+        NativeRouteLane::Pointer => selector.pointer_lane,
+        NativeRouteLane::Keyboard => selector.keyboard_lane,
+    };
+    let translated = application_selector != receiver_selector;
+    if translated {
+        report[offset] = receiver_selector;
+        update_checksum_if_covered(profile, offset, report);
+        validate_native_request(profile, report)?;
+    }
+    Ok(NativeRouteRewrite {
+        application_selector,
+        receiver_selector,
+        translated,
+    })
+}
+
+/// Restores the caller's transaction selector after a routed response matched.
+///
+/// # Errors
+///
+/// Returns a typed structural error when the response or profile is invalid.
+pub fn restore_native_response(
+    profile: &NativeExchangeRecord,
+    rewrite: NativeRouteRewrite,
+    report: &mut [u8],
+) -> Result<(), NativeReportValidationError> {
+    validate_native_response(profile, report)?;
+    if !rewrite.translated {
+        return Ok(());
+    }
+    let Some(selector) = profile.route_selector else {
+        return Err(NativeReportValidationError::InvalidProfile);
+    };
+    if !selector.restore_original_response {
+        return Err(NativeReportValidationError::InvalidProfile);
+    }
+    let offset = usize::from(profile.report_format.transaction_id.offset);
+    if report[offset] != rewrite.receiver_selector {
+        return Err(NativeReportValidationError::InvalidProfile);
+    }
+    report[offset] = rewrite.application_selector;
+    update_checksum_if_covered(profile, offset, report);
+    validate_native_response(profile, report)
+}
+
 fn validate_report_length(
     profile: &NativeExchangeRecord,
     report: &[u8],
@@ -180,12 +269,33 @@ fn validate_common_report(
     Ok(())
 }
 
+fn update_checksum_if_covered(
+    profile: &NativeExchangeRecord,
+    changed_offset: usize,
+    report: &mut [u8],
+) {
+    let checksum = profile.report_format.checksum;
+    if changed_offset < usize::from(checksum.start_offset)
+        || changed_offset >= usize::from(checksum.end_offset_exclusive)
+    {
+        return;
+    }
+    let value = match checksum.algorithm {
+        NativeChecksumAlgorithm::Xor8 => report
+            [usize::from(checksum.start_offset)..usize::from(checksum.end_offset_exclusive)]
+            .iter()
+            .fold(0_u8, |current, byte| current ^ byte),
+    };
+    report[usize::from(checksum.result_offset)] = value;
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::{
         NativeByteRangeRecord, NativeByteValueRecord, NativeChecksumRecord, NativeDataSizeRecord,
-        NativeMatchRangeRecord, NativeReportFormatRecord, NativeTransactionIdRecord,
+        NativeMatchRangeRecord, NativeReportFormatRecord, NativeRouteSelectorRecord,
+        NativeTransactionIdRecord,
     };
 
     const MATCH_RANGES: &[NativeMatchRangeRecord] = &[
@@ -241,6 +351,12 @@ mod tests {
                     match_mask: transaction_mask,
                 },
             },
+            route_selector: Some(NativeRouteSelectorRecord {
+                field: NativeRouteSelectorField::TransactionId,
+                pointer_lane: 0x1f,
+                keyboard_lane: 0x9f,
+                restore_original_response: true,
+            }),
             match_ranges: MATCH_RANGES,
         }
     }
@@ -336,4 +452,47 @@ mod tests {
             Err(NativeReportValidationError::InvalidResponseStatus)
         );
     }
+
+    #[test]
+    fn route_selector_preserves_pointer_and_translates_keyboard() {
+        let pointer_profile = profile(0xff);
+        let mut pointer = report(0, 0x1f);
+        let pointer_rewrite =
+            route_native_request(&pointer_profile, NativeRouteLane::Pointer, &mut pointer)
+                .expect("pointer route");
+        assert_eq!(pointer[1], 0x1f);
+        assert!(!pointer_rewrite.translated);
+
+        let mut keyboard = report(0, 0xff);
+        let rewrite =
+            route_native_request(&pointer_profile, NativeRouteLane::Keyboard, &mut keyboard)
+                .expect("keyboard route");
+        assert_eq!(keyboard[1], 0x9f);
+        assert!(rewrite.translated);
+
+        let mut response = report(2, 0x9f);
+        restore_native_response(&pointer_profile, rewrite, &mut response)
+            .expect("response restoration");
+        assert_eq!(response[1], 0xff);
+    }
+
+    #[test]
+    fn route_selector_recomputes_checksum_when_selected_field_is_covered() {
+        let mut covered = profile(0xff);
+        covered.report_format.transaction_id.offset = 6;
+        let mut request = report(0, 0x00);
+        let before = request[88];
+        let rewrite = route_native_request(&covered, NativeRouteLane::Keyboard, &mut request)
+            .expect("covered route");
+        assert_eq!(request[6], 0x9f);
+        assert_ne!(request[88], before);
+        assert_eq!(validate_native_request(&covered, &request), Ok(()));
+
+        let mut response = request;
+        response[0] = 2;
+        restore_native_response(&covered, rewrite, &mut response)
+            .expect("covered response restoration");
+        assert_eq!(response[6], 0x1f);
+        assert_eq!(validate_native_response(&covered, &response), Ok(()));
+    }
 }
diff --git a/docs/architecture/decisions/declarative-route-selector.md b/docs/architecture/decisions/declarative-route-selector.md
new file mode 100644
index 0000000..e11a5f9
--- /dev/null
+++ b/docs/architecture/decisions/declarative-route-selector.md
@@ -0,0 +1,61 @@
+# Declarative Native Route Selector
+
+Status: accepted for local reconstruction
+
+Approval: `approve HyperFlux Next declarative route-selector backend amendment`
+
+## Context
+
+The direct DeathStalker V2 Pro TKL reference was captured from wired PID
+`1532:0298` with the wireless selector off. Its generic upstream requests use
+transaction selector `0xff`. The receiver exposes the paired wireless child as
+PID `1532:0296`; preserved receiver evidence routes that keyboard lane with
+selector `0x9f`. The pointer lane uses selector `0x1f`.
+
+The transaction selector is receiver routing metadata, not part of a device
+command's semantic payload. Requiring every on-wire byte to remain identical
+would incorrectly classify standard receiver addressing as a model-specific
+backend.
+
+## Decision
+
+Receiver profiles may declare one optional native route selector:
+
+- the selected report field;
+- one value for the pointer endpoint lane;
+- one value for the keyboard endpoint lane;
+- mandatory restoration of the application's original response value.
+
+The kernel validates the original upstream report, clones it, replaces only the
+declared selector, and recomputes the checksum only when that field lies inside
+the declared checksum range. It correlates the receiver response against the
+routed clone, requires the response to echo the selected receiver lane, restores
+the caller's selector, and returns the repaired standard response. Request
+digests, replay identity, certainty, deadlines, and the single-SET rule remain
+bound to the unmodified application request.
+
+No child PID, model name, command class, command identifier, delay, or setting
+appears in the transport engine. A same-protocol child continues to use this
+receiver-level rule through profile composition.
+
+## Evidence Language
+
+Native parity distinguishes two claims:
+
+1. application-owned upstream command fields remain unchanged;
+2. receiver routing may translate a separately declared selector.
+
+Sanitized evidence records both selector values, whether translation occurred,
+whether the application response was restored, and whether the selector value
+came from a captured USB exchange or the canonical receiver profile. It never
+describes a translated on-wire request as byte-for-byte unchanged.
+
+## Consequences
+
+- OpenRazer and OpenRGB still own complete device commands and semantics.
+- HyperFlux owns only the receiver-addressing adaptation required by the route.
+- Pointer and keyboard lanes remain isolated without PID branches.
+- A different report format or a rewrite outside the declared selector remains
+  `backend-required`.
+- Existing lighting maps, input forwarding, timing, UAPI structures, and
+  restoration behavior are unaffected.
diff --git a/docs/architecture/design-book.md b/docs/architecture/design-book.md
index 08acf3b..a918dc0 100644
--- a/docs/architecture/design-book.md
+++ b/docs/architecture/design-book.md
@@ -62,24 +62,24 @@ Chapter IV: Universality And Qualification
 15. Support Levels
 Support must distinguish upstream model support from HyperFlux transport qualification. A device may be a reviewed candidate or have extensive OpenRazer and OpenRGB knowledge while its receiver route remains non-writable. A native route becomes qualified only when exact receiver-observed identity, source-bound upstream records, a matching fixed report family, response correlation, and physical transport evidence agree. Upstream applications decide which model capabilities to expose after that route exists.
 16. Unknown Device Behavior
-When the receiver reports an unfamiliar child PID, the system should expose safe identity and passive observations where possible. It must not send commands copied from a similar model or infer route authority from a support list. Privacy-safe local qualification may propose a declarative route profile. Once unchanged upstream reports and matched responses are proven, promoting a same-protocol device changes profile data and upstream bindings without changing the kernel, bridge engine, SDK transport, relay engine, or application transport abstractions.
+When the receiver reports an unfamiliar child PID, the system should expose safe identity and passive observations where possible. It must not send commands copied from a similar model or infer route authority from a support list. Privacy-safe local qualification may propose a declarative route profile. Once preserved upstream command semantics, any declared receiver selector translation, and matched responses are proven, promoting a same-protocol device changes profile data and upstream bindings without changing the kernel, bridge engine, SDK transport, relay engine, or application transport abstractions.
 17. Declarative Transport Profiles
 Applications keep their own model capabilities and command logic. HyperFlux profiles declare transport facts such as exact identity, protocol family, fixed report shape, route qualification, and response correlation; they never grant support from a PID list alone. This is the key to universality because another same-protocol device can gain a qualified native route through profile data and upstream bindings without adding model branches to the kernel, bridge, SDK, relay, or application transport adapters.
 Chapter V: Application Integrations
 18. OpenRGB Integration
 OpenRGB receives qualified native routes through a dedicated integration that depends only on HyperFlux SDK protocol v7. The integration instantiates the pinned upstream Razer controller with an alternate Feature transport; OpenRGB remains responsible for commands, modes, layouts, LED labels, geometry, color editing, profiles, effects, and application behavior. HyperFlux supplies exact wireless identity, route availability, generation safety, and an opaque 90-byte request/response exchange. Ordinary hidapi controllers remain unchanged, and serial-proven direct USB takes precedence over only the matching receiver route.
 19. OpenRGB Effects
-Spectrum Cycling, Rainbow Wave, Breathing, and the broader Effects catalog belong to OpenRGB’s official effect engine. HyperFlux does not recreate or claim those effects. It carries the same upstream-generated Feature reports through a bounded, fair native exchange and returns the matching response unchanged. Tests verify animation continuity, sibling-device independence, rescan behavior, reconnect recovery, and transport latency rather than reimplementing effect mathematics.
+Spectrum Cycling, Rainbow Wave, Breathing, and the broader Effects catalog belong to OpenRGB’s official effect engine. HyperFlux does not recreate or claim those effects. It carries the same upstream-generated Feature reports through a bounded, fair native exchange and returns a matching application-form response after any declared receiver selector is restored. Tests verify animation continuity, sibling-device independence, rescan behavior, reconnect recovery, and transport latency rather than reimplementing effect mathematics.
 20. Application-Owned Persistence
 Application lighting persistence belongs to OpenRGB. Stable colors, Off, hardware modes, and software-effect startup profiles are represented and resumed by the upstream application exactly as they are for direct devices. HyperFlux reports route loss and return without inventing sleep state, retaining colors, replaying wake frames, or promising a wake-color deadline. Its contract is that the first valid upstream transaction after a writable return is transported without an intentional restoration timer.
 21. OpenRazer Native Route
-OpenRazer contains the device classes, method lists, images, settings, persistence rules, and command construction that its clients already expect. HyperFlux imports source-bound identity and transport facts but does not duplicate those semantics. A narrow pinned source transform lets the official OpenRazer driver send its unchanged 90-byte Feature reports through trusted feature-only UHID routes while preserving the ordinary USB path for direct devices.
+OpenRazer contains the device classes, method lists, images, settings, persistence rules, and command construction that its clients already expect. HyperFlux imports source-bound identity and transport facts but does not duplicate those semantics. A narrow pinned source transform lets the official OpenRazer driver send its ordinary 90-byte Feature reports through trusted feature-only UHID routes while preserving the ordinary USB path for direct devices. HyperFlux may adapt only a receiver-profile route selector and restores it before returning the response.
 22. Migration org.razer Compatibility Provider
 The private HyperFlux org.razer compatibility provider is retained as a migration fallback while native-route physical parity is incomplete. It is isolated, opt-in, and prevented from competing with a native-control session. Removing it requires complete method and hardware parity plus a separate approval gate; it is not part of the final native path.
 23. Polychromatic Through OpenRazer
 Polychromatic continues to use its ordinary OpenRazer backend, official D-Bus API, device presentation, and controls. Receiver-backed devices appear through the patched OpenRazer transport just like the corresponding wireless class. The custom HyperFlux Polychromatic backend remains only as a noncompeting migration fallback until the same parity and retirement gates pass.
 24. Upstream Device Settings
-Lighting is only one part of the upstream experience. DPI stages, independent X/Y DPI, polling rate, acceleration, scroll behavior, Smart Reel, idle timeout, low-battery threshold, gaming mode, macros, brightness, charging state, pairing, and future model behavior remain owned by OpenRazer or OpenRGB. HyperFlux qualifies whether unchanged reports and matching responses cross a route; it does not add one semantic SDK method or receiver translation per setting. A different report format is an explicit backend requirement rather than a guessed rewrite.
+Lighting is only one part of the upstream experience. DPI stages, independent X/Y DPI, polling rate, acceleration, scroll behavior, Smart Reel, idle timeout, low-battery threshold, gaming mode, macros, brightness, charging state, pairing, and future model behavior remain owned by OpenRazer or OpenRGB. HyperFlux qualifies whether application-owned command bytes, declarative receiver routing, and matching responses cross a route; it does not add one semantic SDK method or command translation per setting. A different report format is an explicit backend requirement rather than a guessed rewrite.
 Chapter VI: Application Ownership
 25. Native Control Ownership
 Multiple applications must not send native and migration-path commands to the same child concurrently. The bridge issues a generation-bound NativeControl lease for one exact receiver route. It conflicts with retained semantic lighting, settings, and pairing resources for that child only; siblings, other receivers, and newer generations remain independent.
diff --git a/docs/architecture/device-knowledge.md b/docs/architecture/device-knowledge.md
index b44d431..b412a77 100644
--- a/docs/architecture/device-knowledge.md
+++ b/docs/architecture/device-knowledge.md
@@ -59,8 +59,9 @@ A native route becomes writable only when all of these are true:
    profile, not merely a similar product name.
 3. Pinned OpenRazer or OpenRGB records bind that identity to a fixed upstream
    protocol family and report shape.
-4. Public, device-scoped physical evidence proves that an unchanged upstream
-   report crosses the receiver and returns a matching standard response.
+4. Public, device-scoped physical evidence proves that upstream command
+   semantics, any declared receiver selector translation, and a matching
+   standard response cross the receiver route.
 5. The profile declares response correlation and native qualification, after
    which protocol v7 exposes only the opaque route and bounded exchange.
 
@@ -75,7 +76,7 @@ The pinned OpenRazer source documents wired `0x00A7` and wireless `0x00A8` varia
 
 The pinned OpenRGB source independently documents the same PID pair and a two-slot Logo/Numpad presentation. OpenRazer describes a three-slot matrix. The compiler reports that topology disagreement rather than choosing whichever source is convenient.
 
-Today the official mat snapshot can therefore say a Naga V2 Pro is a reviewed candidate with extensive public device knowledge. It cannot expose a writable native route until an exact receiver-backed identity is observed, its standard report family is bound declaratively, and that transport receives physical evidence. Once qualified, OpenRGB and OpenRazer continue to generate the model-specific commands they already own; HyperFlux carries the unchanged reports without copying Naga packet logic into its kernel, bridge, SDK, relay, or application adapters.
+Today the official mat snapshot can therefore say a Naga V2 Pro is a reviewed candidate with extensive public device knowledge. It cannot expose a writable native route until an exact receiver-backed identity is observed, its standard report family is bound declaratively, and that transport receives physical evidence. Once qualified, OpenRGB and OpenRazer continue to generate the model-specific commands they already own; HyperFlux carries those commands and only declarative receiver addressing without copying Naga packet logic into its kernel, bridge, SDK, relay, or application adapters.
 
 ## Update Workflow
 
diff --git a/docs/architecture/kernel.md b/docs/architecture/kernel.md
index 17c44e5..5fbecb7 100644
--- a/docs/architecture/kernel.md
+++ b/docs/architecture/kernel.md
@@ -37,7 +37,9 @@ endpoint slot, route-token digest, generation, and deadline before entering the
 kernel adapter. The adapter submits one 90-byte upstream Feature report through
 UAPI v2 and projects only the kernel's `not-sent`, `may-have-been-sent`, or
 `matched-response` result. It neither constructs device commands nor translates
-LED slots.
+LED slots. A receiver profile may declare one route-selector field; the kernel
+applies that receiver-only addressing rule to a clone and preserves the
+application request.
 
 The retained UAPI-v1 migration path still selects a receiver encoder, resolves
 each child independently, applies its qualified application-slot-to-carrier map,
@@ -101,11 +103,13 @@ shape before reserving a sequence. A per-receiver transport lock permits one
 active exchange and prevents a native operation from interleaving with the
 legacy carrier path.
 
-The SET begins at most once. After it begins, only bounded GET acquisition may
-repeat according to declarative profile timing and response-matching fields.
-The SET is never replayed. A complete matching 90-byte response is returned
-unchanged, including the device's own status; HyperFlux does not reinterpret
-Busy, Failure, or Not Supported as transport success.
+The SET begins at most once. Before it begins, the kernel may replace only the
+receiver profile's declared route selector in a cloned request. After SET begins,
+only bounded GET acquisition may repeat according to declarative profile timing
+and response-matching fields. The SET is never replayed. A complete matching
+90-byte response has the application's original selector restored and is then
+returned without changing the device's own status; HyperFlux does not
+reinterpret Busy, Failure, or Not Supported as transport success.
 
 The native journal retains 128 complete results and 128 digest-bearing
 tombstones. Exact replay resolves the retained outcome without another SET.
@@ -117,7 +121,8 @@ certainty classes mean:
 - `may-have-been-sent`: SET may have begun, so no layer may repeat it
   automatically;
 - `matched-response`: one full response passed declarative correlation and is
-  returned unchanged.
+  returned with only the declared receiver selector restored to the caller's
+  original value.
 
 ### Semantic Envelope V1 Migration Fallback
 
diff --git a/docs/architecture/native-device-onboarding.md b/docs/architecture/native-device-onboarding.md
index 6c42971..1456736 100644
--- a/docs/architecture/native-device-onboarding.md
+++ b/docs/architecture/native-device-onboarding.md
@@ -52,7 +52,7 @@ An eligible assessment still grants no authority. A maintainer must review the e
 
 ## Promotion Boundary
 
-A same-protocol device may change only profile data, upstream bindings, evidence, and generated projections. It must not require a kernel, bridge, daemon, SDK transport, OpenRazer relay, or OpenRGB transport-engine change.
+A same-protocol device may change only profile data, upstream bindings, evidence, and generated projections. It inherits receiver-level route-selector behavior through profile composition and must not require a kernel, bridge, daemon, SDK transport, OpenRazer relay, or OpenRGB transport-engine change.
 
 If the observed report family or report size differs, the draft is `backend-required`. If either upstream source lacks an exact record, or if identity or topology is ambiguous, the draft remains blocked. Existing unknown candidates remain non-writable.
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 63fac06..b72df80 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343`
+Profile source: `2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
@@ -12,7 +12,7 @@ Support is capability-specific. A listed model does not transfer its transport m
 | --- | --- | --- | --- | ---: | ---: |
 | **Razer Basilisk V3 Pro 35K**<br><code>child.razer.basilisk-v3-pro-35k.00cd</code> | mouse | `1532:00cd` | `62f114182069` | 7 | 7 |
 | **Razer DeathStalker V2 Pro Tenkeyless**<br><code>child.razer.deathstalker-v2-pro-tkl.0296</code> | keyboard | `1532:0296` | `46703d44d594` | 6 | 7 |
-| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `196946934e4c` | 4 | 2 |
+| **Razer HyperFlux V2 Receiver**<br><code>receiver.razer.hyperflux-v2.1532-00cf</code> | receiver | `1532:00cf` | `164b22d9ca70` | 4 | 2 |
 | **Razer HyperFlux V2 Hard Edition**<br><code>surface.razer.hyperflux-v2-hard-edition</code> | mat | reviewed surface metadata (no USB identity) | `0b00ef59eb8c` | 2 | 0 |
 
 ## Composition Contract
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index fa950cf..ff6caf6 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343 */
+/* Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0 */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
@@ -34,6 +34,10 @@ HFX_RECEIVER_PROFILE(
 	.native_trailer_value = 0,
 	.native_transaction_id_offset = 1,
 	.native_transaction_id_match_mask = 0,
+	.native_route_selector_kind = HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID,
+	.native_pointer_route_selector = 31,
+	.native_keyboard_route_selector = 159,
+	.native_restore_original_response = true,
 	.native_match_range_count = 2,
 	.native_match_ranges = { { .offset = 2, .length = 2 }, { .offset = 6, .length = 2 } }
 )
diff --git a/driver/kernel/hyperflux-next-native.c b/driver/kernel/hyperflux-next-native.c
index 05fe573..1ab929d 100644
--- a/driver/kernel/hyperflux-next-native.c
+++ b/driver/kernel/hyperflux-next-native.c
@@ -43,7 +43,21 @@ static bool hfx_native_profile_valid(const struct hfx_receiver_profile *profile)
 	     profile->native_checksum_result_offset <
 		     profile->native_checksum_end_offset) ||
 	    profile->native_trailer_offset >= profile->native_report_bytes ||
-	    profile->native_transaction_id_offset >= profile->native_report_bytes)
+	    profile->native_transaction_id_offset >= profile->native_report_bytes ||
+	    (profile->native_route_selector_kind ==
+		     HFX_NATIVE_ROUTE_SELECTOR_NONE &&
+	     (profile->native_pointer_route_selector ||
+	      profile->native_keyboard_route_selector ||
+	      profile->native_restore_original_response)) ||
+	    (profile->native_route_selector_kind !=
+		     HFX_NATIVE_ROUTE_SELECTOR_NONE &&
+	     (profile->native_route_selector_kind !=
+		      HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID ||
+	      !profile->native_pointer_route_selector ||
+	      !profile->native_keyboard_route_selector ||
+	      profile->native_pointer_route_selector ==
+		      profile->native_keyboard_route_selector ||
+	      !profile->native_restore_original_response)))
 		return false;
 
 	for (index = 0; index < profile->native_match_range_count; index++) {
@@ -58,18 +72,31 @@ static bool hfx_native_profile_valid(const struct hfx_receiver_profile *profile)
 	return true;
 }
 
-static bool hfx_native_checksum_valid(
+static u8 hfx_native_checksum(
 	const struct hfx_receiver_profile *profile, const u8 *report)
 {
 	u8 checksum = 0;
 	u16 index;
 
-	if (profile->native_checksum_kind != HFX_NATIVE_CHECKSUM_XOR8)
-		return false;
 	for (index = profile->native_checksum_start_offset;
 	     index < profile->native_checksum_end_offset; index++)
 		checksum ^= report[index];
-	return checksum == report[profile->native_checksum_result_offset];
+	return checksum;
+}
+
+static bool hfx_native_checksum_valid(
+	const struct hfx_receiver_profile *profile, const u8 *report)
+{
+	return profile->native_checksum_kind == HFX_NATIVE_CHECKSUM_XOR8 &&
+		hfx_native_checksum(profile, report) ==
+			report[profile->native_checksum_result_offset];
+}
+
+static void hfx_native_checksum_update(
+	const struct hfx_receiver_profile *profile, u8 *report)
+{
+	report[profile->native_checksum_result_offset] =
+		hfx_native_checksum(profile, report);
 }
 
 static bool hfx_native_request_report_valid(
@@ -102,6 +129,70 @@ static bool hfx_native_response_report_valid(
 		       profile->native_trailer_value;
 }
 
+static int hfx_native_route_selector(
+	const struct hfx_receiver_profile *profile, u32 endpoint_slot,
+	u8 *selector)
+{
+	if (profile->native_route_selector_kind ==
+	    HFX_NATIVE_ROUTE_SELECTOR_NONE)
+		return 0;
+	if (profile->native_route_selector_kind !=
+	    HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID)
+		return -EOPNOTSUPP;
+	if (endpoint_slot == HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE)
+		*selector = profile->native_pointer_route_selector;
+	else if (endpoint_slot == HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE)
+		*selector = profile->native_keyboard_route_selector;
+	else
+		return -EINVAL;
+	return 1;
+}
+
+static int hfx_native_route_request(
+	const struct hfx_receiver_profile *profile, u32 endpoint_slot,
+	u8 *request, u8 *application_selector, bool *translated)
+{
+	u16 offset = profile->native_transaction_id_offset;
+	u8 receiver_selector = 0;
+	int ret;
+
+	*application_selector = request[offset];
+	*translated = false;
+	ret = hfx_native_route_selector(profile, endpoint_slot,
+					&receiver_selector);
+	if (ret <= 0)
+		return ret;
+	if (request[offset] == receiver_selector)
+		return 0;
+	request[offset] = receiver_selector;
+	if (offset >= profile->native_checksum_start_offset &&
+	    offset < profile->native_checksum_end_offset)
+		hfx_native_checksum_update(profile, request);
+	if (!hfx_native_request_report_valid(profile, request))
+		return -EINVAL;
+	*translated = true;
+	return 0;
+}
+
+static int hfx_native_restore_response(
+	const struct hfx_receiver_profile *profile, u8 application_selector,
+	u8 receiver_selector, bool translated, u8 *response)
+{
+	u16 offset = profile->native_transaction_id_offset;
+
+	if (!translated)
+		return 0;
+	if (!profile->native_restore_original_response)
+		return -EOPNOTSUPP;
+	if (response[offset] != receiver_selector)
+		return -EPROTO;
+	response[offset] = application_selector;
+	if (offset >= profile->native_checksum_start_offset &&
+	    offset < profile->native_checksum_end_offset)
+		hfx_native_checksum_update(profile, response);
+	return hfx_native_response_report_valid(profile, response) ? 0 : -EPROTO;
+}
+
 static int hfx_native_submit_validate(
 	const struct hfx_receiver *receiver,
 	const struct hfx_uapi_native_exchange_submit *submit)
@@ -386,6 +477,9 @@ static int hfx_native_record_dispatch(
 	struct usb_interface *control_interface;
 	u8 *request;
 	u8 *response;
+	u8 application_selector;
+	u8 receiver_selector;
+	bool route_translated;
 	u16 attempt;
 	int ret;
 
@@ -399,6 +493,12 @@ static int hfx_native_record_dispatch(
 		ret = -ENOMEM;
 		goto free_request;
 	}
+	ret = hfx_native_route_request(profile, record->result.endpoint_slot,
+				       request, &application_selector,
+				       &route_translated);
+	if (ret)
+		goto free_buffers;
+	receiver_selector = request[profile->native_transaction_id_offset];
 	control_interface = usb_ifnum_to_if(
 		receiver->udev, profile->native_set_report_index);
 	if (!control_interface) {
@@ -443,6 +543,11 @@ static int hfx_native_record_dispatch(
 		ret = hfx_native_usb_get(receiver, profile, response);
 		if (!ret && hfx_native_response_matches(
 				    profile, request, response)) {
+			ret = hfx_native_restore_response(
+				profile, application_selector, receiver_selector,
+				route_translated, response);
+			if (ret)
+				goto uncertain;
 			record->result.certainty =
 				HFX_UAPI_NATIVE_EXCHANGE_CERTAINTY_MATCHED_RESPONSE;
 			record->result.transport_errno = 0;
diff --git a/driver/kernel/hyperflux-next-profile.h b/driver/kernel/hyperflux-next-profile.h
index a08c59c..eade0a4 100644
--- a/driver/kernel/hyperflux-next-profile.h
+++ b/driver/kernel/hyperflux-next-profile.h
@@ -19,6 +19,11 @@ enum hfx_native_checksum_kind {
 	HFX_NATIVE_CHECKSUM_XOR8 = 1,
 };
 
+enum hfx_native_route_selector_kind {
+	HFX_NATIVE_ROUTE_SELECTOR_NONE = 0,
+	HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID = 1,
+};
+
 #define HFX_NATIVE_MATCH_RANGE_CAPACITY 4U
 
 struct hfx_native_match_range {
@@ -54,6 +59,10 @@ struct hfx_receiver_profile {
 	u8 native_max_data_size;
 	u8 native_trailer_value;
 	u8 native_transaction_id_match_mask;
+	u8 native_pointer_route_selector;
+	u8 native_keyboard_route_selector;
+	u8 native_restore_original_response;
+	u16 native_route_selector_kind;
 	u32 native_initial_response_delay_us;
 	u32 native_response_retry_delay_us;
 	struct hfx_native_match_range
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index db4059b..1f803fb 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -12626,7 +12626,7 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "f004e43cdf57428ebf096160f6f1cda7b78bed6a1b079faa17a26ab18ff5ea10",
+  "source_sha256": "2f96676467fe0dc2bf7f6f93ca31c1e6e7c5efbbad005ad1a5932da321fb7e3d",
   "upstreams": [
     {
       "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index edd3c36..ea03069 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -1451,8 +1451,8 @@
         "Receiver inventory does not imply child availability.",
         "The receiver and mat do not appear as addressable RGB controllers."
       ],
-      "revision": 3,
-      "runtime_sha256": "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01",
+      "revision": 4,
+      "runtime_sha256": "164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11",
       "schema": "hyperflux-hardware-profile-v1",
       "source_path": "profiles/receivers/razer-hyperflux-v2-1532-00cf.json",
       "transport": {
@@ -1511,6 +1511,12 @@
           },
           "response_report_index": 0,
           "response_retry_delay_us": 10000,
+          "route_selector": {
+            "field": "transaction-id",
+            "keyboard_lane": 159,
+            "pointer_lane": 31,
+            "restore_original_response": true
+          },
           "set_report_index": 0
         },
         "pairing_inventory": {
@@ -1567,5 +1573,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
+  "source_sha256": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
 }
diff --git a/migration/sources.json b/migration/sources.json
index 9d8bd77..df65318 100644
--- a/migration/sources.json
+++ b/migration/sources.json
@@ -7,7 +7,7 @@
       "kind": "imported-document",
       "role": "governing product design",
       "imported_path": "docs/architecture/design-book.md",
-      "sha256": "4cd2bb31b51649423bb6b6691601b1b2b75ed65e1a5a5156df959a31bd8289b9"
+      "sha256": "8a7c7e277db5785719d10f7708643e62de0851989244dcf09df82da79c98b63f"
     },
     {
       "id": "device-knowledge-research",
diff --git a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
index ad67094..c05fe62 100644
--- a/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
+++ b/profiles/receivers/razer-hyperflux-v2-1532-00cf.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/hardware-profile.schema.json",
   "schema": "hyperflux-hardware-profile-v1",
   "profile_id": "receiver.razer.hyperflux-v2.1532-00cf",
-  "revision": 3,
+  "revision": 4,
   "kind": "receiver",
   "device_kind": "receiver",
   "identity": {"manufacturer": "Razer", "model_name": "Razer HyperFlux V2 Receiver", "authority": "usb", "vendor_id": 5426, "product_id": 207},
@@ -31,6 +31,12 @@
         "trailer": {"offset": 89, "value": 0},
         "transaction_id": {"offset": 1, "match_mask": 0}
       },
+      "route_selector": {
+        "field": "transaction-id",
+        "pointer_lane": 31,
+        "keyboard_lane": 159,
+        "restore_original_response": true
+      },
       "match_ranges": [
         {"offset": 2, "length": 2},
         {"offset": 6, "length": 2}
diff --git a/schemas/hardware-profile.schema.json b/schemas/hardware-profile.schema.json
index c657c3f..173cd05 100644
--- a/schemas/hardware-profile.schema.json
+++ b/schemas/hardware-profile.schema.json
@@ -105,6 +105,7 @@
         "response_retry_delay_us": {"type": "integer", "minimum": 1, "maximum": 100000},
         "max_response_attempts": {"type": "integer", "minimum": 1, "maximum": 16},
         "report_format": {"$ref": "#/$defs/native-report-format"},
+        "route_selector": {"$ref": "#/$defs/native-route-selector"},
         "match_ranges": {
           "type": "array",
           "minItems": 1,
@@ -121,6 +122,17 @@
         }
       }
     },
+    "native-route-selector": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["field", "pointer_lane", "keyboard_lane", "restore_original_response"],
+      "properties": {
+        "field": {"const": "transaction-id"},
+        "pointer_lane": {"type": "integer", "minimum": 1, "maximum": 255},
+        "keyboard_lane": {"type": "integer", "minimum": 1, "maximum": 255},
+        "restore_original_response": {"const": true}
+      }
+    },
     "native-report-format": {
       "type": "object",
       "additionalProperties": false,
diff --git a/schemas/native-transport-parity-evidence.schema.json b/schemas/native-transport-parity-evidence.schema.json
index f6382e0..a399292 100644
--- a/schemas/native-transport-parity-evidence.schema.json
+++ b/schemas/native-transport-parity-evidence.schema.json
@@ -127,13 +127,43 @@
             }
           }
         },
+        "route_translation": {
+          "oneOf": [
+            {"type": "null"},
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "field",
+                "application_selector",
+                "receiver_selector",
+                "applied",
+                "response_selector",
+                "response_restored_for_application",
+                "authority"
+              ],
+              "properties": {
+                "field": {"const": "transaction-id"},
+                "application_selector": {"type": "integer", "minimum": 0, "maximum": 255},
+                "receiver_selector": {"type": "integer", "minimum": 0, "maximum": 255},
+                "applied": {"type": "boolean"},
+                "response_selector": {"type": ["integer", "null"], "minimum": 0, "maximum": 255},
+                "response_restored_for_application": {"type": ["boolean", "null"]},
+                "authority": {"enum": ["captured-usbmon", "receiver-profile"]}
+              }
+            }
+          ]
+        },
         "receiver_comparison": {
           "type": "object",
           "additionalProperties": false,
           "required": ["attempts", "unchanged_request", "standard_response", "semantic_parity"],
           "properties": {
             "attempts": {"type": "integer", "minimum": 0, "maximum": 8},
-            "unchanged_request": {"type": ["boolean", "null"]},
+            "unchanged_request": {
+              "type": ["boolean", "null"],
+              "description": "Application-owned command fields match the pinned upstream request; a separately declared route-selector field is not treated as command rewriting."
+            },
             "standard_response": {"type": ["boolean", "null"]},
             "semantic_parity": {"type": ["boolean", "null"]}
           }
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index a9a0e98..e1fa4de 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343
+// Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343";
+inline constexpr std::string_view profile_source_sha256 = "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
@@ -238,7 +238,7 @@ inline constexpr std::array<CapabilityRecord, 2> capabilities_3 {{
 inline constexpr std::array<ProfileRecord, 4> catalog {{
     {"child.razer.basilisk-v3-pro-35k.00cd", "62f114182069895ae0c72ebdd7165e1bb774d41eceeeead155eda449df69f8cf", 3, ProfileKind::Child, DeviceKind::Mouse, true, 5426, 205, "Razer Basilisk V3 Pro 35K", std::nullopt, "", receiver_protocols_0, routes_0, supported_child_kinds_0, required_sibling_kinds_0, false, capabilities_0, &lighting_0, &lifecycle_0, &presentation_0},
     {"child.razer.deathstalker-v2-pro-tkl.0296", "46703d44d594392e0cb289f6151a7c6b3b200805503a4cf036747d3c347f0d63", 6, ProfileKind::Child, DeviceKind::Keyboard, true, 5426, 662, "Razer DeathStalker V2 Pro Tenkeyless", std::nullopt, "", receiver_protocols_1, routes_1, supported_child_kinds_1, required_sibling_kinds_1, false, capabilities_1, &lighting_1, &lifecycle_1, &presentation_1},
-    {"receiver.razer.hyperflux-v2.1532-00cf", "196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01", 3, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
+    {"receiver.razer.hyperflux-v2.1532-00cf", "164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11", 4, ProfileKind::Receiver, DeviceKind::Receiver, true, 5426, 207, "Razer HyperFlux V2 Receiver", std::uint32_t{1}, "razer-hyperflux-v2", receiver_protocols_2, routes_2, supported_child_kinds_2, required_sibling_kinds_2, false, capabilities_2, nullptr, nullptr, nullptr},
     {"surface.razer.hyperflux-v2-hard-edition", "0b00ef59eb8c039695c760de855bb7d7d55f1be9a32f6f2d1ed90d039d7796b9", 1, ProfileKind::Surface, DeviceKind::Mat, false, 0, 0, "Razer HyperFlux V2 Hard Edition", std::nullopt, "", receiver_protocols_3, routes_3, supported_child_kinds_3, required_sibling_kinds_3, false, capabilities_3, nullptr, nullptr, nullptr},
 }};
 
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index 4f73e98..edfcd90 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343'
+PROFILE_SOURCE_SHA256: Final = '2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -854,8 +854,8 @@
                'restrictions': ['Unknown children receive zero writable capabilities.',
                                 'Receiver inventory does not imply child availability.',
                                 'The receiver and mat do not appear as addressable RGB controllers.'],
-               'revision': 3,
-               'runtime_sha256': '196946934e4ce6c5d55519a8485df416c8698e9682aa30d59abda00203a38e01',
+               'revision': 4,
+               'runtime_sha256': '164b22d9ca70e7cd62db9012b791444b73d03128314dbc191aa44b6022d4ea11',
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/receivers/razer-hyperflux-v2-1532-00cf.json',
                'transport': {'application_raw_frames': False,
@@ -883,6 +883,10 @@
                                                                    'transaction_id': {'match_mask': 0, 'offset': 1}},
                                                  'response_report_index': 0,
                                                  'response_retry_delay_us': 10000,
+                                                 'route_selector': {'field': 'transaction-id',
+                                                                    'keyboard_lane': 159,
+                                                                    'pointer_lane': 31,
+                                                                    'restore_original_response': True},
                                                  'set_report_index': 0},
                              'pairing_inventory': {'decoder': 'razer-hyperflux-v2-feature-01-v1'}}},
               {'capabilities': [{'access': 'read',
@@ -911,7 +915,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343'}
+ 'source_sha256': '2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/cpp/kernel_profile_table_smoke.cpp b/tests/cpp/kernel_profile_table_smoke.cpp
index 3117d33..cfc3071 100644
--- a/tests/cpp/kernel_profile_table_smoke.cpp
+++ b/tests/cpp/kernel_profile_table_smoke.cpp
@@ -39,6 +39,10 @@ struct ReceiverMatch
     std::uint8_t native_trailer_value;
     std::uint16_t native_transaction_id_offset;
     std::uint8_t native_transaction_id_match_mask;
+    std::uint16_t native_route_selector_kind;
+    std::uint8_t native_pointer_route_selector;
+    std::uint8_t native_keyboard_route_selector;
+    bool native_restore_original_response;
     std::uint16_t native_match_range_count;
     NativeMatchRange native_match_ranges[4];
 };
@@ -49,6 +53,8 @@ struct ReceiverMatch
 #define HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1 1
 #define HFX_NATIVE_CHECKSUM_NONE 0
 #define HFX_NATIVE_CHECKSUM_XOR8 1
+#define HFX_NATIVE_ROUTE_SELECTOR_NONE 0
+#define HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID 1
 #define HFX_RECEIVER_PROFILE(vendor, product, backend, ...) \
     ReceiverMatch{.vendor_id = vendor, .product_id = product, \
                   .backend_id = backend, __VA_ARGS__},
@@ -88,6 +94,10 @@ int main()
     static_assert(receiver_matches[0].native_trailer_value == 0);
     static_assert(receiver_matches[0].native_transaction_id_offset == 1);
     static_assert(receiver_matches[0].native_transaction_id_match_mask == 0);
+    static_assert(receiver_matches[0].native_route_selector_kind == 1);
+    static_assert(receiver_matches[0].native_pointer_route_selector == 0x1f);
+    static_assert(receiver_matches[0].native_keyboard_route_selector == 0x9f);
+    static_assert(receiver_matches[0].native_restore_original_response);
     static_assert(receiver_matches[0].native_match_range_count == 2);
     static_assert(receiver_matches[0].native_match_ranges[0].offset == 2);
     static_assert(receiver_matches[0].native_match_ranges[0].length == 2);
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 1095f72..1117b30 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "ac03ca0358ce92e552fcffb55a48650e87c9608ae684891b8a834b95989ed343"
+  "source_sha256": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
 }
diff --git a/tests/test_kernel_driver.py b/tests/test_kernel_driver.py
index 4faeba5..7c3fa79 100644
--- a/tests/test_kernel_driver.py
+++ b/tests/test_kernel_driver.py
@@ -94,6 +94,10 @@ def test_native_exchange_uses_declarative_receiver_profile(self) -> None:
             "profile->native_trailer_offset",
             "profile->native_transaction_id_offset",
             "profile->native_transaction_id_match_mask",
+            "profile->native_route_selector_kind",
+            "profile->native_pointer_route_selector",
+            "profile->native_keyboard_route_selector",
+            "profile->native_restore_original_response",
             "profile->native_match_ranges",
         ):
             self.assertIn(profile_field, source)
@@ -103,6 +107,7 @@ def test_native_exchange_uses_declarative_receiver_profile(self) -> None:
         ).read_text(encoding="utf-8")
         self.assertIn("HFX_NATIVE_EXCHANGE_RAZER_FEATURE_REPORT_V1", table)
         self.assertIn("HFX_NATIVE_CHECKSUM_XOR8", table)
+        self.assertIn("HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID", table)
         self.assertIn(".native_match_ranges", table)
 
     def test_native_exchange_validates_request_before_set_and_response_before_match(self) -> None:
@@ -120,6 +125,21 @@ def test_native_exchange_validates_request_before_set_and_response_before_match(
         self.assertIn("hfx_native_response_report_valid", matcher)
         self.assertIn("native_transaction_id_match_mask", matcher)
 
+    def test_native_route_selector_is_endpoint_declarative_and_response_repaired(self) -> None:
+        source = (ROOT / "driver/kernel/hyperflux-next-native.c").read_text(
+            encoding="utf-8"
+        )
+        route_start = source.index("static int hfx_native_route_selector")
+        route_end = source.index("static int hfx_native_submit_validate", route_start)
+        routing = source[route_start:route_end]
+        self.assertIn("HFX_UAPI_ENDPOINT_SLOT_POINTER_LANE", routing)
+        self.assertIn("HFX_UAPI_ENDPOINT_SLOT_KEYBOARD_LANE", routing)
+        self.assertIn("hfx_native_checksum_update", routing)
+        self.assertIn("hfx_native_restore_response", routing)
+        self.assertIn("response[offset] != receiver_selector", routing)
+        for forbidden in ("0x1f", "0x9f", "0x00cd", "0x0296"):
+            self.assertNotIn(forbidden, routing.lower())
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/tests/test_native_live_parity.py b/tests/test_native_live_parity.py
index 74d44fb..f68f583 100644
--- a/tests/test_native_live_parity.py
+++ b/tests/test_native_live_parity.py
@@ -132,7 +132,7 @@ def _direct_firmware_evidence(self) -> dict:
 
     def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
         probe = _probe("get_firmware")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((2, 51)))
         evidence = build_live_parity_evidence(
             ROOT,
@@ -153,7 +153,7 @@ def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
 
     def test_source_bound_semantic_reference_does_not_require_raw_direct_report(self) -> None:
         probe = _probe("get_firmware")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((2, 51)))
         evidence = build_live_parity_evidence(
             ROOT,
@@ -170,7 +170,7 @@ def test_source_bound_semantic_reference_does_not_require_raw_direct_report(self
 
     def test_matching_terminal_failure_is_preserved_as_transport_parity(self) -> None:
         probe = _probe("get_brightness")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((0,)), status=3)
         evidence = build_live_parity_evidence(
             ROOT,
@@ -198,12 +198,24 @@ def test_matching_terminal_failure_is_preserved_as_transport_parity(self) -> Non
                 "semantic_parity": True,
             },
         )
+        self.assertEqual(
+            routed["route_translation"],
+            {
+                "field": "transaction-id",
+                "application_selector": 0x1F,
+                "receiver_selector": 0x1F,
+                "applied": False,
+                "response_selector": 0x1F,
+                "response_restored_for_application": True,
+                "authority": "receiver-profile",
+            },
+        )
         self.assertIn("get_brightness", evidence["coverage"]["passed"])
         self.assertNotEqual(evidence["conclusion"], "backend-required")
 
     def test_terminal_status_mismatch_is_semantic_failure_not_backend_rewrite(self) -> None:
         probe = _probe("get_brightness")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((0,)), status=5)
         evidence = build_live_parity_evidence(
             ROOT,
@@ -221,7 +233,7 @@ def test_terminal_status_mismatch_is_semantic_failure_not_backend_rewrite(self)
 
     def test_matching_terminal_status_with_different_exact_summary_fails_semantics(self) -> None:
         probe = _probe("get_brightness")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((1,)), status=3)
         evidence = build_live_parity_evidence(
             ROOT,
@@ -239,7 +251,7 @@ def test_matching_terminal_status_with_different_exact_summary_fails_semantics(s
 
     def test_final_busy_response_remains_incomplete(self) -> None:
         probe = _probe("get_firmware")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((0, 0)), status=1)
         evidence = build_live_parity_evidence(
             ROOT,
@@ -263,7 +275,7 @@ def test_final_busy_response_remains_incomplete(self) -> None:
 
     def test_malformed_receiver_response_requires_a_backend(self) -> None:
         probe = _probe("get_firmware")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = bytearray(_response(request, bytes((2, 51))))
         response[1] ^= 1
         response[88] = _crc(response)
@@ -283,7 +295,7 @@ def test_malformed_receiver_response_requires_a_backend(self) -> None:
 
     def test_unclassified_sent_request_and_rewritten_read_fail_closed(self) -> None:
         probe = _probe("get_firmware")
-        request = canonical_request(probe, 0x9F)
+        request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((2, 51)))
         unknown = _raw_record("get_firmware", request, response)
         unknown["method"] = None
diff --git a/tests/test_native_parity.py b/tests/test_native_parity.py
index 0c40099..fdfc35b 100644
--- a/tests/test_native_parity.py
+++ b/tests/test_native_parity.py
@@ -20,6 +20,7 @@
     build_offline_parity_evidence,
     canonical_request,
     parse_usbmon_capture,
+    validate_parity_evidence,
     write_parity_evidence,
 )
 from hfxdev.native_probe import load_native_probe_catalog
@@ -74,10 +75,10 @@ class NativeParityTests(unittest.TestCase):
     mouse_profile = "child.razer.basilisk-v3-pro-35k.00cd"
     keyboard_profile = "child.razer.deathstalker-v2-pro-tkl.0296"
 
-    def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> None:
+    def _mouse_firmware_evidence(self) -> dict:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((2, 51)))
         receiver_response = _response(receiver_request, bytes((2, 51)))
         with TemporaryDirectory() as directory:
@@ -94,6 +95,10 @@ def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> Non
                 created_at="2026-07-25T00:00:00Z",
                 source_revision=REVISION,
             )
+        return evidence
+
+    def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> None:
+        evidence = self._mouse_firmware_evidence()
         self.assertIn("get_firmware", evidence["coverage"]["passed"])
         self.assertEqual(evidence["conclusion"], "incomplete")
         routed = next(
@@ -110,11 +115,48 @@ def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> Non
                 "semantic_parity": True,
             },
         )
+        self.assertEqual(
+            routed["route_translation"],
+            {
+                "field": "transaction-id",
+                "application_selector": 0x1F,
+                "receiver_selector": 0x1F,
+                "applied": False,
+                "response_selector": 0x1F,
+                "response_restored_for_application": None,
+                "authority": "captured-usbmon",
+            },
+        )
+
+    def test_route_translation_remains_optional_for_v1_evidence(self) -> None:
+        legacy = deepcopy(self._mouse_firmware_evidence())
+        for observation in legacy["observations"]:
+            observation.pop("route_translation", None)
+        validate_parity_evidence(legacy)
+
+    def test_route_translation_rejects_applied_mismatch(self) -> None:
+        forged = deepcopy(self._mouse_firmware_evidence())
+        routed = next(
+            value for value in forged["observations"] if value["origin"] == "receiver-route"
+        )
+        routed["route_translation"]["applied"] = True
+        with self.assertRaisesRegex(ModelError, "invalid route translation"):
+            validate_parity_evidence(forged)
+
+    def test_route_translation_rejects_false_response_restoration(self) -> None:
+        forged = deepcopy(self._mouse_firmware_evidence())
+        routed = next(
+            value for value in forged["observations"] if value["origin"] == "receiver-route"
+        )
+        routed["route_translation"]["response_selector"] = 0x9F
+        routed["route_translation"]["response_restored_for_application"] = True
+        with self.assertRaisesRegex(ModelError, "invalid route translation"):
+            validate_parity_evidence(forged)
 
     def test_matching_terminal_failure_is_transport_parity_offline(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((0, 0)), status=3)
         receiver_response = _response(receiver_request, bytes((0, 0)), status=3)
         with TemporaryDirectory() as directory:
@@ -143,7 +185,7 @@ def test_matching_terminal_failure_is_transport_parity_offline(self) -> None:
     def test_matching_terminal_domain_status_does_not_compare_undefined_payloads(self) -> None:
         probe = _probe(self.mouse_profile, "get_battery")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((0, 128)), status=3)
         receiver_response = _response(receiver_request, bytes((0, 144)), status=3)
         with TemporaryDirectory() as directory:
@@ -166,7 +208,7 @@ def test_complete_request_rewrite_requires_a_backend(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((2, 51)))
-        receiver_request = bytearray(canonical_request(probe, 0x9F))
+        receiver_request = bytearray(canonical_request(probe, 0x1F))
         receiver_request[89] = 1
         receiver_response = _response(bytes(receiver_request), bytes((2, 51)))
         with TemporaryDirectory() as directory:
@@ -191,7 +233,7 @@ def test_serial_is_compared_in_memory_but_never_persisted(self) -> None:
         serial = b"PRIVATE-SERIAL-1234567"
         self.assertEqual(len(serial), 22)
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, serial)
         receiver_response = _response(receiver_request, serial)
         with TemporaryDirectory() as directory:
@@ -230,7 +272,7 @@ def test_serial_is_compared_in_memory_but_never_persisted(self) -> None:
     def test_busy_retries_are_bounded_and_only_the_terminal_result_counts(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((2, 51)))
         busy_response = _response(receiver_request, bytes((0, 0)), status=1)
         success_response = _response(receiver_request, bytes((2, 51)))
@@ -260,7 +302,7 @@ def test_busy_retries_are_bounded_and_only_the_terminal_result_counts(self) -> N
     def test_dynamic_telemetry_requires_valid_values_not_identical_snapshots(self) -> None:
         probe = _probe(self.mouse_profile, "get_battery")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((0, 128)))
         receiver_response = _response(receiver_request, bytes((0, 144)))
         with TemporaryDirectory() as directory:
@@ -309,6 +351,18 @@ def test_keyboard_layout_matches_the_byte_exposed_by_openrazer(self) -> None:
         )
         self.assertEqual(routed["response"]["summary"]["layout_code"], 6)
         self.assertTrue(routed["receiver_comparison"]["semantic_parity"])
+        self.assertEqual(
+            routed["route_translation"],
+            {
+                "field": "transaction-id",
+                "application_selector": 0xFF,
+                "receiver_selector": 0x9F,
+                "applied": True,
+                "response_selector": 0x9F,
+                "response_restored_for_application": None,
+                "authority": "captured-usbmon",
+            },
+        )
 
     def test_parser_rejects_unmatched_or_nonstandard_reports(self) -> None:
         with TemporaryDirectory() as directory:
@@ -322,7 +376,7 @@ def test_parser_rejects_unmatched_or_nonstandard_reports(self) -> None:
     def test_request_marker_and_out_of_range_status_are_not_standard_responses(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         direct_request = canonical_request(probe, 0x1F)
-        receiver_request = canonical_request(probe, 0x9F)
+        receiver_request = canonical_request(probe, 0x1F)
         direct_response = _response(direct_request, bytes((2, 51)))
         for status in (0, 6):
             with self.subTest(status=status), TemporaryDirectory() as directory:
diff --git a/tests/test_profiles.py b/tests/test_profiles.py
index 9c52870..24c207f 100644
--- a/tests/test_profiles.py
+++ b/tests/test_profiles.py
@@ -113,6 +113,15 @@ def test_receiver_native_exchange_is_declarative_bounded_and_digest_bound(self)
                 "transaction_id": {"offset": 1, "match_mask": 0},
             },
         )
+        self.assertEqual(
+            native["route_selector"],
+            {
+                "field": "transaction-id",
+                "pointer_lane": 0x1F,
+                "keyboard_lane": 0x9F,
+                "restore_original_response": True,
+            },
+        )
         self.assertEqual(native["match_ranges"], [{"offset": 2, "length": 2}, {"offset": 6, "length": 2}])
         before = self.runtime_profile_digest(receiver, capabilities)
         native["response_retry_delay_us"] += 1
@@ -159,6 +168,27 @@ def test_receiver_native_exchange_is_declarative_bounded_and_digest_bound(self)
         with self.assertRaisesRegex(ModelError, "response status range is reversed"):
             self.validate_profiles(profiles, capabilities, claims)
 
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        selector = receiver["transport"]["native_exchange"]["route_selector"]
+        selector["keyboard_lane"] = selector["pointer_lane"]
+        with self.assertRaisesRegex(ModelError, "must isolate endpoint lanes"):
+            self.validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        selector = receiver["transport"]["native_exchange"]["route_selector"]
+        selector["pointer_lane"] = 0
+        with self.assertRaisesRegex(ModelError, "pointer_lane is invalid"):
+            self.validate_profiles(profiles, capabilities, claims)
+
+        profiles, capabilities, claims = self.validation_copies()
+        receiver = next(profile for profile in profiles if profile["kind"] == "receiver")
+        selector = receiver["transport"]["native_exchange"]["route_selector"]
+        selector["restore_original_response"] = False
+        with self.assertRaisesRegex(ModelError, "must restore the application response"):
+            self.validate_profiles(profiles, capabilities, claims)
+
     def test_runtime_digest_is_profile_local_and_ignores_presentation_only_edits(self) -> None:
         profiles, capabilities, _ = self.validation_copies()
         mouse = next(profile for profile in profiles if profile["device_kind"] == "mouse")
diff --git a/tools/hfxdev/generators/profiles.py b/tools/hfxdev/generators/profiles.py
index a58f936..876e10f 100644
--- a/tools/hfxdev/generators/profiles.py
+++ b/tools/hfxdev/generators/profiles.py
@@ -353,6 +353,19 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "}",
         "",
         "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub enum NativeRouteSelectorField {",
+        "    TransactionId,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
+        "pub struct NativeRouteSelectorRecord {",
+        "    pub field: NativeRouteSelectorField,",
+        "    pub pointer_lane: u8,",
+        "    pub keyboard_lane: u8,",
+        "    pub restore_original_response: bool,",
+        "}",
+        "",
+        "#[derive(Clone, Copy, Debug, Eq, PartialEq)]",
         "pub struct NativeReportFormatRecord {",
         "    pub request_status: NativeByteValueRecord,",
         "    pub response_status: NativeByteRangeRecord,",
@@ -373,6 +386,7 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         "    pub response_retry_delay_us: u32,",
         "    pub max_response_attempts: u8,",
         "    pub report_format: NativeReportFormatRecord,",
+        "    pub route_selector: Option<NativeRouteSelectorRecord>,",
         "    pub match_ranges: &'static [NativeMatchRangeRecord],",
         "}",
         "",
@@ -529,6 +543,20 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
         if native_exchange:
             report_format = native_exchange["report_format"]
             checksum = report_format["checksum"]
+            route_selector = native_exchange.get("route_selector")
+            if route_selector is None:
+                route_selector_lines = ["            route_selector: None,"]
+            else:
+                route_selector_lines = [
+                    "            route_selector: Some(NativeRouteSelectorRecord {",
+                    "                field: NativeRouteSelectorField::"
+                    f"{_variant(route_selector['field'])},",
+                    f"                pointer_lane: {route_selector['pointer_lane']},",
+                    f"                keyboard_lane: {route_selector['keyboard_lane']},",
+                    "                restore_original_response: "
+                    f"{str(route_selector['restore_original_response']).lower()},",
+                    "            }),",
+                ]
             native_exchange_lines = [
                 "        native_exchange: Some(NativeExchangeRecord {",
                 f"            protocol_family: {json.dumps(native_exchange['protocol_family'])},",
@@ -574,9 +602,14 @@ def rust_catalog(catalog: dict[str, Any]) -> str:
                 f"                    match_mask: {report_format['transaction_id']['match_mask']},",
                 "                },",
                 "            },",
-                f"            match_ranges: NATIVE_MATCH_RANGES_{index},",
-                "        }),",
             ]
+            native_exchange_lines.extend(route_selector_lines)
+            native_exchange_lines.extend(
+                [
+                    f"            match_ranges: NATIVE_MATCH_RANGES_{index},",
+                    "        }),",
+                ]
+            )
         else:
             native_exchange_lines = ["        native_exchange: None,"]
         lighting = profile.get("transport", {}).get("lighting")
@@ -1112,6 +1145,25 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
             match_ranges = native["match_ranges"]
         report_format = native_values["report_format"]
         checksum = report_format["checksum"]
+        route_selector = native_values.get("route_selector")
+        if route_selector is None:
+            route_selector_kind = "HFX_NATIVE_ROUTE_SELECTOR_NONE"
+            pointer_selector = 0
+            keyboard_selector = 0
+            restore_original_response = "false"
+        else:
+            route_selector_kind = {
+                "transaction-id": "HFX_NATIVE_ROUTE_SELECTOR_TRANSACTION_ID"
+            }.get(route_selector["field"])
+            if route_selector_kind is None:
+                raise ValueError(
+                    f"unsupported kernel native route selector: {route_selector['field']}"
+                )
+            pointer_selector = route_selector["pointer_lane"]
+            keyboard_selector = route_selector["keyboard_lane"]
+            restore_original_response = str(
+                route_selector["restore_original_response"]
+            ).lower()
         range_values = ", ".join(
             f"{{ .offset = {item['offset']}, .length = {item['length']} }}"
             for item in match_ranges
@@ -1150,6 +1202,10 @@ def kernel_receiver_table(catalog: dict[str, Any]) -> str:
                 f'\t.native_trailer_value = {report_format["trailer"]["value"]},',
                 f'\t.native_transaction_id_offset = {report_format["transaction_id"]["offset"]},',
                 f'\t.native_transaction_id_match_mask = {report_format["transaction_id"]["match_mask"]},',
+                f"\t.native_route_selector_kind = {route_selector_kind},",
+                f"\t.native_pointer_route_selector = {pointer_selector},",
+                f"\t.native_keyboard_route_selector = {keyboard_selector},",
+                f"\t.native_restore_original_response = {restore_original_response},",
                 f"\t.native_match_range_count = {len(match_ranges)},",
                 f"\t.native_match_ranges = {{ {range_values} }}",
                 ")",
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index fa15547..23c3206 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -17,6 +17,7 @@
 from .model import ModelError, sha256_file
 from .native_probe import REPORT_SIZE, load_native_probe_catalog
 from .private_artifact import write_new_private_json
+from .profiles import load_profile_inputs
 
 
 EVIDENCE_SCHEMA = "hyperflux-native-transport-parity-evidence-v1"
@@ -318,6 +319,47 @@ def _profile(catalog: dict[str, Any], profile_id: str) -> dict[str, Any]:
     return matches[0]
 
 
+def _declared_receiver_selector(root: Path, device_kind: str) -> int:
+    lane = {"mouse": "pointer_lane", "keyboard": "keyboard_lane"}.get(device_kind)
+    if lane is None:
+        raise ModelError("native parity device kind has no receiver endpoint lane")
+    inputs = load_profile_inputs(root)
+    receivers = [profile for profile in inputs.profiles if profile["kind"] == "receiver"]
+    if len(receivers) != 1:
+        raise ModelError("native parity requires exactly one canonical receiver profile")
+    route_selector = (
+        receivers[0].get("transport", {})
+        .get("native_exchange", {})
+        .get("route_selector")
+    )
+    if (
+        not isinstance(route_selector, dict)
+        or route_selector.get("field") != "transaction-id"
+        or not _bounded_int(route_selector.get(lane), 1, 255)
+    ):
+        raise ModelError("native parity receiver route selector is unavailable")
+    return route_selector[lane]
+
+
+def _route_translation(
+    *,
+    application_selector: int,
+    receiver_selector: int,
+    response_selector: int | None,
+    response_restored_for_application: bool | None,
+    authority: str,
+) -> dict[str, Any]:
+    return {
+        "field": "transaction-id",
+        "application_selector": application_selector,
+        "receiver_selector": receiver_selector,
+        "applied": application_selector != receiver_selector,
+        "response_selector": response_selector,
+        "response_restored_for_application": response_restored_for_application,
+        "authority": authority,
+    }
+
+
 def _match_exchanges(
     profile: dict[str, Any],
     exchanges: tuple[UsbmonExchange, ...],
@@ -601,6 +643,9 @@ def build_live_parity_evidence(
     maximum_attempts = catalog["busy_retry"]["maximum_attempts"]
     required = [probe["method"] for probe in profile["probes"]]
     probes = {probe["method"]: probe for probe in profile["probes"]}
+    receiver_selector = _declared_receiver_selector(
+        root, profile["wireless_identity"]["device_kind"]
+    )
     observations: list[dict[str, Any]] = []
     receiver_observations: dict[str, dict[str, Any]] = {}
     for method in required:
@@ -610,7 +655,27 @@ def build_live_parity_evidence(
         routed = receiver_matches.get(method, [])
         if not routed:
             continue
-        receiver = _receiver_observation(routed, None, maximum_attempts)
+        final = routed[-1]
+        application_selector = final.exchange.request[1]
+        response_selector = (
+            final.exchange.response[1] if final.response_complete else None
+        )
+        receiver = _receiver_observation(
+            routed,
+            None,
+            maximum_attempts,
+            route_translation=_route_translation(
+                application_selector=application_selector,
+                receiver_selector=receiver_selector,
+                response_selector=response_selector,
+                response_restored_for_application=(
+                    response_selector == application_selector
+                    if response_selector is not None
+                    else None
+                ),
+                authority="receiver-profile",
+            ),
+        )
         receiver["receiver_comparison"]["semantic_parity"] = (
             _semantic_parity_from_evidence(probes[method], direct, routed[-1])
         )
@@ -704,6 +769,7 @@ def _direct_observation(item: MatchedExchange) -> dict[str, Any]:
             "complete_capture": item.response_complete,
             "summary": item.summary,
         },
+        "route_translation": None,
         "receiver_comparison": {
             "attempts": 0,
             "unchanged_request": None,
@@ -717,6 +783,8 @@ def _receiver_observation(
     items: list[MatchedExchange],
     direct: MatchedExchange | None,
     maximum_attempts: int,
+    *,
+    route_translation: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     if not items:
         raise ModelError("receiver parity observation requires at least one exchange")
@@ -775,6 +843,7 @@ def _receiver_observation(
             "complete_capture": final.response_complete,
             "summary": final.summary,
         },
+        "route_translation": route_translation,
         "receiver_comparison": {
             "attempts": len(items),
             "unchanged_request": unchanged,
@@ -878,7 +947,24 @@ def build_offline_parity_evidence(
             observations.append(_direct_observation(direct))
         routed = receiver_matches.get(method, [])
         if routed:
-            receiver = _receiver_observation(routed, direct, maximum_attempts)
+            final = routed[-1]
+            translation = None
+            if direct is not None:
+                translation = _route_translation(
+                    application_selector=direct.exchange.request[1],
+                    receiver_selector=final.exchange.request[1],
+                    response_selector=(
+                        final.exchange.response[1] if final.response_complete else None
+                    ),
+                    response_restored_for_application=None,
+                    authority="captured-usbmon",
+                )
+            receiver = _receiver_observation(
+                routed,
+                direct,
+                maximum_attempts,
+                route_translation=translation,
+            )
             receiver_observations[method] = receiver
             observations.append(receiver)
 
@@ -1068,11 +1154,17 @@ def exact_keys(item: dict[str, Any], expected: set[str], label: str) -> None:
         label = f"native parity observation {index}"
         if not isinstance(observation, dict):
             raise ModelError(f"{label}: expected an object")
-        exact_keys(
-            observation,
-            {"method", "origin", "comparison", "request", "response", "receiver_comparison"},
-            label,
-        )
+        observation_keys = {
+            "method",
+            "origin",
+            "comparison",
+            "request",
+            "response",
+            "receiver_comparison",
+        }
+        if "route_translation" in observation:
+            observation_keys.add("route_translation")
+        exact_keys(observation, observation_keys, label)
         method = observation["method"]
         origin = observation["origin"]
         if method not in required or origin not in {
@@ -1147,10 +1239,49 @@ def exact_keys(item: dict[str, Any], expected: set[str], label: str) -> None:
         if origin == "direct-semantic-reference":
             if attempts != 0 or states != (None, None, None):
                 raise ModelError(f"{label}: direct evidence claims a receiver outcome")
+            if observation.get("route_translation") is not None:
+                raise ModelError(f"{label}: direct evidence claims receiver translation")
         else:
             if not 1 <= attempts <= 8:
                 raise ModelError(f"{label}: receiver attempts exceed the evidence bound")
             routed[method] = observation
+        translation = observation.get("route_translation")
+        if translation is not None:
+            if not isinstance(translation, dict):
+                raise ModelError(f"{label}: malformed route translation")
+            exact_keys(
+                translation,
+                {
+                    "field",
+                    "application_selector",
+                    "receiver_selector",
+                    "applied",
+                    "response_selector",
+                    "response_restored_for_application",
+                    "authority",
+                },
+                f"{label} route translation",
+            )
+            application_selector = translation["application_selector"]
+            receiver_selector = translation["receiver_selector"]
+            response_selector = translation["response_selector"]
+            restored = translation["response_restored_for_application"]
+            if (
+                translation["field"] != "transaction-id"
+                or not _bounded_int(application_selector, 0, 255)
+                or not _bounded_int(receiver_selector, 0, 255)
+                or translation["applied"]
+                != (application_selector != receiver_selector)
+                or (
+                    response_selector is not None
+                    and not _bounded_int(response_selector, 0, 255)
+                )
+                or (restored is not None and not isinstance(restored, bool))
+                or translation["authority"]
+                not in {"captured-usbmon", "receiver-profile"}
+                or (restored is True and response_selector != application_selector)
+            ):
+                raise ModelError(f"{label}: invalid route translation")
 
     derived_passed: list[str] = []
     derived_failed: list[str] = []
diff --git a/tools/hfxdev/profiles.py b/tools/hfxdev/profiles.py
index a81c12f..332516a 100644
--- a/tools/hfxdev/profiles.py
+++ b/tools/hfxdev/profiles.py
@@ -92,9 +92,17 @@
     "response_retry_delay_us",
     "max_response_attempts",
     "report_format",
+    "route_selector",
     "match_ranges",
 }
+NATIVE_EXCHANGE_REQUIRED_KEYS = NATIVE_EXCHANGE_KEYS - {"route_selector"}
 NATIVE_MATCH_RANGE_KEYS = {"offset", "length"}
+NATIVE_ROUTE_SELECTOR_KEYS = {
+    "field",
+    "pointer_lane",
+    "keyboard_lane",
+    "restore_original_response",
+}
 NATIVE_REPORT_FORMAT_KEYS = {
     "request_status",
     "response_status",
@@ -559,7 +567,7 @@ def _validate_native_exchange(profile_id: str, value: object) -> None:
     if not isinstance(value, dict):
         raise ModelError(f"{profile_id}: native exchange must be an object")
     _expect_keys(value, NATIVE_EXCHANGE_KEYS, f"{profile_id} native exchange")
-    missing = sorted(NATIVE_EXCHANGE_KEYS - set(value))
+    missing = sorted(NATIVE_EXCHANGE_REQUIRED_KEYS - set(value))
     if missing:
         raise ModelError(f"{profile_id}: incomplete native exchange: {', '.join(missing)}")
     if value["protocol_family"] != "razer-feature-report-v1":
@@ -666,6 +674,33 @@ def byte_value(name: str) -> None:
         for key, maximum in (("offset", value["report_bytes"] - 1), ("match_mask", 255))
     ):
         raise ModelError(f"{profile_id}: native transaction id is out of bounds")
+    route_selector = value.get("route_selector")
+    if route_selector is not None:
+        if not isinstance(route_selector, dict):
+            raise ModelError(f"{profile_id}: native route selector must be an object")
+        _expect_keys(
+            route_selector,
+            NATIVE_ROUTE_SELECTOR_KEYS,
+            f"{profile_id} native route selector",
+        )
+        if set(route_selector) != NATIVE_ROUTE_SELECTOR_KEYS:
+            raise ModelError(f"{profile_id}: native route selector is incomplete")
+        if route_selector["field"] != "transaction-id":
+            raise ModelError(f"{profile_id}: native route selector field is unsupported")
+        for lane in ("pointer_lane", "keyboard_lane"):
+            selector = route_selector[lane]
+            if (
+                isinstance(selector, bool)
+                or not isinstance(selector, int)
+                or not 1 <= selector <= 255
+            ):
+                raise ModelError(f"{profile_id}: native route selector {lane} is invalid")
+        if route_selector["pointer_lane"] == route_selector["keyboard_lane"]:
+            raise ModelError(f"{profile_id}: native route selectors must isolate endpoint lanes")
+        if route_selector["restore_original_response"] is not True:
+            raise ModelError(
+                f"{profile_id}: native route selector must restore the application response"
+            )
     ranges = value["match_ranges"]
     if not isinstance(ranges, list) or not 1 <= len(ranges) <= 4:
         raise ModelError(f"{profile_id}: native exchange needs one to four match ranges")

From 6cc4fbea473980020c375d410d1907426418f3a9 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 14:50:12 +0400
Subject: [PATCH 58/67] fix(native): mirror upstream device mode reads

---
 tests/test_native_live_parity.py | 41 ++++++++++++++++++++++++++++++++
 tools/hfxdev/native_parity.py    |  7 ++++--
 2 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/tests/test_native_live_parity.py b/tests/test_native_live_parity.py
index f68f583..4f76554 100644
--- a/tests/test_native_live_parity.py
+++ b/tests/test_native_live_parity.py
@@ -168,6 +168,47 @@ def test_source_bound_semantic_reference_does_not_require_raw_direct_report(self
         )
         self.assertIn("get_firmware", evidence["coverage"]["passed"])
 
+    def test_device_mode_follows_upstream_fixed_argument_reads(self) -> None:
+        probe = _probe("get_device_mode")
+        request = canonical_request(probe, 0x1F)
+        response = bytearray(_response(request, bytes((4,))))
+        response[9] = 7
+        response[88] = _crc(response)
+        with TemporaryDirectory() as directory:
+            direct = Path(directory) / "direct.txt"
+            direct.write_text(_capture(request, bytes(response)), encoding="utf-8")
+            direct_evidence = build_offline_parity_evidence(
+                ROOT,
+                profile_id=PROFILE,
+                direct_capture=direct,
+                created_at="2026-07-26T00:00:00Z",
+                source_revision=REVISION,
+            )
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=direct_evidence,
+            raw_qualification=_raw(
+                [_raw_record("get_device_mode", request, bytes(response))]
+            ),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        self.assertIn("get_device_mode", evidence["coverage"]["passed"])
+        summaries = [
+            item["response"]["summary"]
+            for item in evidence["observations"]
+            if item["method"] == "get_device_mode"
+        ]
+        self.assertEqual(
+            summaries,
+            [
+                {"kind": "device-mode", "mode": 4, "parameter": 7, "available": True},
+                {"kind": "device-mode", "mode": 4, "parameter": 7, "available": True},
+            ],
+        )
+
     def test_matching_terminal_failure_is_preserved_as_transport_parity(self) -> None:
         probe = _probe("get_brightness")
         request = canonical_request(probe, 0x1F)
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index 23c3206..224b5f6 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -281,8 +281,11 @@ def _semantic_summary(
     elif summary_kind == "be16-seconds" and len(arguments) >= 2:
         value = int.from_bytes(arguments[:2], "big")
         summary["seconds"] = value
-    elif summary_kind == "device-mode" and len(arguments) >= 2:
-        value = (arguments[0], arguments[1])
+    elif summary_kind == "device-mode" and len(response) >= 10:
+        # OpenRazer's device_mode readers consume arguments[0] and
+        # arguments[1] directly.  Some devices report a one-byte response
+        # length while still returning both fixed-position bytes.
+        value = (response[8], response[9])
         summary.update({"mode": value[0], "parameter": value[1]})
     elif summary_kind == "dpi-xy" and len(arguments) >= 5:
         value = (

From 27a08eafb5ffd3c0732dc797981652181279875a Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 15:44:20 +0400
Subject: [PATCH 59/67] feat(native): add supervised direct parity references

---
 tests/test_native_direct_reference.py   | 255 ++++++++++
 tests/test_native_live_parity.py        | 148 ++++++
 tests/test_native_parity.py             | 115 +++++
 tools/hfxdev/cli.py                     |  35 ++
 tools/hfxdev/native_direct_reference.py | 649 ++++++++++++++++++++++++
 tools/hfxdev/native_live_parity.py      |  55 +-
 tools/hfxdev/native_parity.py           | 140 ++++-
 7 files changed, 1383 insertions(+), 14 deletions(-)
 create mode 100644 tests/test_native_direct_reference.py
 create mode 100644 tools/hfxdev/native_direct_reference.py

diff --git a/tests/test_native_direct_reference.py b/tests/test_native_direct_reference.py
new file mode 100644
index 0000000..08ce2aa
--- /dev/null
+++ b/tests/test_native_direct_reference.py
@@ -0,0 +1,255 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+import subprocess
+from types import SimpleNamespace
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import MagicMock, patch
+
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "tools"))
+
+from hfxdev.model import ModelError
+import hfxdev.native_direct_reference as direct
+from hfxdev.native_parity import DirectSemanticReference
+
+
+ROUTE = {
+    "driver_family": "razermouse",
+    "vendor_id": 0x1532,
+    "direct_data_product_ids": [0x00CC],
+}
+PROFILE = {
+    "probes": [
+        {"method": "get_serial", "driver": {"attribute": "device_serial"}},
+        {"method": "get_dpi_stages", "driver": {"attribute": "dpi_stages"}},
+    ]
+}
+
+
+class DirectTree:
+    def __init__(self, root: Path) -> None:
+        self.root = root
+        self.devices = root / "devices"
+        self.drivers = root / "drivers"
+        self.devices.mkdir()
+        self.drivers.mkdir()
+
+    def add(
+        self,
+        *,
+        identity: str,
+        bus: int,
+        device: int,
+        port: int = 2,
+        attributes: tuple[str, ...] = ("device_serial", "dpi_stages"),
+    ) -> None:
+        usb = self.devices / f"usb{bus}" / f"{bus}-{port}"
+        hid = usb / f"{bus}-{port}:1.0" / identity
+        hid.mkdir(parents=True)
+        (usb / "busnum").write_text(f"{bus}\n", encoding="ascii")
+        (usb / "devnum").write_text(f"{device}\n", encoding="ascii")
+        for attribute in attributes:
+            (hid / attribute).write_bytes(b"fixture")
+        family = self.drivers / "razermouse"
+        family.mkdir(exist_ok=True)
+        (family / identity).symlink_to(hid)
+
+
+class NativeDirectReferenceTests(unittest.TestCase):
+    def test_exact_direct_identity_and_complete_attribute_carrier_are_required(self) -> None:
+        with TemporaryDirectory() as directory:
+            tree = DirectTree(Path(directory))
+            tree.add(identity="0003:1532:00CD.0001", bus=3, device=4)
+            tree.add(
+                identity="0003:1532:00CC.0002",
+                bus=3,
+                device=5,
+                attributes=("device_serial",),
+            )
+            tree.add(identity="0003:1532:00CC.0003", bus=3, device=6)
+            endpoint = direct.find_exact_direct_endpoint(
+                ROUTE,
+                PROFILE,
+                driver_root=tree.drivers,
+                devices_root=tree.devices,
+            )
+        self.assertEqual((endpoint.bus, endpoint.device), (3, 6))
+        self.assertEqual(endpoint.driver_entry.name, "0003:1532:00CC.0003")
+
+    def test_absent_or_duplicate_direct_data_routes_fail_closed(self) -> None:
+        with TemporaryDirectory() as directory:
+            tree = DirectTree(Path(directory))
+            with self.assertRaisesRegex(ModelError, "data route.*absent"):
+                direct.find_exact_direct_endpoint(
+                    ROUTE,
+                    PROFILE,
+                    driver_root=tree.drivers,
+                    devices_root=tree.devices,
+                )
+            tree.add(identity="0003:1532:00CC.0001", bus=3, device=5, port=2)
+            tree.add(identity="0003:1532:00CC.0002", bus=3, device=6, port=3)
+            with self.assertRaisesRegex(ModelError, "more than one exact"):
+                direct.find_exact_direct_endpoint(
+                    ROUTE,
+                    PROFILE,
+                    driver_root=tree.drivers,
+                    devices_root=tree.devices,
+                )
+
+    def test_only_source_bound_attributes_are_read(self) -> None:
+        seen: list[str] = []
+        with patch.object(
+            direct,
+            "_read_attribute",
+            side_effect=lambda path: seen.append(path.name),
+        ):
+            result = direct.trigger_direct_attributes(Path("/sys/fake"), PROFILE)
+        self.assertEqual(result, ("device_serial", "dpi_stages"))
+        self.assertEqual(seen, ["device_serial", "dpi_stages"])
+
+    def test_private_capture_directory_is_removed_on_failure(self) -> None:
+        path: Path | None = None
+        with self.assertRaisesRegex(RuntimeError, "stop"):
+            with direct._private_capture_directory(os.getuid(), os.getgid()) as directory:
+                path = directory
+                self.assertEqual(directory.stat().st_mode & 0o777, 0o700)
+                raise RuntimeError("stop")
+        self.assertIsNotNone(path)
+        self.assertFalse(path.exists())
+
+    def test_dumpcap_uses_private_files_and_hard_capture_bounds(self) -> None:
+        process = MagicMock()
+        process.poll.return_value = None
+        with TemporaryDirectory() as directory:
+            capture = Path(directory) / "direct.pcapng"
+            with (
+                patch.object(direct.shutil, "which", return_value="/usr/bin/dumpcap"),
+                patch.object(direct.subprocess, "Popen", return_value=process) as popen,
+                patch.object(direct.time, "sleep"),
+            ):
+                started = direct._start_dumpcap("usbmon3", capture)
+            command = popen.call_args.args[0]
+            diagnostic = popen.call_args.kwargs["stderr"]
+            self.assertIs(started.process, process)
+            self.assertNotEqual(diagnostic, subprocess.PIPE)
+            self.assertTrue(diagnostic.closed)
+            self.assertIn("duration:5", command)
+            self.assertIn(
+                f"filesize:{direct.MAX_CAPTURE_BYTES // 1024}",
+                command,
+            )
+            self.assertEqual(started.diagnostic_path.stat().st_mode & 0o777, 0o600)
+
+    def test_capture_export_filters_to_the_exact_physical_device(self) -> None:
+        completed = SimpleNamespace(returncode=0, stdout=b"", stderr=b"")
+        with (
+            patch.object(direct.shutil, "which", return_value="/usr/bin/tshark"),
+            patch.object(direct.subprocess, "run", return_value=completed) as run,
+        ):
+            self.assertEqual(
+                direct._export_capture(Path("direct.pcapng"), bus=3, device=12),
+                "",
+            )
+        command = run.call_args.args[0]
+        self.assertIn("-n", command)
+        filter_index = command.index("-Y")
+        self.assertEqual(
+            command[filter_index + 1],
+            "usb.bus_id == 3 && usb.device_address == 12",
+        )
+
+    def test_staged_session_keeps_serial_material_in_process_only(self) -> None:
+        preflight = SimpleNamespace(
+            route=ROUTE,
+            profile=PROFILE,
+            revision="a" * 40,
+        )
+        reference = DirectSemanticReference(
+            evidence={
+                "observations": [
+                    {"method": "get_serial"},
+                    {"method": "get_dpi_stages"},
+                ]
+            },
+            serial_values={"get_serial": b"PRIVATE-SERIAL"},
+        )
+        captured = direct.CapturedDirectReference(
+            reference=reference,
+            attributes_read=("device_serial", "dpi_stages"),
+            bus=3,
+            device=12,
+        )
+        expected = SimpleNamespace(
+            conclusion="passed",
+            passed=("get_serial", "get_dpi_stages"),
+            missing=(),
+            failed=(),
+        )
+        with (
+            patch.object(direct, "prepare_live_parity", return_value=preflight),
+            patch.object(direct, "_operator_identity", return_value=(os.getuid(), os.getgid())),
+            patch.object(direct, "capture_direct_reference", return_value=captured),
+            patch.object(direct, "_wait_for_operator"),
+            patch.object(direct, "_require_direct_route_absent"),
+            patch.object(direct, "run_live_parity", return_value=expected) as run,
+            patch("builtins.print"),
+        ):
+            result = direct.run_staged_live_parity(
+                ROOT,
+                profile_id="child.razer.example.0001",
+                package=Path("candidate.pkg.tar.zst"),
+                package_sha256="b" * 64,
+                expected_generation=7,
+                approval_text=direct.STAGED_PARITY_APPROVAL,
+                user="operator",
+            )
+        self.assertIs(result, expected)
+        keywords = run.call_args.kwargs
+        self.assertEqual(
+            keywords["direct_serial_values"], {"get_serial": b"PRIVATE-SERIAL"}
+        )
+        self.assertFalse(keywords["direct_evidence_path"].exists())
+
+    def test_staged_session_rejects_incomplete_direct_capture_before_transition(self) -> None:
+        preflight = SimpleNamespace(
+            route=ROUTE,
+            profile=PROFILE,
+            revision="a" * 40,
+        )
+        captured = direct.CapturedDirectReference(
+            reference=DirectSemanticReference(
+                evidence={"observations": [{"method": "get_serial"}]},
+                serial_values={"get_serial": b"PRIVATE-SERIAL"},
+            ),
+            attributes_read=("device_serial",),
+            bus=3,
+            device=12,
+        )
+        with (
+            patch.object(direct, "prepare_live_parity", return_value=preflight),
+            patch.object(direct, "_operator_identity", return_value=(os.getuid(), os.getgid())),
+            patch.object(direct, "capture_direct_reference", return_value=captured),
+            patch.object(direct, "_wait_for_operator") as wait,
+        ):
+            with self.assertRaisesRegex(ModelError, "missed source-bound methods"):
+                direct.run_staged_live_parity(
+                    ROOT,
+                    profile_id="child.razer.example.0001",
+                    package=Path("candidate.pkg.tar.zst"),
+                    package_sha256="b" * 64,
+                    expected_generation=7,
+                    approval_text=direct.STAGED_PARITY_APPROVAL,
+                    user="operator",
+                )
+        wait.assert_not_called()
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/tests/test_native_live_parity.py b/tests/test_native_live_parity.py
index 4f76554..f46d70e 100644
--- a/tests/test_native_live_parity.py
+++ b/tests/test_native_live_parity.py
@@ -151,6 +151,78 @@ def test_ephemeral_exact_report_becomes_privacy_safe_parity(self) -> None:
         self.assertNotIn(request.hex(), serialized)
         self.assertNotIn(response.hex(), serialized)
 
+    def test_staged_serial_material_is_compared_only_in_memory(self) -> None:
+        probe = _probe("get_serial")
+        request = canonical_request(probe, 0x1F)
+        serial = b"PRIVATE-SERIAL-1234567"
+        response = _response(request, serial)
+        direct = self._direct_method_evidence("get_serial", serial)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=direct,
+            raw_qualification=_raw([_raw_record("get_serial", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+            direct_serial_values={"get_serial": serial},
+        )
+        rendered = json.dumps(evidence, sort_keys=True)
+        self.assertIn("get_serial", evidence["coverage"]["passed"])
+        self.assertNotIn(serial.decode(), rendered)
+        self.assertNotIn(hashlib.sha256(serial).hexdigest(), rendered)
+
+        mismatched = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=direct,
+            raw_qualification=_raw([_raw_record("get_serial", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+            direct_serial_values={"get_serial": b"DIFFERENT-SERIAL"},
+        )
+        self.assertIn("get_serial", mismatched["coverage"]["failed"])
+
+    def test_serial_comparison_preserves_leading_bytes(self) -> None:
+        probe = _probe("get_serial")
+        request = canonical_request(probe, 0x1F)
+        direct_serial = b" PRIVATE-SERIAL"
+        receiver_serial = b"PRIVATE-SERIAL"
+        direct = self._direct_method_evidence("get_serial", direct_serial)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=direct,
+            raw_qualification=_raw(
+                [_raw_record("get_serial", request, _response(request, receiver_serial))]
+            ),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+            direct_serial_values={"get_serial": direct_serial},
+        )
+        self.assertIn("get_serial", evidence["coverage"]["failed"])
+
+    def test_serial_material_is_rejected_for_non_serial_methods(self) -> None:
+        probe = _probe("get_firmware")
+        request = canonical_request(probe, 0x1F)
+        response = _response(request, bytes((2, 51)))
+        direct = self._direct_method_evidence("get_firmware", bytes((2, 51)))
+        with self.assertRaisesRegex(ModelError, "serial comparison material"):
+            build_live_parity_evidence(
+                ROOT,
+                profile_id=PROFILE,
+                direct_evidence=direct,
+                raw_qualification=_raw(
+                    [_raw_record("get_firmware", request, response)]
+                ),
+                package_sha256=PACKAGE_SHA256,
+                receiver_generation=7,
+                source_revision=REVISION,
+                direct_serial_values={"get_firmware": b"NOT-A-SERIAL"},
+            )
+
     def test_source_bound_semantic_reference_does_not_require_raw_direct_report(self) -> None:
         probe = _probe("get_firmware")
         request = canonical_request(probe, 0x1F)
@@ -209,6 +281,82 @@ def test_device_mode_follows_upstream_fixed_argument_reads(self) -> None:
             ],
         )
 
+    def test_dpi_stage_summary_covers_every_upstream_exposed_xy_pair(self) -> None:
+        probe = _probe("get_dpi_stages")
+        request = canonical_request(probe, 0x1F)
+        arguments = bytes(
+            (
+                1,
+                2,
+                2,
+                1,
+                0x03,
+                0x20,
+                0x03,
+                0x20,
+                0,
+                0,
+                2,
+                0x07,
+                0x08,
+                0x07,
+                0x08,
+                0,
+                0,
+            )
+        )
+        response = _response(request, arguments)
+        direct = self._direct_method_evidence("get_dpi_stages", arguments)
+        evidence = build_live_parity_evidence(
+            ROOT,
+            profile_id=PROFILE,
+            direct_evidence=direct,
+            raw_qualification=_raw([_raw_record("get_dpi_stages", request, response)]),
+            package_sha256=PACKAGE_SHA256,
+            receiver_generation=7,
+            source_revision=REVISION,
+        )
+        routed = next(
+            item
+            for item in evidence["observations"]
+            if item["method"] == "get_dpi_stages"
+            and item["origin"] == "receiver-route"
+        )
+        self.assertEqual(
+            routed["response"]["summary"],
+            {
+                "kind": "dpi-stages",
+                "active_stage": 2,
+                "stage_count": 2,
+                "stages": [{"x": 800, "y": 800}, {"x": 1800, "y": 1800}],
+                "complete_stage_table": True,
+                "available": True,
+            },
+        )
+        self.assertIn("get_dpi_stages", evidence["coverage"]["passed"])
+
+    def test_truncated_dpi_stage_table_remains_incomplete(self) -> None:
+        direct = self._direct_method_evidence(
+            "get_dpi_stages",
+            bytes((1, 2, 2, 1, 0x03, 0x20, 0x03, 0x20)),
+        )
+        observation = next(
+            item
+            for item in direct["observations"]
+            if item["method"] == "get_dpi_stages"
+        )
+        self.assertEqual(
+            observation["response"]["summary"],
+            {
+                "kind": "dpi-stages",
+                "active_stage": 2,
+                "stage_count": 2,
+                "stages": [{"x": 800, "y": 800}],
+                "complete_stage_table": False,
+                "available": False,
+            },
+        )
+
     def test_matching_terminal_failure_is_preserved_as_transport_parity(self) -> None:
         probe = _probe("get_brightness")
         request = canonical_request(probe, 0x1F)
diff --git a/tests/test_native_parity.py b/tests/test_native_parity.py
index fdfc35b..3dfaea9 100644
--- a/tests/test_native_parity.py
+++ b/tests/test_native_parity.py
@@ -17,12 +17,14 @@
 
 from hfxdev.model import ModelError
 from hfxdev.native_parity import (
+    build_direct_semantic_reference,
     build_offline_parity_evidence,
     canonical_request,
     parse_usbmon_capture,
     validate_parity_evidence,
     write_parity_evidence,
 )
+from hfxdev.native_direct_reference import parse_tshark_usbmon_fields
 from hfxdev.native_probe import load_native_probe_catalog
 
 
@@ -65,6 +67,40 @@ def _capture(request: bytes, response: bytes, *, device: int) -> str:
     )
 
 
+def _tshark_row(
+    timestamp: str,
+    urb_id: str,
+    event: str,
+    *,
+    request_type: str = "",
+    request_id: str = "",
+    value: str = "",
+    interface: str = "",
+    setup_length: str = "",
+    payload: bytes = b"",
+) -> str:
+    fields = [
+        timestamp,
+        urb_id,
+        event,
+        "2",
+        "3",
+        "12",
+        "0",
+        request_type,
+        request_id,
+        value,
+        interface,
+        setup_length,
+        str(len(payload)) if payload else "0",
+        ":".join(f"{byte:02x}" for byte in payload),
+        "",
+        "",
+        "",
+    ]
+    return "\t".join(fields)
+
+
 def _probe(profile_id: str, method: str) -> dict:
     catalog = load_native_probe_catalog(ROOT)
     profile = next(value for value in catalog["devices"] if value["profile_id"] == profile_id)
@@ -128,6 +164,85 @@ def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> Non
             },
         )
 
+    def test_full_tshark_fields_preserve_complete_direct_reports(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        request = canonical_request(probe, 0x1F)
+        response = _response(request, bytes((2, 51)))
+        rows = "\n".join(
+            (
+                _tshark_row(
+                    "1.000001",
+                    "0x1",
+                    "S",
+                    request_type="0x21",
+                    request_id="9",
+                    value="0x0300",
+                    interface="0",
+                    setup_length="90",
+                    payload=request,
+                ),
+                _tshark_row(
+                    "1.000002",
+                    "0x2",
+                    "S",
+                    request_type="0xa1",
+                    request_id="1",
+                    value="0x0300",
+                    interface="0",
+                    setup_length="90",
+                ),
+                _tshark_row("1.000003", "0x2", "C", payload=response),
+            )
+        )
+        exchanges = parse_tshark_usbmon_fields(
+            rows,
+            target_bus=3,
+            target_device=12,
+        )
+        self.assertEqual(len(exchanges), 1)
+        self.assertEqual(exchanges[0].request, request)
+        self.assertEqual(exchanges[0].response, response)
+        self.assertEqual(exchanges[0].timestamp_us, 1_000_001)
+
+        reference = build_direct_semantic_reference(
+            ROOT,
+            profile_id=self.mouse_profile,
+            exchanges=exchanges,
+            created_at="2026-07-26T00:00:00Z",
+            source_revision=REVISION,
+        )
+        direct = next(
+            item
+            for item in reference.evidence["observations"]
+            if item["method"] == "get_firmware"
+        )
+        self.assertTrue(direct["request"]["complete_capture"])
+        self.assertEqual(direct["response"]["summary"]["minor"], 51)
+
+    def test_tshark_fields_reject_incomplete_or_conflicting_raw_material(self) -> None:
+        probe = _probe(self.mouse_profile, "get_firmware")
+        request = canonical_request(probe, 0x1F)
+        incomplete = _tshark_row(
+            "1.0",
+            "0x1",
+            "S",
+            request_type="0x21",
+            request_id="9",
+            value="0x0300",
+            interface="0",
+            setup_length="90",
+            payload=request[:-1],
+        )
+        with self.assertRaisesRegex(ModelError, "request is not complete"):
+            parse_tshark_usbmon_fields(incomplete, target_bus=3, target_device=12)
+
+        fields = _tshark_row("1.0", "0x1", "C", payload=request).split("\t")
+        fields[14] = (bytes((request[0] ^ 1,)) + request[1:]).hex()
+        with self.assertRaisesRegex(ModelError, "conflicting complete reports"):
+            parse_tshark_usbmon_fields(
+                "\t".join(fields), target_bus=3, target_device=12
+            )
+
     def test_route_translation_remains_optional_for_v1_evidence(self) -> None:
         legacy = deepcopy(self._mouse_firmware_evidence())
         for observation in legacy["observations"]:
diff --git a/tools/hfxdev/cli.py b/tools/hfxdev/cli.py
index 70ffa94..06f4148 100644
--- a/tools/hfxdev/cli.py
+++ b/tools/hfxdev/cli.py
@@ -15,6 +15,7 @@
 from .migration import capture_inventory, run_shadow_comparison, summary
 from .model import ModelError
 from .native_control import write_native_method_inventory
+from .native_direct_reference import run_staged_live_parity
 from .native_live_parity import run_live_parity
 from .native_onboarding import (
     build_draft_from_file,
@@ -142,6 +143,18 @@ def _parser() -> argparse.ArgumentParser:
     live_parity.add_argument("--approval-text", required=True)
     live_parity.add_argument("--user", required=True)
     live_parity.add_argument("--timeout-seconds", type=int, default=90)
+    staged_parity = native_commands.add_parser(
+        "staged-parity",
+        help="compare one exact device directly and through the receiver in one private session",
+    )
+    staged_parity.add_argument("--profile", required=True)
+    staged_parity.add_argument("--package", required=True, type=Path)
+    staged_parity.add_argument("--package-sha256", required=True)
+    staged_parity.add_argument("--expected-generation", required=True, type=int)
+    staged_parity.add_argument("--approval-text", required=True)
+    staged_parity.add_argument("--user", required=True)
+    staged_parity.add_argument("--timeout-seconds", type=int, default=90)
+    staged_parity.add_argument("--transition-timeout-seconds", type=int, default=300)
     native_openrazer = native_commands.add_parser(
         "prepare-openrazer",
         help="prepare the source-bound OpenRazer native transport tree",
@@ -391,6 +404,28 @@ def main(arguments: list[str] | None = None) -> int:
                 print(f"Privacy-safe evidence: {result.evidence_path}")
                 print(f"Source-bound run: {result.run_path}")
                 return 0
+            if args.native_command == "staged-parity":
+                result = run_staged_live_parity(
+                    root,
+                    profile_id=args.profile,
+                    package=args.package,
+                    package_sha256=args.package_sha256,
+                    expected_generation=args.expected_generation,
+                    approval_text=args.approval_text,
+                    user=args.user,
+                    timeout_seconds=args.timeout_seconds,
+                    transition_timeout_seconds=args.transition_timeout_seconds,
+                )
+                print(f"Native transport parity: {result.conclusion}")
+                print(
+                    "Coverage: "
+                    f"{len(result.passed)} passed, "
+                    f"{len(result.missing)} incomplete, "
+                    f"{len(result.failed)} failed"
+                )
+                print(f"Privacy-safe evidence: {result.evidence_path}")
+                print(f"Source-bound run: {result.run_path}")
+                return 0
             if args.native_command == "prepare-openrazer":
                 prepared = prepare_openrazer_native_source(
                     root, args.source, args.output
diff --git a/tools/hfxdev/native_direct_reference.py b/tools/hfxdev/native_direct_reference.py
new file mode 100644
index 0000000..25f5850
--- /dev/null
+++ b/tools/hfxdev/native_direct_reference.py
@@ -0,0 +1,649 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+from contextlib import contextmanager
+from dataclasses import dataclass
+from decimal import Decimal, InvalidOperation
+import os
+from pathlib import Path
+import pwd
+import re
+import selectors
+import shutil
+import signal
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+from typing import Any, Iterator
+
+from .model import ModelError
+from .native_parity import (
+    DirectSemanticReference,
+    UsbmonExchange,
+    build_direct_semantic_reference,
+)
+from .native_live_parity import (
+    READ_ONLY_APPROVAL,
+    LiveParityResult,
+    prepare_live_parity,
+    run_live_parity,
+)
+from .native_probe import REPORT_SIZE
+from .private_artifact import write_new_private_json
+
+
+HID_IDENTITY_PATTERN = re.compile(
+    r"0003:(?P<vendor>[0-9A-Fa-f]{4}):(?P<product>[0-9A-Fa-f]{4})\.[0-9A-Fa-f]{4}\Z"
+)
+MAX_ATTRIBUTE_BYTES = 4096
+MAX_CAPTURE_BYTES = 32 * 1024 * 1024
+MAX_PROCESS_OUTPUT_BYTES = 64 * 1024
+CAPTURE_PREFIX = "hyperflux-next-direct-reference-"
+STAGED_PARITY_APPROVAL = (
+    "approve HyperFlux Next supervised direct-to-receiver native parity session"
+)
+TSHARK_FIELDS = (
+    "frame.time_epoch",
+    "usb.urb_id",
+    "usb.urb_type",
+    "usb.transfer_type",
+    "usb.bus_id",
+    "usb.device_address",
+    "usb.endpoint_address",
+    "usb.bmRequestType",
+    "usb.setup.bRequest",
+    "usb.setup.wValue",
+    "usb.setup.wIndex",
+    "usb.setup.wLength",
+    "usb.data_len",
+    "usb.capdata",
+    "usb.data_fragment",
+    "usbhid.data",
+    "usbhid.data.vendor",
+)
+
+
+def _numeric_field(value: str, label: str) -> int:
+    candidate = value.strip().lower()
+    if not candidate:
+        raise ModelError(f"tshark USB row lacks {label}")
+    try:
+        return int(candidate, 16 if candidate.startswith("0x") else 10)
+    except ValueError as error:
+        raise ModelError(f"tshark USB row has invalid {label}") from error
+
+
+def _tshark_payload(values: list[str]) -> bytes:
+    payloads: set[bytes] = set()
+    for value in values:
+        compact = value.replace(":", "").strip()
+        if not compact:
+            continue
+        if re.fullmatch(r"[0-9a-fA-F]+", compact) is None or len(compact) % 2:
+            raise ModelError("tshark USB row contains malformed report bytes")
+        decoded = bytes.fromhex(compact)
+        if len(decoded) == REPORT_SIZE:
+            payloads.add(decoded)
+    if len(payloads) > 1:
+        raise ModelError("tshark USB row exposes conflicting complete reports")
+    return next(iter(payloads), b"")
+
+
+def parse_tshark_usbmon_fields(
+    text: str,
+    *,
+    target_bus: int,
+    target_device: int,
+) -> tuple[UsbmonExchange, ...]:
+    """Parses bounded full-capture tshark fields for one direct USB device."""
+
+    encoded = text.encode("utf-8", errors="strict")
+    if len(encoded) > MAX_CAPTURE_BYTES:
+        raise ModelError("tshark USB export exceeds the bounded size limit")
+    lines = text.splitlines()
+    if len(lines) > 65536:
+        raise ModelError("tshark USB export exceeds the bounded line limit")
+    if not 1 <= target_bus <= 255 or not 1 <= target_device <= 255:
+        raise ModelError("tshark USB target identity is invalid")
+
+    pending_sets: list[tuple[int, int, bytes]] = []
+    pending_gets: dict[str, tuple[int, int]] = {}
+    exchanges: list[UsbmonExchange] = []
+    for line_number, line in enumerate(lines, start=1):
+        fields = line.split("\t")
+        if len(fields) != len(TSHARK_FIELDS):
+            raise ModelError(f"tshark USB row {line_number} has an invalid field count")
+        (
+            timestamp,
+            urb_id,
+            urb_type,
+            transfer_type,
+            bus,
+            device,
+            _endpoint,
+            request_type,
+            request_id,
+            value,
+            interface,
+            setup_length,
+            _data_length,
+            capdata,
+            fragment,
+            hid_data,
+            hid_vendor_data,
+        ) = fields
+        if not bus or not device:
+            continue
+        if (
+            _numeric_field(bus, "bus") != target_bus
+            or _numeric_field(device, "device") != target_device
+        ):
+            continue
+        if not transfer_type or _numeric_field(transfer_type, "transfer type") != 2:
+            continue
+        try:
+            timestamp_us = int(Decimal(timestamp) * 1_000_000)
+        except (InvalidOperation, ValueError) as error:
+            raise ModelError(f"tshark USB row {line_number} has an invalid timestamp") from error
+        event = urb_type.strip()
+        if event in {"0x53", "83"}:
+            event = "S"
+        elif event in {"0x43", "67"}:
+            event = "C"
+        payload = _tshark_payload([capdata, fragment, hid_data, hid_vendor_data])
+
+        if event == "S" and request_type and request_id and value and setup_length:
+            setup = (
+                _numeric_field(request_type, "request type"),
+                _numeric_field(request_id, "request identifier"),
+                _numeric_field(value, "report value"),
+                _numeric_field(interface or "0", "interface"),
+                _numeric_field(setup_length, "setup length"),
+            )
+            if setup[:3] == (0x21, 0x09, 0x0300) and setup[4] == REPORT_SIZE:
+                if len(payload) != REPORT_SIZE:
+                    raise ModelError("captured direct Razer request is not complete")
+                pending_sets.append((timestamp_us, setup[3], payload))
+            elif setup[:3] == (0xA1, 0x01, 0x0300) and setup[4] == REPORT_SIZE:
+                if not urb_id:
+                    raise ModelError("captured direct Razer GET lacks its URB identity")
+                pending_gets[urb_id] = (timestamp_us, setup[3])
+            continue
+
+        if event != "C" or not urb_id or urb_id not in pending_gets or not payload:
+            continue
+        _get_timestamp, get_interface = pending_gets.pop(urb_id)
+        if len(payload) != REPORT_SIZE:
+            raise ModelError("captured direct Razer response is not complete")
+        if not pending_sets:
+            raise ModelError("captured direct Razer response has no preceding SET")
+        request_timestamp, set_interface, request = pending_sets.pop(0)
+        if set_interface != get_interface:
+            raise ModelError("captured direct Razer SET and GET use different interfaces")
+        exchanges.append(
+            UsbmonExchange(
+                timestamp_us=request_timestamp,
+                bus=target_bus,
+                device=target_device,
+                interface=set_interface,
+                request=request,
+                request_length=REPORT_SIZE,
+                response=payload,
+                response_length=REPORT_SIZE,
+            )
+        )
+
+    if pending_sets or pending_gets:
+        raise ModelError("tshark USB export ends with an unmatched Razer transfer")
+    return tuple(exchanges)
+
+
+@dataclass(frozen=True)
+class DirectUsbEndpoint:
+    driver_entry: Path
+    bus: int
+    device: int
+
+
+@dataclass(frozen=True)
+class CapturedDirectReference:
+    reference: DirectSemanticReference
+    attributes_read: tuple[str, ...]
+    bus: int
+    device: int
+
+
+def _bounded_sysfs_number(path: Path, label: str) -> int:
+    try:
+        metadata = path.stat()
+        if not stat.S_ISREG(metadata.st_mode):
+            raise ModelError(f"direct USB {label} is not a sysfs value")
+        with path.open("rb") as handle:
+            value = handle.read(17)
+    except OSError as error:
+        raise ModelError(f"cannot read direct USB {label}: {error}") from error
+    if not value or len(value) > 16:
+        raise ModelError(f"direct USB {label} is outside its bound")
+    try:
+        number = int(value.strip(), 10)
+    except ValueError as error:
+        raise ModelError(f"direct USB {label} is invalid") from error
+    if not 1 <= number <= 255:
+        raise ModelError(f"direct USB {label} is outside one byte")
+    return number
+
+
+def _usb_location(entry: Path, devices_root: Path) -> tuple[int, int]:
+    try:
+        resolved = entry.resolve(strict=True)
+        authority = devices_root.resolve(strict=True)
+        resolved.relative_to(authority)
+    except (OSError, ValueError) as error:
+        raise ModelError("direct USB driver entry escapes the sysfs device tree") from error
+    for parent in (resolved, *resolved.parents):
+        if parent == authority.parent:
+            break
+        busnum = parent / "busnum"
+        devnum = parent / "devnum"
+        if busnum.exists() and devnum.exists():
+            return (
+                _bounded_sysfs_number(busnum, "bus number"),
+                _bounded_sysfs_number(devnum, "device number"),
+            )
+        if parent == authority:
+            break
+    raise ModelError("direct USB driver entry has no physical bus/device identity")
+
+
+def find_exact_direct_endpoint(
+    route: dict[str, Any],
+    profile: dict[str, Any],
+    *,
+    driver_root: Path = Path("/sys/bus/hid/drivers"),
+    devices_root: Path = Path("/sys/devices"),
+) -> DirectUsbEndpoint:
+    """Finds one physical direct-data route from exact source-bound identities."""
+
+    family = route["driver_family"]
+    vendor = route["vendor_id"]
+    products = set(route["direct_data_product_ids"])
+    attributes = tuple(probe["driver"]["attribute"] for probe in profile["probes"])
+    directory = driver_root / family
+    try:
+        entries = tuple(directory.iterdir())
+    except FileNotFoundError as error:
+        raise ModelError("the exact direct USB data route is absent") from error
+    except OSError as error:
+        raise ModelError(f"cannot inspect direct USB driver entries: {error}") from error
+
+    candidates: dict[tuple[int, int], list[Path]] = {}
+    for entry in entries:
+        match = HID_IDENTITY_PATTERN.fullmatch(entry.name)
+        if match is None:
+            continue
+        if int(match.group("vendor"), 16) != vendor:
+            continue
+        if int(match.group("product"), 16) not in products:
+            continue
+        if not all((entry / attribute).is_file() for attribute in attributes):
+            continue
+        location = _usb_location(entry, devices_root)
+        candidates.setdefault(location, []).append(entry)
+    if not candidates:
+        raise ModelError(
+            "the exact direct USB data route with every source-bound read attribute is absent"
+        )
+    if len(candidates) != 1:
+        raise ModelError("more than one exact direct USB device is connected")
+    (bus, device), carriers = next(iter(candidates.items()))
+    carrier = sorted(carriers, key=lambda value: value.name)[0]
+    return DirectUsbEndpoint(driver_entry=carrier, bus=bus, device=device)
+
+
+def _read_attribute(path: Path) -> None:
+    flags = os.O_RDONLY | os.O_CLOEXEC
+    if hasattr(os, "O_NOFOLLOW"):
+        flags |= os.O_NOFOLLOW
+    try:
+        descriptor = os.open(path, flags)
+    except OSError as error:
+        raise ModelError(f"cannot open source-bound OpenRazer attribute: {error}") from error
+    try:
+        value = os.read(descriptor, MAX_ATTRIBUTE_BYTES + 1)
+    except OSError as error:
+        raise ModelError(f"cannot read source-bound OpenRazer attribute: {error}") from error
+    finally:
+        os.close(descriptor)
+    if len(value) > MAX_ATTRIBUTE_BYTES:
+        raise ModelError("source-bound OpenRazer attribute exceeded its read bound")
+
+
+def trigger_direct_attributes(entry: Path, profile: dict[str, Any]) -> tuple[str, ...]:
+    attributes: list[str] = []
+    for probe in profile["probes"]:
+        attribute = probe["driver"]["attribute"]
+        _read_attribute(entry / attribute)
+        attributes.append(attribute)
+    return tuple(attributes)
+
+
+@contextmanager
+def _private_capture_directory(uid: int, gid: int) -> Iterator[Path]:
+    directory = Path(tempfile.mkdtemp(prefix=CAPTURE_PREFIX, dir="/dev/shm"))
+    try:
+        os.chmod(directory, 0o700)
+        os.chown(directory, uid, gid)
+        yield directory
+    finally:
+        try:
+            shutil.rmtree(directory)
+        except OSError as error:
+            raise ModelError("private direct USB material could not be deleted") from error
+
+
+def _bounded_output(value: bytes, label: str) -> str:
+    if len(value) > MAX_PROCESS_OUTPUT_BYTES:
+        raise ModelError(f"{label} output exceeded its bound")
+    return value.decode("utf-8", errors="replace").strip()
+
+
+def _bounded_log(path: Path, label: str) -> str:
+    try:
+        metadata = path.lstat()
+        if not stat.S_ISREG(metadata.st_mode):
+            raise ModelError(f"{label} log is not a regular file")
+        with path.open("rb") as handle:
+            value = handle.read(MAX_PROCESS_OUTPUT_BYTES + 1)
+    except OSError as error:
+        raise ModelError(f"cannot read {label} log: {error}") from error
+    return _bounded_output(value, label)
+
+
+@dataclass(frozen=True)
+class CaptureProcess:
+    process: subprocess.Popen[bytes]
+    diagnostic_path: Path
+
+
+def _start_dumpcap(interface: str, capture: Path) -> CaptureProcess:
+    executable = shutil.which("dumpcap")
+    if executable is None:
+        raise ModelError("dumpcap is required for complete direct USB references")
+    diagnostic_path = capture.with_name("dumpcap.log")
+    previous_umask = os.umask(0o077)
+    try:
+        with diagnostic_path.open("xb") as diagnostic:
+            process = subprocess.Popen(
+                [
+                    executable,
+                    "-i",
+                    interface,
+                    "-s",
+                    "0",
+                    "-q",
+                    "-a",
+                    "duration:5",
+                    "-a",
+                    f"filesize:{MAX_CAPTURE_BYTES // 1024}",
+                    "-w",
+                    str(capture),
+                ],
+                stdout=subprocess.DEVNULL,
+                stderr=diagnostic,
+            )
+    except OSError as error:
+        raise ModelError(f"cannot start private direct USB capture: {error}") from error
+    finally:
+        os.umask(previous_umask)
+    time.sleep(0.25)
+    if process.poll() is not None:
+        process.wait(timeout=1)
+        detail = _bounded_log(diagnostic_path, "dumpcap")
+        raise ModelError(f"private direct USB capture did not start: {detail}")
+    return CaptureProcess(process=process, diagnostic_path=diagnostic_path)
+
+
+def _stop_dumpcap(capture: CaptureProcess) -> None:
+    process = capture.process
+    if process.poll() is None:
+        process.send_signal(signal.SIGINT)
+    try:
+        process.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        process.kill()
+        process.wait(timeout=2)
+    detail = _bounded_log(capture.diagnostic_path, "dumpcap")
+    if process.returncode not in {0, 130}:
+        raise ModelError(f"private direct USB capture failed: {detail}")
+
+
+def _export_capture(capture: Path, *, bus: int, device: int) -> str:
+    executable = shutil.which("tshark")
+    if executable is None:
+        raise ModelError("tshark is required for complete direct USB references")
+    command = [
+        executable,
+        "-n",
+        "-r",
+        str(capture),
+        "-Y",
+        f"usb.bus_id == {bus} && usb.device_address == {device}",
+        "-T",
+        "fields",
+        "-E",
+        "separator=/t",
+        "-E",
+        "quote=n",
+        "-E",
+        "occurrence=f",
+    ]
+    for field_name in TSHARK_FIELDS:
+        command.extend(("-e", field_name))
+    try:
+        result = subprocess.run(
+            command,
+            check=False,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=20,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"cannot sanitize direct USB capture: {error}") from error
+    if result.returncode != 0:
+        detail = _bounded_output(result.stderr, "tshark")
+        raise ModelError(f"cannot sanitize direct USB capture: {detail}")
+    if len(result.stdout) > MAX_CAPTURE_BYTES:
+        raise ModelError("sanitized direct USB capture exceeded its bound")
+    try:
+        return result.stdout.decode("utf-8")
+    except UnicodeError as error:
+        raise ModelError("sanitized direct USB capture is not UTF-8") from error
+
+
+def capture_direct_reference(
+    root: Path,
+    *,
+    profile_id: str,
+    route: dict[str, Any],
+    profile: dict[str, Any],
+    uid: int,
+    gid: int,
+    source_revision: str,
+    driver_root: Path = Path("/sys/bus/hid/drivers"),
+    devices_root: Path = Path("/sys/devices"),
+) -> CapturedDirectReference:
+    endpoint = find_exact_direct_endpoint(
+        route,
+        profile,
+        driver_root=driver_root,
+        devices_root=devices_root,
+    )
+    process: CaptureProcess | None = None
+    with _private_capture_directory(uid, gid) as directory:
+        capture = directory / "direct.pcapng"
+        try:
+            process = _start_dumpcap(f"usbmon{endpoint.bus}", capture)
+            attributes = trigger_direct_attributes(endpoint.driver_entry, profile)
+            time.sleep(0.25)
+        finally:
+            if process is not None:
+                _stop_dumpcap(process)
+        try:
+            metadata = capture.lstat()
+        except OSError as error:
+            raise ModelError(f"private direct USB capture is absent: {error}") from error
+        if (
+            not stat.S_ISREG(metadata.st_mode)
+            or metadata.st_size <= 0
+            or metadata.st_size > MAX_CAPTURE_BYTES
+        ):
+            raise ModelError("private direct USB capture has an invalid type or size")
+        os.chmod(capture, 0o600)
+        exported = _export_capture(
+            capture,
+            bus=endpoint.bus,
+            device=endpoint.device,
+        )
+        exchanges = parse_tshark_usbmon_fields(
+            exported,
+            target_bus=endpoint.bus,
+            target_device=endpoint.device,
+        )
+        reference = build_direct_semantic_reference(
+            root,
+            profile_id=profile_id,
+            exchanges=exchanges,
+            source_revision=source_revision,
+        )
+    if directory.exists():
+        raise ModelError("private direct USB capture directory was not deleted")
+    return CapturedDirectReference(
+        reference=reference,
+        attributes_read=attributes,
+        bus=endpoint.bus,
+        device=endpoint.device,
+    )
+
+
+def _operator_identity(user: str) -> tuple[int, int]:
+    try:
+        account = pwd.getpwnam(user)
+    except KeyError as error:
+        raise ModelError("staged parity operator does not exist") from error
+    if account.pw_uid == 0:
+        raise ModelError("staged parity operator must not be root")
+    return account.pw_uid, account.pw_gid
+
+
+def _wait_for_operator(timeout_seconds: int) -> None:
+    if not 30 <= timeout_seconds <= 600:
+        raise ModelError("staged parity transition timeout is invalid")
+    selector = selectors.DefaultSelector()
+    try:
+        selector.register(sys.stdin, selectors.EVENT_READ)
+        events = selector.select(timeout_seconds)
+        if not events:
+            raise ModelError("staged direct-to-receiver transition timed out")
+        if sys.stdin.readline() == "":
+            raise ModelError("staged direct-to-receiver transition input closed")
+    finally:
+        selector.close()
+
+
+def _require_direct_route_absent(
+    route: dict[str, Any],
+    profile: dict[str, Any],
+) -> None:
+    try:
+        find_exact_direct_endpoint(route, profile)
+    except ModelError as error:
+        if str(error) in {
+            "the exact direct USB data route is absent",
+            "the exact direct USB data route with every source-bound read attribute is absent",
+        }:
+            return
+        raise
+    raise ModelError("the direct USB data route is still active after the transition")
+
+
+def run_staged_live_parity(
+    root: Path,
+    *,
+    profile_id: str,
+    package: Path,
+    package_sha256: str,
+    expected_generation: int,
+    approval_text: str,
+    user: str,
+    timeout_seconds: int = 90,
+    transition_timeout_seconds: int = 300,
+) -> LiveParityResult:
+    """Captures upstream direct reads, then compares the same device via the receiver."""
+
+    if approval_text != STAGED_PARITY_APPROVAL:
+        raise ModelError("the exact staged native parity approval is missing")
+    preflight = prepare_live_parity(
+        root,
+        profile_id=profile_id,
+        package=package,
+        package_sha256=package_sha256,
+        expected_generation=expected_generation,
+        timeout_seconds=timeout_seconds,
+    )
+    uid, gid = _operator_identity(user)
+    captured = capture_direct_reference(
+        root,
+        profile_id=profile_id,
+        route=preflight.route,
+        profile=preflight.profile,
+        uid=uid,
+        gid=gid,
+        source_revision=preflight.revision,
+    )
+    observed = {
+        item["method"]
+        for item in captured.reference.evidence["observations"]
+    }
+    required = {
+        probe["method"]
+        for probe in preflight.profile["probes"]
+    }
+    missing = sorted(required - observed)
+    if missing:
+        raise ModelError(
+            "direct OpenRazer capture missed source-bound methods: " + ", ".join(missing)
+        )
+    print(
+        "Direct OpenRazer reference captured completely.\n"
+        "Switch this same device to 2.4 GHz, remove its direct USB data route, "
+        "place or wake it on the HyperFlux receiver, and exercise it.\n"
+        "Press Enter only after it is ready. The receiver itself stays connected.",
+        flush=True,
+    )
+    _wait_for_operator(transition_timeout_seconds)
+    _require_direct_route_absent(preflight.route, preflight.profile)
+
+    with _private_capture_directory(uid, gid) as directory:
+        direct_evidence = write_new_private_json(
+            directory,
+            "direct-evidence.json",
+            captured.reference.evidence,
+        )
+        result = run_live_parity(
+            root,
+            profile_id=profile_id,
+            direct_evidence_path=direct_evidence,
+            package=package,
+            package_sha256=package_sha256,
+            expected_generation=expected_generation,
+            approval_text=READ_ONLY_APPROVAL,
+            user=user,
+            timeout_seconds=timeout_seconds,
+            direct_serial_values=captured.reference.serial_values,
+        )
+    if directory.exists():
+        raise ModelError("ephemeral staged parity material was not deleted")
+    return result
diff --git a/tools/hfxdev/native_live_parity.py b/tools/hfxdev/native_live_parity.py
index 766a4b1..bdb2f57 100644
--- a/tools/hfxdev/native_live_parity.py
+++ b/tools/hfxdev/native_live_parity.py
@@ -59,6 +59,14 @@ class LiveParityResult:
     failed: tuple[str, ...]
 
 
+@dataclass(frozen=True)
+class LiveParityPreflight:
+    revision: str
+    probes: dict[str, Any]
+    profile: dict[str, Any]
+    route: dict[str, Any]
+
+
 def _git_revision(root: Path) -> str:
     try:
         result = subprocess.run(
@@ -388,6 +396,33 @@ def _qualifier_command(
     ]
 
 
+def prepare_live_parity(
+    root: Path,
+    *,
+    profile_id: str,
+    package: Path,
+    package_sha256: str,
+    expected_generation: int,
+    timeout_seconds: int,
+) -> LiveParityPreflight:
+    """Checks the immutable software and isolation boundary for a live read."""
+
+    if os.geteuid() != 0:
+        raise ModelError("live native parity must run as root")
+    if not 10 <= timeout_seconds <= 120 or not 1 <= expected_generation < 2**63:
+        raise ModelError("live native parity generation or timeout is invalid")
+    revision = _git_revision(root)
+    _verify_candidate_package(package, package_sha256)
+    _require_isolated_services()
+    probes, profile, route = _profile_authority(root, profile_id)
+    return LiveParityPreflight(
+        revision=revision,
+        probes=probes,
+        profile=profile,
+        route=route,
+    )
+
+
 def run_live_parity(
     root: Path,
     *,
@@ -399,6 +434,7 @@ def run_live_parity(
     approval_text: str,
     user: str,
     timeout_seconds: int = 90,
+    direct_serial_values: dict[str, bytes] | None = None,
 ) -> LiveParityResult:
     """Run one exact, restoration-isolated, read-only receiver parity session."""
 
@@ -406,12 +442,18 @@ def run_live_parity(
         raise ModelError("live native parity must run as root")
     if approval_text != READ_ONLY_APPROVAL:
         raise ModelError("the exact read-only native parity approval is missing")
-    if not 10 <= timeout_seconds <= 120 or not 1 <= expected_generation < 2**63:
-        raise ModelError("live native parity generation or timeout is invalid")
-    revision = _git_revision(root)
-    _verify_candidate_package(package, package_sha256)
-    _require_isolated_services()
-    probes, profile, route = _profile_authority(root, profile_id)
+    preflight = prepare_live_parity(
+        root,
+        profile_id=profile_id,
+        package=package,
+        package_sha256=package_sha256,
+        expected_generation=expected_generation,
+        timeout_seconds=timeout_seconds,
+    )
+    revision = preflight.revision
+    probes = preflight.probes
+    profile = preflight.profile
+    route = preflight.route
     direct_evidence = _read_private_json(direct_evidence_path)
     validate_parity_evidence(direct_evidence)
     parity_cache, uid, gid = _user_cache(user, "native-transport-parity")
@@ -474,6 +516,7 @@ def run_live_parity(
         receiver_generation=expected_generation,
         created_at=timestamp,
         source_revision=revision,
+        direct_serial_values=direct_serial_values,
     )
     _drop_to_operator(user, uid, gid)
     evidence_path = write_parity_evidence(evidence, cache_root=parity_cache)
diff --git a/tools/hfxdev/native_parity.py b/tools/hfxdev/native_parity.py
index 224b5f6..5b94584 100644
--- a/tools/hfxdev/native_parity.py
+++ b/tools/hfxdev/native_parity.py
@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import UTC, datetime
 import hashlib
 import json
@@ -64,6 +64,14 @@ class MatchedExchange:
     serial_value: bytes | None
 
 
+@dataclass(frozen=True)
+class DirectSemanticReference:
+    """Sanitized direct evidence plus process-local comparison material."""
+
+    evidence: dict[str, Any]
+    serial_values: dict[str, bytes] = field(repr=False)
+
+
 def _bounded_int(value: Any, minimum: int, maximum: int) -> bool:
     return (
         isinstance(value, int)
@@ -251,6 +259,13 @@ def _response_arguments(response: bytes) -> bytes:
     return response[8 : min(len(response), 8 + data_size)]
 
 
+def _serial_comparison_value(value: bytes) -> bytes | None:
+    normalized = value.rstrip(b"\x00\t\n\r\x0b\x0c ")
+    if not normalized or len(normalized) > 80 or b"\x00" in normalized:
+        return None
+    return normalized
+
+
 def _semantic_summary(
     summary_kind: str,
     response: bytes,
@@ -261,9 +276,10 @@ def _semantic_summary(
     summary: dict[str, Any] = {"kind": summary_kind}
 
     if summary_kind == "redacted-serial-equality":
+        serial = _serial_comparison_value(bytes(arguments)) if complete_arguments else None
         summary["redacted"] = True
-        summary["available"] = complete_arguments
-        return summary, None, bytes(arguments) if complete_arguments else None
+        summary["available"] = serial is not None
+        return summary, None, serial
 
     value: Any = None
     if summary_kind == "firmware-version" and len(arguments) >= 2:
@@ -296,12 +312,22 @@ def _semantic_summary(
     elif summary_kind == "dpi-stages" and len(arguments) >= 3:
         active, count = arguments[1], arguments[2]
         required = count * 7 + 1
-        value = (active, count) if len(arguments) >= required else None
+        complete = len(arguments) >= required
+        stages = [
+            {
+                "x": int.from_bytes(arguments[4 + index * 7 : 6 + index * 7], "big"),
+                "y": int.from_bytes(arguments[6 + index * 7 : 8 + index * 7], "big"),
+            }
+            for index in range(count)
+            if 8 + index * 7 <= len(arguments)
+        ]
+        value = (active, tuple((stage["x"], stage["y"]) for stage in stages)) if complete else None
         summary.update(
             {
                 "active_stage": active,
                 "stage_count": count,
-                "complete_stage_table": len(arguments) >= required,
+                "stages": stages,
+                "complete_stage_table": complete,
             }
         )
     elif summary_kind == "keyboard-layout" and len(arguments) >= 2:
@@ -404,6 +430,69 @@ def _match_exchanges(
     return matched
 
 
+def build_direct_semantic_reference(
+    root: Path,
+    *,
+    profile_id: str,
+    exchanges: tuple[UsbmonExchange, ...],
+    created_at: str | None = None,
+    source_revision: str | None = None,
+) -> DirectSemanticReference:
+    """Sanitizes complete direct USB exchanges without persisting identity material."""
+
+    if len(exchanges) > 256:
+        raise ModelError("direct semantic reference exceeds its exchange bound")
+    catalog = load_native_probe_catalog(root)
+    profile = _profile(catalog, profile_id)
+    matches = _match_exchanges(profile, exchanges)
+    required = [probe["method"] for probe in profile["probes"]]
+    observations: list[dict[str, Any]] = []
+    serial_values: dict[str, bytes] = {}
+    for method in required:
+        items = matches.get(method, [])
+        if not items:
+            continue
+        item = items[-1]
+        observations.append(_direct_observation(item))
+        if item.serial_value is not None:
+            serial_values[method] = item.serial_value
+    timestamp = (
+        created_at
+        or datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z")
+    )
+    revision = source_revision or _git_revision(root)
+    evidence = {
+        "$schema": "https://hyperflux.dev/schemas/native-transport-parity-evidence-v1.json",
+        "schema": EVIDENCE_SCHEMA,
+        "created_at": timestamp,
+        "source_revision": revision,
+        "profile_id": profile_id,
+        "upstream_commit": catalog["upstream"]["commit"],
+        "catalog_sha256": sha256_file(
+            root / "integrations" / "openrazer" / "native-probe-catalog.json"
+        ),
+        "safety": {
+            "read_only": True,
+            "settings_changed": False,
+            "serials_persisted": False,
+            "raw_reports_persisted": False,
+            "private_paths_persisted": False,
+            "network_upload": False,
+            "file_mode": "0600",
+        },
+        "observations": observations,
+        "coverage": {
+            "required": required,
+            "passed": [],
+            "missing": required,
+            "failed": [],
+        },
+        "conclusion": "incomplete",
+    }
+    validate_parity_evidence(evidence)
+    return DirectSemanticReference(evidence=evidence, serial_values=serial_values)
+
+
 def _validate_raw_qualification(
     value: dict[str, Any],
     *,
@@ -585,10 +674,30 @@ def _semantic_parity_from_evidence(
     probe: dict[str, Any],
     direct: dict[str, Any] | None,
     receiver: MatchedExchange,
+    direct_serial_value: bytes | None = None,
 ) -> bool | None:
     if direct is None or not receiver.response_complete:
         return None
     response = direct["response"]
+    if probe["comparison"] == "redacted-equality":
+        if not response["structural_match"] or not receiver.response_structural:
+            return False
+        direct_status = response["status"]
+        receiver_status = receiver.exchange.response[0]
+        if BUSY_STATUS in {direct_status, receiver_status}:
+            return None
+        if direct_status != receiver_status:
+            return False
+        if direct_status != SUCCESS_STATUS:
+            return None
+        if (
+            response["summary"].get("available") is not True
+            or receiver.summary.get("available") is not True
+            or direct_serial_value is None
+            or receiver.serial_value is None
+        ):
+            return None
+        return secrets.compare_digest(direct_serial_value, receiver.serial_value)
     return _semantic_summary_parity(
         probe,
         direct_status=response["status"],
@@ -610,6 +719,7 @@ def build_live_parity_evidence(
     receiver_generation: int,
     created_at: str | None = None,
     source_revision: str | None = None,
+    direct_serial_values: dict[str, bytes] | None = None,
 ) -> dict[str, Any]:
     """Sanitize one ephemeral receiver qualification into canonical parity evidence."""
 
@@ -638,14 +748,23 @@ def build_live_parity_evidence(
         receiver_generation=receiver_generation,
     )
     receiver_matches = _raw_receiver_matches(profile, raw_qualification)
+    required = [probe["method"] for probe in profile["probes"]]
+    probes = {probe["method"]: probe for probe in profile["probes"]}
     direct_by_method = {
         observation["method"]: observation
         for observation in direct_evidence["observations"]
         if observation["origin"] == "direct-semantic-reference"
     }
+    private_serials = direct_serial_values or {}
+    if any(
+        method not in direct_by_method
+        or probes[method]["comparison"] != "redacted-equality"
+        or not isinstance(value, bytes)
+        or _serial_comparison_value(value) != value
+        for method, value in private_serials.items()
+    ):
+        raise ModelError("direct serial comparison material is invalid")
     maximum_attempts = catalog["busy_retry"]["maximum_attempts"]
-    required = [probe["method"] for probe in profile["probes"]]
-    probes = {probe["method"]: probe for probe in profile["probes"]}
     receiver_selector = _declared_receiver_selector(
         root, profile["wireless_identity"]["device_kind"]
     )
@@ -680,7 +799,12 @@ def build_live_parity_evidence(
             ),
         )
         receiver["receiver_comparison"]["semantic_parity"] = (
-            _semantic_parity_from_evidence(probes[method], direct, routed[-1])
+            _semantic_parity_from_evidence(
+                probes[method],
+                direct,
+                routed[-1],
+                private_serials.get(method),
+            )
         )
         receiver_observations[method] = receiver
         observations.append(receiver)

From 94297d18793019cb23bf60b218ec0731aa46a735 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 16:20:35 +0400
Subject: [PATCH 60/67] fix(verification): prune generated license trees

---
 tests/test_repository_experience.py | 17 ++++++++++
 tools/hfxdev/licensing.py           | 51 ++++++++++++++++++-----------
 2 files changed, 49 insertions(+), 19 deletions(-)

diff --git a/tests/test_repository_experience.py b/tests/test_repository_experience.py
index ec31cb4..ed046dc 100644
--- a/tests/test_repository_experience.py
+++ b/tests/test_repository_experience.py
@@ -9,6 +9,7 @@
 import sys
 import tempfile
 import unittest
+from unittest.mock import patch
 
 
 ROOT = Path(__file__).resolve().parents[1]
@@ -159,6 +160,22 @@ def test_license_policy_covers_spdx_sources_and_one_root_license(self) -> None:
         )
         self.assertEqual(expression_for_path(policy, "README.md"), "GPL-2.0-only")
 
+    def test_license_policy_prunes_generated_roots_before_descent(self) -> None:
+        source = ROOT / "tools" / "hfxdev" / "licensing.py"
+
+        def guarded_walk(root: Path, *, topdown: bool, followlinks: bool):
+            directories = ["build", "target", "tools"]
+            yield str(root), directories, []
+            generated = {"build", "target"}.intersection(directories)
+            if generated:
+                raise AssertionError(f"generated roots were traversed: {generated}")
+            yield str(source.parent), [], [source.name]
+
+        with patch("hfxdev.licensing.os.walk", guarded_walk):
+            result = verify_licensing_policy(ROOT)
+
+        self.assertEqual(result["checked_spdx_files"], 1)
+
     def test_ambiguous_root_license_document_is_rejected(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
diff --git a/tools/hfxdev/licensing.py b/tools/hfxdev/licensing.py
index a4a1d97..95d25ac 100644
--- a/tools/hfxdev/licensing.py
+++ b/tools/hfxdev/licensing.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import fnmatch
+import os
 from pathlib import Path, PurePosixPath
 import re
 from typing import Any
@@ -83,6 +84,7 @@ def expression_for_path(policy: dict[str, Any], path: str) -> str:
 
 
 def verify_licensing_policy(root: Path) -> dict[str, Any]:
+    root = root.resolve()
     policy = load_licensing_policy(root)
     root_license = root / "LICENSE"
     if root_license.is_symlink() or not root_license.is_file():
@@ -99,25 +101,36 @@ def verify_licensing_policy(root: Path) -> dict[str, Any]:
         raise ModelError("root LICENSE does not match the declared GPL-2.0-only text")
     checked = 0
     mismatches: list[str] = []
-    ignored_roots = {".git", ".hfx", "build", "LICENSES"}
-    for path in sorted(root.rglob("*")):
-        if not path.is_file() or path.is_symlink():
-            continue
-        relative = path.relative_to(root)
-        if relative.parts[0] in ignored_roots:
-            continue
-        try:
-            first_lines = "\n".join(path.read_text(encoding="utf-8").splitlines()[:10])
-        except (OSError, UnicodeError):
-            continue
-        match = SPDX.search(first_lines)
-        if match is None:
-            continue
-        checked += 1
-        actual = match.group("expression").strip()
-        expected = expression_for_path(policy, relative.as_posix())
-        if actual != expected:
-            mismatches.append(f"{relative}: expected {expected}, found {actual}")
+    ignored_roots = {".git", ".hfx", "build", "target", "LICENSES"}
+    for directory, directories, filenames in os.walk(
+        root, topdown=True, followlinks=False
+    ):
+        current = Path(directory)
+        directories[:] = sorted(
+            name
+            for name in directories
+            if not (current / name).is_symlink()
+            and (current != root or name not in ignored_roots)
+        )
+        for filename in sorted(filenames):
+            path = current / filename
+            if not path.is_file() or path.is_symlink():
+                continue
+            relative = path.relative_to(root)
+            try:
+                first_lines = "\n".join(
+                    path.read_text(encoding="utf-8").splitlines()[:10]
+                )
+            except (OSError, UnicodeError):
+                continue
+            match = SPDX.search(first_lines)
+            if match is None:
+                continue
+            checked += 1
+            actual = match.group("expression").strip()
+            expected = expression_for_path(policy, relative.as_posix())
+            if actual != expected:
+                mismatches.append(f"{relative}: expected {expected}, found {actual}")
     if mismatches:
         raise ModelError("license policy mismatch: " + "; ".join(mismatches[:8]))
     return {

From 479503a06e18430057bcf861e9f421eb2c2c4b70 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 17:21:08 +0400
Subject: [PATCH 61/67] fix(native): keep raw capture under process ownership

---
 tests/test_native_direct_reference.py   | 11 +++++++++++
 tools/hfxdev/native_direct_reference.py | 14 +++++++++-----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/tests/test_native_direct_reference.py b/tests/test_native_direct_reference.py
index 08ce2aa..7f0bda9 100644
--- a/tests/test_native_direct_reference.py
+++ b/tests/test_native_direct_reference.py
@@ -124,6 +124,17 @@ def test_private_capture_directory_is_removed_on_failure(self) -> None:
         self.assertIsNotNone(path)
         self.assertFalse(path.exists())
 
+    def test_raw_capture_uses_the_privileged_process_identity(self) -> None:
+        with (
+            patch.object(direct.os, "geteuid", return_value=0),
+            patch.object(direct.os, "getegid", return_value=0),
+        ):
+            self.assertEqual(direct._capture_process_identity(), (0, 0))
+
+        with patch.object(direct.os, "geteuid", return_value=1000):
+            with self.assertRaisesRegex(ModelError, "must run as root"):
+                direct._capture_process_identity()
+
     def test_dumpcap_uses_private_files_and_hard_capture_bounds(self) -> None:
         process = MagicMock()
         process.poll.return_value = None
diff --git a/tools/hfxdev/native_direct_reference.py b/tools/hfxdev/native_direct_reference.py
index 25f5850..96bd8eb 100644
--- a/tools/hfxdev/native_direct_reference.py
+++ b/tools/hfxdev/native_direct_reference.py
@@ -344,6 +344,14 @@ def _private_capture_directory(uid: int, gid: int) -> Iterator[Path]:
             raise ModelError("private direct USB material could not be deleted") from error
 
 
+def _capture_process_identity() -> tuple[int, int]:
+    uid = os.geteuid()
+    gid = os.getegid()
+    if uid != 0:
+        raise ModelError("private direct USB capture must run as root")
+    return uid, gid
+
+
 def _bounded_output(value: bytes, label: str) -> str:
     if len(value) > MAX_PROCESS_OUTPUT_BYTES:
         raise ModelError(f"{label} output exceeded its bound")
@@ -469,8 +477,6 @@ def capture_direct_reference(
     profile_id: str,
     route: dict[str, Any],
     profile: dict[str, Any],
-    uid: int,
-    gid: int,
     source_revision: str,
     driver_root: Path = Path("/sys/bus/hid/drivers"),
     devices_root: Path = Path("/sys/devices"),
@@ -482,7 +488,7 @@ def capture_direct_reference(
         devices_root=devices_root,
     )
     process: CaptureProcess | None = None
-    with _private_capture_directory(uid, gid) as directory:
+    with _private_capture_directory(*_capture_process_identity()) as directory:
         capture = directory / "direct.pcapng"
         try:
             process = _start_dumpcap(f"usbmon{endpoint.bus}", capture)
@@ -599,8 +605,6 @@ def run_staged_live_parity(
         profile_id=profile_id,
         route=preflight.route,
         profile=preflight.profile,
-        uid=uid,
-        gid=gid,
         source_revision=preflight.revision,
     )
     observed = {

From b19395f3bb26d094202677d38127359412ebed21 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 18:56:50 +0400
Subject: [PATCH 62/67] fix(native): parse direct usbmon captures without
 tshark

---
 tests/test_native_direct_reference.py   |  30 ++-
 tests/test_native_parity.py             | 172 +++++++-------
 tools/hfxdev/native_direct_reference.py | 291 +++++++++++-------------
 3 files changed, 241 insertions(+), 252 deletions(-)

diff --git a/tests/test_native_direct_reference.py b/tests/test_native_direct_reference.py
index 7f0bda9..334119d 100644
--- a/tests/test_native_direct_reference.py
+++ b/tests/test_native_direct_reference.py
@@ -156,25 +156,21 @@ def test_dumpcap_uses_private_files_and_hard_capture_bounds(self) -> None:
                 f"filesize:{direct.MAX_CAPTURE_BYTES // 1024}",
                 command,
             )
+            format_index = command.index("-F")
+            self.assertEqual(command[format_index + 1], "pcap")
             self.assertEqual(started.diagnostic_path.stat().st_mode & 0o777, 0o600)
 
-    def test_capture_export_filters_to_the_exact_physical_device(self) -> None:
-        completed = SimpleNamespace(returncode=0, stdout=b"", stderr=b"")
-        with (
-            patch.object(direct.shutil, "which", return_value="/usr/bin/tshark"),
-            patch.object(direct.subprocess, "run", return_value=completed) as run,
-        ):
-            self.assertEqual(
-                direct._export_capture(Path("direct.pcapng"), bus=3, device=12),
-                "",
-            )
-        command = run.call_args.args[0]
-        self.assertIn("-n", command)
-        filter_index = command.index("-Y")
-        self.assertEqual(
-            command[filter_index + 1],
-            "usb.bus_id == 3 && usb.device_address == 12",
-        )
+    def test_capture_reader_requires_one_bounded_regular_file(self) -> None:
+        with TemporaryDirectory() as directory:
+            root = Path(directory)
+            capture = root / "direct.pcap"
+            capture.write_bytes(b"pcap")
+            self.assertEqual(direct._capture_bytes(capture), b"pcap")
+            with self.assertRaisesRegex(ModelError, "not a regular file"):
+                direct._capture_bytes(root)
+            with patch.object(direct, "MAX_CAPTURE_BYTES", 3):
+                with self.assertRaisesRegex(ModelError, "invalid size"):
+                    direct._capture_bytes(capture)
 
     def test_staged_session_keeps_serial_material_in_process_only(self) -> None:
         preflight = SimpleNamespace(
diff --git a/tests/test_native_parity.py b/tests/test_native_parity.py
index 3dfaea9..a71b7f3 100644
--- a/tests/test_native_parity.py
+++ b/tests/test_native_parity.py
@@ -7,6 +7,7 @@
 from copy import deepcopy
 from pathlib import Path
 import stat
+import struct
 import sys
 from tempfile import TemporaryDirectory
 import unittest
@@ -24,7 +25,7 @@
     validate_parity_evidence,
     write_parity_evidence,
 )
-from hfxdev.native_direct_reference import parse_tshark_usbmon_fields
+from hfxdev.native_direct_reference import parse_pcap_usbmon_capture
 from hfxdev.native_probe import load_native_probe_catalog
 
 
@@ -67,38 +68,70 @@ def _capture(request: bytes, response: bytes, *, device: int) -> str:
     )
 
 
-def _tshark_row(
-    timestamp: str,
-    urb_id: str,
+def _usbmon_frame(
+    urb_id: int,
     event: str,
     *,
-    request_type: str = "",
-    request_id: str = "",
-    value: str = "",
-    interface: str = "",
-    setup_length: str = "",
-    payload: bytes = b"",
-) -> str:
-    fields = [
-        timestamp,
-        urb_id,
-        event,
-        "2",
-        "3",
-        "12",
-        "0",
-        request_type,
-        request_id,
-        value,
-        interface,
-        setup_length,
-        str(len(payload)) if payload else "0",
-        ":".join(f"{byte:02x}" for byte in payload),
-        "",
-        "",
-        "",
-    ]
-    return "\t".join(fields)
+    device: int = 12,
+    setup: tuple[int, int, int, int, int] | None = None,
+    data: bytes = b"",
+    status: int = 0,
+) -> bytes:
+    frame = bytearray(64)
+    frame[0:8] = urb_id.to_bytes(8, byteorder=sys.byteorder)
+    frame[8] = ord(event)
+    frame[9] = 2
+    frame[11] = device
+    frame[12:14] = (3).to_bytes(2, byteorder=sys.byteorder)
+    frame[14] = 0 if setup is not None else 1
+    frame[15] = 0 if data else 1
+    frame[28:32] = status.to_bytes(4, byteorder=sys.byteorder, signed=True)
+    frame[32:36] = (setup[4] if setup else len(data)).to_bytes(
+        4, byteorder=sys.byteorder
+    )
+    frame[36:40] = len(data).to_bytes(4, byteorder=sys.byteorder)
+    if setup is not None:
+        request_type, request_id, value, interface, length = setup
+        frame[40] = request_type
+        frame[41] = request_id
+        frame[42:44] = value.to_bytes(2, byteorder="little")
+        frame[44:46] = interface.to_bytes(2, byteorder="little")
+        frame[46:48] = length.to_bytes(2, byteorder="little")
+    return bytes(frame) + data
+
+
+def _pcap_capture(
+    request: bytes,
+    response: bytes,
+    *,
+    device: int = 12,
+    response_status: int = 0,
+    linktype: int = 220,
+) -> bytes:
+    frames = (
+        _usbmon_frame(
+            1,
+            "S",
+            device=device,
+            setup=(0x21, 0x09, 0x0300, 3, 90),
+            data=request,
+        ),
+        _usbmon_frame(1, "C", device=device),
+        _usbmon_frame(
+            2,
+            "S",
+            device=device,
+            setup=(0xA1, 0x01, 0x0300, 3, 90),
+        ),
+        _usbmon_frame(2, "C", device=device, data=response, status=response_status),
+    )
+    capture = bytearray(
+        struct.pack("<IHHIIII", 0xA1B2C3D4, 2, 4, 0, 0, 262144, linktype)
+    )
+    for fraction, frame in enumerate(frames, start=1):
+        capture.extend(struct.pack("<IIII", 1, fraction, len(frame), len(frame)))
+        capture.extend(frame)
+    return bytes(capture)
 
 
 def _probe(profile_id: str, method: str) -> dict:
@@ -164,38 +197,12 @@ def test_complete_source_bound_firmware_exchange_passes_that_method(self) -> Non
             },
         )
 
-    def test_full_tshark_fields_preserve_complete_direct_reports(self) -> None:
+    def test_linux_usbmon_pcap_preserves_complete_direct_reports(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         request = canonical_request(probe, 0x1F)
         response = _response(request, bytes((2, 51)))
-        rows = "\n".join(
-            (
-                _tshark_row(
-                    "1.000001",
-                    "0x1",
-                    "S",
-                    request_type="0x21",
-                    request_id="9",
-                    value="0x0300",
-                    interface="0",
-                    setup_length="90",
-                    payload=request,
-                ),
-                _tshark_row(
-                    "1.000002",
-                    "0x2",
-                    "S",
-                    request_type="0xa1",
-                    request_id="1",
-                    value="0x0300",
-                    interface="0",
-                    setup_length="90",
-                ),
-                _tshark_row("1.000003", "0x2", "C", payload=response),
-            )
-        )
-        exchanges = parse_tshark_usbmon_fields(
-            rows,
+        exchanges = parse_pcap_usbmon_capture(
+            _pcap_capture(request, response),
             target_bus=3,
             target_device=12,
         )
@@ -203,6 +210,14 @@ def test_full_tshark_fields_preserve_complete_direct_reports(self) -> None:
         self.assertEqual(exchanges[0].request, request)
         self.assertEqual(exchanges[0].response, response)
         self.assertEqual(exchanges[0].timestamp_us, 1_000_001)
+        self.assertEqual(
+            parse_pcap_usbmon_capture(
+                _pcap_capture(request, response),
+                target_bus=3,
+                target_device=11,
+            ),
+            (),
+        )
 
         reference = build_direct_semantic_reference(
             ROOT,
@@ -219,28 +234,29 @@ def test_full_tshark_fields_preserve_complete_direct_reports(self) -> None:
         self.assertTrue(direct["request"]["complete_capture"])
         self.assertEqual(direct["response"]["summary"]["minor"], 51)
 
-    def test_tshark_fields_reject_incomplete_or_conflicting_raw_material(self) -> None:
+    def test_linux_usbmon_pcap_rejects_incomplete_or_failed_material(self) -> None:
         probe = _probe(self.mouse_profile, "get_firmware")
         request = canonical_request(probe, 0x1F)
-        incomplete = _tshark_row(
-            "1.0",
-            "0x1",
-            "S",
-            request_type="0x21",
-            request_id="9",
-            value="0x0300",
-            interface="0",
-            setup_length="90",
-            payload=request[:-1],
-        )
+        response = _response(request, bytes((2, 51)))
         with self.assertRaisesRegex(ModelError, "request is not complete"):
-            parse_tshark_usbmon_fields(incomplete, target_bus=3, target_device=12)
+            parse_pcap_usbmon_capture(
+                _pcap_capture(request[:-1], response),
+                target_bus=3,
+                target_device=12,
+            )
+
+        with self.assertRaisesRegex(ModelError, "completed with an error"):
+            parse_pcap_usbmon_capture(
+                _pcap_capture(request, response, response_status=-32),
+                target_bus=3,
+                target_device=12,
+            )
 
-        fields = _tshark_row("1.0", "0x1", "C", payload=request).split("\t")
-        fields[14] = (bytes((request[0] ^ 1,)) + request[1:]).hex()
-        with self.assertRaisesRegex(ModelError, "conflicting complete reports"):
-            parse_tshark_usbmon_fields(
-                "\t".join(fields), target_bus=3, target_device=12
+        with self.assertRaisesRegex(ModelError, "not Linux usbmon"):
+            parse_pcap_usbmon_capture(
+                _pcap_capture(request, response, linktype=1),
+                target_bus=3,
+                target_device=12,
             )
 
     def test_route_translation_remains_optional_for_v1_evidence(self) -> None:
diff --git a/tools/hfxdev/native_direct_reference.py b/tools/hfxdev/native_direct_reference.py
index 96bd8eb..33ffb6f 100644
--- a/tools/hfxdev/native_direct_reference.py
+++ b/tools/hfxdev/native_direct_reference.py
@@ -4,7 +4,6 @@
 
 from contextlib import contextmanager
 from dataclasses import dataclass
-from decimal import Decimal, InvalidOperation
 import os
 from pathlib import Path
 import pwd
@@ -13,6 +12,7 @@
 import shutil
 import signal
 import stat
+import struct
 import subprocess
 import sys
 import tempfile
@@ -40,143 +40,166 @@
 )
 MAX_ATTRIBUTE_BYTES = 4096
 MAX_CAPTURE_BYTES = 32 * 1024 * 1024
+MAX_CAPTURE_PACKETS = 65536
 MAX_PROCESS_OUTPUT_BYTES = 64 * 1024
 CAPTURE_PREFIX = "hyperflux-next-direct-reference-"
 STAGED_PARITY_APPROVAL = (
     "approve HyperFlux Next supervised direct-to-receiver native parity session"
 )
-TSHARK_FIELDS = (
-    "frame.time_epoch",
-    "usb.urb_id",
-    "usb.urb_type",
-    "usb.transfer_type",
-    "usb.bus_id",
-    "usb.device_address",
-    "usb.endpoint_address",
-    "usb.bmRequestType",
-    "usb.setup.bRequest",
-    "usb.setup.wValue",
-    "usb.setup.wIndex",
-    "usb.setup.wLength",
-    "usb.data_len",
-    "usb.capdata",
-    "usb.data_fragment",
-    "usbhid.data",
-    "usbhid.data.vendor",
-)
+PCAP_GLOBAL_HEADER_SIZE = 24
+PCAP_RECORD_HEADER_SIZE = 16
+USBMON_MMAPPED_HEADER_SIZE = 64
+USBMON_MMAPPED_LINKTYPE = 220
+USBMON_CONTROL_TRANSFER = 2
+USBMON_SUBMIT = ord("S")
+USBMON_COMPLETE = ord("C")
+
+PCAP_FORMATS = {
+    b"\xd4\xc3\xb2\xa1": ("<", 1),
+    b"\xa1\xb2\xc3\xd4": (">", 1),
+    b"\x4d\x3c\xb2\xa1": ("<", 1_000),
+    b"\xa1\xb2\x3c\x4d": (">", 1_000),
+}
+
+
+def _capture_bytes(path: Path) -> bytes:
+    try:
+        metadata = path.lstat()
+        if not stat.S_ISREG(metadata.st_mode):
+            raise ModelError("private direct USB capture is not a regular file")
+        if metadata.st_size <= 0 or metadata.st_size > MAX_CAPTURE_BYTES:
+            raise ModelError("private direct USB capture has an invalid size")
+        with path.open("rb") as handle:
+            value = handle.read(MAX_CAPTURE_BYTES + 1)
+    except OSError as error:
+        raise ModelError(f"cannot read private direct USB capture: {error}") from error
+    if len(value) > MAX_CAPTURE_BYTES:
+        raise ModelError("private direct USB capture exceeded its bound")
+    return value
 
 
-def _numeric_field(value: str, label: str) -> int:
-    candidate = value.strip().lower()
-    if not candidate:
-        raise ModelError(f"tshark USB row lacks {label}")
-    try:
-        return int(candidate, 16 if candidate.startswith("0x") else 10)
-    except ValueError as error:
-        raise ModelError(f"tshark USB row has invalid {label}") from error
+def _usbmon_number(value: bytes, *, signed: bool = False) -> int:
+    return int.from_bytes(value, byteorder=sys.byteorder, signed=signed)
 
 
-def _tshark_payload(values: list[str]) -> bytes:
-    payloads: set[bytes] = set()
-    for value in values:
-        compact = value.replace(":", "").strip()
-        if not compact:
-            continue
-        if re.fullmatch(r"[0-9a-fA-F]+", compact) is None or len(compact) % 2:
-            raise ModelError("tshark USB row contains malformed report bytes")
-        decoded = bytes.fromhex(compact)
-        if len(decoded) == REPORT_SIZE:
-            payloads.add(decoded)
-    if len(payloads) > 1:
-        raise ModelError("tshark USB row exposes conflicting complete reports")
-    return next(iter(payloads), b"")
-
-
-def parse_tshark_usbmon_fields(
-    text: str,
+def parse_pcap_usbmon_capture(
+    value: bytes,
     *,
     target_bus: int,
     target_device: int,
 ) -> tuple[UsbmonExchange, ...]:
-    """Parses bounded full-capture tshark fields for one direct USB device."""
-
-    encoded = text.encode("utf-8", errors="strict")
-    if len(encoded) > MAX_CAPTURE_BYTES:
-        raise ModelError("tshark USB export exceeds the bounded size limit")
-    lines = text.splitlines()
-    if len(lines) > 65536:
-        raise ModelError("tshark USB export exceeds the bounded line limit")
+    """Parses one bounded Linux usbmon pcap without dissector-dependent fields."""
+
+    if not isinstance(value, bytes) or len(value) > MAX_CAPTURE_BYTES:
+        raise ModelError("private direct USB capture exceeds the bounded size limit")
+    if len(value) < PCAP_GLOBAL_HEADER_SIZE:
+        raise ModelError("private direct USB capture has a truncated pcap header")
     if not 1 <= target_bus <= 255 or not 1 <= target_device <= 255:
-        raise ModelError("tshark USB target identity is invalid")
+        raise ModelError("direct USB target identity is invalid")
+
+    try:
+        endian, fractional_divisor = PCAP_FORMATS[value[:4]]
+    except KeyError as error:
+        raise ModelError("private direct USB capture has an unsupported pcap format") from error
+    (
+        version_major,
+        version_minor,
+        _zone,
+        _sigfigs,
+        snaplen,
+        linktype,
+    ) = struct.unpack_from(f"{endian}HHiIII", value, 4)
+    if (version_major, version_minor) != (2, 4):
+        raise ModelError("private direct USB capture has an unsupported pcap version")
+    if not 1 <= snaplen <= MAX_CAPTURE_BYTES:
+        raise ModelError("private direct USB capture has an invalid snapshot bound")
+    if linktype != USBMON_MMAPPED_LINKTYPE:
+        raise ModelError("private direct USB capture is not Linux usbmon mmapped data")
 
     pending_sets: list[tuple[int, int, bytes]] = []
-    pending_gets: dict[str, tuple[int, int]] = {}
+    pending_gets: dict[int, tuple[int, int]] = {}
     exchanges: list[UsbmonExchange] = []
-    for line_number, line in enumerate(lines, start=1):
-        fields = line.split("\t")
-        if len(fields) != len(TSHARK_FIELDS):
-            raise ModelError(f"tshark USB row {line_number} has an invalid field count")
-        (
-            timestamp,
-            urb_id,
-            urb_type,
-            transfer_type,
-            bus,
-            device,
-            _endpoint,
-            request_type,
-            request_id,
-            value,
-            interface,
-            setup_length,
-            _data_length,
-            capdata,
-            fragment,
-            hid_data,
-            hid_vendor_data,
-        ) = fields
-        if not bus or not device:
-            continue
+    offset = PCAP_GLOBAL_HEADER_SIZE
+    packet_count = 0
+    while offset < len(value):
+        packet_count += 1
+        if packet_count > MAX_CAPTURE_PACKETS:
+            raise ModelError("private direct USB capture exceeds the packet bound")
+        if len(value) - offset < PCAP_RECORD_HEADER_SIZE:
+            raise ModelError("private direct USB capture ends in a partial pcap record")
+        seconds, fraction, captured_length, original_length = struct.unpack_from(
+            f"{endian}IIII", value, offset
+        )
+        offset += PCAP_RECORD_HEADER_SIZE
         if (
-            _numeric_field(bus, "bus") != target_bus
-            or _numeric_field(device, "device") != target_device
+            captured_length > snaplen
+            or captured_length > MAX_CAPTURE_BYTES
+            or original_length > MAX_CAPTURE_BYTES
+            or original_length < captured_length
+            or len(value) - offset < captured_length
         ):
+            raise ModelError("private direct USB capture has an invalid pcap record")
+        if fraction >= 1_000_000 * fractional_divisor:
+            raise ModelError("private direct USB capture has an invalid timestamp")
+        frame = value[offset : offset + captured_length]
+        offset += captured_length
+        if len(frame) < 14:
             continue
-        if not transfer_type or _numeric_field(transfer_type, "transfer type") != 2:
+        event = frame[8]
+        transfer_type = frame[9]
+        device = frame[11]
+        bus = _usbmon_number(frame[12:14])
+        if (
+            bus != target_bus
+            or device != target_device
+            or transfer_type != USBMON_CONTROL_TRANSFER
+        ):
             continue
-        try:
-            timestamp_us = int(Decimal(timestamp) * 1_000_000)
-        except (InvalidOperation, ValueError) as error:
-            raise ModelError(f"tshark USB row {line_number} has an invalid timestamp") from error
-        event = urb_type.strip()
-        if event in {"0x53", "83"}:
-            event = "S"
-        elif event in {"0x43", "67"}:
-            event = "C"
-        payload = _tshark_payload([capdata, fragment, hid_data, hid_vendor_data])
-
-        if event == "S" and request_type and request_id and value and setup_length:
+        if len(frame) < USBMON_MMAPPED_HEADER_SIZE:
+            raise ModelError("captured direct USB control record is truncated")
+
+        urb_id = _usbmon_number(frame[0:8])
+        setup_flag = frame[14]
+        data_flag = frame[15]
+        status = _usbmon_number(frame[28:32], signed=True)
+        data_length = _usbmon_number(frame[36:40])
+        payload = frame[USBMON_MMAPPED_HEADER_SIZE:]
+        timestamp_us = seconds * 1_000_000 + fraction // fractional_divisor
+
+        if event == USBMON_SUBMIT and setup_flag == 0:
             setup = (
-                _numeric_field(request_type, "request type"),
-                _numeric_field(request_id, "request identifier"),
-                _numeric_field(value, "report value"),
-                _numeric_field(interface or "0", "interface"),
-                _numeric_field(setup_length, "setup length"),
+                frame[40],
+                frame[41],
+                int.from_bytes(frame[42:44], byteorder="little"),
+                int.from_bytes(frame[44:46], byteorder="little"),
+                int.from_bytes(frame[46:48], byteorder="little"),
             )
             if setup[:3] == (0x21, 0x09, 0x0300) and setup[4] == REPORT_SIZE:
-                if len(payload) != REPORT_SIZE:
+                if (
+                    data_flag != 0
+                    or data_length != REPORT_SIZE
+                    or len(payload) != REPORT_SIZE
+                ):
                     raise ModelError("captured direct Razer request is not complete")
                 pending_sets.append((timestamp_us, setup[3], payload))
             elif setup[:3] == (0xA1, 0x01, 0x0300) and setup[4] == REPORT_SIZE:
-                if not urb_id:
+                if urb_id == 0:
                     raise ModelError("captured direct Razer GET lacks its URB identity")
+                if urb_id in pending_gets:
+                    raise ModelError("captured direct Razer GET reuses a pending URB identity")
                 pending_gets[urb_id] = (timestamp_us, setup[3])
             continue
 
-        if event != "C" or not urb_id or urb_id not in pending_gets or not payload:
+        if event != USBMON_COMPLETE or urb_id not in pending_gets:
             continue
         _get_timestamp, get_interface = pending_gets.pop(urb_id)
-        if len(payload) != REPORT_SIZE:
+        if status != 0:
+            raise ModelError("captured direct Razer response completed with an error")
+        if (
+            data_flag != 0
+            or data_length != REPORT_SIZE
+            or len(payload) != REPORT_SIZE
+        ):
             raise ModelError("captured direct Razer response is not complete")
         if not pending_sets:
             raise ModelError("captured direct Razer response has no preceding SET")
@@ -197,7 +220,7 @@ def parse_tshark_usbmon_fields(
         )
 
     if pending_sets or pending_gets:
-        raise ModelError("tshark USB export ends with an unmatched Razer transfer")
+        raise ModelError("private direct USB capture ends with an unmatched Razer transfer")
     return tuple(exchanges)
 
 
@@ -387,6 +410,8 @@ def _start_dumpcap(interface: str, capture: Path) -> CaptureProcess:
             process = subprocess.Popen(
                 [
                     executable,
+                    "-F",
+                    "pcap",
                     "-i",
                     interface,
                     "-s",
@@ -428,49 +453,6 @@ def _stop_dumpcap(capture: CaptureProcess) -> None:
         raise ModelError(f"private direct USB capture failed: {detail}")
 
 
-def _export_capture(capture: Path, *, bus: int, device: int) -> str:
-    executable = shutil.which("tshark")
-    if executable is None:
-        raise ModelError("tshark is required for complete direct USB references")
-    command = [
-        executable,
-        "-n",
-        "-r",
-        str(capture),
-        "-Y",
-        f"usb.bus_id == {bus} && usb.device_address == {device}",
-        "-T",
-        "fields",
-        "-E",
-        "separator=/t",
-        "-E",
-        "quote=n",
-        "-E",
-        "occurrence=f",
-    ]
-    for field_name in TSHARK_FIELDS:
-        command.extend(("-e", field_name))
-    try:
-        result = subprocess.run(
-            command,
-            check=False,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.PIPE,
-            timeout=20,
-        )
-    except (OSError, subprocess.SubprocessError) as error:
-        raise ModelError(f"cannot sanitize direct USB capture: {error}") from error
-    if result.returncode != 0:
-        detail = _bounded_output(result.stderr, "tshark")
-        raise ModelError(f"cannot sanitize direct USB capture: {detail}")
-    if len(result.stdout) > MAX_CAPTURE_BYTES:
-        raise ModelError("sanitized direct USB capture exceeded its bound")
-    try:
-        return result.stdout.decode("utf-8")
-    except UnicodeError as error:
-        raise ModelError("sanitized direct USB capture is not UTF-8") from error
-
-
 def capture_direct_reference(
     root: Path,
     *,
@@ -489,7 +471,7 @@ def capture_direct_reference(
     )
     process: CaptureProcess | None = None
     with _private_capture_directory(*_capture_process_identity()) as directory:
-        capture = directory / "direct.pcapng"
+        capture = directory / "direct.pcap"
         try:
             process = _start_dumpcap(f"usbmon{endpoint.bus}", capture)
             attributes = trigger_direct_attributes(endpoint.driver_entry, profile)
@@ -508,13 +490,8 @@ def capture_direct_reference(
         ):
             raise ModelError("private direct USB capture has an invalid type or size")
         os.chmod(capture, 0o600)
-        exported = _export_capture(
-            capture,
-            bus=endpoint.bus,
-            device=endpoint.device,
-        )
-        exchanges = parse_tshark_usbmon_fields(
-            exported,
+        exchanges = parse_pcap_usbmon_capture(
+            _capture_bytes(capture),
             target_bus=endpoint.bus,
             target_device=endpoint.device,
         )

From e89e6c55964b7110a56decf0eb1282e5d8215007 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Sun, 26 Jul 2026 22:36:59 +0400
Subject: [PATCH 63/67] feat(openrazer): package native receiver route

---
 .gitattributes                                |   2 +
 .../tests/fixtures/rust-qualified-mouse.json  |   2 +-
 .../tests/fixtures/rust-qualified-pair.json   |   2 +-
 assurance/generated/hyperflux-next.spdx.json  |  10 +-
 crates/hfx-errors/src/generated.rs            | 202 +++++---
 crates/hfx-integration-model/src/generated.rs |   6 +-
 .../src/openrazer_native_generated.rs         |   4 +-
 crates/hfx-ops/src/assessment.rs              |  56 ++-
 .../src/bin/hyperflux-next-activate.rs        |   3 +
 crates/hfx-ops/src/lib.rs                     |   5 +-
 crates/hfx-ops/src/probe.rs                   | 144 ++++++
 crates/hfx-ops/src/qualification.rs           |   1 +
 crates/hfx-ops/src/support.rs                 |   1 +
 crates/hfx-profiles/src/generated.rs          |   4 +-
 docs/generated/development-environment.md     |   2 +-
 docs/generated/device-knowledge.md            |  36 +-
 docs/generated/distributions.md               |   8 +-
 docs/generated/error-catalog.md               |  54 +-
 docs/generated/installation.md                |  11 +-
 docs/generated/integrations.md                |   4 +-
 docs/generated/openrazer-native-deployment.md |  17 +-
 docs/generated/supply-chain.md                |   2 +-
 docs/generated/supported-hardware.md          |   2 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 errors/catalog.json                           |  48 ++
 generated/integrations/catalog.json           |   6 +-
 generated/knowledge/catalog.json              |  42 +-
 generated/profiles/catalog.json               |   6 +-
 integrations/catalog.json                     |   4 +-
 integrations/openrazer/compatibility.json     |   2 +-
 .../generated_contract.py                     |   2 +-
 integrations/openrazer/import.json            |   2 +-
 integrations/openrazer/metadata.json          |   6 +-
 .../openrazer/native-control-policy.json      |   2 +-
 .../openrazer/native-method-inventory.json    |  24 +-
 .../openrazer/native-probe-catalog.json       | 116 ++---
 .../openrazer/native-probe-policy.json        |   2 +-
 .../openrazer/native-route/catalog.json       |  12 +-
 .../openrazer/native-route/deployment.json    |  12 +-
 ...usted-HyperFlux-native-HID-transport.patch | 467 ++++++++++++------
 .../openrazer/native-route/transform.json     |  40 +-
 knowledge/upstreams/openrazer.json            |   4 +-
 packaging/distributions.json                  |   6 +
 packaging/generated/install-plan.json         |  31 +-
 packaging/generated/openrazer.sysusers        |   3 +
 packaging/install.json                        |  29 ++
 profiles/lifecycle-policies.json              |   4 +-
 schemas/install-manifest.schema.json          |  27 +-
 .../openrazer-native-deployment.schema.json   |  22 +-
 .../openrazer-native-transform.schema.json    |   5 +-
 schemas/package-build-manifest.schema.json    |   2 +-
 .../hyperflux/generated/error_catalog.hpp     | 164 +++---
 .../generated/integration_catalog.hpp         |   4 +-
 .../hyperflux/generated/profile_catalog.hpp   |   4 +-
 .../hyperflux_sdk/generated/error_catalog.py  | 160 ++++--
 .../generated/integration_catalog.py          |   6 +-
 .../generated/openrazer_metadata.py           |   6 +-
 .../generated/profile_catalog.py              |   8 +-
 .../cpp/openrgb_controller_model_contract.cpp |   4 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_device_knowledge.py                |   2 +-
 tests/test_distribution_debian.py             |   6 +-
 tests/test_distribution_package.py            |   2 +
 tests/test_integrations.py                    |  35 +-
 tests/test_package_pipeline.py                |  66 ++-
 tests/test_verify.py                          |  32 ++
 tools/hfxdev/distribution_package.py          |   1 +
 tools/hfxdev/generators/openrazer_native.py   |  25 +
 tools/hfxdev/install.py                       |  67 +++
 tools/hfxdev/native_probe.py                  |  10 +-
 tools/hfxdev/openrazer_native_route.py        |  62 ++-
 tools/hfxdev/package_pipeline.py              |  86 +++-
 tools/hfxdev/render.py                        |   4 +
 tools/hfxdev/verify.py                        |  42 +-
 74 files changed, 1753 insertions(+), 551 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 packaging/generated/openrazer.sysusers

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..04e10b0
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Unified diffs contain significant one-character context prefixes.
+*.patch -whitespace
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 5084881..4888fc5 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
+    "profile_catalog_digest": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 2bae859..6828229 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
+    "profile_catalog_digest": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
   },
   "receivers": [
     {
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 5e3accd..8bb5d99 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/28d7686f8ab617943f82bca2e058891c70608adbbbaf6dd0c1f09fb8c4257e9c",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/5db9df91fc4c065eb1cc1cac43895ebc25f0d4d017084dc830be83b8e3dfc53b",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
@@ -1139,15 +1139,15 @@
       "comment": "Distribution-provided build dependency."
     },
     {
-      "SPDXID": "SPDXRef-Upstream-openrazer-6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+      "SPDXID": "SPDXRef-Upstream-openrazer-ddea89607b86023e88563b8feabc8fa2d5773cdd",
       "name": "OpenRazer",
-      "versionInfo": "3.12.1-41-g6820f9d",
+      "versionInfo": "3.12.2",
       "downloadLocation": "https://github.com/openrazer/openrazer.git",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "copyrightText": "NOASSERTION",
-      "comment": "Pinned integration source commit 6820f9da169d354bc7e6e93a0aa8683a6bb75792."
+      "comment": "Pinned integration source commit ddea89607b86023e88563b8feabc8fa2d5773cdd."
     },
     {
       "SPDXID": "SPDXRef-Upstream-openrgb-6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
@@ -2096,7 +2096,7 @@
       "relatedSpdxElement": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1"
     },
     {
-      "spdxElementId": "SPDXRef-Upstream-openrazer-6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+      "spdxElementId": "SPDXRef-Upstream-openrazer-ddea89607b86023e88563b8feabc8fa2d5773cdd",
       "relationshipType": "BUILD_DEPENDENCY_OF",
       "relatedSpdxElement": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1"
     },
diff --git a/crates/hfx-errors/src/generated.rs b/crates/hfx-errors/src/generated.rs
index 480c1b4..9f33927 100644
--- a/crates/hfx-errors/src/generated.rs
+++ b/crates/hfx-errors/src/generated.rs
@@ -66,6 +66,8 @@ wire_enum!(ErrorCode {
     HfxDeadline001 => "HFX-DEADLINE-001",
     HfxGeneration001 => "HFX-GENERATION-001",
     HfxIntegration001 => "HFX-INTEGRATION-001",
+    HfxIntegration002 => "HFX-INTEGRATION-002",
+    HfxIntegration003 => "HFX-INTEGRATION-003",
     HfxInternal001 => "HFX-INTERNAL-001",
     HfxKernel001 => "HFX-KERNEL-001",
     HfxKernel002 => "HFX-KERNEL-002",
@@ -91,8 +93,10 @@ wire_enum!(RemediationId {
     AcquireNewLease => "acquire-new-lease",
     ActivateInstalledDriver => "activate-installed-driver",
     ActivateOpenrazerRouteDriver => "activate-openrazer-route-driver",
+    ActivateOpenrazerSessionAccess => "activate-openrazer-session-access",
     CollectSupportBundle => "collect-support-bundle",
     CorrectRequest => "correct-request",
+    CreateOpenrazerAccessGroup => "create-openrazer-access-group",
     DisableUnsupportedFeature => "disable-unsupported-feature",
     LookupTransactionOutcome => "lookup-transaction-outcome",
     QualifyDevice => "qualify-device",
@@ -212,7 +216,7 @@ pub struct ErrorDescriptor {
 }
 
 pub const ERROR_CATALOG_SHA256: &str =
-    "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066";
+    "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c";
 pub const MAX_ERROR_COUNT: usize = 256;
 pub const MAX_REMEDIATION_COUNT: usize = 128;
 pub const MAX_SAFE_DETAIL_FIELDS: usize = 12;
@@ -240,6 +244,13 @@ pub const REMEDIATIONS: &[RemediationDescriptor] = &[
         verification: "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
         automatic: false,
     },
+    RemediationDescriptor {
+        id: RemediationId::ActivateOpenrazerSessionAccess,
+        title: "Activate OpenRazer access for this desktop session",
+        safe_action: "Run sudo gpasswd -a \"$USER\" openrazer, then sign out and back in once.",
+        verification: "After signing back in, run Doctor and confirm OpenRazer application access is ready.",
+        automatic: false,
+    },
     RemediationDescriptor {
         id: RemediationId::CollectSupportBundle,
         title: "Collect a privacy-safe support bundle",
@@ -254,6 +265,13 @@ pub const REMEDIATIONS: &[RemediationDescriptor] = &[
         verification: "Validate the corrected request against the negotiated protocol schema.",
         automatic: false,
     },
+    RemediationDescriptor {
+        id: RemediationId::CreateOpenrazerAccessGroup,
+        title: "Create the OpenRazer access group",
+        safe_action: "Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first.",
+        verification: "Run Doctor and confirm the OpenRazer access-group finding is absent.",
+        automatic: false,
+    },
     RemediationDescriptor {
         id: RemediationId::DisableUnsupportedFeature,
         title: "Disable the unsupported feature",
@@ -416,7 +434,33 @@ const DETAILS_2: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_3_1: &[&str] = &[
+const DETAIL_VALUES_3_0: &[&str] = &["group-unavailable"];
+
+const DETAILS_3: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+    name: "access_state",
+    kind: SafeDetailKind::Enum,
+    required: true,
+    maximum_length: None,
+    maximum_value: None,
+    allowed_values: DETAIL_VALUES_3_0,
+    privacy: PrivacyClass::Public,
+    description: "OpenRazer access-group state.",
+}];
+
+const DETAIL_VALUES_4_0: &[&str] = &["session-membership-required"];
+
+const DETAILS_4: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+    name: "access_state",
+    kind: SafeDetailKind::Enum,
+    required: true,
+    maximum_length: None,
+    maximum_value: None,
+    allowed_values: DETAIL_VALUES_4_0,
+    privacy: PrivacyClass::Public,
+    description: "OpenRazer desktop-session access state.",
+}];
+
+const DETAIL_VALUES_5_1: &[&str] = &[
     "bridge",
     "kernel",
     "persistence",
@@ -425,7 +469,7 @@ const DETAIL_VALUES_3_1: &[&str] = &[
     "transport",
 ];
 
-const DETAILS_3: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "invariant_id",
         kind: SafeDetailKind::Identifier,
@@ -442,13 +486,13 @@ const DETAILS_3: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_3_1,
+        allowed_values: DETAIL_VALUES_5_1,
         privacy: PrivacyClass::Public,
         description: "Subsystem that raised the invariant failure.",
     },
 ];
 
-const DETAILS_4: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "installed_abi",
         kind: SafeDetailKind::Identifier,
@@ -471,7 +515,7 @@ const DETAILS_4: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "installed_abi",
         kind: SafeDetailKind::Identifier,
@@ -504,7 +548,7 @@ const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_6: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_8: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -515,7 +559,7 @@ const DETAILS_6: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction identity that has no retained or eviction record.",
 }];
 
-const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "history_capacity",
         kind: SafeDetailKind::U16,
@@ -538,7 +582,7 @@ const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "owner_name",
         kind: SafeDetailKind::Text,
@@ -561,9 +605,9 @@ const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_9_1: &[&str] = &["expired", "released", "revoked"];
+const DETAIL_VALUES_11_1: &[&str] = &["expired", "released", "revoked"];
 
-const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "lease_id",
         kind: SafeDetailKind::Identifier,
@@ -580,29 +624,29 @@ const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_9_1,
+        allowed_values: DETAIL_VALUES_11_1,
         privacy: PrivacyClass::Public,
         description: "Terminal lease state.",
     },
 ];
 
-const DETAIL_VALUES_10_0: &[&str] = &["load", "migrate", "validate"];
+const DETAIL_VALUES_12_0: &[&str] = &["load", "migrate", "validate"];
 
-const DETAIL_VALUES_10_1: &[&str] = &[
+const DETAIL_VALUES_12_1: &[&str] = &[
     "corrupt",
     "incompatible-schema",
     "missing",
     "permission-denied",
 ];
 
-const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_10_0,
+        allowed_values: DETAIL_VALUES_12_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-read phase.",
     },
@@ -612,24 +656,24 @@ const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_10_1,
+        allowed_values: DETAIL_VALUES_12_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAIL_VALUES_11_0: &[&str] = &["commit", "rollback", "snapshot"];
+const DETAIL_VALUES_13_0: &[&str] = &["commit", "rollback", "snapshot"];
 
-const DETAIL_VALUES_11_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
+const DETAIL_VALUES_13_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
 
-const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_11_0,
+        allowed_values: DETAIL_VALUES_13_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-write phase.",
     },
@@ -639,13 +683,13 @@ const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_11_1,
+        allowed_values: DETAIL_VALUES_13_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capability",
         kind: SafeDetailKind::Identifier,
@@ -668,7 +712,7 @@ const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "active_digest",
         kind: SafeDetailKind::Identifier,
@@ -701,7 +745,7 @@ const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "client_max_version",
         kind: SafeDetailKind::U16,
@@ -744,7 +788,7 @@ const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_15: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_17: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "feature",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -755,7 +799,7 @@ const DETAILS_15: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Requested protocol feature identifier.",
 }];
 
-const DETAIL_VALUES_16_1: &[&str] = &[
+const DETAIL_VALUES_18_1: &[&str] = &[
     "configuration",
     "diagnostics",
     "effects",
@@ -763,7 +807,7 @@ const DETAIL_VALUES_16_1: &[&str] = &[
     "restore",
 ];
 
-const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capacity",
         kind: SafeDetailKind::U16,
@@ -780,13 +824,13 @@ const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_16_1,
+        allowed_values: DETAIL_VALUES_18_1,
         privacy: PrivacyClass::Public,
         description: "Bounded queue that rejected admission.",
     },
 ];
 
-const DETAIL_VALUES_17_1: &[&str] = &[
+const DETAIL_VALUES_19_1: &[&str] = &[
     "duplicate",
     "missing",
     "out-of-range",
@@ -794,7 +838,7 @@ const DETAIL_VALUES_17_1: &[&str] = &[
     "unsupported",
 ];
 
-const DETAILS_17: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "field",
         kind: SafeDetailKind::Text,
@@ -811,7 +855,7 @@ const DETAILS_17: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_17_1,
+        allowed_values: DETAIL_VALUES_19_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized validation reason.",
     },
@@ -827,7 +871,7 @@ const DETAILS_17: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_18_0: &[&str] = &[
+const DETAIL_VALUES_20_0: &[&str] = &[
     "activating",
     "active-unready",
     "failed",
@@ -836,27 +880,27 @@ const DETAIL_VALUES_18_0: &[&str] = &[
     "unavailable",
 ];
 
-const DETAILS_18: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_20: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "service_state",
     kind: SafeDetailKind::Enum,
     required: true,
     maximum_length: None,
     maximum_value: None,
-    allowed_values: DETAIL_VALUES_18_0,
+    allowed_values: DETAIL_VALUES_20_0,
     privacy: PrivacyClass::Public,
     description: "Sanitized bridge service state.",
 }];
 
-const DETAIL_VALUES_19_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
+const DETAIL_VALUES_21_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
 
-const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "reason",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_19_0,
+        allowed_values: DETAIL_VALUES_21_0,
         privacy: PrivacyClass::Public,
         description: "Sanitized pre-dispatch failure reason.",
     },
@@ -872,7 +916,7 @@ const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_20: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_22: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -883,7 +927,7 @@ const DETAILS_20: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction whose transport outcome is uncertain.",
 }];
 
-const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_23: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "delivered_frames",
         kind: SafeDetailKind::U16,
@@ -977,6 +1021,46 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         privacy: PrivacyClass::Public,
         docs_path: "docs/generated/error-catalog.md#hfx-integration-001",
     },
+    ErrorDescriptor {
+        code: ErrorCode::HfxIntegration002,
+        error_class: ErrorClass::Integration,
+        severity: ErrorSeverity::Error,
+        retry_policy: RetryPolicy::AfterRemediation,
+        side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
+        remediation_id: RemediationId::CreateOpenrazerAccessGroup,
+        safe_detail_fields: DETAILS_3,
+        lifecycle: LifecycleDescriptor {
+            state: ErrorLifecycleState::Active,
+            introduced_in: "0.0.0-dev.1",
+            deprecated_in: None,
+            replacement_code: None,
+        },
+        owner: ErrorOwner::Integration,
+        technical_cause: "OpenRazer is installed, but its standard access group is unavailable.",
+        user_explanation: "OpenRazer application access was not installed completely.",
+        privacy: PrivacyClass::Public,
+        docs_path: "docs/generated/error-catalog.md#hfx-integration-002",
+    },
+    ErrorDescriptor {
+        code: ErrorCode::HfxIntegration003,
+        error_class: ErrorClass::Integration,
+        severity: ErrorSeverity::Error,
+        retry_policy: RetryPolicy::AfterRemediation,
+        side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
+        remediation_id: RemediationId::ActivateOpenrazerSessionAccess,
+        safe_detail_fields: DETAILS_4,
+        lifecycle: LifecycleDescriptor {
+            state: ErrorLifecycleState::Active,
+            introduced_in: "0.0.0-dev.1",
+            deprecated_in: None,
+            replacement_code: None,
+        },
+        owner: ErrorOwner::Integration,
+        technical_cause: "OpenRazer is installed, but the current desktop session does not have the openrazer group active.",
+        user_explanation: "This desktop session cannot open OpenRazer devices yet.",
+        privacy: PrivacyClass::Public,
+        docs_path: "docs/generated/error-catalog.md#hfx-integration-003",
+    },
     ErrorDescriptor {
         code: ErrorCode::HfxInternal001,
         error_class: ErrorClass::Internal,
@@ -984,7 +1068,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::RuntimeReported,
         remediation_id: RemediationId::CollectSupportBundle,
-        safe_detail_fields: DETAILS_3,
+        safe_detail_fields: DETAILS_5,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1004,7 +1088,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ActivateInstalledDriver,
-        safe_detail_fields: DETAILS_4,
+        safe_detail_fields: DETAILS_6,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1024,7 +1108,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ActivateOpenrazerRouteDriver,
-        safe_detail_fields: DETAILS_5,
+        safe_detail_fields: DETAILS_7,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1044,7 +1128,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_6,
+        safe_detail_fields: DETAILS_8,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1064,7 +1148,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_7,
+        safe_detail_fields: DETAILS_9,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1084,7 +1168,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::ReleaseOwner,
-        safe_detail_fields: DETAILS_8,
+        safe_detail_fields: DETAILS_10,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1104,7 +1188,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::AcquireNewLease,
-        safe_detail_fields: DETAILS_9,
+        safe_detail_fields: DETAILS_11,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1124,7 +1208,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_10,
+        safe_detail_fields: DETAILS_12,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1144,7 +1228,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_11,
+        safe_detail_fields: DETAILS_13,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1164,7 +1248,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::QualifyDevice,
-        safe_detail_fields: DETAILS_12,
+        safe_detail_fields: DETAILS_14,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1184,7 +1268,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::VerifyProfileCatalog,
-        safe_detail_fields: DETAILS_13,
+        safe_detail_fields: DETAILS_15,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1204,7 +1288,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::UpdateProtocolPeer,
-        safe_detail_fields: DETAILS_14,
+        safe_detail_fields: DETAILS_16,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1224,7 +1308,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::DisableUnsupportedFeature,
-        safe_detail_fields: DETAILS_15,
+        safe_detail_fields: DETAILS_17,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1244,7 +1328,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_16,
+        safe_detail_fields: DETAILS_18,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1264,7 +1348,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::CorrectRequest,
-        safe_detail_fields: DETAILS_17,
+        safe_detail_fields: DETAILS_19,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1284,7 +1368,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::StartBridge,
-        safe_detail_fields: DETAILS_18,
+        safe_detail_fields: DETAILS_20,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1304,7 +1388,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_19,
+        safe_detail_fields: DETAILS_21,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1324,7 +1408,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Possible,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_20,
+        safe_detail_fields: DETAILS_22,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1344,7 +1428,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Partial,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_21,
+        safe_detail_fields: DETAILS_23,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
diff --git a/crates/hfx-integration-model/src/generated.rs b/crates/hfx-integration-model/src/generated.rs
index d883a49..06c9827 100644
--- a/crates/hfx-integration-model/src/generated.rs
+++ b/crates/hfx-integration-model/src/generated.rs
@@ -26,15 +26,15 @@ pub struct AdapterRecord {
 }
 
 pub const INTEGRATION_SOURCE_SHA256: &str =
-    "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f";
+    "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0";
 
 pub const UPSTREAMS: &[UpstreamRecord] = &[
     UpstreamRecord {
         id: "openrazer",
         name: "OpenRazer",
         repository: "https://github.com/openrazer/openrazer.git",
-        version: "3.12.1-41-g6820f9d",
-        commit: "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+        version: "3.12.2",
+        commit: "ddea89607b86023e88563b8feabc8fa2d5773cdd",
         license_expression: "GPL-2.0-or-later AND CC-BY-SA-4.0",
         api_contract: "org.razer 3.x metadata and D-Bus vocabulary",
         uses: &["compatibility-contract", "metadata-import"],
diff --git a/crates/hfx-integration-model/src/openrazer_native_generated.rs b/crates/hfx-integration-model/src/openrazer_native_generated.rs
index bc9984f..e2196c6 100644
--- a/crates/hfx-integration-model/src/openrazer_native_generated.rs
+++ b/crates/hfx-integration-model/src/openrazer_native_generated.rs
@@ -2,8 +2,8 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const OPENRAZER_NATIVE_DEPLOYMENT_SHA256: &str =
-    "8940c61d14a234049e1226d046b0ba41745d5ae69c387ba0c89f02b37c8dcd28";
+    "c918380e3017ab6e5cd996a21d32c7ea8b5410d8f13b2881d0f85a08df6b8bbd";
 pub const OPENRAZER_NATIVE_DKMS_NAME: &str = "openrazer-driver";
-pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = "3.12.1";
+pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = "3.12.2";
 pub const OPENRAZER_NATIVE_DRIVER_MODULES: &[&str] =
     &["razeraccessory", "razerkbd", "razerkraken", "razermouse"];
diff --git a/crates/hfx-ops/src/assessment.rs b/crates/hfx-ops/src/assessment.rs
index f030922..d04b9b2 100644
--- a/crates/hfx-ops/src/assessment.rs
+++ b/crates/hfx-ops/src/assessment.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::{OpenRazerDriverState, ServiceState, SystemSnapshot};
+use crate::{OpenRazerAccessState, OpenRazerDriverState, ServiceState, SystemSnapshot};
 use hfx_errors::{ErrorCode, error_by_code, remediation_by_id};
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
@@ -156,6 +156,30 @@ fn classify_openrazer_driver(
     state
 }
 
+fn classify_openrazer_access(
+    snapshot: &SystemSnapshot,
+    working: &mut Vec<String>,
+    findings: &mut Vec<AssessmentFinding>,
+) {
+    match snapshot.openrazer_access {
+        OpenRazerAccessState::Ready => {
+            working.push("OpenRazer application access is ready".to_owned());
+        }
+        OpenRazerAccessState::GroupUnavailable => findings.push(local_finding(
+            ErrorCode::HfxIntegration002,
+            BTreeMap::from([("access_state".to_owned(), "group-unavailable".to_owned())]),
+        )),
+        OpenRazerAccessState::SessionMembershipRequired => findings.push(local_finding(
+            ErrorCode::HfxIntegration003,
+            BTreeMap::from([(
+                "access_state".to_owned(),
+                "session-membership-required".to_owned(),
+            )]),
+        )),
+        OpenRazerAccessState::NotInstalled | OpenRazerAccessState::Unverified => {}
+    }
+}
+
 #[must_use]
 pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
     let mut working = vec!["package metadata is available".to_owned()];
@@ -212,6 +236,8 @@ pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
         ));
     }
 
+    classify_openrazer_access(snapshot, &mut working, &mut findings);
+
     let (receiver_generations, qualified_generations) =
         snapshot.bridge.as_ref().map_or((0, 0), |bridge| {
             let receivers = bridge.snapshot.receivers.len();
@@ -364,6 +390,7 @@ mod tests {
                     loaded_identity: None,
                 }],
             },
+            openrazer_access: OpenRazerAccessState::Ready,
             service_state: ServiceState::Active,
             bridge: Some(empty_bridge()),
             legacy_v2_stack_detected: false,
@@ -437,4 +464,31 @@ mod tests {
         assert_eq!(assessment.findings[0].code, "HFX-KERNEL-002");
         assert_eq!(assessment.findings[0].details["module"], "razerkbd");
     }
+
+    #[test]
+    fn optional_openrazer_absence_does_not_block_the_core_bridge() {
+        let mut value = snapshot();
+        value.openrazer_access = OpenRazerAccessState::NotInstalled;
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.state, AssessmentState::Ready);
+        assert!(assessment.findings.is_empty());
+    }
+
+    #[test]
+    fn installed_openrazer_names_missing_session_membership_exactly() {
+        let mut value = snapshot();
+        value.openrazer_access = OpenRazerAccessState::SessionMembershipRequired;
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.state, AssessmentState::NeedsAttention);
+        assert_eq!(assessment.findings.len(), 1);
+        assert_eq!(assessment.findings[0].code, "HFX-INTEGRATION-003");
+        assert_eq!(
+            assessment.findings[0].details["access_state"],
+            "session-membership-required"
+        );
+    }
 }
diff --git a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
index 29c1cea..5ba492b 100644
--- a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
+++ b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
@@ -56,6 +56,9 @@ fn fresh_install(probe: &RealSystemProbe) -> Result<(), String> {
     let _ = probe;
     println!("HyperFlux Next installed with conservative read-only defaults.");
     println!("The bridge remains disabled until the user explicitly enables it.");
+    println!("OpenRazer and Polychromatic use the standard openrazer access group.");
+    println!("For the desktop user, run: sudo gpasswd -a \"$USER\" openrazer");
+    println!("Then sign out and back in once so the session receives the group.");
     Ok(())
 }
 
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index baa91e4..85ba66c 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -36,8 +36,9 @@ pub use native_onboarding::{
 };
 pub use probe::{
     BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, KernelModuleIdentitySnapshot,
-    OpenRazerDriverSnapshot, OpenRazerDriverState, ProbeError, RealCommandRunner, RealSystemProbe,
-    ServiceState, SystemController, SystemProbe, SystemSnapshot,
+    OpenRazerAccessState, OpenRazerDriverSnapshot, OpenRazerDriverState, ProbeError,
+    RealCommandRunner, RealSystemProbe, ServiceState, SystemController, SystemProbe,
+    SystemSnapshot,
 };
 pub use qualification::{
     ActionConfirmation, BatteryAvailability, BatteryView, CapabilityAccess, CapabilityView,
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index c2b4f39..4132b6b 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -28,6 +28,8 @@ use std::time::{Duration, Instant};
 const MAX_COMMAND_OUTPUT_BYTES: usize = 4_096;
 const MAX_USB_DEVICE_ENTRIES: usize = 256;
 const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
+const OPENRAZER_DAEMON_PATH: &str = "/usr/bin/openrazer-daemon";
+const OPENRAZER_GROUP: &str = "openrazer";
 const EVENT_SUBSCRIPTIONS_FEATURE: &str = "event-subscriptions";
 const INTEGRATION_VIEW_FEATURE: &str = "integration-view-projection";
 const STRUCTURED_DIAGNOSTICS_FEATURE: &str = "structured-diagnostics";
@@ -173,12 +175,23 @@ pub struct SystemSnapshot {
     pub installed_module_identity: Option<String>,
     pub loaded_module_identity: Option<String>,
     pub openrazer_driver: OpenRazerDriverSnapshot,
+    pub openrazer_access: OpenRazerAccessState,
     pub service_state: ServiceState,
     pub bridge: Option<BridgeHealth>,
     pub legacy_v2_stack_detected: bool,
     pub supported_receiver_present: bool,
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum OpenRazerAccessState {
+    NotInstalled,
+    Ready,
+    GroupUnavailable,
+    SessionMembershipRequired,
+    Unverified,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct KernelModuleIdentitySnapshot {
     pub module_name: String,
@@ -265,6 +278,7 @@ pub struct RealSystemProbe<R = RealCommandRunner> {
     runner: R,
     sys_module_root: PathBuf,
     usb_devices_root: PathBuf,
+    openrazer_daemon_path: PathBuf,
     socket_path: PathBuf,
     timeout: Duration,
 }
@@ -275,6 +289,7 @@ impl Default for RealSystemProbe<RealCommandRunner> {
             runner: RealCommandRunner,
             sys_module_root: PathBuf::from("/sys/module"),
             usb_devices_root: PathBuf::from(USB_DEVICES_ROOT),
+            openrazer_daemon_path: PathBuf::from(OPENRAZER_DAEMON_PATH),
             socket_path: PathBuf::from(BRIDGE_SOCKET_PATH),
             timeout: Duration::from_millis(STATUS_TIMEOUT_MS),
         }
@@ -293,6 +308,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             runner,
             sys_module_root,
             PathBuf::from(USB_DEVICES_ROOT),
+            PathBuf::from(OPENRAZER_DAEMON_PATH),
             socket_path,
             timeout,
         )
@@ -302,6 +318,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         runner: R,
         sys_module_root: PathBuf,
         usb_devices_root: PathBuf,
+        openrazer_daemon_path: PathBuf,
         socket_path: PathBuf,
         timeout: Duration,
     ) -> Self {
@@ -309,6 +326,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             runner,
             sys_module_root,
             usb_devices_root,
+            openrazer_daemon_path,
             socket_path,
             timeout,
         }
@@ -355,6 +373,47 @@ impl<R: CommandRunner> RealSystemProbe<R> {
         }
     }
 
+    fn openrazer_access(&self) -> OpenRazerAccessState {
+        if !self.openrazer_daemon_path.is_file() {
+            return OpenRazerAccessState::NotInstalled;
+        }
+        let Ok(group) = self
+            .runner
+            .run("getent", &["group", OPENRAZER_GROUP], self.timeout)
+        else {
+            return OpenRazerAccessState::Unverified;
+        };
+        let Some(group_id) = group
+            .success
+            .then(|| parse_group_id(&group.stdout))
+            .flatten()
+        else {
+            return OpenRazerAccessState::GroupUnavailable;
+        };
+        let Ok(user_id) = self.runner.run("id", &["-u"], self.timeout) else {
+            return OpenRazerAccessState::Unverified;
+        };
+        if user_id.success && user_id.stdout.parse::<u32>() == Ok(0) {
+            return OpenRazerAccessState::Ready;
+        }
+        let Ok(group_ids) = self.runner.run("id", &["-G"], self.timeout) else {
+            return OpenRazerAccessState::Unverified;
+        };
+        if !user_id.success || !group_ids.success {
+            return OpenRazerAccessState::Unverified;
+        }
+        if group_ids
+            .stdout
+            .split_ascii_whitespace()
+            .filter_map(|value| value.parse::<u32>().ok())
+            .any(|value| value == group_id)
+        {
+            OpenRazerAccessState::Ready
+        } else {
+            OpenRazerAccessState::SessionMembershipRequired
+        }
+    }
+
     fn service_state(&self) -> ServiceState {
         let Ok(output) = self.runner.run(
             "systemctl",
@@ -553,6 +612,7 @@ impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
             installed_module_identity: self.installed_module_identity(),
             loaded_module_identity: self.loaded_module_identity(),
             openrazer_driver: self.openrazer_driver(),
+            openrazer_access: self.openrazer_access(),
             service_state,
             bridge,
             legacy_v2_stack_detected: self.legacy_v2_stack_detected(),
@@ -680,6 +740,17 @@ fn bounded_identity(value: &str) -> Option<String> {
     }
 }
 
+fn parse_group_id(value: &str) -> Option<u32> {
+    let mut fields = value.split(':');
+    if fields.next()? != OPENRAZER_GROUP {
+        return None;
+    }
+    let _password = fields.next()?;
+    let group_id = fields.next()?.parse::<u32>().ok()?;
+    let _members = fields.next()?;
+    fields.next().is_none().then_some(group_id)
+}
+
 fn read_usb_hex_id(path: &Path) -> Option<u16> {
     let value = fs::read_to_string(path).ok()?;
     let value = value.trim();
@@ -832,6 +903,77 @@ mod tests {
         );
     }
 
+    #[test]
+    fn openrazer_group_id_requires_the_exact_group_record() {
+        assert_eq!(parse_group_id("openrazer:x:946:"), Some(946));
+        assert_eq!(parse_group_id("other:x:946:"), None);
+        assert_eq!(parse_group_id("openrazer:x:not-a-number:"), None);
+        assert_eq!(parse_group_id("openrazer:x:946::extra"), None);
+    }
+
+    #[test]
+    fn installed_openrazer_daemon_requires_active_session_membership() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        let daemon = std::env::temp_dir().join(format!("hfx-openrazer-{unique}"));
+        fs::write(&daemon, "fixture").expect("write daemon fixture");
+        let probe = RealSystemProbe::with_all_paths(
+            FakeRunner::new(vec![
+                Ok(CommandOutput {
+                    success: true,
+                    stdout: "openrazer:x:946:".to_owned(),
+                }),
+                Ok(CommandOutput {
+                    success: true,
+                    stdout: "1000".to_owned(),
+                }),
+                Ok(CommandOutput {
+                    success: true,
+                    stdout: "1000 998".to_owned(),
+                }),
+            ]),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing-usb"),
+            daemon.clone(),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+
+        assert_eq!(
+            probe.openrazer_access(),
+            OpenRazerAccessState::SessionMembershipRequired
+        );
+        assert_eq!(
+            probe.runner.calls(),
+            vec![
+                (
+                    "getent".to_owned(),
+                    vec!["group".to_owned(), "openrazer".to_owned()]
+                ),
+                ("id".to_owned(), vec!["-u".to_owned()]),
+                ("id".to_owned(), vec!["-G".to_owned()]),
+            ]
+        );
+        fs::remove_file(daemon).expect("remove daemon fixture");
+    }
+
+    #[test]
+    fn absent_openrazer_daemon_does_not_require_group_access() {
+        let probe = RealSystemProbe::with_all_paths(
+            FakeRunner::new(Vec::new()),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing-usb"),
+            PathBuf::from("/missing-openrazer-daemon"),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+
+        assert_eq!(probe.openrazer_access(), OpenRazerAccessState::NotInstalled);
+        assert!(probe.runner.calls().is_empty());
+    }
+
     #[test]
     fn legacy_v2_service_is_detected_without_claiming_next_is_ready() {
         let probe = RealSystemProbe::with_paths(
@@ -898,6 +1040,7 @@ mod tests {
             FakeRunner::new(Vec::new()),
             PathBuf::from("/missing"),
             usb_root.clone(),
+            PathBuf::from("/missing-openrazer-daemon"),
             PathBuf::from("/missing.sock"),
             Duration::from_millis(10),
         );
@@ -921,6 +1064,7 @@ mod tests {
             FakeRunner::new(Vec::new()),
             PathBuf::from("/missing"),
             usb_root.clone(),
+            PathBuf::from("/missing-openrazer-daemon"),
             PathBuf::from("/missing.sock"),
             Duration::from_millis(10),
         );
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index b26f798..144bfc0 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1339,6 +1339,7 @@ mod tests {
                     loaded_identity: None,
                 }],
             },
+            openrazer_access: crate::OpenRazerAccessState::NotInstalled,
             service_state: ServiceState::Active,
             bridge: None,
             legacy_v2_stack_detected: false,
diff --git a/crates/hfx-ops/src/support.rs b/crates/hfx-ops/src/support.rs
index 626f221..ab2c342 100644
--- a/crates/hfx-ops/src/support.rs
+++ b/crates/hfx-ops/src/support.rs
@@ -247,6 +247,7 @@ mod tests {
                     loaded_identity: None,
                 }],
             },
+            openrazer_access: crate::OpenRazerAccessState::NotInstalled,
             service_state: ServiceState::Inactive,
             bridge: None,
             legacy_v2_stack_detected: false,
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index 2498b82..eb61146 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0
+// Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -221,7 +221,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0";
+    "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
diff --git a/docs/generated/development-environment.md b/docs/generated/development-environment.md
index 8251f48..e3ae638 100644
--- a/docs/generated/development-environment.md
+++ b/docs/generated/development-environment.md
@@ -25,7 +25,7 @@ This is the only ordinary setup step that uses the network. It creates clean, de
 
 | Upstream | Commit | Contract |
 | --- | --- | --- |
-| OpenRazer | `6820f9da169d354bc7e6e93a0aa8683a6bb75792` | org.razer 3.x metadata and D-Bus vocabulary |
+| OpenRazer | `ddea89607b86023e88563b8feabc8fa2d5773cdd` | org.razer 3.x metadata and D-Bus vocabulary |
 | OpenRGB | `6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0` | OpenRGB plugin API 4 |
 | Polychromatic | `716737bf444ab7e962f4d3b7a5188b2f07c0c4a1` | Polychromatic 0.9 native backend contract |
 
diff --git a/docs/generated/device-knowledge.md b/docs/generated/device-knowledge.md
index ff3aad2..0dfc2f5 100644
--- a/docs/generated/device-knowledge.md
+++ b/docs/generated/device-knowledge.md
@@ -74,8 +74,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBasiliskV3ProWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1659) | `direct-usb` | `1532:00aa` | hardware class | matrix 1x13 |
-| [`openrazer:RazerBasiliskV3ProWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1695) | `vendor-wireless-receiver` | `1532:00ab` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1659) | `direct-usb` | `1532:00aa` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1695) | `vendor-wireless-receiver` | `1532:00ab` | hardware class | matrix 1x13 |
 | [`openrgb:basilisk_v3_pro_bluetooth_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5240) | `bluetooth` | `unknown:00ac` | table only | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L4909) | `direct-usb` | `1532:00aa` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L4968) | `vendor-wireless-receiver` | `1532:00ab` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
@@ -190,8 +190,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBasiliskV3Pro35KWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1703) | `direct-usb` | `1532:00cc` | hardware class | matrix 1x13 |
-| [`openrazer:RazerBasiliskV3Pro35KWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1739) | `vendor-wireless-receiver` | `1532:00cd` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3Pro35KWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1703) | `direct-usb` | `1532:00cc` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3Pro35KWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1739) | `vendor-wireless-receiver` | `1532:00cd` | hardware class | matrix 1x13 |
 | [`openrgb:basilisk_v3_pro_35k_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5026) | `direct-usb` | `1532:00cc` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_35k_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5085) | `vendor-wireless-receiver` | `1532:00cd` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 
@@ -300,8 +300,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV3ProWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L379) | `direct-usb` | `1532:025a` | hardware class | matrix 6x22 |
-| [`openrazer:RazerBlackWidowV3ProWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L402) | `vendor-wireless-receiver` | `1532:025c` | hardware class | matrix 6x22 |
+| [`openrazer:RazerBlackWidowV3ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L379) | `direct-usb` | `1532:025a` | hardware class | matrix 6x22 |
+| [`openrazer:RazerBlackWidowV3ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L402) | `vendor-wireless-receiver` | `1532:025c` | hardware class | matrix 6x22 |
 | [`openrgb:blackwidow_v3_pro_bluetooth_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1578) | `bluetooth` | `unknown:025b` | table only | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
 | [`openrgb:blackwidow_v3_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1543) | `direct-usb` | `1532:025a` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
 | [`openrgb:blackwidow_v3_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1613) | `vendor-wireless-receiver` | `1532:025c` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
@@ -541,8 +541,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1156) | `direct-usb` | `1532:02b9` | hardware class | matrix 5x14 |
-| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1177) | `vendor-wireless-receiver` | `1532:02ba` | hardware class | matrix 5x14 |
+| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1156) | `direct-usb` | `1532:02b9` | hardware class | matrix 5x14 |
+| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1177) | `vendor-wireless-receiver` | `1532:02ba` | hardware class | matrix 5x14 |
 
 | Pinned Linux semantic | Presentation | HyperFlux state | Missing capability |
 | --- | --- | --- | --- |
@@ -634,8 +634,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L423) | `direct-usb` | `1532:02d7` | hardware class | matrix 6x18 |
-| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L445) | `vendor-wireless-receiver` | `1532:02d5` | hardware class | matrix 6x18 |
+| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L423) | `direct-usb` | `1532:02d7` | hardware class | matrix 6x18 |
+| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L445) | `vendor-wireless-receiver` | `1532:02d5` | hardware class | matrix 6x18 |
 | [`openrgb:blackwidow_v4_tkl_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2028) | `direct-usb` | `1532:02d7` | active detector | slots 6x18; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v4_tkl_layout |
 | [`openrgb:blackwidow_v4_tkl_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2063) | `vendor-wireless-receiver` | `1532:02d5` | active detector | slots 6x18; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v4_tkl_layout |
 
@@ -777,8 +777,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerCobraProWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1566) | `direct-usb` | `1532:00af` | hardware class | not documented |
-| [`openrazer:RazerCobraProWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1595) | `vendor-wireless-receiver` | `1532:00b0` | hardware class | not documented |
+| [`openrazer:RazerCobraProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1566) | `direct-usb` | `1532:00af` | hardware class | not documented |
+| [`openrazer:RazerCobraProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1595) | `vendor-wireless-receiver` | `1532:00b0` | hardware class | not documented |
 | [`openrgb:cobra_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5369) | `direct-usb` | `1532:00af` | active detector | slots 1x11; zones Logo, Scroll Wheel, Underglow |
 | [`openrgb:cobra_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5428) | `vendor-wireless-receiver` | `1532:00b0` | active detector | slots 1x11; zones Logo, Scroll Wheel, Underglow |
 
@@ -880,8 +880,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerDeathStalkerV2ProWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1422) | `direct-usb` | `1532:0292` | hardware class | matrix 6x22 |
-| [`openrazer:RazerDeathStalkerV2ProWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1444) | `vendor-wireless-receiver` | `1532:0290` | hardware class | matrix 6x22 |
+| [`openrazer:RazerDeathStalkerV2ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1422) | `direct-usb` | `1532:0292` | hardware class | matrix 6x22 |
+| [`openrazer:RazerDeathStalkerV2ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1444) | `vendor-wireless-receiver` | `1532:0290` | hardware class | matrix 6x22 |
 | [`openrgb:deathstalker_v2_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2750) | `direct-usb` | `1532:0292` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_layout |
 | [`openrgb:deathstalker_v2_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2715) | `vendor-wireless-receiver` | `1532:0290` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_layout |
 
@@ -971,8 +971,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerDeathStalkerV2ProTKLWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1451) | `direct-usb` | `1532:0298` | hardware class | matrix 6x17 |
-| [`openrazer:RazerDeathStalkerV2ProTKLWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1473) | `vendor-wireless-receiver` | `1532:0296` | hardware class | matrix 6x17 |
+| [`openrazer:RazerDeathStalkerV2ProTKLWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1451) | `direct-usb` | `1532:0298` | hardware class | matrix 6x17 |
+| [`openrazer:RazerDeathStalkerV2ProTKLWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1473) | `vendor-wireless-receiver` | `1532:0296` | hardware class | matrix 6x17 |
 | [`openrgb:deathstalker_v2_pro_tkl_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2660) | `direct-usb` | `1532:0298` | active detector | slots 6x17; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_tkl_layout |
 | [`openrgb:deathstalker_v2_pro_tkl_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2680) | `vendor-wireless-receiver` | `1532:0296` | active detector | slots 6x17; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_tkl_layout |
 
@@ -1065,8 +1065,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerNagaV2ProWired`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1011) | `direct-usb` | `1532:00a7` | hardware class | matrix 1x3 |
-| [`openrazer:RazerNagaV2ProWireless`](https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1038) | `vendor-wireless-receiver` | `1532:00a8` | hardware class | matrix 1x3 |
+| [`openrazer:RazerNagaV2ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1011) | `direct-usb` | `1532:00a7` | hardware class | matrix 1x3 |
+| [`openrazer:RazerNagaV2ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1038) | `vendor-wireless-receiver` | `1532:00a8` | hardware class | matrix 1x3 |
 | [`openrgb:naga_pro_v2_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L7146) | `direct-usb` | `1532:00a7` | active detector | slots 1x2; zones Logo, Numpad |
 | [`openrgb:naga_pro_v2_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L7166) | `vendor-wireless-receiver` | `1532:00a8` | active detector | slots 1x2; zones Logo, Numpad |
 
diff --git a/docs/generated/distributions.md b/docs/generated/distributions.md
index 1d0cc9a..d7dec60 100644
--- a/docs/generated/distributions.md
+++ b/docs/generated/distributions.md
@@ -2,15 +2,15 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical distribution digest: `234a59b415fab7c6d7da979b445cf06e699ce3ff73cf795f7cbcf5947d987a53`.
+Canonical distribution digest: `8abc3a4b58c4696be8b8fbfe36afd77e3c71c89e13a1e2b73a358b25b4d4e970`.
 
 Every target packages the same `hyperflux-next-linux` canonical staged payload. Distribution wrappers add only native metadata, lifecycle hooks, and Python discovery.
 
 | Target | Architectures | Required packages | Optional integrations |
 | --- | --- | --- | --- |
-| `arch` | `aarch64-unknown-linux-gnu` to `aarch64`, `x86_64-unknown-linux-gnu` to `x86_64` | `dkms`, `glibc`, `gcc-libs`, `python`, `systemd` | `openrgb`, `polychromatic`, `python-dbus`, `python-gobject` |
-| `debian` | `aarch64-unknown-linux-gnu` to `arm64`, `x86_64-unknown-linux-gnu` to `amd64` | `dkms`, `libc6`, `libgcc-s1`, `python3 (>= 3.11)`, `systemd`, `udev` | `openrgb`, `polychromatic`, `python3-dbus`, `python3-gi` |
-| `rpm` | `aarch64-unknown-linux-gnu` to `aarch64`, `x86_64-unknown-linux-gnu` to `x86_64` | `dkms`, `glibc`, `libgcc`, `python3`, `systemd`, `systemd-udev` | `openrgb`, `polychromatic`, `python3-dbus`, `python3-gobject` |
+| `arch` | `aarch64-unknown-linux-gnu` to `aarch64`, `x86_64-unknown-linux-gnu` to `x86_64` | `dkms`, `glibc`, `gcc-libs`, `python`, `systemd` | `openrazer-daemon`, `python-openrazer`, `openrgb`, `polychromatic`, `python-dbus`, `python-gobject` |
+| `debian` | `aarch64-unknown-linux-gnu` to `arm64`, `x86_64-unknown-linux-gnu` to `amd64` | `dkms`, `libc6`, `libgcc-s1`, `python3 (>= 3.11)`, `systemd`, `udev` | `openrazer-daemon`, `python3-openrazer`, `openrgb`, `polychromatic`, `python3-dbus`, `python3-gi` |
+| `rpm` | `aarch64-unknown-linux-gnu` to `aarch64`, `x86_64-unknown-linux-gnu` to `x86_64` | `dkms`, `glibc`, `libgcc`, `python3`, `systemd`, `systemd-udev` | `openrazer-daemon`, `python3-openrazer`, `openrgb`, `polychromatic`, `python3-dbus`, `python3-gobject` |
 
 ## Package Relationships
 
diff --git a/docs/generated/error-catalog.md b/docs/generated/error-catalog.md
index 718b961..18af1fe 100644
--- a/docs/generated/error-catalog.md
+++ b/docs/generated/error-catalog.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Catalog source: `5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066`
+Catalog source: `f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c`
 
 This catalog is the single authority for Doctor, services, SDKs, integrations, package hooks, and support bundles. Safe details are an allowlist: raw payloads, serials, host identifiers, private paths, and arbitrary exception or log text are not accepted.
 
@@ -32,6 +32,8 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | [`HFX-DEADLINE-001`](#hfx-deadline-001) | `deadline` | `warning` | `never` | `must-be-none` | `bridge` | `active` |
 | [`HFX-GENERATION-001`](#hfx-generation-001) | `generation` | `warning` | `after-remediation` | `must-be-none` | `bridge` | `active` |
 | [`HFX-INTEGRATION-001`](#hfx-integration-001) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
+| [`HFX-INTEGRATION-002`](#hfx-integration-002) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
+| [`HFX-INTEGRATION-003`](#hfx-integration-003) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
 | [`HFX-INTERNAL-001`](#hfx-internal-001) | `internal` | `critical` | `never` | `runtime-reported` | `bridge` | `active` |
 | [`HFX-KERNEL-001`](#hfx-kernel-001) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
 | [`HFX-KERNEL-002`](#hfx-kernel-002) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
@@ -59,8 +61,10 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | `acquire-new-lease` | Request a new lease for the complete resource set before submitting another operation. | Read the ownership snapshot and confirm the new lease is current. | false |
 | `activate-installed-driver` | Use the platform's documented reboot or receiver-disconnect activation path. | Run Doctor and confirm the loaded and installed driver identities match. | false |
 | `activate-openrazer-route-driver` | Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying. | Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity. | false |
+| `activate-openrazer-session-access` | Run sudo gpasswd -a "$USER" openrazer, then sign out and back in once. | After signing back in, run Doctor and confirm OpenRazer application access is ready. | false |
 | `collect-support-bundle` | Preview and create the bounded HyperFlux support bundle for the unresolved internal failure. | Confirm the bundle preview excludes private paths, serials, raw reports, and arbitrary logs. | false |
 | `correct-request` | Correct the named request field and submit a new request with a new request identifier. | Validate the corrected request against the negotiated protocol schema. | false |
+| `create-openrazer-access-group` | Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first. | Run Doctor and confirm the OpenRazer access-group finding is absent. | false |
 | `disable-unsupported-feature` | Continue without the feature or use a peer that advertises it during negotiation. | Repeat negotiation and inspect the enabled feature set. | false |
 | `lookup-transaction-outcome` | Look up the existing transaction identifier; do not resubmit the hardware operation. | Confirm the transaction reaches exactly one recorded terminal outcome. | false |
 | `qualify-device` | Keep the device read-only until an evidence-backed profile qualifies the requested capability. | Inspect the capability snapshot and confirm the support level permits the operation. | false |
@@ -150,6 +154,54 @@ This application adapter must be updated before it can use HyperFlux.
 | `integration` | `text` | true | max 96 characters | `public` |
 | `protocol_range` | `text` | true | max 32 characters | `public` |
 
+## HFX-INTEGRATION-002
+
+OpenRazer application access was not installed completely.
+
+**Technical cause:** OpenRazer is installed, but its standard access group is unavailable.
+
+**Class / severity:** `integration` / `error`
+
+**Retry / side effects:** `after-remediation` / `not-applicable`
+
+**Owner / privacy:** `integration` / `public`
+
+**Lifecycle:** `active` since `0.0.0-dev.1`
+
+**Safe action (`create-openrazer-access-group`):** Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first.
+
+**Verify:** Run Doctor and confirm the OpenRazer access-group finding is absent.
+
+### Safe Details
+
+| Field | Type | Required | Bound | Privacy |
+| --- | --- | --- | --- | --- |
+| `access_state` | `enum` | true | `group-unavailable` | `public` |
+
+## HFX-INTEGRATION-003
+
+This desktop session cannot open OpenRazer devices yet.
+
+**Technical cause:** OpenRazer is installed, but the current desktop session does not have the openrazer group active.
+
+**Class / severity:** `integration` / `error`
+
+**Retry / side effects:** `after-remediation` / `not-applicable`
+
+**Owner / privacy:** `integration` / `public`
+
+**Lifecycle:** `active` since `0.0.0-dev.1`
+
+**Safe action (`activate-openrazer-session-access`):** Run sudo gpasswd -a "$USER" openrazer, then sign out and back in once.
+
+**Verify:** After signing back in, run Doctor and confirm OpenRazer application access is ready.
+
+### Safe Details
+
+| Field | Type | Required | Bound | Privacy |
+| --- | --- | --- | --- | --- |
+| `access_state` | `enum` | true | `session-membership-required` | `public` |
+
 ## HFX-INTERNAL-001
 
 HyperFlux stopped the affected operation because an internal safety rule failed.
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 4c6e753..4f3cceb 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical manifest digest: `1733db54a95a302e1b849aa84fe5f551cab85209db93439c451b86de241d746b`.
+Canonical manifest digest: `4b5a1bb4f376550379f673465149af66d48909247f7af7de69e2c1ee9ac7a723`.
 
 Package: `hyperflux-next-linux` `0.0.0-dev.1` release `1`.
 
@@ -19,7 +19,7 @@ Package hooks prepare system metadata and delegate compatibility decisions to th
 
 ## Build Products
 
-The canonical plan contains `7` required and `3` optional build products.
+The canonical plan contains `9` required and `3` optional build products.
 
 | Component | Kind | Required | Destination or distribution |
 | --- | --- | --- | --- |
@@ -28,7 +28,9 @@ The canonical plan contains `7` required and `3` optional build products.
 | `activation-utility` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-activate` |
 | `openrazer-native-relay` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-uhid-relay` |
 | `native-readonly-qualifier` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-native-qualifier` |
-| `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.1` |
+| `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.2` |
+| `openrazer-native-udev-rules` | `source-transform-file` | yes | `/usr/lib/udev/rules.d/99-razer.rules` |
+| `openrazer-native-mount-helper` | `source-transform-file` | yes | `/usr/lib/udev/razer_mount` |
 | `openrgb-native` | `cmake-module` | no | `/usr/lib/openrgb/plugins/hyperflux-next-openrgb.so` |
 | `python-sdk` | `python-project` | yes | `hyperflux-next-sdk` |
 | `polychromatic-native` | `python-project` | no | `hyperflux-next-polychromatic` |
@@ -36,7 +38,7 @@ The canonical plan contains `7` required and `3` optional build products.
 
 ## Static Payload
 
-The expanded source payload contains `188` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
+The expanded source payload contains `189` files. Every destination is normalized below `/etc` or `/usr` and checked for collisions.
 
 | Component | Files | Preserved destination |
 | --- | ---: | --- |
@@ -47,6 +49,7 @@ The expanded source payload contains `188` files. Every destination is normalize
 | `activation-service` | 1 | `-` |
 | `confirmation-service` | 1 | `-` |
 | `system-users` | 1 | `-` |
+| `openrazer-system-group` | 1 | `-` |
 | `runtime-directories` | 1 | `-` |
 | `device-permissions` | 1 | `-` |
 | `default-configuration` | 1 | `/etc/hyperflux-next/bridge.json` |
diff --git a/docs/generated/integrations.md b/docs/generated/integrations.md
index 9e5f073..d54138e 100644
--- a/docs/generated/integrations.md
+++ b/docs/generated/integrations.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Integration source: `fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f`
+Integration source: `f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0`
 
 Every adapter uses only the versioned HyperFlux SDK, preserves unrelated application devices, and owns no receiver encoding.
 
@@ -10,7 +10,7 @@ Every adapter uses only the versioned HyperFlux SDK, preserves unrelated applica
 
 | Project | Version | Commit | Contract | Build network |
 | --- | --- | --- | --- | --- |
-| [OpenRazer](https://github.com/openrazer/openrazer) | `3.12.1-41-g6820f9d` | `6820f9da169d` | org.razer 3.x metadata and D-Bus vocabulary | disabled |
+| [OpenRazer](https://github.com/openrazer/openrazer) | `3.12.2` | `ddea89607b86` | org.razer 3.x metadata and D-Bus vocabulary | disabled |
 | [OpenRGB](https://github.com/CalcProgrammer1/OpenRGB) | `1.0rc3` | `6fbcf62d7694` | OpenRGB plugin API 4 | disabled |
 | [Polychromatic](https://github.com/polychromatic/polychromatic) | `0.9.7-7-g716737b` | `716737bf444a` | Polychromatic 0.9 native backend contract | disabled |
 
diff --git a/docs/generated/openrazer-native-deployment.md b/docs/generated/openrazer-native-deployment.md
index edf7512..494c573 100644
--- a/docs/generated/openrazer-native-deployment.md
+++ b/docs/generated/openrazer-native-deployment.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical deployment digest: `8940c61d14a234049e1226d046b0ba41745d5ae69c387ba0c89f02b37c8dcd28`.
+Canonical deployment digest: `c918380e3017ab6e5cd996a21d32c7ea8b5410d8f13b2881d0f85a08df6b8bbd`.
 
 ## Relay
 
@@ -19,8 +19,19 @@ The static relay service is pulled in by the bridge service. It runs as root onl
 
 | Field | Value |
 | --- | --- |
-| DKMS identity | `openrazer-driver` `3.12.1` |
-| Source tree | `/usr/src/openrazer-driver-3.12.1` |
+| DKMS identity | `openrazer-driver` `3.12.2` |
+| Source tree | `/usr/src/openrazer-driver-3.12.2` |
 | Modules | `razeraccessory`, `razerkbd`, `razerkraken`, `razermouse` |
 
 The package build applies the source-locked transport patch to the pinned OpenRazer tree, projects only its DKMS build inputs, and verifies every transformed digest. The ordinary BUS_USB tables and direct-device transport remain upstream-owned.
+
+## Local Access
+
+| Field | Value |
+| --- | --- |
+| Group | `openrazer` |
+| Udev rules | `/usr/lib/udev/rules.d/99-razer.rules` |
+| Mount helper | `/usr/lib/udev/razer_mount` |
+| Sysusers declaration | `/usr/lib/sysusers.d/openrazer.conf` |
+
+The rules and helper are selected from the same transformed, pinned OpenRazer tree as the DKMS source. The package manager owns every deployed file, and the distribution group substitution is part of the reviewed source transform.
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index 3bddc07..ca255e9 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `28d7686f8ab617943f82bca2e058891c70608adbbbaf6dd0c1f09fb8c4257e9c`
+- Authority SHA-256: `5db9df91fc4c065eb1cc1cac43895ebc25f0d4d017084dc830be83b8e3dfc53b`
 
 ## License Policy
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index b72df80..31ab57c 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0`
+Profile source: `b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index ff6caf6..58ceb7f 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0 */
+/* Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70 */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/errors/catalog.json b/errors/catalog.json
index 0a471a5..7b5118e 100644
--- a/errors/catalog.json
+++ b/errors/catalog.json
@@ -23,6 +23,13 @@
       "verification": "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
       "automatic": false
     },
+    {
+      "id": "activate-openrazer-session-access",
+      "title": "Activate OpenRazer access for this desktop session",
+      "safe_action": "Run sudo gpasswd -a \"$USER\" openrazer, then sign out and back in once.",
+      "verification": "After signing back in, run Doctor and confirm OpenRazer application access is ready.",
+      "automatic": false
+    },
     {
       "id": "collect-support-bundle",
       "title": "Collect a privacy-safe support bundle",
@@ -37,6 +44,13 @@
       "verification": "Validate the corrected request against the negotiated protocol schema.",
       "automatic": false
     },
+    {
+      "id": "create-openrazer-access-group",
+      "title": "Create the OpenRazer access group",
+      "safe_action": "Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first.",
+      "verification": "Run Doctor and confirm the OpenRazer access-group finding is absent.",
+      "automatic": false
+    },
     {
       "id": "disable-unsupported-feature",
       "title": "Disable the unsupported feature",
@@ -184,6 +198,40 @@
       "privacy": "public",
       "docs_path": "docs/generated/error-catalog.md#hfx-integration-001"
     },
+    {
+      "code": "HFX-INTEGRATION-002",
+      "class": "integration",
+      "severity": "error",
+      "retry_policy": "after-remediation",
+      "side_effect_certainty_policy": "not-applicable",
+      "remediation_id": "create-openrazer-access-group",
+      "safe_detail_fields": [
+        {"name": "access_state", "type": "enum", "required": true, "maximum_length": null, "maximum_value": null, "allowed_values": ["group-unavailable"], "privacy": "public", "description": "OpenRazer access-group state."}
+      ],
+      "lifecycle": {"state": "active", "introduced_in": "0.0.0-dev.1", "deprecated_in": null, "replacement_code": null},
+      "owner": "integration",
+      "technical_cause": "OpenRazer is installed, but its standard access group is unavailable.",
+      "user_explanation": "OpenRazer application access was not installed completely.",
+      "privacy": "public",
+      "docs_path": "docs/generated/error-catalog.md#hfx-integration-002"
+    },
+    {
+      "code": "HFX-INTEGRATION-003",
+      "class": "integration",
+      "severity": "error",
+      "retry_policy": "after-remediation",
+      "side_effect_certainty_policy": "not-applicable",
+      "remediation_id": "activate-openrazer-session-access",
+      "safe_detail_fields": [
+        {"name": "access_state", "type": "enum", "required": true, "maximum_length": null, "maximum_value": null, "allowed_values": ["session-membership-required"], "privacy": "public", "description": "OpenRazer desktop-session access state."}
+      ],
+      "lifecycle": {"state": "active", "introduced_in": "0.0.0-dev.1", "deprecated_in": null, "replacement_code": null},
+      "owner": "integration",
+      "technical_cause": "OpenRazer is installed, but the current desktop session does not have the openrazer group active.",
+      "user_explanation": "This desktop session cannot open OpenRazer devices yet.",
+      "privacy": "public",
+      "docs_path": "docs/generated/error-catalog.md#hfx-integration-003"
+    },
     {
       "code": "HFX-INTERNAL-001",
       "class": "internal",
diff --git a/generated/integrations/catalog.json b/generated/integrations/catalog.json
index b39b58b..d253563 100644
--- a/generated/integrations/catalog.json
+++ b/generated/integrations/catalog.json
@@ -128,12 +128,12 @@
     }
   ],
   "schema": "hyperflux-integration-catalog-v1",
-  "source_sha256": "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f",
+  "source_sha256": "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0",
   "upstreams": [
     {
       "api_contract": "org.razer 3.x metadata and D-Bus vocabulary",
       "build_network_access": false,
-      "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
       "id": "openrazer",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "name": "OpenRazer",
@@ -142,7 +142,7 @@
         "compatibility-contract",
         "metadata-import"
       ],
-      "version": "3.12.1-41-g6820f9d"
+      "version": "3.12.2"
     },
     {
       "api_contract": "OpenRGB plugin API 4",
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 1f803fb..5f656a7 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -1039,7 +1039,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1659",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1659",
           "usb_identity": {
             "product_id": 170,
             "vendor_id": 5426
@@ -1111,7 +1111,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1695",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1695",
           "usb_identity": {
             "product_id": 171,
             "vendor_id": 5426
@@ -2400,7 +2400,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1703",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1703",
           "usb_identity": {
             "product_id": 204,
             "vendor_id": 5426
@@ -2472,7 +2472,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1739",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1739",
           "usb_identity": {
             "product_id": 205,
             "vendor_id": 5426
@@ -3440,7 +3440,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L379",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L379",
           "usb_identity": {
             "product_id": 602,
             "vendor_id": 5426
@@ -3504,7 +3504,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L402",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L402",
           "usb_identity": {
             "product_id": 604,
             "vendor_id": 5426
@@ -6256,7 +6256,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1156",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1156",
           "usb_identity": {
             "product_id": 697,
             "vendor_id": 5426
@@ -6318,7 +6318,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1177",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1177",
           "usb_identity": {
             "product_id": 698,
             "vendor_id": 5426
@@ -7212,7 +7212,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L423",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L423",
           "usb_identity": {
             "product_id": 727,
             "vendor_id": 5426
@@ -7276,7 +7276,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L445",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L445",
           "usb_identity": {
             "product_id": 725,
             "vendor_id": 5426
@@ -8843,7 +8843,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1566",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1566",
           "usb_identity": {
             "product_id": 175,
             "vendor_id": 5426
@@ -8897,7 +8897,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1595",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1595",
           "usb_identity": {
             "product_id": 176,
             "vendor_id": 5426
@@ -9799,7 +9799,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1422",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1422",
           "usb_identity": {
             "product_id": 658,
             "vendor_id": 5426
@@ -9857,7 +9857,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1444",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1444",
           "usb_identity": {
             "product_id": 656,
             "vendor_id": 5426
@@ -10782,7 +10782,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1451",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1451",
           "usb_identity": {
             "product_id": 664,
             "vendor_id": 5426
@@ -10840,7 +10840,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/keyboards.py#L1473",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1473",
           "usb_identity": {
             "product_id": 662,
             "vendor_id": 5426
@@ -11958,7 +11958,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1011",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1011",
           "usb_identity": {
             "product_id": 167,
             "vendor_id": 5426
@@ -12030,7 +12030,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/6820f9da169d354bc7e6e93a0aa8683a6bb75792/daemon/openrazer_daemon/hardware/mouse.py#L1038",
+          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1038",
           "usb_identity": {
             "product_id": 168,
             "vendor_id": 5426
@@ -12626,10 +12626,10 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "2f96676467fe0dc2bf7f6f93ca31c1e6e7c5efbbad005ad1a5932da321fb7e3d",
+  "source_sha256": "89d25e0d74052f49df34f125f96f02faf107985e727262f59f7314363ba8a212",
   "upstreams": [
     {
-      "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
       "extractor": "python-ast-v1",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "record_count": 232,
@@ -12645,7 +12645,7 @@
         }
       ],
       "upstream_id": "openrazer",
-      "version": "3.12.1-41-g6820f9d"
+      "version": "3.12.2"
     },
     {
       "commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index ea03069..b7208d0 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -783,8 +783,8 @@
       "timing_authorities": [
         {
           "kind": "pinned-upstream-contract",
-          "source_id": "openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339",
-          "source_sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829",
+          "source_id": "openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339",
+          "source_sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc",
           "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
         },
         {
@@ -1573,5 +1573,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
+  "source_sha256": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
 }
diff --git a/integrations/catalog.json b/integrations/catalog.json
index 620de82..7e8f1e1 100644
--- a/integrations/catalog.json
+++ b/integrations/catalog.json
@@ -6,8 +6,8 @@
       "id": "openrazer",
       "name": "OpenRazer",
       "repository": "https://github.com/openrazer/openrazer.git",
-      "version": "3.12.1-41-g6820f9d",
-      "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+      "version": "3.12.2",
+      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "api_contract": "org.razer 3.x metadata and D-Bus vocabulary",
       "uses": ["compatibility-contract", "metadata-import"],
diff --git a/integrations/openrazer/compatibility.json b/integrations/openrazer/compatibility.json
index 7c7cf0b..485543a 100644
--- a/integrations/openrazer/compatibility.json
+++ b/integrations/openrazer/compatibility.json
@@ -3,7 +3,7 @@
   "schema": "hyperflux-openrazer-compatibility-v1",
   "upstream": {
     "id": "openrazer",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
     "api_contract": "org.razer 3.x metadata and D-Bus vocabulary"
   },
   "service": {
diff --git a/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py b/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
index bbb9779..779b623 100644
--- a/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
+++ b/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
@@ -72,7 +72,7 @@
                                   'root_path': '/dev/hyperflux/OpenRazer1'},
              'reconcile_interval_ms': {'default': 5000, 'maximum': 300000, 'minimum': 250}},
  'upstream': {'api_contract': 'org.razer 3.x metadata and D-Bus vocabulary',
-              'commit': '6820f9da169d354bc7e6e93a0aa8683a6bb75792',
+              'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
               'id': 'openrazer'}}
 
 __all__ = ["OPENRAZER_COMPATIBILITY_CONTRACT"]
diff --git a/integrations/openrazer/import.json b/integrations/openrazer/import.json
index 2c3edb4..6a310e0 100644
--- a/integrations/openrazer/import.json
+++ b/integrations/openrazer/import.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/upstream-metadata-import.schema.json",
   "schema": "hyperflux-upstream-metadata-import-v1",
   "upstream_id": "openrazer",
-  "source_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
   "devices": [
     {
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
diff --git a/integrations/openrazer/metadata.json b/integrations/openrazer/metadata.json
index 0364516..9279d2a 100644
--- a/integrations/openrazer/metadata.json
+++ b/integrations/openrazer/metadata.json
@@ -4,11 +4,11 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.1-41-g6820f9d",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "version": "3.12.2",
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "selection_sha256": "0bd97b07f4c8f9d2c99ac3a3622477704661d5069bd984a0ef8d4a72bf32998f",
+  "selection_sha256": "a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9",
   "devices": [
     {
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
diff --git a/integrations/openrazer/native-control-policy.json b/integrations/openrazer/native-control-policy.json
index ff51926..cdba478 100644
--- a/integrations/openrazer/native-control-policy.json
+++ b/integrations/openrazer/native-control-policy.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/openrazer-native-control-policy.schema.json",
   "schema": "hyperflux-openrazer-native-control-policy-v1",
   "upstream_id": "openrazer",
-  "source_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
   "scope": "transport-facing-exact-wireless-classes",
   "report_size": 90,
   "common_methods": [
diff --git a/integrations/openrazer/native-method-inventory.json b/integrations/openrazer/native-method-inventory.json
index b152137..bdcb6a0 100644
--- a/integrations/openrazer/native-method-inventory.json
+++ b/integrations/openrazer/native-method-inventory.json
@@ -4,17 +4,17 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.1-41-g6820f9d",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "version": "3.12.2",
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "policy_sha256": "0d2b4e21cc66e8bb85519eeaf9e47ef42b1885cf0b9c4ea3145782080e376d14",
-  "metadata_selection_sha256": "0bd97b07f4c8f9d2c99ac3a3622477704661d5069bd984a0ef8d4a72bf32998f",
+  "policy_sha256": "b109fb8473a004f6b27e85c399486e2b2bd57d99589e5caa15c10d673dafcf7e",
+  "metadata_selection_sha256": "a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9",
   "report_size": 90,
   "source_files": [
     {
       "path": "daemon/openrazer_daemon/hardware/device_base.py",
-      "sha256": "7dcece1e1d9afb84d672f3995acd0cb5f24e8e908f212dba2601a50f4fab362d"
+      "sha256": "525da09ddbbabb2dbd97dbfcd41f000465b8d609285d3cddc2b1bacb691a49c2"
     },
     {
       "path": "daemon/openrazer_daemon/hardware/keyboards.py",
@@ -26,7 +26,7 @@
     },
     {
       "path": "driver/razerchromacommon.c",
-      "sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829"
+      "sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc"
     },
     {
       "path": "driver/razerchromacommon.h",
@@ -34,27 +34,27 @@
     },
     {
       "path": "driver/razercommon.c",
-      "sha256": "984c3f95cba20710e84f3eed8a26b1e2eddf0f8b6e5fe8bca51a32166744509e"
+      "sha256": "635f9403432150c055f446b38413218771476df7f70e74ae432bba43a089d14b"
     },
     {
       "path": "driver/razercommon.h",
-      "sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65"
+      "sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df"
+      "sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4"
     },
     {
       "path": "driver/razerkbd_driver.h",
-      "sha256": "068af601b5f1adc79eaebdcbcd728a5062cf258607229990e1ad9b999ebb1a80"
+      "sha256": "55192a7eca55a6eeedf7b692f61a41dd9c5636548d7b7b3975e743870fe79f9c"
     },
     {
       "path": "driver/razermouse_driver.c",
-      "sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff"
+      "sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1"
     },
     {
       "path": "driver/razermouse_driver.h",
-      "sha256": "7a34037673253eb5e75889333a3e63dd59924cc7a9b5c14b294a2ee40947b336"
+      "sha256": "fb58a57422672a085d77c57b11ca39b1b58d01d6474248c1317fd3d9de0b8ab4"
     }
   ],
   "devices": [
diff --git a/integrations/openrazer/native-probe-catalog.json b/integrations/openrazer/native-probe-catalog.json
index b07fa0b..f3547e4 100644
--- a/integrations/openrazer/native-probe-catalog.json
+++ b/integrations/openrazer/native-probe-catalog.json
@@ -4,12 +4,12 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.1-41-g6820f9d",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "version": "3.12.2",
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "policy_sha256": "802c5a515e01e1fc71f6b43243b0ec6dbb009f64a9c83f2049bba098e17de448",
-  "inventory_sha256": "bf02e41424652869aeefdab9d63288bc4dcf2d4ca56c0bf253988b1af04cb8bf",
+  "policy_sha256": "35f634e6a6ee688aed8887ddd4abca369822052414605a9e04dcf893c89dd073",
+  "inventory_sha256": "0d88389f31c899515e7995a441bbfa12e64aad230caf670060c5b0da12c3e385",
   "report_size": 90,
   "busy_retry": {
     "status": 1,
@@ -18,19 +18,19 @@
   "source_files": [
     {
       "path": "driver/razerchromacommon.c",
-      "sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829"
+      "sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc"
     },
     {
       "path": "driver/razercommon.h",
-      "sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65"
+      "sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df"
+      "sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4"
     },
     {
       "path": "driver/razermouse_driver.c",
-      "sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff"
+      "sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1"
     }
   ],
   "devices": [
@@ -59,8 +59,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_firmware_version",
             "request_owner": "razer_attr_read_firmware_version",
-            "source_line": 765,
-            "source_sha256": "80cb0bdcdd2a9d7c33b91322d2594c5e4c05723f01e29e64af033fc487d38662"
+            "source_line": 751,
+            "source_sha256": "9031ecacfbb04bbc58d034f4883cb8ee7dcdea3ff96cabfbe55697f06f7b0f9d"
           },
           "request": {
             "command_class": 0,
@@ -85,8 +85,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_device_serial",
             "request_owner": "razer_attr_read_device_serial",
-            "source_line": 1373,
-            "source_sha256": "47b6441ef48de520297d8743b555cc2873b4fb6f7223e0352ad0708cc539e113"
+            "source_line": 1320,
+            "source_sha256": "2944c301199de96b7daa010af48ccee4b106eda5ce5135bb394a5a207dc73290"
           },
           "request": {
             "command_class": 0,
@@ -131,8 +131,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_device_mode",
             "request_owner": "razer_attr_read_device_mode",
-            "source_line": 4007,
-            "source_sha256": "898fbf1a8338f6edf4c36f26d6d2e5eadcef52b57180686606ca39d4464253a7"
+            "source_line": 3850,
+            "source_sha256": "e8684b8ae9ce66776b46ea20755c3ba3e77fab21a762015526cb1254289e172b"
           },
           "request": {
             "command_class": 0,
@@ -157,8 +157,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_charge_level",
             "request_owner": "razer_attr_read_charge_level",
-            "source_line": 1532,
-            "source_sha256": "4ac4766ac285a9c670be2941a89804e00c482efc0b9903a41bfb06535b727ec3"
+            "source_line": 1475,
+            "source_sha256": "8d94f4d600d3dc5afb599057d6cbe16ddcea133b2fc82cf580b50859d3b3c4a8"
           },
           "request": {
             "command_class": 7,
@@ -183,8 +183,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_charge_status",
             "request_owner": "razer_attr_read_charge_status",
-            "source_line": 1633,
-            "source_sha256": "247ab66d8083c5484592890dd98fe4453679e0e9a2a9cca630420d875e8f346a"
+            "source_line": 1573,
+            "source_sha256": "c5a80b8e4bbad6a7b26c5e36826dea4574affe3d03b2373f58f09884369e71d2"
           },
           "request": {
             "command_class": 7,
@@ -209,8 +209,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_dpi",
             "request_owner": "razer_attr_read_dpi",
-            "source_line": 2620,
-            "source_sha256": "f2d5fece316d18b1c104c388945b6703a969cea65f0f3b92224c024525956d7f"
+            "source_line": 2516,
+            "source_sha256": "f28cba39646fcdc401fa8c8e2aa41144cee17ff421fce81d4f30a7d01f32aa3e"
           },
           "request": {
             "command_class": 4,
@@ -240,8 +240,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_dpi_stages",
             "request_owner": "razer_attr_read_dpi_stages",
-            "source_line": 3176,
-            "source_sha256": "9e027c4e30109c5d4503ec664cdaacf7b524772800aae2296d4a306a91e4c6db"
+            "source_line": 3048,
+            "source_sha256": "8273cc2cf2171434b84736bdd118b9b5e87af59aaa117fd0476abadf64ef5d28"
           },
           "request": {
             "command_class": 4,
@@ -302,8 +302,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_poll_rate",
             "request_owner": "razer_attr_read_poll_rate",
-            "source_line": 1838,
-            "source_sha256": "af007d5b3f2e2f7c7120754e39b2cef6ef11f2e8190705cb61c8484ba95429e4"
+            "source_line": 1767,
+            "source_sha256": "6d7756dc1beccbe14c3d19600cee44937c8c84f6e13d03358be2b8fc849df299"
           },
           "request": {
             "command_class": 0,
@@ -327,8 +327,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_device_idle_time",
             "request_owner": "razer_attr_read_device_idle_time",
-            "source_line": 3312,
-            "source_sha256": "68914aaaffdc83c6c0a67a2db5e1f2b332e36876e52d6f3cfb7fa4e8e524af99"
+            "source_line": 3181,
+            "source_sha256": "1eed392d43158d3316b8a4f4569945a03533a7fffbc7fb985c67a59c67d0afa7"
           },
           "request": {
             "command_class": 7,
@@ -353,8 +353,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_charge_low_threshold",
             "request_owner": "razer_attr_read_charge_low_threshold",
-            "source_line": 3513,
-            "source_sha256": "2f3dfbbd401de6bb010940f434697f07ec7033051e9027ca138725ce52b60b89"
+            "source_line": 3372,
+            "source_sha256": "ebea15e501a3cce3366149f01086b17d63e9956f8bef5e5b038db46b577667e2"
           },
           "request": {
             "command_class": 7,
@@ -378,8 +378,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_scroll_mode",
             "request_owner": "razer_attr_read_scroll_mode",
-            "source_line": 2842,
-            "source_sha256": "f596cabd69ba25e23fba94494e54632e2e9f4009901238b377028fec69cd015b"
+            "source_line": 2732,
+            "source_sha256": "5288da3a3191d5615971b4d071789bfae87d7649f5612d3e6431649160032e9c"
           },
           "request": {
             "command_class": 2,
@@ -404,8 +404,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_scroll_acceleration",
             "request_owner": "razer_attr_read_scroll_acceleration",
-            "source_line": 2890,
-            "source_sha256": "5bca30d5a567cd70c1abaaadd029db82ae0c231d49295c673edabee4e09399ff"
+            "source_line": 2774,
+            "source_sha256": "080e4231c2806216a14c845df0790f8056ce5ec477a4dd40b41c86031d5bdb2f"
           },
           "request": {
             "command_class": 2,
@@ -430,8 +430,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_scroll_smart_reel",
             "request_owner": "razer_attr_read_scroll_smart_reel",
-            "source_line": 2938,
-            "source_sha256": "33e327d93701aa382ad97207719e851b379dd4c0a6c6488dc48caef610be0639"
+            "source_line": 2816,
+            "source_sha256": "89095514daa62312e2fa5e8779f0ad0e5078a5a3b3e0b09095c398bdd8622aa0"
           },
           "request": {
             "command_class": 2,
@@ -456,8 +456,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_matrix_brightness",
             "request_owner": "razer_attr_read_matrix_brightness",
-            "source_line": 2309,
-            "source_sha256": "8936de697b1078c0d897f83f786ecd7526c80455305d5c2ffddd534c8e0248e8"
+            "source_line": 2215,
+            "source_sha256": "39e3ccfc00c53a6c97d7c31847a51daaeefd1132636a4933d776134e45154aae"
           },
           "request": {
             "command_class": 15,
@@ -483,8 +483,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_logo_led_brightness",
             "request_owner": "razer_attr_read_led_brightness",
-            "source_line": 4160,
-            "source_sha256": "a7afde4ad8e28df647866a7f7dec5e515381104edd10ffa9796df313187bcf86"
+            "source_line": 4000,
+            "source_sha256": "ec5e0dc21f57238a096883f546a641d389ef6c8b8182a02ecedb4a56a95e81ef"
           },
           "request": {
             "command_class": 15,
@@ -510,8 +510,8 @@
             "source_path": "driver/razermouse_driver.c",
             "reader": "razer_attr_read_scroll_led_brightness",
             "request_owner": "razer_attr_read_led_brightness",
-            "source_line": 4160,
-            "source_sha256": "a7afde4ad8e28df647866a7f7dec5e515381104edd10ffa9796df313187bcf86"
+            "source_line": 4000,
+            "source_sha256": "ec5e0dc21f57238a096883f546a641d389ef6c8b8182a02ecedb4a56a95e81ef"
           },
           "request": {
             "command_class": 15,
@@ -556,8 +556,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_firmware_version",
             "request_owner": "razer_attr_read_firmware_version",
-            "source_line": 2176,
-            "source_sha256": "6d7c1e47cc33578e73a6c4d871ce389283db1b5db97f0f1b75c5883418e211f9"
+            "source_line": 2044,
+            "source_sha256": "c4437ed6144a46d785ae773fe3c851432c80c63e2d740b6d01070f6d7f7ff21f"
           },
           "request": {
             "command_class": 0,
@@ -582,8 +582,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_device_serial",
             "request_owner": "razer_attr_read_device_serial",
-            "source_line": 2143,
-            "source_sha256": "619b348495fb5ac76d20c7fcdda3de4f6426f67a8bbcc79987eb46be81cc40fd"
+            "source_line": 2014,
+            "source_sha256": "eddbee64061c17aed62a4241b1e172a7abeab5961833170855441fdbe29f38ab"
           },
           "request": {
             "command_class": 0,
@@ -628,8 +628,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_device_mode",
             "request_owner": "razer_attr_read_device_mode",
-            "source_line": 4322,
-            "source_sha256": "1722c7ef941ca73e29afd916ba1812de88ee658608afa0e825a4ec847d59f290"
+            "source_line": 4039,
+            "source_sha256": "39236061ef91779c100d8eccd1606023e3b60e9b694af79d140a8dc4382b1ea3"
           },
           "request": {
             "command_class": 0,
@@ -654,8 +654,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_kbd_layout",
             "request_owner": "razer_attr_read_kbd_layout",
-            "source_line": 487,
-            "source_sha256": "ef8bd45645c5498c7d70591af816ba31f2ac1a7675893724dd377e9ad477906d"
+            "source_line": 470,
+            "source_sha256": "ddeb5301cf7a572e443da7893454cd38cae3ac049162d68e3f6402b5bc4b6006"
           },
           "request": {
             "command_class": 0,
@@ -680,8 +680,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_charge_level",
             "request_owner": "razer_attr_read_charge_level",
-            "source_line": 663,
-            "source_sha256": "d6faf79e5398bf13c7549b23002d7aef6657d7e1c60a69dc830e8494b925f392"
+            "source_line": 642,
+            "source_sha256": "7883389bbba439585de271db6bc5565ffa89d9829337f577b72e835a38b04133"
           },
           "request": {
             "command_class": 7,
@@ -706,8 +706,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_charge_status",
             "request_owner": "razer_attr_read_charge_status",
-            "source_line": 711,
-            "source_sha256": "d50dcc9e97058f280bd6548b709fc4d08eed6555cbb9019c6aa9db4a61e4eb33"
+            "source_line": 687,
+            "source_sha256": "fe90a99badadce54aafbfe60458ff63cd6d99d4d81a712b685878febd683ae66"
           },
           "request": {
             "command_class": 7,
@@ -732,8 +732,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_game_led_state",
             "request_owner": "razer_attr_read_game_led_state",
-            "source_line": 974,
-            "source_sha256": "42bcb7bc45638187f7891736c7eee0df61b8bb4254b6bd346386d1956535acd2"
+            "source_line": 922,
+            "source_sha256": "6c17d88e0814bf372c766b7de4cea7b368002f47c3acdcaca47f4dfc91406ce7"
           },
           "request": {
             "command_class": 3,
@@ -759,8 +759,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_macro_led_state",
             "request_owner": "razer_attr_read_macro_led_state",
-            "source_line": 1175,
-            "source_sha256": "8945f0a18041478e1983470b2af29a387028d24c368b0451c8da34b6df8a7222"
+            "source_line": 1101,
+            "source_sha256": "888e0973122d9ae89ec4d68a920e8981356ff8c58970f1e4c148da321bc1cd2d"
           },
           "request": {
             "command_class": 3,
@@ -786,8 +786,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_macro_led_effect",
             "request_owner": "razer_attr_read_macro_led_effect",
-            "source_line": 1812,
-            "source_sha256": "52c249a6453a4205fae261da1b1217a2ea8319cd1e6b707707c0e2efca48a24a"
+            "source_line": 1724,
+            "source_sha256": "2ff2b62f16d8ece600d215adb4a4088a4198307cc7c62132713f429c1b0b3b3c"
           },
           "request": {
             "command_class": 3,
diff --git a/integrations/openrazer/native-probe-policy.json b/integrations/openrazer/native-probe-policy.json
index 978f8a5..39d28a4 100644
--- a/integrations/openrazer/native-probe-policy.json
+++ b/integrations/openrazer/native-probe-policy.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/openrazer-native-probe-policy.schema.json",
   "schema": "hyperflux-openrazer-native-probe-policy-v1",
   "upstream_id": "openrazer",
-  "source_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
   "report_size": 90,
   "busy_retry": {
     "status": 1,
diff --git a/integrations/openrazer/native-route/catalog.json b/integrations/openrazer/native-route/catalog.json
index c2df18d..8c5a593 100644
--- a/integrations/openrazer/native-route/catalog.json
+++ b/integrations/openrazer/native-route/catalog.json
@@ -1,8 +1,8 @@
 {
   "$schema": "../../../schemas/openrazer-native-route-catalog.schema.json",
   "schema": "hyperflux-openrazer-native-route-catalog-v1",
-  "upstream_commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
-  "metadata_sha256": "36a26c62f1992a9f84f7925c9f9a4252e449f966efb61ab6511d08fb2569eee2",
+  "upstream_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+  "metadata_sha256": "529bf7d31c496a96ef5d0798fd08555f8c16c8c9a7e3670c42689a51e964589a",
   "transport": {
     "protocol_family": "razer-feature-report-v1",
     "report_bytes": 90,
@@ -23,7 +23,9 @@
         "class_name": "RazerBasiliskV3Pro35KWireless",
         "sha256": "c36180167f3f07f2299eb2653dd171ce6086a5cb0c30a898d9ee2be3dc3c4c03"
       },
-      "direct_data_product_ids": [204],
+      "direct_data_product_ids": [
+        204
+      ],
       "event_file_regex": ".*Razer_Basilisk_V3_Pro_35K_000000000000-if0(1|2)-event-kbd"
     },
     {
@@ -38,7 +40,9 @@
         "class_name": "RazerDeathStalkerV2ProTKLWireless",
         "sha256": "a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9"
       },
-      "direct_data_product_ids": [664],
+      "direct_data_product_ids": [
+        664
+      ],
       "event_file_regex": ".*DSV2Pro_TKL_000000000000-if01-event-mouse"
     }
   ]
diff --git a/integrations/openrazer/native-route/deployment.json b/integrations/openrazer/native-route/deployment.json
index 8097d09..5579b80 100644
--- a/integrations/openrazer/native-route/deployment.json
+++ b/integrations/openrazer/native-route/deployment.json
@@ -9,8 +9,16 @@
   },
   "driver": {
     "dkms_name": "openrazer-driver",
-    "dkms_version": "3.12.1",
-    "source_directory": "/usr/src/openrazer-driver-3.12.1",
+    "dkms_version": "3.12.2",
+    "source_directory": "/usr/src/openrazer-driver-3.12.2",
     "modules": ["razeraccessory", "razerkbd", "razerkraken", "razermouse"]
+  },
+  "access": {
+    "group": "openrazer",
+    "udev_rules_source": "install_files/udev/99-razer.rules",
+    "udev_rules_path": "/usr/lib/udev/rules.d/99-razer.rules",
+    "mount_helper_source": "install_files/udev/razer_mount",
+    "mount_helper_path": "/usr/lib/udev/razer_mount",
+    "sysusers_path": "/usr/lib/sysusers.d/openrazer.conf"
   }
 }
diff --git a/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
index 50fa072..e2ecd69 100644
--- a/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
+++ b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
@@ -1,20 +1,25 @@
-From 5849f6da4cebefa90275ad28ce783a48857e3c86 Mon Sep 17 00:00:00 2001
+From 3fb18470ece076b4165593b1828760a1ad166b58 Mon Sep 17 00:00:00 2001
 From: HyperFlux Next Source Transformer <noreply@hyperflux.dev>
-Date: Sat, 25 Jul 2026 12:15:23 +0400
+Date: Sun, 26 Jul 2026 21:29:19 +0400
 Subject: [PATCH] Add trusted HyperFlux native HID transport
 
+Carry the Arch Linux hid_report_raw_event compatibility condition for newer kernels and deploy udev access through the openrazer group.
 ---
- driver/razercommon.c       |  88 +++++++++++++++++++++++++++++++
- driver/razercommon.h       |   7 +++
- driver/razerkbd_driver.c   | 104 ++++++++++++++++++++++++++-----------
- driver/razermouse_driver.c |  58 +++++++++++++++++----
- 4 files changed, 215 insertions(+), 42 deletions(-)
+ driver/razercommon.c              |  89 +++++++++++++++++++++++
+ driver/razercommon.h              |   8 +++
+ driver/razerkbd_driver.c          | 112 +++++++++++++++++++++++-------
+ driver/razerkbd_driver.h          |   1 +
+ driver/razermouse_driver.c        |  81 +++++++++++++++------
+ driver/razermouse_driver.h        |   1 +
+ install_files/udev/99-razer.rules |   5 ++++-
+ install_files/udev/razer_mount    |   3 +-
+ 8 files changed, 249 insertions(+), 51 deletions(-)
 
 diff --git a/driver/razercommon.c b/driver/razercommon.c
-index fd6e828..5f21721 100644
+index 4e8548a..126f3a5 100644
 --- a/driver/razercommon.c
 +++ b/driver/razercommon.c
-@@ -12,6 +12,94 @@
+@@ -12,6 +12,95 @@
  
  #include "razercommon.h"
  
@@ -34,6 +39,7 @@ index fd6e828..5f21721 100644
 +    const char *instance;
 +
 +    if (hdev->bus != BUS_VIRTUAL ||
++        !hdev->phys[0] ||
 +        hdev->vendor != USB_VENDOR_ID_RAZER ||
 +        strncmp(hdev->phys, RAZER_HYPERFLUX_PHYS_PREFIX,
 +                sizeof(RAZER_HYPERFLUX_PHYS_PREFIX) - 1) != 0 ||
@@ -110,42 +116,51 @@ index fd6e828..5f21721 100644
   * Send USB control report to the keyboard
   * USUALLY index = 0x02
 diff --git a/driver/razercommon.h b/driver/razercommon.h
-index b469ba1..3275438 100644
+index aaad6d6..dcf2551 100644
 --- a/driver/razercommon.h
 +++ b/driver/razercommon.h
-@@ -8,6 +8,7 @@
+@@ -7,6 +7,8 @@
+ #ifndef DRIVER_RAZERCOMMON_H_
  #define DRIVER_RAZERCOMMON_H_
  
- #include <linux/hid.h>
 +#include <linux/errno.h>
++#include <linux/hid.h>
  #include <linux/usb/input.h>
- #include "compat.h"
  
-@@ -25,6 +26,9 @@ do { \
+ #define DRIVER_VERSION "3.12.2"
+@@ -33,6 +35,9 @@ do { \
  
  #define USB_VENDOR_ID_RAZER 0x1532
  
-+#define RAZER_HYPERFLUX_TRANSPORT_NOT_SENT          (-EAGAIN)
++#define RAZER_HYPERFLUX_TRANSPORT_NOT_SENT           (-EAGAIN)
 +#define RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT (-ENOTRECOVERABLE)
 +
- // LED STATE
- #define OFF 0x00
- #define ON  0x01
-@@ -152,6 +156,9 @@ int razer_send_argb_msg(struct hid_device *hdev, unsigned char channel, size_t s
- unsigned char razer_calculate_crc(struct razer_report *report);
+ /* Each USB report has 90 bytes*/
+ #define RAZER_USB_REPORT_LEN 0x5A
+ 
+@@ -167,6 +172,9 @@ unsigned char razer_calculate_crc(struct razer_report *report);
  struct razer_report get_razer_report(unsigned char command_class, unsigned char command_id, unsigned char data_size);
- void print_erroneous_report(struct hid_device *hdev, struct razer_report* report, const char *message);
+ struct razer_report get_empty_razer_report(void);
+ void print_erroneous_report(struct razer_report* report, char* driver_name, char* message);
 +bool razer_is_hyperflux_native(struct hid_device *hdev);
 +int razer_get_hyperflux_response(struct hid_device *hdev, struct razer_report *request_report, struct razer_report *response_report);
 +bool razer_hyperflux_error_is_uncertain(int error);
  
- /* Borrowed from drivers/hid/usbhid/usbhid.h */
- #define	hid_to_usb_dev(hid_dev) \
+ // Convenience functions
+ unsigned char clamp_u8(unsigned char value, unsigned char min, unsigned char max);
 diff --git a/driver/razerkbd_driver.c b/driver/razerkbd_driver.c
-index f06d5de..b1690d2 100644
+index 20345ff..c542631 100644
 --- a/driver/razerkbd_driver.c
 +++ b/driver/razerkbd_driver.c
-@@ -24,6 +24,8 @@
+@@ -11,6 +11,7 @@
+ #include <linux/hid.h>
+ #include <linux/dmi.h>
+ #include <linux/input-event-codes.h>
++#include <linux/version.h>
+ 
+ #include "usb_hid_keys.h"
+ 
+@@ -23,6 +24,8 @@
   */
  #define DRIVER_DESC "Razer Keyboard Device Driver"
  
@@ -154,97 +169,118 @@ index f06d5de..b1690d2 100644
  MODULE_AUTHOR(DRIVER_AUTHOR);
  MODULE_DESCRIPTION(DRIVER_DESC);
  MODULE_VERSION(DRIVER_VERSION);
-@@ -318,9 +320,9 @@ static bool is_blade_laptop(struct razer_kbd_device *device)
+@@ -319,9 +322,9 @@ static bool is_blade_laptop(struct razer_kbd_device *device)
  /**
   * Get request/response indices and timing parameters for the device
   */
--static void razer_get_report_params(struct usb_device *usb_dev, uint *report_index, uint *response_index, ulong *wait)
-+static void razer_get_report_params(u16 product, uint *report_index, uint *response_index, ulong *wait)
+-static void razer_get_report_params(struct usb_device *usb_dev, uint *report_index, uint *response_index, ulong *wait_min, ulong *wait_max)
++static void razer_get_report_params(u16 product, uint *report_index, uint *response_index, ulong *wait_min, ulong *wait_max)
  {
 -    switch (usb_dev->descriptor.idProduct) {
 +    switch (product) {
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_TENKEYLESS:
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2:
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_ANALOG:
-@@ -390,11 +392,13 @@ static void razer_get_report_params(struct usb_device *usb_dev, uint *report_ind
+@@ -395,12 +398,16 @@ static void razer_get_report_params(struct usb_device *usb_dev, uint *report_ind
+ /**
+  * Send report to the keyboard
   */
- static int razer_get_report(struct hid_device *hdev, struct razer_report *request, struct razer_report *response)
+-static int razer_get_report(struct usb_device *usb_dev, struct razer_report *request, struct razer_report *response)
++static int razer_get_report(struct razer_kbd_device *device, struct razer_report *request, struct razer_report *response)
  {
--    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
      uint report_index, response_index;
-     ulong wait;
- 
--    razer_get_report_params(usb_dev, &report_index, &response_index, &wait);
-+    if (razer_is_hyperflux_native(hdev))
-+        return razer_get_hyperflux_response(hdev, request, response);
+     ulong wait_min, wait_max;
+-    razer_get_report_params(usb_dev, &report_index, &response_index, &wait_min, &wait_max);
+-    return razer_get_usb_response(usb_dev, report_index, request, response_index, response, wait_min, wait_max);
 +
-+    razer_get_report_params(hdev->product, &report_index, &response_index, &wait);
- 
-     return razer_get_usb_response(hdev, report_index, request, response_index, response, wait);
++    if (razer_is_hyperflux_native(device->hdev))
++        return razer_get_hyperflux_response(device->hdev, request, response);
++
++    razer_get_report_params(device->usb_pid, &report_index, &response_index, &wait_min, &wait_max);
++    return razer_get_usb_response(device->usb_dev, report_index, request, response_index, response, wait_min, wait_max);
  }
-@@ -404,14 +408,19 @@ static int razer_get_report(struct hid_device *hdev, struct razer_report *reques
-  */
- static int __must_check razer_send_payload_no_response(struct razer_kbd_device *device, struct razer_report *request)
- {
--    struct usb_device *usb_dev = hid_to_usb_dev(device->hdev);
-     uint report_index, response_index;
-     ulong wait;
  
+ /**
+@@ -414,7 +421,13 @@ static int razer_send_payload_no_response(struct razer_kbd_device *device, struc
      /* Except the caller to have set the transaction_id */
      WARN_ON(request->transaction_id.id == 0x00);
  
--    razer_get_report_params(usb_dev, &report_index, &response_index, &wait);
+-    razer_get_report_params(device->usb_dev, &report_index, &response_index, &wait_min, &wait_max);
 +    if (razer_is_hyperflux_native(device->hdev)) {
 +        struct razer_report response = {0};
 +
 +        return razer_get_hyperflux_response(device->hdev, request, &response);
 +    }
 +
-+    razer_get_report_params(device->hdev->product, &report_index, &response_index, &wait);
- 
-     return razer_send_control_msg(device->hdev, request, sizeof(*request), report_index, wait);
++    razer_get_report_params(device->usb_pid, &report_index, &response_index, &wait_min, &wait_max);
+     return razer_send_control_msg(device->usb_dev, request, report_index, wait_min, wait_max);
  }
-@@ -430,6 +439,9 @@ static int __must_check razer_send_payload(struct razer_kbd_device *device, stru
-         mutex_lock(&device->lock);
-         err = razer_get_report(device->hdev, request, response);
-         mutex_unlock(&device->lock);
-+        if (razer_is_hyperflux_native(device->hdev) &&
-+            razer_hyperflux_error_is_uncertain(err))
-+            return err;
-         if (err) {
-             print_erroneous_report(device->hdev, response, "Invalid Report Length");
-             goto retry;
-@@ -440,6 +452,8 @@ static int __must_check razer_send_payload(struct razer_kbd_device *device, stru
-             response->command_class != request->command_class ||
-             response->command_id.id != request->command_id.id) {
-             print_erroneous_report(device->hdev, response, "Response doesn't match request");
-+            if (razer_is_hyperflux_native(device->hdev))
-+                return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
-             err = -EINVAL;
-             goto retry;
-         }
-@@ -5257,16 +5271,22 @@ static int razer_kbd_input_mapping(struct hid_device *hdev, struct hid_input *hi
  
- static void razer_kbd_init(struct razer_kbd_device *dev, struct hid_device *hdev)
+@@ -428,7 +441,7 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
+     request->crc = razer_calculate_crc(request);
+ 
+     mutex_lock(&device->lock);
+-    err = razer_get_report(device->usb_dev, request, response);
++    err = razer_get_report(device, request, response);
+     mutex_unlock(&device->lock);
+     if (err) {
+         print_erroneous_report(response, "razerkbd", "Invalid Report Length");
+@@ -440,6 +453,8 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
+         response->command_class != request->command_class ||
+         response->command_id.id != request->command_id.id) {
+         print_erroneous_report(response, "razerkbd", "Response doesn't match request");
++        if (razer_is_hyperflux_native(device->hdev))
++            return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
+         return -EIO;
+     }
+ 
+@@ -4834,11 +4849,23 @@ static int razer_raw_event_bitfield(struct hid_device *hdev, struct razer_kbd_de
+ 
+                             // report key down
+                             xdata[1] = cur_value;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0) || \
++        (LINUX_VERSION_CODE >= KERNEL_VERSION(7, 0, 10) && LINUX_VERSION_CODE < KERNEL_VERSION(7, 1, 0)) || \
++        (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 33) && LINUX_VERSION_CODE < KERNEL_VERSION(6, 19, 0))
++                            hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), sizeof(xdata), 0);
++#else
+                             hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), 0);
++#endif
+ 
+                             // report key up
+                             xdata[1] = 0x00;
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0) || \
++        (LINUX_VERSION_CODE >= KERNEL_VERSION(7, 0, 10) && LINUX_VERSION_CODE < KERNEL_VERSION(7, 1, 0)) || \
++        (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 33) && LINUX_VERSION_CODE < KERNEL_VERSION(6, 19, 0))
++                            hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), sizeof(xdata), 0);
++#else
+                             hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), 0);
++#endif
+                         }
+                     }
+                 }
+@@ -4946,15 +4973,23 @@ static int razer_kbd_input_mapping(struct hid_device *hdev, struct hid_input *hi
+ 
+ static void razer_kbd_init(struct razer_kbd_device *dev, struct usb_interface *intf, struct hid_device *hdev)
  {
--    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
--    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+-    struct usb_device *usb_dev = interface_to_usbdev(intf);
 -
      // Initialise mutex
      mutex_init(&dev->lock);
      // Setup values
-     dev->hdev = hdev;
+-    dev->usb_dev = usb_dev;
 -    dev->usb_vid = usb_dev->descriptor.idVendor;
 -    dev->usb_pid = usb_dev->descriptor.idProduct;
 -    dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
++    dev->hdev = hdev;
 +    if (razer_is_hyperflux_native(hdev)) {
++        dev->usb_dev = NULL;
 +        dev->usb_vid = hdev->vendor;
 +        dev->usb_pid = hdev->product;
 +        dev->usb_interface_protocol = USB_INTERFACE_PROTOCOL_MOUSE;
 +    } else {
-+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
-+        struct usb_device *usb_dev = hid_to_usb_dev(hdev);
++        struct usb_device *usb_dev = interface_to_usbdev(intf);
 +
++        dev->usb_dev = usb_dev;
 +        dev->usb_vid = usb_dev->descriptor.idVendor;
 +        dev->usb_pid = usb_dev->descriptor.idProduct;
 +        dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
@@ -252,49 +288,32 @@ index f06d5de..b1690d2 100644
  }
  
  /**
-@@ -5275,33 +5295,39 @@ static void razer_kbd_init(struct razer_kbd_device *dev, struct hid_device *hdev
+@@ -4963,13 +4998,20 @@ static void razer_kbd_init(struct razer_kbd_device *dev, struct usb_interface *i
  static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *id)
  {
      int retval = 0;
 -    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
--    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+-    struct usb_device *usb_dev = interface_to_usbdev(intf);
++    struct usb_interface *intf = NULL;
 +    struct usb_device *usb_dev = NULL;
      struct razer_kbd_device *dev = NULL;
-     struct razer_kbd_usb_device_data *usb_dev_data = NULL;
-     int err;
  
 +    if (!razer_kbd_transport_supported(hdev))
 +        return -ENODEV;
-+    if (hdev->bus == BUS_USB)
-+        usb_dev = hid_to_usb_dev(hdev);
++    if (hdev->bus == BUS_USB) {
++        intf = to_usb_interface(hdev->dev.parent);
++        usb_dev = interface_to_usbdev(intf);
++    }
 +
-     dev = kzalloc_obj(*dev);
+     dev = kzalloc(sizeof(struct razer_kbd_device), GFP_KERNEL);
      if(dev == NULL) {
-         hid_err(hdev, "out of memory\n");
+-        dev_err(&intf->dev, "out of memory\n");
++        hid_err(hdev, "out of memory\n");
          return -ENOMEM;
      }
  
--    // Allocate data in context to the usb device if not already done.
--    usb_dev_data = dev_get_drvdata(&usb_dev->dev);
--    if (!usb_dev_data) {
--        usb_dev_data = devm_kzalloc(&usb_dev->dev, sizeof(struct razer_kbd_usb_device_data), GFP_KERNEL);
--        if (!usb_dev_data)
--            return -ENOMEM;
-+    // Allocate shared input state only for a physical multi-interface USB device.
-+    if (usb_dev) {
-+        usb_dev_data = dev_get_drvdata(&usb_dev->dev);
-+        if (!usb_dev_data) {
-+            usb_dev_data = devm_kzalloc(&usb_dev->dev, sizeof(struct razer_kbd_usb_device_data), GFP_KERNEL);
-+            if (!usb_dev_data)
-+                return -ENOMEM;
- 
--        dev_set_drvdata(&usb_dev->dev, usb_dev_data);
-+            dev_set_drvdata(&usb_dev->dev, usb_dev_data);
-+        }
-     }
- 
-     // Init data
-     razer_kbd_init(dev, hdev);
+@@ -4977,7 +5019,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+     razer_kbd_init(dev, intf, hdev);
  
      // Other interfaces are actual key-emitting devices
 -    if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_MOUSE) {
@@ -302,7 +321,7 @@ index f06d5de..b1690d2 100644
          // If the currently bound device is the control (mouse) interface
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_version);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
-@@ -5312,7 +5338,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -4988,7 +5030,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
  
@@ -311,22 +330,20 @@ index f06d5de..b1690d2 100644
  
          case USB_DEVICE_ID_RAZER_NOSTROMO:
              CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
-@@ -5798,12 +5824,12 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5474,10 +5516,10 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
          // Set device to regular mode, not driver mode
          // When the daemon discovers the device it will instruct it to enter driver mode
          // Tartarus Pro resets when it receives this command
 -        if (usb_dev->descriptor.idProduct != USB_DEVICE_ID_RAZER_TARTARUS_PRO) {
 +        if (usb_dev && dev->usb_pid != USB_DEVICE_ID_RAZER_TARTARUS_PRO) {
-             err = razer_set_device_mode(dev, 0x00, 0x00);
-             if (err)
-                 return err;
+             razer_set_device_mode(dev, 0x00, 0x00);
          }
 -    } else if(intf->cur_altsetting->desc.bInterfaceProtocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
 +    } else if(dev->usb_interface_protocol == USB_INTERFACE_PROTOCOL_KEYBOARD) {
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_super);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_tab);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_f4);
-@@ -5823,7 +5849,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5497,7 +5539,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
      }
  
      // Leave autosuspend on for laptops
@@ -335,7 +352,7 @@ index f06d5de..b1690d2 100644
          usb_disable_autosuspend(usb_dev);
      }
  
-@@ -5842,13 +5868,11 @@ exit_free:
+@@ -5516,13 +5558,11 @@ exit_free:
  static void razer_kbd_disconnect(struct hid_device *hdev)
  {
      struct razer_kbd_device *dev;
@@ -350,7 +367,7 @@ index f06d5de..b1690d2 100644
          // If the currently bound device is the control (mouse) interface
          device_remove_file(&hdev->dev, &dev_attr_version);
          device_remove_file(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
-@@ -5859,7 +5883,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+@@ -5533,7 +5573,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
          device_remove_file(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
          device_remove_file(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
  
@@ -359,7 +376,7 @@ index f06d5de..b1690d2 100644
  
          case USB_DEVICE_ID_RAZER_NOSTROMO:
              device_remove_file(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
-@@ -6341,7 +6365,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+@@ -6015,7 +6055,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
              device_remove_file(&hdev->dev, &dev_attr_macro_led_effect);              // Change macro LED effect (static, flashing)
              break;
          }
@@ -368,7 +385,16 @@ index f06d5de..b1690d2 100644
          device_remove_file(&hdev->dev, &dev_attr_key_super);
          device_remove_file(&hdev->dev, &dev_attr_key_alt_tab);
          device_remove_file(&hdev->dev, &dev_attr_key_alt_f4);
-@@ -6498,9 +6522,27 @@ static const struct hid_device_id razer_devices[] = {
+@@ -6023,7 +6063,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+ 
+     hid_hw_stop(hdev);
+     kfree(dev);
+-    dev_info(&intf->dev, "Razer Device disconnected\n");
++    dev_info(&hdev->dev, "Razer Device disconnected\n");
+ }
+ 
+ /**
+@@ -6172,9 +6212,27 @@ static const struct hid_device_id razer_devices[] = {
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_HUNTSMAN_V3_PRO_8KHZ) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2024) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2025) },
@@ -396,8 +422,20 @@ index f06d5de..b1690d2 100644
  MODULE_DEVICE_TABLE(hid, razer_devices);
  
  /**
+diff --git a/driver/razerkbd_driver.h b/driver/razerkbd_driver.h
+index 36a66ab..62d4fb0 100644
+--- a/driver/razerkbd_driver.h
++++ b/driver/razerkbd_driver.h
+@@ -174,6 +174,7 @@
+ #define RAZER_FIREFLY_WAIT_MAX_US 1000
+ 
+ struct razer_kbd_device {
++    struct hid_device *hdev;
+     struct usb_device *usb_dev;
+     struct mutex lock;
+     unsigned char usb_interface_protocol;
 diff --git a/driver/razermouse_driver.c b/driver/razermouse_driver.c
-index 8aada2f..637072e 100644
+index aa6aef3..2d36210 100644
 --- a/driver/razermouse_driver.c
 +++ b/driver/razermouse_driver.c
 @@ -22,6 +22,8 @@
@@ -406,64 +444,108 @@ index 8aada2f..637072e 100644
  
 +static bool razer_mouse_transport_supported(struct hid_device *hdev);
 +
- MODULE_AUTHOR(DRIVER_AUTHOR);
- MODULE_DESCRIPTION(DRIVER_DESC);
- MODULE_VERSION(DRIVER_VERSION);
-@@ -32,6 +34,9 @@ MODULE_LICENSE(DRIVER_LICENSE);
+ /* REL_HWHEEL_HI_RES was added in Linux 5.0, so define ourselves for older kernels
+  * See also https://git.kernel.org/torvalds/c/52ea899 */
+ #ifndef REL_HWHEEL_HI_RES
+@@ -36,10 +38,14 @@ MODULE_LICENSE(DRIVER_LICENSE);
+ /**
+  * Send report to the mouse
   */
- static int razer_get_report(struct hid_device *hdev, struct razer_report *request, struct razer_report *response)
+-static int razer_get_report(struct usb_device *usb_dev, struct razer_report *request, struct razer_report *response)
++static int razer_get_report(struct razer_mouse_device *device, struct razer_report *request, struct razer_report *response)
  {
-+    if (razer_is_hyperflux_native(hdev))
-+        return razer_get_hyperflux_response(hdev, request, response);
-+
-     struct usb_device *usb_dev = hid_to_usb_dev(hdev);
      unsigned int index = 0;
-     switch (usb_dev->descriptor.idProduct) {
-@@ -124,6 +129,9 @@ static int __must_check razer_send_payload(struct razer_mouse_device *device, st
-         mutex_lock(&device->lock);
-         err = razer_get_report(device->hdev, request, response);
-         mutex_unlock(&device->lock);
-+        if (razer_is_hyperflux_native(device->hdev) &&
-+            razer_hyperflux_error_is_uncertain(err))
-+            return err;
-         if (err) {
-             print_erroneous_report(device->hdev, response, "Invalid Report Length");
-             goto retry;
-@@ -134,6 +142,8 @@ static int __must_check razer_send_payload(struct razer_mouse_device *device, st
-             response->command_class != request->command_class ||
-             response->command_id.id != request->command_id.id) {
-             print_erroneous_report(device->hdev, response, "Response doesn't match request");
-+            if (razer_is_hyperflux_native(device->hdev))
-+                return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
-             err = -EINVAL;
-             goto retry;
-         }
-@@ -6249,19 +6259,26 @@ static int razer_input_configured(struct hid_device *hdev,
+-    switch (usb_dev->descriptor.idProduct) {
++
++    if (razer_is_hyperflux_native(device->hdev))
++        return razer_get_hyperflux_response(device->hdev, request, response);
++
++    switch (device->usb_pid) {
+     // These devices require longer waits to read their firmware, serial, and other setting values
+     case USB_DEVICE_ID_RAZER_LANCEHEAD_WIRELESS_RECEIVER:
+     case USB_DEVICE_ID_RAZER_LANCEHEAD_WIRELESS_WIRED:
+@@ -82,13 +88,13 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
+     case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_VERTICAL_EDITION_WIRED:
+     case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRED:
+     case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRELESS:
+-        return razer_get_usb_response(usb_dev, index, request, index, response, RAZER_NEW_MOUSE_RECEIVER_WAIT_MIN_US, RAZER_NEW_MOUSE_RECEIVER_WAIT_MAX_US);
++        return razer_get_usb_response(device->usb_dev, index, request, index, response, RAZER_NEW_MOUSE_RECEIVER_WAIT_MIN_US, RAZER_NEW_MOUSE_RECEIVER_WAIT_MAX_US);
+         break;
+ 
+     case USB_DEVICE_ID_RAZER_ATHERIS_RECEIVER:
+     case USB_DEVICE_ID_RAZER_OROCHI_V2_RECEIVER:
+     case USB_DEVICE_ID_RAZER_OROCHI_V2_BLUETOOTH:
+-        return razer_get_usb_response(usb_dev, index, request, index, response, RAZER_ATHERIS_RECEIVER_WAIT_MIN_US, RAZER_ATHERIS_RECEIVER_WAIT_MAX_US);
++        return razer_get_usb_response(device->usb_dev, index, request, index, response, RAZER_ATHERIS_RECEIVER_WAIT_MIN_US, RAZER_ATHERIS_RECEIVER_WAIT_MAX_US);
+         break;
+ 
+     case USB_DEVICE_ID_RAZER_VIPER_ULTIMATE_WIRELESS:
+@@ -100,18 +106,18 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
+     case USB_DEVICE_ID_RAZER_HYPERPOLLING_WIRELESS_DONGLE:
+     case USB_DEVICE_ID_RAZER_VIPER_V3_HYPERSPEED:
+     case USB_DEVICE_ID_RAZER_VIPER_V3_PRO_WIRELESS:
+-        return razer_get_usb_response(usb_dev, index, request, index, response, RAZER_VIPER_MOUSE_RECEIVER_WAIT_MIN_US, RAZER_VIPER_MOUSE_RECEIVER_WAIT_MAX_US);
++        return razer_get_usb_response(device->usb_dev, index, request, index, response, RAZER_VIPER_MOUSE_RECEIVER_WAIT_MIN_US, RAZER_VIPER_MOUSE_RECEIVER_WAIT_MAX_US);
+         break;
+ 
+     case USB_DEVICE_ID_RAZER_NAGA_X:
+     case USB_DEVICE_ID_RAZER_BASILISK_V3:
+     case USB_DEVICE_ID_RAZER_BASILISK_V3_35K:
+         index = 0x03;
+-        return razer_get_usb_response(usb_dev, index, request, index, response, RAZER_MOUSE_WAIT_MIN_US, RAZER_MOUSE_WAIT_MAX_US);
++        return razer_get_usb_response(device->usb_dev, index, request, index, response, RAZER_MOUSE_WAIT_MIN_US, RAZER_MOUSE_WAIT_MAX_US);
+         break;
+ 
+     default:
+-        return razer_get_usb_response(usb_dev, index, request, index, response, RAZER_MOUSE_WAIT_MIN_US, RAZER_MOUSE_WAIT_MAX_US);
++        return razer_get_usb_response(device->usb_dev, index, request, index, response, RAZER_MOUSE_WAIT_MIN_US, RAZER_MOUSE_WAIT_MAX_US);
+     }
+ }
+ 
+@@ -125,7 +131,7 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
+     request->crc = razer_calculate_crc(request);
+ 
+     mutex_lock(&device->lock);
+-    err = razer_get_report(device->usb_dev, request, response);
++    err = razer_get_report(device, request, response);
+     mutex_unlock(&device->lock);
+     if (err) {
+         print_erroneous_report(response, "razermouse", "Invalid Report Length");
+@@ -137,6 +143,8 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
+         response->command_class != request->command_class ||
+         response->command_id.id != request->command_id.id) {
+         print_erroneous_report(response, "razermouse", "Response doesn't match request");
++        if (razer_is_hyperflux_native(device->hdev))
++            return RAZER_HYPERFLUX_TRANSPORT_MAY_HAVE_BEEN_SENT;
+         return -EIO;
+     }
+ 
+@@ -6010,17 +6018,27 @@ static int razer_input_configured(struct hid_device *hdev,
   */
- static void razer_mouse_init(struct razer_mouse_device *dev, struct hid_device *hdev)
+ static void razer_mouse_init(struct razer_mouse_device *dev, struct usb_interface *intf, struct hid_device *hdev)
  {
--    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
--    struct usb_device *usb_dev = hid_to_usb_dev(hdev);
--
+-    struct usb_device *usb_dev = interface_to_usbdev(intf);
      unsigned int rand_serial = 0;
  
      // Initialise mutex
      mutex_init(&dev->lock);
      // Setup values
-     dev->hdev = hdev;
+-    dev->usb_dev = usb_dev;
 -    dev->usb_vid = usb_dev->descriptor.idVendor;
 -    dev->usb_pid = usb_dev->descriptor.idProduct;
 -    dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
 -    dev->usb_interface_subclass = intf->cur_altsetting->desc.bInterfaceSubClass;
++    dev->hdev = hdev;
 +    if (razer_is_hyperflux_native(hdev)) {
++        dev->usb_dev = NULL;
 +        dev->usb_vid = hdev->vendor;
 +        dev->usb_pid = hdev->product;
 +        dev->usb_interface_protocol = USB_INTERFACE_PROTOCOL_MOUSE;
 +        dev->usb_interface_subclass = 0;
 +    } else {
-+        struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
-+        struct usb_device *usb_dev = hid_to_usb_dev(hdev);
++        struct usb_device *usb_dev = interface_to_usbdev(intf);
 +
++        dev->usb_dev = usb_dev;
 +        dev->usb_vid = usb_dev->descriptor.idVendor;
 +        dev->usb_pid = usb_dev->descriptor.idProduct;
 +        dev->usb_interface_protocol = intf->cur_altsetting->desc.bInterfaceProtocol;
@@ -472,17 +554,29 @@ index 8aada2f..637072e 100644
  
      // Get a "random" integer
      get_random_bytes(&rand_serial, sizeof(unsigned int));
-@@ -6298,6 +6315,9 @@ static int razer_mouse_probe(struct hid_device *hdev, const struct hid_device_id
+@@ -6054,14 +6072,19 @@ static void razer_mouse_init(struct razer_mouse_device *dev, struct usb_interfac
+ static int razer_mouse_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ {
+     int retval = 0;
+-    struct usb_interface *intf = to_usb_interface(hdev->dev.parent);
++    struct usb_interface *intf = NULL;
      struct razer_mouse_device *dev = NULL;
      unsigned char expected_subclass = 0xFF;
  
 +    if (!razer_mouse_transport_supported(hdev))
 +        return -ENODEV;
++    if (hdev->bus == BUS_USB)
++        intf = to_usb_interface(hdev->dev.parent);
 +
-     dev = kzalloc_obj(*dev);
+     dev = kzalloc(sizeof(struct razer_mouse_device), GFP_KERNEL);
  
      if(dev == NULL) {
-@@ -7425,12 +7445,10 @@ exit_free:
+-        dev_err(&intf->dev, "out of memory\n");
++        hid_err(hdev, "out of memory\n");
+         return -ENOMEM;
+     }
+ 
+@@ -7185,12 +7208,10 @@ exit_free:
  static void razer_mouse_disconnect(struct hid_device *hdev)
  {
      struct razer_mouse_device *dev;
@@ -496,7 +590,7 @@ index 8aada2f..637072e 100644
          device_remove_file(&hdev->dev, &dev_attr_version);
          device_remove_file(&hdev->dev, &dev_attr_test);
          device_remove_file(&hdev->dev, &dev_attr_firmware_version);
-@@ -7438,7 +7456,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
+@@ -7198,7 +7219,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
          device_remove_file(&hdev->dev, &dev_attr_device_serial);
          device_remove_file(&hdev->dev, &dev_attr_device_mode);
  
@@ -505,7 +599,16 @@ index 8aada2f..637072e 100644
          case USB_DEVICE_ID_RAZER_ABYSSUS_ELITE_DVA_EDITION:
          case USB_DEVICE_ID_RAZER_ABYSSUS_ESSENTIAL:
              device_remove_file(&hdev->dev, &dev_attr_poll_rate);
-@@ -8630,9 +8648,27 @@ static const struct hid_device_id razer_devices[] = {
+@@ -8270,7 +8291,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
+     hrtimer_cancel(&dev->repeat_timer);
+ 
+     kfree(dev);
+-    dev_info(&intf->dev, "Razer Device disconnected\n");
++    dev_info(&hdev->dev, "Razer Device disconnected\n");
+ }
+ 
+ /**
+@@ -8390,9 +8411,27 @@ static const struct hid_device_id razer_devices[] = {
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_VERTICAL_EDITION_WIRED) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRED) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRELESS) },
@@ -533,6 +636,48 @@ index 8aada2f..637072e 100644
  MODULE_DEVICE_TABLE(hid, razer_devices);
  
  /**
--- 
-2.55.0
-
+diff --git a/driver/razermouse_driver.h b/driver/razermouse_driver.h
+index 66612ff..22ad571 100644
+--- a/driver/razermouse_driver.h
++++ b/driver/razermouse_driver.h
+@@ -142,6 +142,7 @@
+ #define RAZER_MOUSE_MAX_DPI_STAGES 5
+ 
+ struct razer_mouse_device {
++    struct hid_device *hdev;
+     struct usb_device *usb_dev;
+     struct mutex lock;
+ 
+diff --git a/install_files/udev/99-razer.rules b/install_files/udev/99-razer.rules
+index ca66a20..207c404 100644
+--- a/install_files/udev/99-razer.rules
++++ b/install_files/udev/99-razer.rules
+@@ -1,3 +1,6 @@
++# HyperFlux UHID children have no USB parent, so run the normal helper after the trusted driver binds.
++ACTION=="bind", SUBSYSTEM=="hid", KERNEL=="0006:1532:*", ENV{HID_PHYS}=="hyperflux-next/native/v1/*", DRIVER=="razerkbd", RUN+="razer_mount razerkbd $kernel"
++ACTION=="bind", SUBSYSTEM=="hid", KERNEL=="0006:1532:*", ENV{HID_PHYS}=="hyperflux-next/native/v1/*", DRIVER=="razermouse", RUN+="razer_mount razermouse $kernel"
+ ACTION!="add", GOTO="razer_end"
+ SUBSYSTEMS=="usb|input|hid", ATTRS{idVendor}=="1532", GOTO="razer_vendor"
+ GOTO="razer_end"
+@@ -28,7 +28,7 @@ ATTRS{idProduct}=="0068|007e|00a4|0215|0517|0518|0c00|0c01|0c02|0c04|0c05|0c06|0
+ ENV{ID_RAZER_CHROMA}!="1", GOTO="razer_end"
+ 
+ # Set permissions if this is an input node
+-SUBSYSTEM=="usb|input|hid", GROUP:="plugdev"
++SUBSYSTEM=="usb|input|hid", GROUP:="openrazer"
+ 
+ # We're done unless it's the hid node
+ SUBSYSTEM!="hid|usb", GOTO="razer_end"
+diff --git a/install_files/udev/razer_mount b/install_files/udev/razer_mount
+index 3fc0fef..3fa03b7 100755
+--- a/install_files/udev/razer_mount
++++ b/install_files/udev/razer_mount
+@@ -56,7 +56,6 @@ done
+ 
+ if [ -d /sys/bus/hid/drivers/"$DRIVER"/"$DEVICE_ID" ] ; then
+ 	mesg "Changing group /sys/bus/hid/drivers/$DRIVER/$DEVICE_ID/"
+-	chgrp -R plugdev /sys/bus/hid/drivers/"$DRIVER"/"$DEVICE_ID"/
++	chgrp -R openrazer /sys/bus/hid/drivers/"$DRIVER"/"$DEVICE_ID"/
+ 	mesg "Changed group /sys/bus/hid/drivers/$DRIVER/$DEVICE_ID/"
+ fi
+-
diff --git a/integrations/openrazer/native-route/transform.json b/integrations/openrazer/native-route/transform.json
index 5e79a2c..12ebf28 100644
--- a/integrations/openrazer/native-route/transform.json
+++ b/integrations/openrazer/native-route/transform.json
@@ -4,32 +4,52 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792"
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd"
   },
   "patch": {
     "path": "patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
-    "sha256": "0fdef2ee1e820505a6e8ffd6a6bc18aed82e57bea2527711d710c8a992147ff4"
+    "sha256": "525e6c7655e9ca4dc2192117066e384b9a5b7dc799894e4163577144f53409b4"
   },
   "files": [
     {
       "path": "driver/razercommon.c",
-      "source_sha256": "984c3f95cba20710e84f3eed8a26b1e2eddf0f8b6e5fe8bca51a32166744509e",
-      "transformed_sha256": "e71aa4484904b6422b974f7c14fa9f3d6c20efc9382d59503d420a1ae0e6fa11"
+      "source_sha256": "635f9403432150c055f446b38413218771476df7f70e74ae432bba43a089d14b",
+      "transformed_sha256": "ffaa400ceccad65a560aec1f0e16913303cfd3e7e5be0fb303716f461a0c0624"
     },
     {
       "path": "driver/razercommon.h",
-      "source_sha256": "8145e8670a5230fac3a54392b63b901b2ea4c38cf8b82ee016e415d9e3d6de65",
-      "transformed_sha256": "7cf36b2058a54bfc0f38c595d83de9a5da425c6aa053e0ddef07ee07ea706888"
+      "source_sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f",
+      "transformed_sha256": "cc21768853373e1d1ed76a9fb8459fcb594a6044508fecf72e1c77bea5ff45dc"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "source_sha256": "27d8d4558b0026a1df2a7568e3c52bcb4eac337fe0b1acbc0e2a95f0c47593df",
-      "transformed_sha256": "f4d1f902ceb0b1b0145dc50139b2c9860584901730af6668697e69877f13918a"
+      "source_sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4",
+      "transformed_sha256": "fcfe4fbfe23fc47416932c9a116f9ea58e00c8ebc0b72741b9352e101c8e49c1"
+    },
+    {
+      "path": "driver/razerkbd_driver.h",
+      "source_sha256": "55192a7eca55a6eeedf7b692f61a41dd9c5636548d7b7b3975e743870fe79f9c",
+      "transformed_sha256": "db0a98b84fcb6173d9982bd514a09c02596ae3a639ae0da966169f5644ea16c5"
     },
     {
       "path": "driver/razermouse_driver.c",
-      "source_sha256": "73ccf9e31d04db2d6a4b300376d3545d14c10ff7ae417bf4d11fa18e60ebb0ff",
-      "transformed_sha256": "4b0de8f5971afa01b06c8fe479b70ef269a6804e7feee80c827389f0f5623d7d"
+      "source_sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1",
+      "transformed_sha256": "b5dcc8d8726c383b2cc253a1ccfb28ee917bf3fb08ae39e5464b1d04406b0c51"
+    },
+    {
+      "path": "driver/razermouse_driver.h",
+      "source_sha256": "fb58a57422672a085d77c57b11ca39b1b58d01d6474248c1317fd3d9de0b8ab4",
+      "transformed_sha256": "bcd7d6bc7ca6122d5d0da680b32b7e8b078b44d64cb4d4b64894860226b206f1"
+    },
+    {
+      "path": "install_files/udev/99-razer.rules",
+      "source_sha256": "5c18d8c8353cab82cf3d162cfb99100af3208ebca9a528d6229228f2f8684a84",
+      "transformed_sha256": "e30dd8f41033b4a050716fefcdeed833eff081206df6ef90e4f673a10adb6d3d"
+    },
+    {
+      "path": "install_files/udev/razer_mount",
+      "source_sha256": "4ea2cb22653e9ac1924533228704767d91210ec2a7643f5d4955671e31130a21",
+      "transformed_sha256": "4a46f0a70945ccdb9863db6b8cbd62b5d68b90e180554d23f791950f5327e02a"
     }
   ]
 }
diff --git a/knowledge/upstreams/openrazer.json b/knowledge/upstreams/openrazer.json
index a26f060..19375fb 100644
--- a/knowledge/upstreams/openrazer.json
+++ b/knowledge/upstreams/openrazer.json
@@ -4,8 +4,8 @@
   "source": {
     "upstream_id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.1-41-g6820f9d",
-    "commit": "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+    "version": "3.12.2",
+    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
     "extractor": "python-ast-v1",
     "source_files": [
diff --git a/packaging/distributions.json b/packaging/distributions.json
index de6d56b..9e84789 100644
--- a/packaging/distributions.json
+++ b/packaging/distributions.json
@@ -20,6 +20,8 @@
         "device-manager": "systemd"
       },
       "optional_dependencies": [
+        {"package": "openrazer-daemon", "purpose": "official OpenRazer daemon for native receiver children"},
+        {"package": "python-openrazer", "purpose": "official OpenRazer client used by Polychromatic"},
         {"package": "openrgb", "purpose": "native OpenRGB controller integration"},
         {"package": "polychromatic", "purpose": "native Polychromatic backend"},
         {"package": "python-dbus", "purpose": "private OpenRazer compatibility service"},
@@ -44,6 +46,8 @@
         "device-manager": "udev"
       },
       "optional_dependencies": [
+        {"package": "openrazer-daemon", "purpose": "official OpenRazer daemon for native receiver children"},
+        {"package": "python3-openrazer", "purpose": "official OpenRazer client used by Polychromatic"},
         {"package": "openrgb", "purpose": "native OpenRGB controller integration"},
         {"package": "polychromatic", "purpose": "native Polychromatic backend"},
         {"package": "python3-dbus", "purpose": "private OpenRazer compatibility service"},
@@ -68,6 +72,8 @@
         "device-manager": "systemd-udev"
       },
       "optional_dependencies": [
+        {"package": "openrazer-daemon", "purpose": "official OpenRazer daemon for native receiver children"},
+        {"package": "python3-openrazer", "purpose": "official OpenRazer client used by Polychromatic"},
         {"package": "openrgb", "purpose": "native OpenRGB controller integration"},
         {"package": "polychromatic", "purpose": "native Polychromatic backend"},
         {"package": "python3-dbus", "purpose": "private OpenRazer compatibility service"},
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 1d20c25..54602c7 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -1,6 +1,6 @@
 {
   "schema": "hyperflux-compiled-install-plan-v1",
-  "install_manifest_sha256": "1733db54a95a302e1b849aa84fe5f551cab85209db93439c451b86de241d746b",
+  "install_manifest_sha256": "4b5a1bb4f376550379f673465149af66d48909247f7af7de69e2c1ee9ac7a723",
   "product": {
     "name": "hyperflux-next-linux",
     "version": "0.0.0-dev.1",
@@ -68,10 +68,30 @@
       "kind": "source-transform",
       "required": true,
       "transform": "openrazer-native-route",
-      "destination": "/usr/src/openrazer-driver-3.12.1",
+      "destination": "/usr/src/openrazer-driver-3.12.2",
       "mode": "0644",
       "capability": "openrazer-source"
     },
+    {
+      "id": "openrazer-native-udev-rules",
+      "kind": "source-transform-file",
+      "required": true,
+      "source": "install_files/udev/99-razer.rules",
+      "transform": "openrazer-native-route",
+      "destination": "/usr/lib/udev/rules.d/99-razer.rules",
+      "mode": "0644",
+      "capability": "openrazer-source"
+    },
+    {
+      "id": "openrazer-native-mount-helper",
+      "kind": "source-transform-file",
+      "required": true,
+      "source": "install_files/udev/razer_mount",
+      "transform": "openrazer-native-route",
+      "destination": "/usr/lib/udev/razer_mount",
+      "mode": "0755",
+      "capability": "openrazer-source"
+    },
     {
       "id": "openrgb-native",
       "kind": "cmake-module",
@@ -253,6 +273,13 @@
       "mode": "0644",
       "preserve": false
     },
+    {
+      "component": "openrazer-system-group",
+      "source": "packaging/generated/openrazer.sysusers",
+      "destination": "/usr/lib/sysusers.d/openrazer.conf",
+      "mode": "0644",
+      "preserve": false
+    },
     {
       "component": "runtime-directories",
       "source": "packaging/generated/hyperflux-next.tmpfiles",
diff --git a/packaging/generated/openrazer.sysusers b/packaging/generated/openrazer.sysusers
new file mode 100644
index 0000000..90ab6a7
--- /dev/null
+++ b/packaging/generated/openrazer.sysusers
@@ -0,0 +1,3 @@
+# Generated by ./hfx generate. Do not edit manually.
+# SPDX-License-Identifier: GPL-2.0-only
+g openrazer -
diff --git a/packaging/install.json b/packaging/install.json
index 6c00b50..2379d04 100644
--- a/packaging/install.json
+++ b/packaging/install.json
@@ -67,6 +67,26 @@
       "required": true,
       "capability": "openrazer-source"
     },
+    {
+      "id": "openrazer-native-udev-rules",
+      "kind": "source-transform-file",
+      "transform": "openrazer-native-route",
+      "source": "install_files/udev/99-razer.rules",
+      "destination": "@openrazer_udev_rules_path@",
+      "mode": "0644",
+      "required": true,
+      "capability": "openrazer-source"
+    },
+    {
+      "id": "openrazer-native-mount-helper",
+      "kind": "source-transform-file",
+      "transform": "openrazer-native-route",
+      "source": "install_files/udev/razer_mount",
+      "destination": "@openrazer_mount_helper_path@",
+      "mode": "0755",
+      "required": true,
+      "capability": "openrazer-source"
+    },
     {
       "id": "openrgb-native",
       "kind": "cmake-module",
@@ -164,6 +184,15 @@
       "preserve": false,
       "include": []
     },
+    {
+      "id": "openrazer-system-group",
+      "kind": "file",
+      "source": "packaging/generated/openrazer.sysusers",
+      "destination": "@openrazer_sysusers_path@",
+      "mode": "0644",
+      "preserve": false,
+      "include": []
+    },
     {
       "id": "runtime-directories",
       "kind": "file",
diff --git a/profiles/lifecycle-policies.json b/profiles/lifecycle-policies.json
index 27426e1..65c3c6d 100644
--- a/profiles/lifecycle-policies.json
+++ b/profiles/lifecycle-policies.json
@@ -15,8 +15,8 @@
       "timing_authorities": [
         {
           "kind": "pinned-upstream-contract",
-          "source_id": "openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339",
-          "source_sha256": "3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829",
+          "source_id": "openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339",
+          "source_sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc",
           "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
         },
         {
diff --git a/schemas/install-manifest.schema.json b/schemas/install-manifest.schema.json
index a2614a4..83e687b 100644
--- a/schemas/install-manifest.schema.json
+++ b/schemas/install-manifest.schema.json
@@ -62,7 +62,8 @@
         {"$ref": "#/$defs/cargoBuild"},
         {"$ref": "#/$defs/cmakeBuild"},
         {"$ref": "#/$defs/pythonBuild"},
-        {"$ref": "#/$defs/sourceTransformBuild"}
+        {"$ref": "#/$defs/sourceTransformBuild"},
+        {"$ref": "#/$defs/sourceTransformFileBuild"}
       ]
     },
     "cargoBuild": {
@@ -130,6 +131,30 @@
         "capability": {"$ref": "#/$defs/identifier"}
       }
     },
+    "sourceTransformFileBuild": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "transform",
+        "source",
+        "destination",
+        "mode",
+        "required",
+        "capability"
+      ],
+      "properties": {
+        "id": {"$ref": "#/$defs/identifier"},
+        "kind": {"const": "source-transform-file"},
+        "transform": {"$ref": "#/$defs/identifier"},
+        "source": {"$ref": "#/$defs/relativePath"},
+        "destination": {"$ref": "#/$defs/destination"},
+        "mode": {"$ref": "#/$defs/mode"},
+        "required": {"const": true},
+        "capability": {"$ref": "#/$defs/identifier"}
+      }
+    },
     "payload": {
       "type": "object",
       "additionalProperties": false,
diff --git a/schemas/openrazer-native-deployment.schema.json b/schemas/openrazer-native-deployment.schema.json
index 11a2ec5..6f1709d 100644
--- a/schemas/openrazer-native-deployment.schema.json
+++ b/schemas/openrazer-native-deployment.schema.json
@@ -4,7 +4,7 @@
   "title": "HyperFlux OpenRazer native-route deployment",
   "type": "object",
   "additionalProperties": false,
-  "required": ["$schema", "schema", "relay", "driver"],
+  "required": ["$schema", "schema", "relay", "driver", "access"],
   "properties": {
     "$schema": {"const": "../../../schemas/openrazer-native-deployment.schema.json"},
     "schema": {"const": "hyperflux-openrazer-native-deployment-v1"},
@@ -48,6 +48,26 @@
           "items": {"type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$"}
         }
       }
+    },
+    "access": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "group",
+        "udev_rules_source",
+        "udev_rules_path",
+        "mount_helper_source",
+        "mount_helper_path",
+        "sysusers_path"
+      ],
+      "properties": {
+        "group": {"const": "openrazer"},
+        "udev_rules_source": {"const": "install_files/udev/99-razer.rules"},
+        "udev_rules_path": {"const": "/usr/lib/udev/rules.d/99-razer.rules"},
+        "mount_helper_source": {"const": "install_files/udev/razer_mount"},
+        "mount_helper_path": {"const": "/usr/lib/udev/razer_mount"},
+        "sysusers_path": {"const": "/usr/lib/sysusers.d/openrazer.conf"}
+      }
     }
   }
 }
diff --git a/schemas/openrazer-native-transform.schema.json b/schemas/openrazer-native-transform.schema.json
index 8444e4c..14486a2 100644
--- a/schemas/openrazer-native-transform.schema.json
+++ b/schemas/openrazer-native-transform.schema.json
@@ -36,7 +36,10 @@
         "additionalProperties": false,
         "required": ["path", "source_sha256", "transformed_sha256"],
         "properties": {
-          "path": {"type": "string", "pattern": "^driver/[A-Za-z0-9._-]+$"},
+          "path": {
+            "type": "string",
+            "pattern": "^(driver/[A-Za-z0-9._-]+|install_files/udev/(99-razer\\.rules|razer_mount))$"
+          },
           "source_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
           "transformed_sha256": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
         }
diff --git a/schemas/package-build-manifest.schema.json b/schemas/package-build-manifest.schema.json
index 96aa430..779559e 100644
--- a/schemas/package-build-manifest.schema.json
+++ b/schemas/package-build-manifest.schema.json
@@ -111,7 +111,7 @@
       "required": ["build_id", "kind", "path", "sha256", "size", "mode"],
       "properties": {
         "build_id": {"$ref": "#/$defs/identifier"},
-        "kind": {"enum": ["cargo-binary", "cmake-module", "python-wheel", "source-tree"]},
+        "kind": {"enum": ["cargo-binary", "cmake-module", "python-wheel", "source-tree", "source-file"]},
         "path": {"$ref": "#/$defs/relativePath"},
         "sha256": {"$ref": "#/$defs/digest"},
         "size": {"type": "integer", "minimum": 1, "maximum": 1073741824},
diff --git a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
index e7ce4d9..1a5c1d1 100644
--- a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
@@ -20,6 +20,8 @@ enum class ErrorCode
     HfxDeadline001,
     HfxGeneration001,
     HfxIntegration001,
+    HfxIntegration002,
+    HfxIntegration003,
     HfxInternal001,
     HfxKernel001,
     HfxKernel002,
@@ -48,6 +50,8 @@ enum class ErrorCode
         case ErrorCode::HfxDeadline001: return "HFX-DEADLINE-001";
         case ErrorCode::HfxGeneration001: return "HFX-GENERATION-001";
         case ErrorCode::HfxIntegration001: return "HFX-INTEGRATION-001";
+        case ErrorCode::HfxIntegration002: return "HFX-INTEGRATION-002";
+        case ErrorCode::HfxIntegration003: return "HFX-INTEGRATION-003";
         case ErrorCode::HfxInternal001: return "HFX-INTERNAL-001";
         case ErrorCode::HfxKernel001: return "HFX-KERNEL-001";
         case ErrorCode::HfxKernel002: return "HFX-KERNEL-002";
@@ -76,8 +80,10 @@ enum class RemediationId
     AcquireNewLease,
     ActivateInstalledDriver,
     ActivateOpenrazerRouteDriver,
+    ActivateOpenrazerSessionAccess,
     CollectSupportBundle,
     CorrectRequest,
+    CreateOpenrazerAccessGroup,
     DisableUnsupportedFeature,
     LookupTransactionOutcome,
     QualifyDevice,
@@ -100,8 +106,10 @@ enum class RemediationId
         case RemediationId::AcquireNewLease: return "acquire-new-lease";
         case RemediationId::ActivateInstalledDriver: return "activate-installed-driver";
         case RemediationId::ActivateOpenrazerRouteDriver: return "activate-openrazer-route-driver";
+        case RemediationId::ActivateOpenrazerSessionAccess: return "activate-openrazer-session-access";
         case RemediationId::CollectSupportBundle: return "collect-support-bundle";
         case RemediationId::CorrectRequest: return "correct-request";
+        case RemediationId::CreateOpenrazerAccessGroup: return "create-openrazer-access-group";
         case RemediationId::DisableUnsupportedFeature: return "disable-unsupported-feature";
         case RemediationId::LookupTransactionOutcome: return "lookup-transaction-outcome";
         case RemediationId::QualifyDevice: return "qualify-device";
@@ -315,18 +323,20 @@ struct ErrorDescriptor
     std::string_view docs_path;
 };
 
-inline constexpr std::string_view error_catalog_sha256 = "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066";
+inline constexpr std::string_view error_catalog_sha256 = "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c";
 inline constexpr std::size_t max_error_count = 256;
 inline constexpr std::size_t max_remediation_count = 128;
 inline constexpr std::size_t max_safe_detail_fields = 12;
 inline constexpr std::size_t max_safe_detail_length = 256;
 
-inline constexpr std::array<RemediationDescriptor, 18> remediations {{
+inline constexpr std::array<RemediationDescriptor, 20> remediations {{
     {RemediationId::AcquireNewLease, "Acquire a current lease", "Request a new lease for the complete resource set before submitting another operation.", "Read the ownership snapshot and confirm the new lease is current.", false},
     {RemediationId::ActivateInstalledDriver, "Activate the installed driver", "Use the platform's documented reboot or receiver-disconnect activation path.", "Run Doctor and confirm the loaded and installed driver identities match.", false},
     {RemediationId::ActivateOpenrazerRouteDriver, "Activate the OpenRazer route driver", "Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.", "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.", false},
+    {RemediationId::ActivateOpenrazerSessionAccess, "Activate OpenRazer access for this desktop session", "Run sudo gpasswd -a \"$USER\" openrazer, then sign out and back in once.", "After signing back in, run Doctor and confirm OpenRazer application access is ready.", false},
     {RemediationId::CollectSupportBundle, "Collect a privacy-safe support bundle", "Preview and create the bounded HyperFlux support bundle for the unresolved internal failure.", "Confirm the bundle preview excludes private paths, serials, raw reports, and arbitrary logs.", false},
     {RemediationId::CorrectRequest, "Correct the request", "Correct the named request field and submit a new request with a new request identifier.", "Validate the corrected request against the negotiated protocol schema.", false},
+    {RemediationId::CreateOpenrazerAccessGroup, "Create the OpenRazer access group", "Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first.", "Run Doctor and confirm the OpenRazer access-group finding is absent.", false},
     {RemediationId::DisableUnsupportedFeature, "Disable the unsupported feature", "Continue without the feature or use a peer that advertises it during negotiation.", "Repeat negotiation and inspect the enabled feature set.", false},
     {RemediationId::LookupTransactionOutcome, "Resolve the existing transaction", "Look up the existing transaction identifier; do not resubmit the hardware operation.", "Confirm the transaction reaches exactly one recorded terminal outcome.", false},
     {RemediationId::QualifyDevice, "Use a qualified device capability", "Keep the device read-only until an evidence-backed profile qualifies the requested capability.", "Inspect the capability snapshot and confirm the support level permits the operation.", false},
@@ -357,124 +367,136 @@ inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_2 {{
     {"protocol_range", SafeDetailKind::Text, true, 32ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Protocol range advertised by the integration."},
 }};
 
-inline constexpr std::array<std::string_view, 6> detail_values_3_1 {{"bridge", "kernel", "persistence", "protocol", "sdk", "transport"}};
+inline constexpr std::array<std::string_view, 1> detail_values_3_0 {{"group-unavailable"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_3 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_3 {{
+    {"access_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_3_0, PrivacyClass::Public, "OpenRazer access-group state."},
+}};
+
+inline constexpr std::array<std::string_view, 1> detail_values_4_0 {{"session-membership-required"}};
+
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_4 {{
+    {"access_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_4_0, PrivacyClass::Public, "OpenRazer desktop-session access state."},
+}};
+
+inline constexpr std::array<std::string_view, 6> detail_values_5_1 {{"bridge", "kernel", "persistence", "protocol", "sdk", "transport"}};
+
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_5 {{
     {"invariant_id", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Stable violated invariant identifier."},
-    {"subsystem", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_3_1, PrivacyClass::Public, "Subsystem that raised the invariant failure."},
+    {"subsystem", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_5_1, PrivacyClass::Public, "Subsystem that raised the invariant failure."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_4 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_6 {{
     {"installed_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Installed kernel interface identity."},
     {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Currently loaded kernel interface identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_5 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_7 {{
     {"installed_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Installed OpenRazer module source identity."},
     {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Loaded OpenRazer module source identity or activation state."},
     {"module", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "OpenRazer native-route kernel module name."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_6 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_8 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity that has no retained or eviction record."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_7 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_9 {{
     {"history_capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured retained outcome capacity."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity whose terminal record aged out."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_8 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_10 {{
     {"owner_name", SafeDetailKind::Text, false, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Current application owner when available."},
     {"resource_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Contended logical resource."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_9_1 {{"expired", "released", "revoked"}};
+inline constexpr std::array<std::string_view, 3> detail_values_11_1 {{"expired", "released", "revoked"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_9 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
     {"lease_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Expired or revoked lease identity."},
-    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_9_1, PrivacyClass::Public, "Terminal lease state."},
+    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_1, PrivacyClass::Public, "Terminal lease state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_10_0 {{"load", "migrate", "validate"}};
+inline constexpr std::array<std::string_view, 3> detail_values_12_0 {{"load", "migrate", "validate"}};
 
-inline constexpr std::array<std::string_view, 4> detail_values_10_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
+inline constexpr std::array<std::string_view, 4> detail_values_12_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_10 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_0, PrivacyClass::Public, "Failed state-read phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_10_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_12 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_12_0, PrivacyClass::Public, "Failed state-read phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_12_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_11_0 {{"commit", "rollback", "snapshot"}};
+inline constexpr std::array<std::string_view, 3> detail_values_13_0 {{"commit", "rollback", "snapshot"}};
 
-inline constexpr std::array<std::string_view, 3> detail_values_11_1 {{"io-failure", "permission-denied", "validation-failed"}};
+inline constexpr std::array<std::string_view, 3> detail_values_13_1 {{"io-failure", "permission-denied", "validation-failed"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_0, PrivacyClass::Public, "Failed state-write phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_13 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_13_0, PrivacyClass::Public, "Failed state-write phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_13_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_12 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_14 {{
     {"capability", SafeDetailKind::Identifier, true, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested semantic capability."},
     {"product_id", SafeDetailKind::U16, false, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Observed USB product identifier when available."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_13 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_15 {{
     {"active_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest bound to the active generation."},
     {"catalog_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest from the generated profile catalog."},
     {"profile_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Selected profile identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_14 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_16 {{
     {"client_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the client."},
     {"client_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the client."},
     {"server_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the bridge."},
     {"server_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the bridge."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_15 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_17 {{
     {"feature", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested protocol feature identifier."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_16_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
+inline constexpr std::array<std::string_view, 5> detail_values_18_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_16 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_18 {{
     {"capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured queue capacity."},
-    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_16_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
+    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_18_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_17_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
+inline constexpr std::array<std::string_view, 5> detail_values_19_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_17 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_19 {{
     {"field", SafeDetailKind::Text, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Schema field path without request data."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_17_1, PrivacyClass::Public, "Sanitized validation reason."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_19_1, PrivacyClass::Public, "Sanitized validation reason."},
     {"request_id", SafeDetailKind::Identifier, false, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Request identity when parsing reached it."},
 }};
 
-inline constexpr std::array<std::string_view, 6> detail_values_18_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
+inline constexpr std::array<std::string_view, 6> detail_values_20_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_18 {{
-    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_18_0, PrivacyClass::Public, "Sanitized bridge service state."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_20 {{
+    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_20_0, PrivacyClass::Public, "Sanitized bridge service state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_19_0 {{"device-absent", "session-unavailable", "transport-busy"}};
+inline constexpr std::array<std::string_view, 3> detail_values_21_0 {{"device-absent", "session-unavailable", "transport-busy"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_19 {{
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_19_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_21 {{
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_21_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction that did not begin transport."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_20 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_22 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction whose transport outcome is uncertain."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_21 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_23 {{
     {"delivered_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames terminally delivered before failure."},
     {"total_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames declared by the transaction."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Partially delivered transaction identity."},
 }};
 
-inline constexpr std::array<ErrorDescriptor, 22> errors {{
+inline constexpr std::array<ErrorDescriptor, 24> errors {{
     {
         ErrorCode::HfxDeadline001, ErrorClass::Deadline,
         ErrorSeverity::Warning, RetryPolicy::Never,
@@ -505,11 +527,31 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         "This application adapter must be updated before it can use HyperFlux.", PrivacyClass::Public,
         "docs/generated/error-catalog.md#hfx-integration-001"
     },
+    {
+        ErrorCode::HfxIntegration002, ErrorClass::Integration,
+        ErrorSeverity::Error, RetryPolicy::AfterRemediation,
+        SideEffectCertaintyPolicy::NotApplicable,
+        RemediationId::CreateOpenrazerAccessGroup, details_3,
+        {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
+        ErrorOwner::Integration, "OpenRazer is installed, but its standard access group is unavailable.",
+        "OpenRazer application access was not installed completely.", PrivacyClass::Public,
+        "docs/generated/error-catalog.md#hfx-integration-002"
+    },
+    {
+        ErrorCode::HfxIntegration003, ErrorClass::Integration,
+        ErrorSeverity::Error, RetryPolicy::AfterRemediation,
+        SideEffectCertaintyPolicy::NotApplicable,
+        RemediationId::ActivateOpenrazerSessionAccess, details_4,
+        {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
+        ErrorOwner::Integration, "OpenRazer is installed, but the current desktop session does not have the openrazer group active.",
+        "This desktop session cannot open OpenRazer devices yet.", PrivacyClass::Public,
+        "docs/generated/error-catalog.md#hfx-integration-003"
+    },
     {
         ErrorCode::HfxInternal001, ErrorClass::Internal,
         ErrorSeverity::Critical, RetryPolicy::Never,
         SideEffectCertaintyPolicy::RuntimeReported,
-        RemediationId::CollectSupportBundle, details_3,
+        RemediationId::CollectSupportBundle, details_5,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "A declared HyperFlux invariant was violated.",
         "HyperFlux stopped the affected operation because an internal safety rule failed.", PrivacyClass::PublicSummary,
@@ -519,7 +561,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxKernel001, ErrorClass::Kernel,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ActivateInstalledDriver, details_4,
+        RemediationId::ActivateInstalledDriver, details_6,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "The loaded kernel interface does not match the installed userspace contract.",
         "The newly installed driver is not active yet.", PrivacyClass::Public,
@@ -529,7 +571,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxKernel002, ErrorClass::Kernel,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ActivateOpenrazerRouteDriver, details_5,
+        RemediationId::ActivateOpenrazerRouteDriver, details_7,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "A required OpenRazer native-route kernel module is missing or an older module remains active.",
         "The OpenRazer route driver is not ready yet.", PrivacyClass::Public,
@@ -539,7 +581,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxOutcome001, ErrorClass::Outcome,
         ErrorSeverity::Warning, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_6,
+        RemediationId::ReconcileTransactionState, details_8,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded bridge history has no retained or eviction record for the requested transaction.",
         "HyperFlux cannot determine the result of this transaction from its current history.", PrivacyClass::PublicSummary,
@@ -549,7 +591,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxOutcome002, ErrorClass::Outcome,
         ErrorSeverity::Info, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_7,
+        RemediationId::ReconcileTransactionState, details_9,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The transaction was known, but its terminal result aged out of bounded retained history.",
         "The transaction result is older than the history HyperFlux keeps in memory.", PrivacyClass::PublicSummary,
@@ -559,7 +601,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxOwnership001, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::ReleaseOwner, details_8,
+        RemediationId::ReleaseOwner, details_10,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Another live client owns at least one requested resource.",
         "Another application currently controls this device function.", PrivacyClass::Public,
@@ -569,7 +611,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxOwnership002, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::AcquireNewLease, details_9,
+        RemediationId::AcquireNewLease, details_11,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The lease no longer authorizes the requested resource set.",
         "The application's control lease ended before the operation started.", PrivacyClass::Public,
@@ -579,7 +621,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxPersistence001, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_10,
+        RemediationId::RepairStateStorage, details_12,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Persisted bridge state could not be loaded and validated safely.",
         "HyperFlux could not read its saved state and kept hardware restoration disabled.", PrivacyClass::PublicSummary,
@@ -589,7 +631,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxPersistence002, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_11,
+        RemediationId::RepairStateStorage, details_13,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "A transactional state update could not be committed or rolled back safely.",
         "HyperFlux could not save its latest stable state.", PrivacyClass::PublicSummary,
@@ -599,7 +641,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxProfile001, ErrorClass::Profile,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::QualifyDevice, details_12,
+        RemediationId::QualifyDevice, details_14,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "No evidence-backed profile qualifies the requested device capability.",
         "The device is visible, but this operation is not qualified for it.", PrivacyClass::Public,
@@ -609,7 +651,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxProfile002, ErrorClass::Profile,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::VerifyProfileCatalog, details_13,
+        RemediationId::VerifyProfileCatalog, details_15,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The active profile binding does not match the generated profile catalog.",
         "HyperFlux paused writes because its hardware profile changed.", PrivacyClass::Public,
@@ -619,7 +661,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxProtocol001, ErrorClass::Protocol,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::UpdateProtocolPeer, details_14,
+        RemediationId::UpdateProtocolPeer, details_16,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The client and bridge protocol version ranges do not overlap.",
         "The application and HyperFlux service are not protocol-compatible.", PrivacyClass::Public,
@@ -629,7 +671,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxProtocol002, ErrorClass::Protocol,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::DisableUnsupportedFeature, details_15,
+        RemediationId::DisableUnsupportedFeature, details_17,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request requires a feature that was not enabled during negotiation.",
         "This feature is unavailable with the current application and service combination.", PrivacyClass::Public,
@@ -639,7 +681,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxQueue001, ErrorClass::Queue,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_16,
+        RemediationId::RetryBounded, details_18,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded queue had no admissible capacity before the request deadline.",
         "HyperFlux is temporarily busy and did not start this operation.", PrivacyClass::Public,
@@ -649,7 +691,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxRequest001, ErrorClass::Request,
         ErrorSeverity::Error, RetryPolicy::Never,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::CorrectRequest, details_17,
+        RemediationId::CorrectRequest, details_19,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request violates the negotiated bounded protocol schema.",
         "The application sent a request HyperFlux cannot safely accept.", PrivacyClass::PublicSummary,
@@ -659,7 +701,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxService001, ErrorClass::Service,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::StartBridge, details_18,
+        RemediationId::StartBridge, details_20,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "The compatible bridge service is stopped or is not ready to accept SDK requests.",
         "The HyperFlux service is not ready yet.", PrivacyClass::Public,
@@ -669,7 +711,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxTransport001, ErrorClass::Transport,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_19,
+        RemediationId::RetryBounded, details_21,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport failed before any hardware frame was dispatched.",
         "The receiver was unavailable before HyperFlux sent anything.", PrivacyClass::PublicSummary,
@@ -679,7 +721,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxTransport002, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Possible,
-        RemediationId::LookupTransactionOutcome, details_20,
+        RemediationId::LookupTransactionOutcome, details_22,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport began, but the bridge could not prove whether the receiver accepted a frame.",
         "The operation may have reached the receiver, so HyperFlux will not repeat it automatically.", PrivacyClass::PublicSummary,
@@ -689,7 +731,7 @@ inline constexpr std::array<ErrorDescriptor, 22> errors {{
         ErrorCode::HfxTransport003, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Partial,
-        RemediationId::LookupTransactionOutcome, details_21,
+        RemediationId::LookupTransactionOutcome, details_23,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "At least one declared frame was delivered before a later frame failed.",
         "The operation was only partly delivered and will not be repeated automatically.", PrivacyClass::PublicSummary,
diff --git a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
index 4aa5c5b..fab4657 100644
--- a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
@@ -33,7 +33,7 @@ struct AdapterRecord
     std::string_view coexistence_policy;
 };
 
-inline constexpr std::string_view integration_source_sha256 = "fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f";
+inline constexpr std::string_view integration_source_sha256 = "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0";
 
 inline constexpr std::array<std::string_view, 2> upstream_uses_0 {{"compatibility-contract", "metadata-import"}};
 inline constexpr std::array<std::string_view, 3> upstream_uses_1 {{"effect-engine", "model-layout-registry", "plugin-build-contract"}};
@@ -52,7 +52,7 @@ inline constexpr std::array<std::uint16_t, 1> adapter_protocols_3 {{5}};
 inline constexpr std::array<std::string_view, 5> adapter_features_3 {{"inventory", "lighting", "ownership", "presentation", "telemetry"}};
 
 inline constexpr std::array<UpstreamRecord, 3> upstreams {{
-    {"openrazer", "OpenRazer", "https://github.com/openrazer/openrazer.git", "3.12.1-41-g6820f9d", "6820f9da169d354bc7e6e93a0aa8683a6bb75792", "GPL-2.0-or-later AND CC-BY-SA-4.0", "org.razer 3.x metadata and D-Bus vocabulary", upstream_uses_0},
+    {"openrazer", "OpenRazer", "https://github.com/openrazer/openrazer.git", "3.12.2", "ddea89607b86023e88563b8feabc8fa2d5773cdd", "GPL-2.0-or-later AND CC-BY-SA-4.0", "org.razer 3.x metadata and D-Bus vocabulary", upstream_uses_0},
     {"openrgb", "OpenRGB", "https://github.com/CalcProgrammer1/OpenRGB.git", "1.0rc3", "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "GPL-2.0-only", "OpenRGB plugin API 4", upstream_uses_1},
     {"polychromatic", "Polychromatic", "https://github.com/polychromatic/polychromatic.git", "0.9.7-7-g716737b", "716737bf444ab7e962f4d3b7a5188b2f07c0c4a1", "GPL-3.0-only", "Polychromatic 0.9 native backend contract", upstream_uses_2},
 }};
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index e1fa4de..d1174e5 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: 2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0
+// Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0";
+inline constexpr std::string_view profile_source_sha256 = "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
diff --git a/sdk/python/hyperflux_sdk/generated/error_catalog.py b/sdk/python/hyperflux_sdk/generated/error_catalog.py
index b4c10e2..6218d5c 100644
--- a/sdk/python/hyperflux_sdk/generated/error_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/error_catalog.py
@@ -13,6 +13,8 @@ class ErrorCode(str, Enum):
     HFX_DEADLINE_001 = "HFX-DEADLINE-001"
     HFX_GENERATION_001 = "HFX-GENERATION-001"
     HFX_INTEGRATION_001 = "HFX-INTEGRATION-001"
+    HFX_INTEGRATION_002 = "HFX-INTEGRATION-002"
+    HFX_INTEGRATION_003 = "HFX-INTEGRATION-003"
     HFX_INTERNAL_001 = "HFX-INTERNAL-001"
     HFX_KERNEL_001 = "HFX-KERNEL-001"
     HFX_KERNEL_002 = "HFX-KERNEL-002"
@@ -38,8 +40,10 @@ class RemediationId(str, Enum):
     ACQUIRE_NEW_LEASE = "acquire-new-lease"
     ACTIVATE_INSTALLED_DRIVER = "activate-installed-driver"
     ACTIVATE_OPENRAZER_ROUTE_DRIVER = "activate-openrazer-route-driver"
+    ACTIVATE_OPENRAZER_SESSION_ACCESS = "activate-openrazer-session-access"
     COLLECT_SUPPORT_BUNDLE = "collect-support-bundle"
     CORRECT_REQUEST = "correct-request"
+    CREATE_OPENRAZER_ACCESS_GROUP = "create-openrazer-access-group"
     DISABLE_UNSUPPORTED_FEATURE = "disable-unsupported-feature"
     LOOKUP_TRANSACTION_OUTCOME = "lookup-transaction-outcome"
     QUALIFY_DEVICE = "qualify-device"
@@ -158,7 +162,7 @@ class ErrorDescriptor:
     docs_path: str
 
 
-ERROR_CATALOG_SHA256: Final = "5574ceb2d25ce311b99274418912cd2c04efb9bebb5262e5704ef474de79a066"
+ERROR_CATALOG_SHA256: Final = "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c"
 MAX_ERROR_COUNT: Final = 256
 MAX_REMEDIATION_COUNT: Final = 128
 MAX_SAFE_DETAIL_FIELDS: Final = 12
@@ -186,6 +190,13 @@ class ErrorDescriptor:
         verification="Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.",
         automatic=False,
     ),
+    RemediationDescriptor(
+        id=RemediationId.ACTIVATE_OPENRAZER_SESSION_ACCESS,
+        title="Activate OpenRazer access for this desktop session",
+        safe_action="Run sudo gpasswd -a \"$USER\" openrazer, then sign out and back in once.",
+        verification="After signing back in, run Doctor and confirm OpenRazer application access is ready.",
+        automatic=False,
+    ),
     RemediationDescriptor(
         id=RemediationId.COLLECT_SUPPORT_BUNDLE,
         title="Collect a privacy-safe support bundle",
@@ -200,6 +211,13 @@ class ErrorDescriptor:
         verification="Validate the corrected request against the negotiated protocol schema.",
         automatic=False,
     ),
+    RemediationDescriptor(
+        id=RemediationId.CREATE_OPENRAZER_ACCESS_GROUP,
+        title="Create the OpenRazer access group",
+        safe_action="Run sudo systemd-sysusers openrazer.conf. If that file is missing, reinstall the current HyperFlux Next package first.",
+        verification="Run Doctor and confirm the OpenRazer access-group finding is absent.",
+        automatic=False,
+    ),
     RemediationDescriptor(
         id=RemediationId.DISABLE_UNSUPPORTED_FEATURE,
         title="Disable the unsupported feature",
@@ -363,6 +381,32 @@ class ErrorDescriptor:
 )
 
 DETAILS_3: Final = (
+    SafeDetailFieldDescriptor(
+        name="access_state",
+        kind=SafeDetailKind.ENUM,
+        required=True,
+        maximum_length=None,
+        maximum_value=None,
+        allowed_values=('group-unavailable',),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer access-group state.",
+    ),
+)
+
+DETAILS_4: Final = (
+    SafeDetailFieldDescriptor(
+        name="access_state",
+        kind=SafeDetailKind.ENUM,
+        required=True,
+        maximum_length=None,
+        maximum_value=None,
+        allowed_values=('session-membership-required',),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer desktop-session access state.",
+    ),
+)
+
+DETAILS_5: Final = (
     SafeDetailFieldDescriptor(
         name="invariant_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -385,7 +429,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_4: Final = (
+DETAILS_6: Final = (
     SafeDetailFieldDescriptor(
         name="installed_abi",
         kind=SafeDetailKind.IDENTIFIER,
@@ -408,7 +452,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_5: Final = (
+DETAILS_7: Final = (
     SafeDetailFieldDescriptor(
         name="installed_abi",
         kind=SafeDetailKind.IDENTIFIER,
@@ -441,7 +485,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_6: Final = (
+DETAILS_8: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -454,7 +498,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_7: Final = (
+DETAILS_9: Final = (
     SafeDetailFieldDescriptor(
         name="history_capacity",
         kind=SafeDetailKind.U16,
@@ -477,7 +521,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_8: Final = (
+DETAILS_10: Final = (
     SafeDetailFieldDescriptor(
         name="owner_name",
         kind=SafeDetailKind.TEXT,
@@ -500,7 +544,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_9: Final = (
+DETAILS_11: Final = (
     SafeDetailFieldDescriptor(
         name="lease_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -523,7 +567,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_10: Final = (
+DETAILS_12: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -546,7 +590,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_11: Final = (
+DETAILS_13: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -569,7 +613,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_12: Final = (
+DETAILS_14: Final = (
     SafeDetailFieldDescriptor(
         name="capability",
         kind=SafeDetailKind.IDENTIFIER,
@@ -592,7 +636,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_13: Final = (
+DETAILS_15: Final = (
     SafeDetailFieldDescriptor(
         name="active_digest",
         kind=SafeDetailKind.IDENTIFIER,
@@ -625,7 +669,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_14: Final = (
+DETAILS_16: Final = (
     SafeDetailFieldDescriptor(
         name="client_max_version",
         kind=SafeDetailKind.U16,
@@ -668,7 +712,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_15: Final = (
+DETAILS_17: Final = (
     SafeDetailFieldDescriptor(
         name="feature",
         kind=SafeDetailKind.IDENTIFIER,
@@ -681,7 +725,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_16: Final = (
+DETAILS_18: Final = (
     SafeDetailFieldDescriptor(
         name="capacity",
         kind=SafeDetailKind.U16,
@@ -704,7 +748,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_17: Final = (
+DETAILS_19: Final = (
     SafeDetailFieldDescriptor(
         name="field",
         kind=SafeDetailKind.TEXT,
@@ -737,7 +781,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_18: Final = (
+DETAILS_20: Final = (
     SafeDetailFieldDescriptor(
         name="service_state",
         kind=SafeDetailKind.ENUM,
@@ -750,7 +794,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_19: Final = (
+DETAILS_21: Final = (
     SafeDetailFieldDescriptor(
         name="reason",
         kind=SafeDetailKind.ENUM,
@@ -773,7 +817,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_20: Final = (
+DETAILS_22: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -786,7 +830,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_21: Final = (
+DETAILS_23: Final = (
     SafeDetailFieldDescriptor(
         name="delivered_frames",
         kind=SafeDetailKind.U16,
@@ -880,6 +924,46 @@ class ErrorDescriptor:
         privacy=PrivacyClass.PUBLIC,
         docs_path="docs/generated/error-catalog.md#hfx-integration-001",
     ),
+    ErrorDescriptor(
+        code=ErrorCode.HFX_INTEGRATION_002,
+        error_class=ErrorClass.INTEGRATION,
+        severity=ErrorSeverity.ERROR,
+        retry_policy=RetryPolicy.AFTER_REMEDIATION,
+        side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
+        remediation_id=RemediationId.CREATE_OPENRAZER_ACCESS_GROUP,
+        safe_detail_fields=DETAILS_3,
+        lifecycle=LifecycleDescriptor(
+            state=ErrorLifecycleState.ACTIVE,
+            introduced_in="0.0.0-dev.1",
+            deprecated_in=None,
+            replacement_code=None,
+        ),
+        owner=ErrorOwner.INTEGRATION,
+        technical_cause="OpenRazer is installed, but its standard access group is unavailable.",
+        user_explanation="OpenRazer application access was not installed completely.",
+        privacy=PrivacyClass.PUBLIC,
+        docs_path="docs/generated/error-catalog.md#hfx-integration-002",
+    ),
+    ErrorDescriptor(
+        code=ErrorCode.HFX_INTEGRATION_003,
+        error_class=ErrorClass.INTEGRATION,
+        severity=ErrorSeverity.ERROR,
+        retry_policy=RetryPolicy.AFTER_REMEDIATION,
+        side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
+        remediation_id=RemediationId.ACTIVATE_OPENRAZER_SESSION_ACCESS,
+        safe_detail_fields=DETAILS_4,
+        lifecycle=LifecycleDescriptor(
+            state=ErrorLifecycleState.ACTIVE,
+            introduced_in="0.0.0-dev.1",
+            deprecated_in=None,
+            replacement_code=None,
+        ),
+        owner=ErrorOwner.INTEGRATION,
+        technical_cause="OpenRazer is installed, but the current desktop session does not have the openrazer group active.",
+        user_explanation="This desktop session cannot open OpenRazer devices yet.",
+        privacy=PrivacyClass.PUBLIC,
+        docs_path="docs/generated/error-catalog.md#hfx-integration-003",
+    ),
     ErrorDescriptor(
         code=ErrorCode.HFX_INTERNAL_001,
         error_class=ErrorClass.INTERNAL,
@@ -887,7 +971,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.RUNTIME_REPORTED,
         remediation_id=RemediationId.COLLECT_SUPPORT_BUNDLE,
-        safe_detail_fields=DETAILS_3,
+        safe_detail_fields=DETAILS_5,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -907,7 +991,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.ACTIVATE_INSTALLED_DRIVER,
-        safe_detail_fields=DETAILS_4,
+        safe_detail_fields=DETAILS_6,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -927,7 +1011,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.ACTIVATE_OPENRAZER_ROUTE_DRIVER,
-        safe_detail_fields=DETAILS_5,
+        safe_detail_fields=DETAILS_7,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -947,7 +1031,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_6,
+        safe_detail_fields=DETAILS_8,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -967,7 +1051,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_7,
+        safe_detail_fields=DETAILS_9,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -987,7 +1071,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RELEASE_OWNER,
-        safe_detail_fields=DETAILS_8,
+        safe_detail_fields=DETAILS_10,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1007,7 +1091,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.ACQUIRE_NEW_LEASE,
-        safe_detail_fields=DETAILS_9,
+        safe_detail_fields=DETAILS_11,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1027,7 +1111,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_10,
+        safe_detail_fields=DETAILS_12,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1047,7 +1131,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_11,
+        safe_detail_fields=DETAILS_13,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1067,7 +1151,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.QUALIFY_DEVICE,
-        safe_detail_fields=DETAILS_12,
+        safe_detail_fields=DETAILS_14,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1087,7 +1171,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.VERIFY_PROFILE_CATALOG,
-        safe_detail_fields=DETAILS_13,
+        safe_detail_fields=DETAILS_15,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1107,7 +1191,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.UPDATE_PROTOCOL_PEER,
-        safe_detail_fields=DETAILS_14,
+        safe_detail_fields=DETAILS_16,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1127,7 +1211,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.DISABLE_UNSUPPORTED_FEATURE,
-        safe_detail_fields=DETAILS_15,
+        safe_detail_fields=DETAILS_17,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1147,7 +1231,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_16,
+        safe_detail_fields=DETAILS_18,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1167,7 +1251,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.CORRECT_REQUEST,
-        safe_detail_fields=DETAILS_17,
+        safe_detail_fields=DETAILS_19,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1187,7 +1271,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.START_BRIDGE,
-        safe_detail_fields=DETAILS_18,
+        safe_detail_fields=DETAILS_20,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1207,7 +1291,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_19,
+        safe_detail_fields=DETAILS_21,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1227,7 +1311,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.POSSIBLE,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_20,
+        safe_detail_fields=DETAILS_22,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1247,7 +1331,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.PARTIAL,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_21,
+        safe_detail_fields=DETAILS_23,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
diff --git a/sdk/python/hyperflux_sdk/generated/integration_catalog.py b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
index 9bf4340..4e24c59 100644
--- a/sdk/python/hyperflux_sdk/generated/integration_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
@@ -68,16 +68,16 @@
                'unrelated_device_policy': 'preserve',
                'upstream_ids': ['openrazer', 'polychromatic']}],
  'schema': 'hyperflux-integration-catalog-v1',
- 'source_sha256': 'fa6daa3a0bc6a8d036d6f41d1105742d70392f7f2e753e90e987a2612135d55f',
+ 'source_sha256': 'f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0',
  'upstreams': [{'api_contract': 'org.razer 3.x metadata and D-Bus vocabulary',
                 'build_network_access': False,
-                'commit': '6820f9da169d354bc7e6e93a0aa8683a6bb75792',
+                'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
                 'id': 'openrazer',
                 'license_expression': 'GPL-2.0-or-later AND CC-BY-SA-4.0',
                 'name': 'OpenRazer',
                 'repository': 'https://github.com/openrazer/openrazer.git',
                 'uses': ['compatibility-contract', 'metadata-import'],
-                'version': '3.12.1-41-g6820f9d'},
+                'version': '3.12.2'},
                {'api_contract': 'OpenRGB plugin API 4',
                 'build_network_access': False,
                 'commit': '6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0',
diff --git a/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py b/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
index 2d3f7ed..a1a4cc5 100644
--- a/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
+++ b/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
@@ -99,12 +99,12 @@
                          'path': 'daemon/openrazer_daemon/hardware/keyboards.py',
                          'sha256': 'a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9'}}],
  'schema': 'hyperflux-imported-device-metadata-v1',
- 'selection_sha256': '0bd97b07f4c8f9d2c99ac3a3622477704661d5069bd984a0ef8d4a72bf32998f',
- 'upstream': {'commit': '6820f9da169d354bc7e6e93a0aa8683a6bb75792',
+ 'selection_sha256': 'a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9',
+ 'upstream': {'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
               'id': 'openrazer',
               'license_expression': 'GPL-2.0-or-later AND CC-BY-SA-4.0',
               'repository': 'https://github.com/openrazer/openrazer.git',
-              'version': '3.12.1-41-g6820f9d'}}
+              'version': '3.12.2'}}
 OPENRAZER_DEVICES_BY_PROFILE: Final = MappingProxyType(
     {value['profile_id']: value for value in OPENRAZER_METADATA['devices']}
 )
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index edfcd90..a2acc68 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = '2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0'
+PROFILE_SOURCE_SHA256: Final = 'b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -474,8 +474,8 @@
                          'retry_offsets_ms': [0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000],
                          'strategy': 'activity-assisted-return-epoch',
                          'timing_authorities': [{'kind': 'pinned-upstream-contract',
-                                                 'source_id': 'openrazer:6820f9da169d354bc7e6e93a0aa8683a6bb75792:driver/razerchromacommon.c:1339',
-                                                 'source_sha256': '3aeaf974d3ecd5b6b3fd405dc22a4383dc1951e1f3c64824f1bdcf4caf852829',
+                                                 'source_id': 'openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339',
+                                                 'source_sha256': '6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc',
                                                  'summary': 'The pinned upstream idle-time command accepts 60 through '
                                                             '900 seconds; 60 seconds is therefore a conservative '
                                                             'quiescent candidate, never a claim that the endpoint '
@@ -915,7 +915,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': '2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0'}
+ 'source_sha256': 'b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/cpp/openrgb_controller_model_contract.cpp b/tests/cpp/openrgb_controller_model_contract.cpp
index 717b8ec..d38261c 100644
--- a/tests/cpp/openrgb_controller_model_contract.cpp
+++ b/tests/cpp/openrgb_controller_model_contract.cpp
@@ -68,11 +68,11 @@ hyperflux::v5::ControllerView controller(
         {
             text<UpstreamId>(upstream),
             text<UpstreamOwner>(upstream == "openrgb" ? "OpenRGB" : "OpenRazer"),
-            text<ComponentVersion>(upstream == "openrgb" ? "1.0rc3" : "3.12.1"),
+            text<ComponentVersion>(upstream == "openrgb" ? "1.0rc3" : "3.12.2"),
             text<SourceRevision>(
                 upstream == "openrgb"
                     ? "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0"
-                    : "6820f9da169d354bc7e6e93a0aa8683a6bb75792"),
+                    : "ddea89607b86023e88563b8feabc8fa2d5773cdd"),
             text<PresentationKey>(std::string(device) + "_device"),
             kind == DeviceKind::Keyboard
                 ? std::optional<PresentationKey>(text<PresentationKey>("keyboard_layout"))
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 1117b30..13c28c0 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "2c438f5f49e436fa8621bd38b2a99d8aceb1ed650ed2da9ae3d393c329dfaea0"
+  "source_sha256": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
 }
diff --git a/tests/test_device_knowledge.py b/tests/test_device_knowledge.py
index f98298b..0d80c98 100644
--- a/tests/test_device_knowledge.py
+++ b/tests/test_device_knowledge.py
@@ -277,7 +277,7 @@ def test_source_catalogs_match_exact_integration_pins(self) -> None:
         self.assertEqual(sources["openrgb"]["record_count"], 112)
         self.assertEqual(
             sources["openrazer"]["commit"],
-            "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+            "ddea89607b86023e88563b8feabc8fa2d5773cdd",
         )
         self.assertEqual(
             sources["openrgb"]["commit"],
diff --git a/tests/test_distribution_debian.py b/tests/test_distribution_debian.py
index 17d5c1a..d70901f 100644
--- a/tests/test_distribution_debian.py
+++ b/tests/test_distribution_debian.py
@@ -84,7 +84,11 @@ def test_control_comes_from_distribution_and_runtime_authorities(self) -> None:
         self.assertIn("Architecture: amd64\n", control)
         self.assertIn(f"Maintainer: {DEBIAN_MAINTAINER}\n", control)
         self.assertIn("Depends: dkms, libc6, libgcc-s1, python3 (>= 3.11), systemd, udev\n", control)
-        self.assertIn("Suggests: openrgb, polychromatic, python3-dbus, python3-gi\n", control)
+        self.assertIn(
+            "Suggests: openrazer-daemon, python3-openrazer, openrgb, polychromatic, "
+            "python3-dbus, python3-gi\n",
+            control,
+        )
         self.assertIn(
             "Conflicts: hyperflux-v2-linux-dkms, openrazer-driver-dkms\n",
             control,
diff --git a/tests/test_distribution_package.py b/tests/test_distribution_package.py
index 2ea70e5..78e95e6 100644
--- a/tests/test_distribution_package.py
+++ b/tests/test_distribution_package.py
@@ -127,6 +127,8 @@ def test_arch_hooks_delegate_lifecycle_without_hardware_logic(self) -> None:
         self.assertIn(f"Exec = {activation} post-update", transaction)
         self.assertIn("When = PostTransaction", transaction)
         self.assertIn("udevadm control --reload", install)
+        self.assertIn("systemd-sysusers hyperflux-next.conf", install)
+        self.assertIn("systemd-sysusers openrazer.conf", install)
         for forbidden in ("modprobe", "unbind", "rebind", "hidraw", "1532"):
             self.assertNotIn(forbidden, install + transaction)
 
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 0dcb8f0..ef22d5f 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -25,6 +25,7 @@
 import hfxdev.native_control as native_control
 import hfxdev.native_probe as native_probe
 import hfxdev.openrazer as openrazer
+import hfxdev.openrazer_native_route as openrazer_native_route
 from hfxdev.native_control import (
     load_native_control_policy,
     load_native_method_inventory,
@@ -44,6 +45,7 @@
     verify_global_event_file_matcher,
 )
 from hfxdev.openrazer_native_route import (
+    load_native_transform,
     load_native_route_catalog,
     transformed_native_route_catalog,
 )
@@ -68,7 +70,7 @@ def test_catalog_is_deterministic_pinned_and_network_independent(self) -> None:
         )
         self.assertEqual(
             upstreams["openrazer"]["commit"],
-            "6820f9da169d354bc7e6e93a0aa8683a6bb75792",
+            "ddea89607b86023e88563b8feabc8fa2d5773cdd",
         )
         self.assertEqual(
             upstreams["polychromatic"]["commit"],
@@ -266,6 +268,37 @@ def test_openrazer_native_route_catalog_is_fully_authority_bound(self) -> None:
             direct = probes_by_profile[route["profile_id"]]["direct_usb_reference"]
             self.assertEqual(route["direct_data_product_ids"], [direct["product_id"]])
 
+    def test_openrazer_native_transform_auxiliary_source_set_is_exact(self) -> None:
+        transform = load_native_transform(ROOT)
+        auxiliary = {
+            record["path"]
+            for record in transform["files"]
+            if not record["path"].startswith("driver/")
+        }
+        self.assertEqual(
+            auxiliary,
+            {
+                "install_files/udev/99-razer.rules",
+                "install_files/udev/razer_mount",
+            },
+        )
+
+        drifted = deepcopy(transform)
+        drifted["files"][-1]["path"] = "install_files/udev/unreviewed-helper"
+        path = ROOT / "integrations/openrazer/native-route/transform.json"
+
+        def substituted_load(candidate: Path):
+            if candidate == path:
+                return deepcopy(drifted)
+            return model_load_json(candidate)
+
+        with patch.object(
+            openrazer_native_route,
+            "load_json",
+            side_effect=substituted_load,
+        ), self.assertRaisesRegex(ModelError, "outside the approved source set"):
+            load_native_transform(ROOT)
+
     def test_openrazer_relay_keeps_module_preflight_outside_its_sealed_namespace(self) -> None:
         runtime = load_linux_runtime(ROOT)
         service = relay_service(load_native_deployment(ROOT), runtime)
diff --git a/tests/test_package_pipeline.py b/tests/test_package_pipeline.py
index e859ddf..55a2615 100644
--- a/tests/test_package_pipeline.py
+++ b/tests/test_package_pipeline.py
@@ -29,6 +29,7 @@
     _inspect_staged_files,
     _normalize_tree,
     _openrazer_dkms_projection_files,
+    _openrazer_source_file_projection,
     _private_stage_prefixes,
     _provenance_inputs,
     _provenance_materials,
@@ -145,6 +146,59 @@ def test_openrazer_dkms_projection_requires_a_regular_license(self) -> None:
             with self.assertRaisesRegex(ModelError, "no regular license text"):
                 _openrazer_dkms_projection_files(prepared, projection)
 
+    def test_openrazer_access_files_keep_authoritative_destinations_and_modes(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            prepared = root / "prepared"
+            rules = prepared / "install_files/udev/99-razer.rules"
+            helper = prepared / "install_files/udev/razer_mount"
+            rules.parent.mkdir(parents=True)
+            rules.write_text('GROUP="openrazer"\n', encoding="utf-8")
+            helper.write_text("#!/bin/sh\n", encoding="utf-8")
+            install = load_install_manifest(ROOT)
+
+            expected = {
+                "openrazer-native-udev-rules": (
+                    "/usr/lib/udev/rules.d/99-razer.rules",
+                    0o644,
+                    'GROUP="openrazer"\n',
+                ),
+                "openrazer-native-mount-helper": (
+                    "/usr/lib/udev/razer_mount",
+                    0o755,
+                    "#!/bin/sh\n",
+                ),
+            }
+            for build_id, (destination, mode, content) in expected.items():
+                artifact = _openrazer_source_file_projection(
+                    root / "artifacts",
+                    install.build(build_id),
+                    SimpleNamespace(root=prepared),
+                )
+                self.assertEqual(artifact.kind, "source-file")
+                self.assertEqual(artifact.destination, destination)
+                self.assertEqual(artifact.mode, mode)
+                self.assertEqual(artifact.path.stat().st_mode & 0o777, mode)
+                self.assertEqual(artifact.path.read_text(encoding="utf-8"), content)
+
+    def test_openrazer_access_file_rejects_a_symbolic_link(self) -> None:
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            prepared = root / "prepared"
+            source = prepared / "install_files/udev/99-razer.rules"
+            source.parent.mkdir(parents=True)
+            target = root / "outside.rules"
+            target.write_text('GROUP="openrazer"\n', encoding="utf-8")
+            source.symlink_to(target)
+            build = load_install_manifest(ROOT).build("openrazer-native-udev-rules")
+
+            with self.assertRaisesRegex(ModelError, "transformed source file is missing"):
+                _openrazer_source_file_projection(
+                    root / "artifacts",
+                    build,
+                    SimpleNamespace(root=prepared),
+                )
+
     def test_openrgb_build_uses_the_source_bound_native_transform(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             output = Path(temporary)
@@ -241,6 +295,7 @@ def _artifact_manifest(self, directory: Path) -> Path:
             artifact_kind = {
                 "python-project": "python-wheel",
                 "source-transform": "source-tree",
+                "source-transform-file": "source-file",
             }.get(build.kind, build.kind)
             path = directory / "files" / build.id / (
                 f"{build.id}.whl" if build.kind == "python-project" else build.target or build.id
@@ -253,11 +308,7 @@ def _artifact_manifest(self, directory: Path) -> Path:
                 "path": path.relative_to(directory).as_posix(),
                 "sha256": sha256_file(path),
                 "size": path.stat().st_size,
-                "mode": (
-                    "0644"
-                    if build.kind in {"python-project", "source-transform"}
-                    else "0755"
-                ),
+                "mode": f"{(build.mode or 0o644):04o}",
             }
             if build.destination is not None:
                 value["destination"] = build.destination
@@ -303,7 +354,10 @@ def test_artifact_manifest_binds_every_declared_build(self) -> None:
                 return_value=("a" * 40, 1_700_000_000),
             ):
                 artifacts = load_artifact_set(ROOT, path)
-            self.assertEqual(len(artifacts.artifacts), 10)
+            self.assertEqual(
+                len(artifacts.artifacts),
+                len(load_install_manifest(ROOT).builds),
+            )
             self.assertFalse(artifacts.omitted)
 
     def test_artifact_tamper_is_rejected_before_staging(self) -> None:
diff --git a/tests/test_verify.py b/tests/test_verify.py
index f3791e1..b0c50e3 100644
--- a/tests/test_verify.py
+++ b/tests/test_verify.py
@@ -13,6 +13,7 @@
 from tools.hfxdev.verify import (
     _check_build_cache_clock,
     _kernel_build_directories,
+    _openrazer_payload_retry_is_safe,
     _python_sdk_license_files,
     _resolve_schema_reference,
     _run_openrgb_adapter_contracts,
@@ -22,6 +23,37 @@
 
 
 class VerificationGuardTests(unittest.TestCase):
+    def test_openrazer_single_attempt_payload_needs_no_retry_guard(self) -> None:
+        source = """
+static int razer_send_payload(struct device *device)
+{
+    int err = razer_get_report(device);
+    return err;
+}
+"""
+        self.assertTrue(_openrazer_payload_retry_is_safe(source))
+
+    def test_openrazer_retry_requires_an_uncertain_outcome_guard(self) -> None:
+        unsafe = """
+static int razer_send_payload(struct device *device)
+{
+    int err;
+retry:
+    err = razer_get_report(device);
+    if (err)
+        goto retry;
+    return err;
+}
+"""
+        guarded = unsafe.replace(
+            "    if (err)\n",
+            "    if (razer_hyperflux_error_is_uncertain(err))\n"
+            "        return err;\n"
+            "    if (err)\n",
+        )
+        self.assertFalse(_openrazer_payload_retry_is_safe(unsafe))
+        self.assertTrue(_openrazer_payload_retry_is_safe(guarded))
+
     def test_kernel_build_directories_deduplicate_resolved_aliases(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
             root = Path(temporary)
diff --git a/tools/hfxdev/distribution_package.py b/tools/hfxdev/distribution_package.py
index 3a5702b..87bcf4f 100644
--- a/tools/hfxdev/distribution_package.py
+++ b/tools/hfxdev/distribution_package.py
@@ -140,6 +140,7 @@ def _arch_install(runtime: LinuxRuntime) -> str:
             "",
             "_hyperflux_refresh_system() {",
             "  systemd-sysusers hyperflux-next.conf",
+            "  systemd-sysusers openrazer.conf",
             "  systemd-tmpfiles --create hyperflux-next.conf",
             "  systemctl daemon-reload",
             "  udevadm control --reload",
diff --git a/tools/hfxdev/generators/openrazer_native.py b/tools/hfxdev/generators/openrazer_native.py
index ebd62c8..d2a1ed8 100644
--- a/tools/hfxdev/generators/openrazer_native.py
+++ b/tools/hfxdev/generators/openrazer_native.py
@@ -88,9 +88,21 @@ def relay_service(
     )
 
 
+def sysusers(deployment: OpenRazerNativeDeployment) -> str:
+    return "\n".join(
+        [
+            "# Generated by ./hfx generate. Do not edit manually.",
+            "# SPDX-License-Identifier: GPL-2.0-only",
+            f"g {deployment.access.group} -",
+            "",
+        ]
+    )
+
+
 def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> str:
     relay = deployment.relay
     driver = deployment.driver
+    access = deployment.access
     return "\n".join(
         [
             "# OpenRazer Native Route Deployment",
@@ -126,5 +138,18 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
             "tree, projects only its DKMS build inputs, and verifies every transformed digest. "
             "The ordinary BUS_USB tables and direct-device transport remain upstream-owned.",
             "",
+            "## Local Access",
+            "",
+            "| Field | Value |",
+            "| --- | --- |",
+            f"| Group | `{access.group}` |",
+            f"| Udev rules | `{access.udev_rules_path}` |",
+            f"| Mount helper | `{access.mount_helper_path}` |",
+            f"| Sysusers declaration | `{access.sysusers_path}` |",
+            "",
+            "The rules and helper are selected from the same transformed, pinned OpenRazer "
+            "tree as the DKMS source. The package manager owns every deployed file, and the "
+            "distribution group substitution is part of the reviewed source transform.",
+            "",
         ]
     )
diff --git a/tools/hfxdev/install.py b/tools/hfxdev/install.py
index a25ceb0..1f74f1c 100644
--- a/tools/hfxdev/install.py
+++ b/tools/hfxdev/install.py
@@ -51,6 +51,7 @@
     "required",
     "capability",
 }
+SOURCE_TRANSFORM_FILE_KEYS = SOURCE_TRANSFORM_KEYS | {"source"}
 PAYLOAD_KEYS = {"id", "kind", "source", "destination", "mode", "preserve", "include"}
 IDENTIFIER = re.compile(r"^[a-z][a-z0-9-]{0,63}$")
 DISTRIBUTION = re.compile(r"^[a-z][a-z0-9-]{0,95}$")
@@ -211,6 +212,9 @@ def _tokens(root: Path, runtime: LinuxRuntime) -> dict[str, str]:
         "@bridge_configuration_file_path@": runtime.bridge.configuration_file_path,
         "@openrazer_relay_executable_path@": openrazer.relay.executable_path,
         "@openrazer_dkms_source_directory@": openrazer.driver.source_directory,
+        "@openrazer_udev_rules_path@": openrazer.access.udev_rules_path,
+        "@openrazer_mount_helper_path@": openrazer.access.mount_helper_path,
+        "@openrazer_sysusers_path@": openrazer.access.sysusers_path,
     }
 
 
@@ -292,6 +296,34 @@ def _source_transform_build(
     )
 
 
+def _source_transform_file_build(
+    value: dict[str, Any], tokens: dict[str, str], label: str
+) -> BuildSpec:
+    _exact(value, SOURCE_TRANSFORM_FILE_KEYS, label)
+    if value["required"] is not True:
+        raise ModelError(f"{label}: source transform file must be required")
+    source = value["source"]
+    if (
+        not isinstance(source, str)
+        or not source
+        or source.startswith("/")
+        or str(PurePosixPath(source)) != source
+        or ".." in PurePosixPath(source).parts
+        or len(source.encode()) > 256
+    ):
+        raise ModelError(f"{label}: source transform file path is invalid")
+    return BuildSpec(
+        id=_identifier(value["id"], f"{label} id"),
+        kind="source-transform-file",
+        required=True,
+        source=source,
+        transform=_identifier(value["transform"], f"{label} transform"),
+        destination=_destination(value["destination"], f"{label} destination", tokens),
+        mode=_mode(value["mode"], f"{label} mode"),
+        capability=_identifier(value["capability"], f"{label} capability"),
+    )
+
+
 def _load_builds(
     root: Path, values: list[Any], tokens: dict[str, str]
 ) -> tuple[BuildSpec, ...]:
@@ -308,6 +340,8 @@ def _load_builds(
             builds.append(_python_build(root, value, label))
         elif kind == "source-transform":
             builds.append(_source_transform_build(value, tokens, label))
+        elif kind == "source-transform-file":
+            builds.append(_source_transform_file_build(value, tokens, label))
         else:
             raise ModelError(f"{label}: unsupported build kind")
     require_unique([build.id for build in builds], "install build id")
@@ -487,6 +521,30 @@ def _check_cross_contract(
         or not driver.required
     ):
         raise ModelError("OpenRazer native driver build does not match its deployment authority")
+    rules = build_by_id.get("openrazer-native-udev-rules")
+    if (
+        rules is None
+        or rules.kind != "source-transform-file"
+        or rules.transform != "openrazer-native-route"
+        or rules.capability != "openrazer-source"
+        or rules.source != openrazer.access.udev_rules_source
+        or rules.destination != openrazer.access.udev_rules_path
+        or rules.mode != 0o644
+        or not rules.required
+    ):
+        raise ModelError("OpenRazer native udev rules build does not match its deployment authority")
+    helper = build_by_id.get("openrazer-native-mount-helper")
+    if (
+        helper is None
+        or helper.kind != "source-transform-file"
+        or helper.transform != "openrazer-native-route"
+        or helper.capability != "openrazer-source"
+        or helper.source != openrazer.access.mount_helper_source
+        or helper.destination != openrazer.access.mount_helper_path
+        or helper.mode != 0o755
+        or not helper.required
+    ):
+        raise ModelError("OpenRazer native mount helper build does not match its deployment authority")
 
     payload_by_id = {payload.id: payload for payload in payloads}
     relay_service = payload_by_id.get("openrazer-native-relay-service")
@@ -496,6 +554,15 @@ def _check_cross_contract(
         != f"/usr/lib/systemd/system/{openrazer.relay.service_unit}"
     ):
         raise ModelError("OpenRazer native relay service is missing from the package")
+    openrazer_group = payload_by_id.get("openrazer-system-group")
+    if (
+        openrazer_group is None
+        or openrazer_group.source != "packaging/generated/openrazer.sysusers"
+        or openrazer_group.destination != openrazer.access.sysusers_path
+        or openrazer_group.mode != 0o644
+        or openrazer_group.preserve
+    ):
+        raise ModelError("OpenRazer native system group is missing from the package")
     configuration = payload_by_id.get("default-configuration")
     if (
         configuration is None
diff --git a/tools/hfxdev/native_probe.py b/tools/hfxdev/native_probe.py
index aa96ee1..9717d36 100644
--- a/tools/hfxdev/native_probe.py
+++ b/tools/hfxdev/native_probe.py
@@ -259,9 +259,9 @@ def _skip_c_quoted(source: str, index: int, quote: str) -> int:
     raise ModelError("unterminated quoted string in pinned OpenRazer source")
 
 
-def _c_function(source: str, name: str) -> tuple[str, int]:
+def c_function_source(source: str, name: str) -> tuple[str, int]:
     pattern = re.compile(
-        rf"(?m)^(?:static\s+)?(?:ssize_t|struct\s+razer_report)\s+{re.escape(name)}\s*\("
+        rf"(?m)^(?:static\s+)?(?:int|ssize_t|struct\s+razer_report)\s+{re.escape(name)}\s*\("
     )
     match = pattern.search(source)
     if match is None:
@@ -358,7 +358,7 @@ def _compile_report_expressions(
             if _expression_function(expression) != "get_razer_report"
         }
     )
-    function_sources = [_c_function(chroma_source, name)[0] for name in functions]
+    function_sources = [c_function_source(chroma_source, name)[0] for name in functions]
     constant_lines = "\n".join(
         f"#define {name} {constants[name]}" for name in required_constants
     )
@@ -515,9 +515,9 @@ def transformed_native_probe_catalog(root: Path, source_root: Path) -> dict[str,
             reader = readers.get(attribute)
             if reader is None:
                 raise ModelError(f"OpenRazer driver lacks readable attribute {attribute}")
-            reader_source, _ = _c_function(source, reader)
+            reader_source, _ = c_function_source(source, reader)
             owner = binding["request_owner"]
-            owner_source, owner_line = _c_function(source, owner)
+            owner_source, owner_line = c_function_source(source, owner)
             if reader != owner and owner not in reader_source:
                 raise ModelError(
                     f"OpenRazer attribute {attribute} does not delegate to {owner}"
diff --git a/tools/hfxdev/openrazer_native_route.py b/tools/hfxdev/openrazer_native_route.py
index 4744414..3466157 100644
--- a/tools/hfxdev/openrazer_native_route.py
+++ b/tools/hfxdev/openrazer_native_route.py
@@ -30,9 +30,17 @@
 DEPLOYMENT_SCHEMA = "hyperflux-openrazer-native-deployment-v1"
 CATALOG_SCHEMA = "hyperflux-openrazer-native-route-catalog-v1"
 TRANSFORM_KEYS = {"$schema", "schema", "upstream", "patch", "files"}
-DEPLOYMENT_KEYS = {"$schema", "schema", "relay", "driver"}
+DEPLOYMENT_KEYS = {"$schema", "schema", "relay", "driver", "access"}
 RELAY_KEYS = {"executable_path", "service_unit", "uhid_device", "restart_seconds"}
 DRIVER_KEYS = {"dkms_name", "dkms_version", "source_directory", "modules"}
+ACCESS_KEYS = {
+    "group",
+    "udev_rules_source",
+    "udev_rules_path",
+    "mount_helper_source",
+    "mount_helper_path",
+    "sysusers_path",
+}
 UPSTREAM_KEYS = {"id", "repository", "commit"}
 PATCH_KEYS = {"path", "sha256"}
 FILE_KEYS = {"path", "source_sha256", "transformed_sha256"}
@@ -67,6 +75,10 @@
 NATIVE_PROTOCOL_FAMILY = "razer-feature-report-v1"
 NATIVE_REPORT_BYTES = 90
 NATIVE_PHYS_PREFIX = "hyperflux-next/native/v1/"
+NATIVE_AUXILIARY_TRANSFORM_PATHS = {
+    "install_files/udev/99-razer.rules",
+    "install_files/udev/razer_mount",
+}
 
 
 @dataclass(frozen=True)
@@ -93,11 +105,22 @@ class OpenRazerDriverDeployment:
     modules: tuple[str, ...]
 
 
+@dataclass(frozen=True)
+class OpenRazerAccessDeployment:
+    group: str
+    udev_rules_source: str
+    udev_rules_path: str
+    mount_helper_source: str
+    mount_helper_path: str
+    sysusers_path: str
+
+
 @dataclass(frozen=True)
 class OpenRazerNativeDeployment:
     source_sha256: str
     relay: OpenRazerRelayDeployment
     driver: OpenRazerDriverDeployment
+    access: OpenRazerAccessDeployment
 
 
 def _json_payload(value: dict[str, Any]) -> bytes:
@@ -342,8 +365,16 @@ def load_native_transform(root: Path) -> dict[str, Any]:
             raise ModelError(f"OpenRazer native transform file {index}: expected an object")
         _exact_keys(record, FILE_KEYS, f"OpenRazer native transform file {index}")
         path = _safe_relative_path(record["path"], f"OpenRazer native transform file {index}")
-        if not path.parts or path.parts[0] != "driver":
-            raise ModelError(f"OpenRazer native transform file {index}: path must remain below driver/")
+        if (
+            not path.parts
+            or (
+                path.parts[0] != "driver"
+                and path.as_posix() not in NATIVE_AUXILIARY_TRANSFORM_PATHS
+            )
+        ):
+            raise ModelError(
+                f"OpenRazer native transform file {index}: path is outside the approved source set"
+            )
         _digest(record["source_sha256"], f"OpenRazer native transform file {index} source")
         _digest(
             record["transformed_sha256"],
@@ -421,6 +452,23 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
         )
     ):
         raise ModelError("OpenRazer native DKMS module inventory is invalid")
+
+    access = value["access"]
+    if not isinstance(access, dict):
+        raise ModelError("OpenRazer native access deployment must be an object")
+    _exact_keys(access, ACCESS_KEYS, "OpenRazer native access deployment")
+    if access["group"] != "openrazer":
+        raise ModelError("OpenRazer native access group must match the distribution contract")
+    expected_access = {
+        "udev_rules_source": "install_files/udev/99-razer.rules",
+        "udev_rules_path": "/usr/lib/udev/rules.d/99-razer.rules",
+        "mount_helper_source": "install_files/udev/razer_mount",
+        "mount_helper_path": "/usr/lib/udev/razer_mount",
+        "sysusers_path": "/usr/lib/sysusers.d/openrazer.conf",
+    }
+    for key, expected in expected_access.items():
+        if access[key] != expected:
+            raise ModelError(f"OpenRazer native access {key} differs from its deployment contract")
     return OpenRazerNativeDeployment(
         source_sha256=sha256_file(path),
         relay=OpenRazerRelayDeployment(
@@ -435,6 +483,14 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
             source_directory=source_directory,
             modules=tuple(modules),
         ),
+        access=OpenRazerAccessDeployment(
+            group=access["group"],
+            udev_rules_source=access["udev_rules_source"],
+            udev_rules_path=access["udev_rules_path"],
+            mount_helper_source=access["mount_helper_source"],
+            mount_helper_path=access["mount_helper_path"],
+            sysusers_path=access["sysusers_path"],
+        ),
     )
 
 
diff --git a/tools/hfxdev/package_pipeline.py b/tools/hfxdev/package_pipeline.py
index f0d9898..a05bd89 100644
--- a/tools/hfxdev/package_pipeline.py
+++ b/tools/hfxdev/package_pipeline.py
@@ -25,6 +25,7 @@
 from .linux_runtime import LinuxRuntime, load_linux_runtime
 from .model import ModelError, load_json, require_unique, sha256_file
 from .openrazer_native_route import (
+    PreparedOpenRazerNativeSource,
     load_native_deployment,
     load_native_transform as load_openrazer_native_transform,
     prepare_openrazer_native_source,
@@ -462,18 +463,10 @@ def _openrazer_dkms_projection(
     output: Path,
     environment: dict[str, str],
     build: BuildSpec,
-    capabilities: dict[str, Path],
+    prepared: PreparedOpenRazerNativeSource,
 ) -> BuiltArtifact:
     if build.transform != "openrazer-native-route" or build.capability != "openrazer-source":
         raise ModelError(f"build {build.id}: unsupported source transform")
-    source_value = capabilities.get(build.capability)
-    if source_value is None:
-        raise ModelError(
-            f"build {build.id}: required capability {build.capability} is absent"
-        )
-    source = _pinned_source(root, build.capability, source_value)
-    prepared_path = output / "work" / build.id / "prepared"
-    prepared = prepare_openrazer_native_source(root, source, prepared_path)
     deployment = load_native_deployment(root)
     _verify_openrazer_dkms_contract(prepared.root, deployment)
 
@@ -504,6 +497,52 @@ def _openrazer_dkms_projection(
     )
 
 
+def _openrazer_source_file_projection(
+    output: Path,
+    build: BuildSpec,
+    prepared: PreparedOpenRazerNativeSource,
+) -> BuiltArtifact:
+    if build.transform != "openrazer-native-route" or build.capability != "openrazer-source":
+        raise ModelError(f"build {build.id}: unsupported source transform file")
+    if build.source is None or build.destination is None or build.mode is None:
+        raise ModelError(f"build {build.id}: source transform file is incomplete")
+    source = prepared.root / PurePosixPath(build.source)
+    if (
+        not source.is_file()
+        or source.is_symlink()
+        or not source.resolve().is_relative_to(prepared.root.resolve())
+    ):
+        raise ModelError(f"build {build.id}: transformed source file is missing")
+    return _copy_artifact(
+        source,
+        output,
+        build,
+        kind="source-file",
+        destination=build.destination,
+        mode=build.mode,
+    )
+
+
+def _prepare_openrazer_source_transform(
+    root: Path,
+    output: Path,
+    builds: list[BuildSpec],
+    capabilities: dict[str, Path],
+) -> PreparedOpenRazerNativeSource:
+    if any(
+        build.transform != "openrazer-native-route"
+        or build.capability != "openrazer-source"
+        for build in builds
+    ):
+        raise ModelError("OpenRazer source transform build set is inconsistent")
+    source_value = capabilities.get("openrazer-source")
+    if source_value is None:
+        raise ModelError("required capability openrazer-source is absent")
+    source = _pinned_source(root, "openrazer-source", source_value)
+    prepared_path = output / "work" / "openrazer-native-route" / "prepared"
+    return prepare_openrazer_native_source(root, source, prepared_path)
+
+
 def _openrazer_dkms_projection_files(
     prepared: Path, projection: Path
 ) -> tuple[tuple[Path, Path], ...]:
@@ -726,6 +765,18 @@ def build_artifacts(
     artifacts: list[BuiltArtifact] = []
     cargo = [build for build in install.builds if build.kind == "cargo-binary"]
     artifacts.extend(_build_cargo(root, output, environment, cargo))
+    openrazer_builds = [
+        build
+        for build in install.builds
+        if build.kind in {"source-transform", "source-transform-file"}
+    ]
+    prepared_openrazer = (
+        _prepare_openrazer_source_transform(
+            root, output, openrazer_builds, capabilities
+        )
+        if openrazer_builds
+        else None
+    )
     omitted: list[tuple[str, str]] = []
     for build in install.builds:
         if build.kind == "cmake-module":
@@ -741,7 +792,13 @@ def build_artifacts(
         elif build.kind == "source-transform":
             artifacts.append(
                 _openrazer_dkms_projection(
-                    root, output, environment, build, capabilities
+                    root, output, environment, build, prepared_openrazer
+                )
+            )
+        elif build.kind == "source-transform-file":
+            artifacts.append(
+                _openrazer_source_file_projection(
+                    output, build, prepared_openrazer
                 )
             )
 
@@ -785,7 +842,13 @@ def _manifest_artifact(root: Path, value: Any, label: str) -> BuiltArtifact:
     kind = value["kind"]
     if not isinstance(build_id, str) or not re.fullmatch(r"[a-z][a-z0-9-]{0,63}", build_id):
         raise ModelError(f"{label}: invalid build id")
-    if kind not in {"cargo-binary", "cmake-module", "python-wheel", "source-tree"}:
+    if kind not in {
+        "cargo-binary",
+        "cmake-module",
+        "python-wheel",
+        "source-tree",
+        "source-file",
+    }:
         raise ModelError(f"{label}: invalid artifact kind")
     path_value = value["path"]
     if not isinstance(path_value, str) or path_value.startswith("/"):
@@ -1021,6 +1084,7 @@ def load_artifact_set(root: Path, manifest_path: Path) -> ArtifactSet:
         expected_kind = {
             "python-project": "python-wheel",
             "source-transform": "source-tree",
+            "source-transform-file": "source-file",
         }.get(build.kind, build.kind)
         if artifact.kind != expected_kind:
             raise ModelError(f"artifact {artifact.build_id}: kind does not match install contract")
diff --git a/tools/hfxdev/render.py b/tools/hfxdev/render.py
index a70fc6e..e01dbde 100644
--- a/tools/hfxdev/render.py
+++ b/tools/hfxdev/render.py
@@ -96,6 +96,7 @@
     markdown as openrazer_native_markdown,
     relay_service as openrazer_native_relay_service,
     rust_constants as openrazer_native_rust_constants,
+    sysusers as openrazer_native_sysusers,
 )
 from .generators.profiles import (
     compiled_json as profile_compiled_json,
@@ -424,6 +425,9 @@ def rendered_files(root: Path) -> dict[Path, str]:
         / openrazer_native.relay.service_unit: openrazer_native_relay_service(
             openrazer_native, linux_runtime
         ),
+        root / "packaging" / "generated" / "openrazer.sysusers": openrazer_native_sysusers(
+            openrazer_native
+        ),
         root / "packaging" / "generated" / "hyperflux-next-activation.service": activation_service(linux_runtime),
         root / "packaging" / "generated" / "hyperflux-next-confirmation.service": confirmation_service(linux_runtime),
         root / "packaging" / "generated" / "hyperflux-next.sysusers": sysusers(linux_runtime),
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index da1b443..820b5cf 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -32,6 +32,7 @@
     transformed_native_inventory,
 )
 from .native_probe import (
+    c_function_source,
     load_native_probe_catalog,
     load_native_probe_policy,
     transformed_native_probe_catalog,
@@ -91,6 +92,19 @@
 INSTALLED_SCHEMA_ROOT = Path("/usr/share/hyperflux-next/schemas")
 
 
+def _openrazer_payload_retry_is_safe(source: str) -> bool:
+    payload, _ = c_function_source(source, "razer_send_payload")
+    if "razer_hyperflux_error_is_uncertain(err)" in payload:
+        return True
+    return (
+        payload.count("razer_get_report(") == 1
+        and "goto " not in payload
+        and "retry:" not in payload
+        and not re.search(r"\b(?:for|while)\s*\(", payload)
+        and not re.search(r"\bdo\s*\{", payload)
+    )
+
+
 def _check_constitution(constitution: dict) -> None:
     if constitution.get("schema") != "hyperflux-architecture-constitution-v1":
         raise ModelError("unsupported architecture constitution schema")
@@ -746,6 +760,7 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
     common = (prepared.root / "driver" / "razercommon.c").read_text(encoding="utf-8")
     required_common = (
         'RAZER_HYPERFLUX_PHYS_PREFIX "hyperflux-next/native/v1/"',
+        "!hdev->phys[0]",
         "hdev->dev_rsize != sizeof(razer_hyperflux_descriptor)",
         "hid_hw_raw_request(hdev, 0",
         "RAZER_HYPERFLUX_TRANSPORT_NOT_SENT",
@@ -753,13 +768,38 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
     )
     if any(marker not in common for marker in required_common):
         raise ModelError("OpenRazer native common transport is incomplete")
+
+    rules = (prepared.root / "install_files" / "udev" / "99-razer.rules").read_text(
+        encoding="utf-8"
+    )
+    bind_rules = (
+        'ACTION=="bind", SUBSYSTEM=="hid", KERNEL=="0006:1532:*", '
+        'ENV{HID_PHYS}=="hyperflux-next/native/v1/*", DRIVER=="razerkbd", '
+        'RUN+="razer_mount razerkbd $kernel"',
+        'ACTION=="bind", SUBSYSTEM=="hid", KERNEL=="0006:1532:*", '
+        'ENV{HID_PHYS}=="hyperflux-next/native/v1/*", DRIVER=="razermouse", '
+        'RUN+="razer_mount razermouse $kernel"',
+    )
+    if any(rules.count(marker) != 1 for marker in bind_rules):
+        raise ModelError("OpenRazer native virtual-device access rules are incomplete")
+    if any(rules.index(marker) > rules.index('ACTION!="add"') for marker in bind_rules):
+        raise ModelError("OpenRazer native virtual-device access rules run after the add-only gate")
+    if 'GROUP:="openrazer"' not in rules or "plugdev" in rules:
+        raise ModelError("OpenRazer native udev group differs from its deployment authority")
+
+    mount_helper = (prepared.root / "install_files" / "udev" / "razer_mount").read_text(
+        encoding="utf-8"
+    )
+    if "chgrp -R openrazer" not in mount_helper or "plugdev" in mount_helper:
+        raise ModelError("OpenRazer native mount helper group differs from its deployment authority")
+
     for driver in ("razerkbd_driver.c", "razermouse_driver.c"):
         source_text = (prepared.root / "driver" / driver).read_text(encoding="utf-8")
         if source_text.count("HID_DEVICE(BUS_VIRTUAL,HID_GROUP_ANY") != 1:
             raise ModelError(f"OpenRazer native {driver} has an invalid virtual match boundary")
         if "identity->bus == BUS_USB" not in source_text:
             raise ModelError(f"OpenRazer native {driver} no longer reuses its exact USB catalog")
-        if "razer_hyperflux_error_is_uncertain(err)" not in source_text:
+        if not _openrazer_payload_retry_is_safe(source_text):
             raise ModelError(f"OpenRazer native {driver} can retry an uncertain transaction")
 
     prepared_driver = prepared.root / "driver"

From e473e0c1a819542a7ac536fc44fbbe6e806a4d6a Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Mon, 27 Jul 2026 00:14:33 +0400
Subject: [PATCH 64/67] Rebase native OpenRazer route onto 3.12.4

---
 .../tests/fixtures/rust-qualified-mouse.json  |   2 +-
 .../tests/fixtures/rust-qualified-pair.json   |   2 +-
 assurance/generated/hyperflux-next.spdx.json  |  10 +-
 crates/hfx-errors/src/generated.rs            | 234 +++++++++----
 crates/hfx-integration-model/src/generated.rs |   6 +-
 .../src/openrazer_native_generated.rs         |  10 +-
 crates/hfx-ops/src/activation.rs              |   6 +-
 crates/hfx-ops/src/assessment.rs              | 111 +++++-
 .../src/bin/hyperflux-next-activate.rs        |  71 +++-
 crates/hfx-ops/src/lib.rs                     |   6 +-
 crates/hfx-ops/src/probe.rs                   | 203 ++++++++++-
 crates/hfx-ops/src/qualification.rs           |   5 +
 crates/hfx-ops/src/support.rs                 |   5 +
 crates/hfx-profiles/src/generated.rs          |   4 +-
 docs/generated/development-environment.md     |   2 +-
 docs/generated/device-knowledge.md            |  36 +-
 docs/generated/distributions.md               |   8 +-
 docs/generated/error-catalog.md               |  57 ++-
 docs/generated/installation.md                |   2 +-
 docs/generated/integrations.md                |   4 +-
 docs/generated/openrazer-native-deployment.md |  18 +-
 docs/generated/supply-chain.md                |   2 +-
 docs/generated/supported-hardware.md          |   2 +-
 .../generated/hyperflux_receiver_profiles.inc |   2 +-
 errors/catalog.json                           |  51 +++
 generated/integrations/catalog.json           |   6 +-
 generated/knowledge/catalog.json              |  42 +--
 generated/profiles/catalog.json               |   4 +-
 integrations/catalog.json                     |   4 +-
 integrations/openrazer/compatibility.json     |   2 +-
 .../generated_contract.py                     |   2 +-
 integrations/openrazer/import.json            |   2 +-
 integrations/openrazer/metadata.json          |   6 +-
 .../openrazer/native-control-policy.json      |   2 +-
 .../openrazer/native-method-inventory.json    |  14 +-
 .../openrazer/native-probe-catalog.json       |  36 +-
 .../openrazer/native-probe-policy.json        |   2 +-
 .../openrazer/native-route/catalog.json       |   4 +-
 .../openrazer/native-route/deployment.json    |  18 +-
 ...usted-HyperFlux-native-HID-transport.patch | 131 +++----
 .../openrazer/native-route/transform.json     |  16 +-
 knowledge/upstreams/openrazer.json            |   4 +-
 packaging/distributions.json                  |  15 +-
 .../hyperflux-next-openrazer-relay.service    |   1 +
 packaging/generated/install-plan.json         |   2 +-
 profiles/lifecycle-policies.json              |   2 +-
 .../openrazer-native-deployment.schema.json   |  51 ++-
 .../hyperflux/generated/error_catalog.hpp     | 165 +++++----
 .../generated/integration_catalog.hpp         |   4 +-
 .../hyperflux/generated/profile_catalog.hpp   |   4 +-
 .../hyperflux_sdk/generated/error_catalog.py  | 190 ++++++++--
 .../generated/integration_catalog.py          |   6 +-
 .../generated/openrazer_metadata.py           |   6 +-
 .../generated/profile_catalog.py              |   6 +-
 .../cpp/openrgb_controller_model_contract.cpp |   4 +-
 .../generated/profile-compositions.json       |   2 +-
 tests/test_device_knowledge.py                |   2 +-
 tests/test_distribution_debian.py             |   6 +-
 tests/test_distribution_package.py            |  12 +-
 tests/test_distribution_rpm.py                |   2 +
 tests/test_integrations.py                    |   2 +-
 tools/hfxdev/arch_update_policy.py            | 330 ++++++++++++++++++
 tools/hfxdev/distribution_package.py          |  27 +-
 tools/hfxdev/distributions.py                 |  26 +-
 tools/hfxdev/generators/openrazer_native.py   |  36 ++
 tools/hfxdev/openrazer_native_route.py        | 104 +++++-
 tools/hfxdev/verify.py                        |  88 +++++
 67 files changed, 1844 insertions(+), 403 deletions(-)
 create mode 100644 tools/hfxdev/arch_update_policy.py

diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
index 4888fc5..4535336 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-mouse.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
+    "profile_catalog_digest": "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee"
   },
   "receivers": [
     {
diff --git a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
index 6828229..bda4674 100644
--- a/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
+++ b/apps/device-qualification/tests/fixtures/rust-qualified-pair.json
@@ -15,7 +15,7 @@
   "system": {
     "driver_version": "0.0.0-dev.1",
     "bridge_version": "0.0.0-dev.1",
-    "profile_catalog_digest": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
+    "profile_catalog_digest": "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee"
   },
   "receivers": [
     {
diff --git a/assurance/generated/hyperflux-next.spdx.json b/assurance/generated/hyperflux-next.spdx.json
index 8bb5d99..91ffbe3 100644
--- a/assurance/generated/hyperflux-next.spdx.json
+++ b/assurance/generated/hyperflux-next.spdx.json
@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "HyperFlux Next source dependency inventory",
-  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/5db9df91fc4c065eb1cc1cac43895ebc25f0d4d017084dc830be83b8e3dfc53b",
+  "documentNamespace": "https://hyperflux.dev/spdx/hyperflux-next/6235b6f83cecf4a78814eaf8f4e4f393a526082c09fc0161f15b2a2d8a07d66c",
   "creationInfo": {
     "created": "2026-07-20T00:00:00Z",
     "creators": [
@@ -1139,15 +1139,15 @@
       "comment": "Distribution-provided build dependency."
     },
     {
-      "SPDXID": "SPDXRef-Upstream-openrazer-ddea89607b86023e88563b8feabc8fa2d5773cdd",
+      "SPDXID": "SPDXRef-Upstream-openrazer-1ef8a91712906a89fd332a2ed62bbd105315d6d1",
       "name": "OpenRazer",
-      "versionInfo": "3.12.2",
+      "versionInfo": "3.12.4",
       "downloadLocation": "https://github.com/openrazer/openrazer.git",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "copyrightText": "NOASSERTION",
-      "comment": "Pinned integration source commit ddea89607b86023e88563b8feabc8fa2d5773cdd."
+      "comment": "Pinned integration source commit 1ef8a91712906a89fd332a2ed62bbd105315d6d1."
     },
     {
       "SPDXID": "SPDXRef-Upstream-openrgb-6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
@@ -2096,7 +2096,7 @@
       "relatedSpdxElement": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1"
     },
     {
-      "spdxElementId": "SPDXRef-Upstream-openrazer-ddea89607b86023e88563b8feabc8fa2d5773cdd",
+      "spdxElementId": "SPDXRef-Upstream-openrazer-1ef8a91712906a89fd332a2ed62bbd105315d6d1",
       "relationshipType": "BUILD_DEPENDENCY_OF",
       "relatedSpdxElement": "SPDXRef-Package-hyperflux-next-0.0.0-dev.1"
     },
diff --git a/crates/hfx-errors/src/generated.rs b/crates/hfx-errors/src/generated.rs
index 9f33927..d7f2d4a 100644
--- a/crates/hfx-errors/src/generated.rs
+++ b/crates/hfx-errors/src/generated.rs
@@ -68,6 +68,8 @@ wire_enum!(ErrorCode {
     HfxIntegration001 => "HFX-INTEGRATION-001",
     HfxIntegration002 => "HFX-INTEGRATION-002",
     HfxIntegration003 => "HFX-INTEGRATION-003",
+    HfxIntegration004 => "HFX-INTEGRATION-004",
+    HfxIntegration005 => "HFX-INTEGRATION-005",
     HfxInternal001 => "HFX-INTERNAL-001",
     HfxKernel001 => "HFX-KERNEL-001",
     HfxKernel002 => "HFX-KERNEL-002",
@@ -102,9 +104,11 @@ wire_enum!(RemediationId {
     QualifyDevice => "qualify-device",
     ReconcileTransactionState => "reconcile-transaction-state",
     RefreshGeneration => "refresh-generation",
+    ReinstallOpenrazerRouteDriver => "reinstall-openrazer-route-driver",
     ReleaseOwner => "release-owner",
     RepairStateStorage => "repair-state-storage",
     RetryBounded => "retry-bounded",
+    ReverifyOpenrazerSource => "reverify-openrazer-source",
     StartBridge => "start-bridge",
     SubmitBeforeDeadline => "submit-before-deadline",
     UpdateIntegration => "update-integration",
@@ -216,7 +220,7 @@ pub struct ErrorDescriptor {
 }
 
 pub const ERROR_CATALOG_SHA256: &str =
-    "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c";
+    "e709d84eae07623b6e59c2863cf707d9d3edb09381ef77f40fd0126cfca66afd";
 pub const MAX_ERROR_COUNT: usize = 256;
 pub const MAX_REMEDIATION_COUNT: usize = 128;
 pub const MAX_SAFE_DETAIL_FIELDS: usize = 12;
@@ -307,6 +311,13 @@ pub const REMEDIATIONS: &[RemediationDescriptor] = &[
         verification: "Confirm the request uses the currently active generation identifier.",
         automatic: true,
     },
+    RemediationDescriptor {
+        id: RemediationId::ReinstallOpenrazerRouteDriver,
+        title: "Restore the OpenRazer native-route capability",
+        safe_action: "Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor.",
+        verification: "Run Doctor and confirm the OpenRazer native-route capability finding is absent.",
+        automatic: false,
+    },
     RemediationDescriptor {
         id: RemediationId::ReleaseOwner,
         title: "Release the current owner",
@@ -328,6 +339,13 @@ pub const REMEDIATIONS: &[RemediationDescriptor] = &[
         verification: "Confirm the new attempt is admitted once and produces one terminal outcome.",
         automatic: true,
     },
+    RemediationDescriptor {
+        id: RemediationId::ReverifyOpenrazerSource,
+        title: "Use a verified OpenRazer source line",
+        safe_action: "Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified.",
+        verification: "Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay.",
+        automatic: false,
+    },
     RemediationDescriptor {
         id: RemediationId::StartBridge,
         title: "Start the bridge service",
@@ -460,7 +478,65 @@ const DETAILS_4: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "OpenRazer desktop-session access state.",
 }];
 
-const DETAIL_VALUES_5_1: &[&str] = &[
+const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
+    SafeDetailFieldDescriptor {
+        name: "capability",
+        kind: SafeDetailKind::Identifier,
+        required: true,
+        maximum_length: Some(64),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "Required HyperFlux native transport capability.",
+    },
+    SafeDetailFieldDescriptor {
+        name: "module",
+        kind: SafeDetailKind::Identifier,
+        required: true,
+        maximum_length: Some(64),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "OpenRazer module missing the native transport capability.",
+    },
+];
+
+const DETAIL_VALUES_6_1: &[&str] = &["rebase-reverification-required", "version-unverified"];
+
+const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
+    SafeDetailFieldDescriptor {
+        name: "observed_version",
+        kind: SafeDetailKind::Text,
+        required: true,
+        maximum_length: Some(32),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "Bounded upstream version reported by the installed OpenRazer daemon, or unavailable.",
+    },
+    SafeDetailFieldDescriptor {
+        name: "runtime_state",
+        kind: SafeDetailKind::Enum,
+        required: true,
+        maximum_length: None,
+        maximum_value: None,
+        allowed_values: DETAIL_VALUES_6_1,
+        privacy: PrivacyClass::Public,
+        description: "OpenRazer source-line verification state.",
+    },
+    SafeDetailFieldDescriptor {
+        name: "verified_version",
+        kind: SafeDetailKind::Text,
+        required: true,
+        maximum_length: Some(32),
+        maximum_value: None,
+        allowed_values: &[],
+        privacy: PrivacyClass::Public,
+        description: "OpenRazer upstream source version verified by this HyperFlux package.",
+    },
+];
+
+const DETAIL_VALUES_7_1: &[&str] = &[
     "bridge",
     "kernel",
     "persistence",
@@ -469,7 +545,7 @@ const DETAIL_VALUES_5_1: &[&str] = &[
     "transport",
 ];
 
-const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "invariant_id",
         kind: SafeDetailKind::Identifier,
@@ -486,13 +562,13 @@ const DETAILS_5: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_5_1,
+        allowed_values: DETAIL_VALUES_7_1,
         privacy: PrivacyClass::Public,
         description: "Subsystem that raised the invariant failure.",
     },
 ];
 
-const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_8: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "installed_abi",
         kind: SafeDetailKind::Identifier,
@@ -515,7 +591,7 @@ const DETAILS_6: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "installed_abi",
         kind: SafeDetailKind::Identifier,
@@ -548,7 +624,7 @@ const DETAILS_7: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_8: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_10: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -559,7 +635,7 @@ const DETAILS_8: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction identity that has no retained or eviction record.",
 }];
 
-const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "history_capacity",
         kind: SafeDetailKind::U16,
@@ -582,7 +658,7 @@ const DETAILS_9: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "owner_name",
         kind: SafeDetailKind::Text,
@@ -605,9 +681,9 @@ const DETAILS_10: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_11_1: &[&str] = &["expired", "released", "revoked"];
+const DETAIL_VALUES_13_1: &[&str] = &["expired", "released", "revoked"];
 
-const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "lease_id",
         kind: SafeDetailKind::Identifier,
@@ -624,29 +700,29 @@ const DETAILS_11: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_11_1,
+        allowed_values: DETAIL_VALUES_13_1,
         privacy: PrivacyClass::Public,
         description: "Terminal lease state.",
     },
 ];
 
-const DETAIL_VALUES_12_0: &[&str] = &["load", "migrate", "validate"];
+const DETAIL_VALUES_14_0: &[&str] = &["load", "migrate", "validate"];
 
-const DETAIL_VALUES_12_1: &[&str] = &[
+const DETAIL_VALUES_14_1: &[&str] = &[
     "corrupt",
     "incompatible-schema",
     "missing",
     "permission-denied",
 ];
 
-const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_12_0,
+        allowed_values: DETAIL_VALUES_14_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-read phase.",
     },
@@ -656,24 +732,24 @@ const DETAILS_12: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_12_1,
+        allowed_values: DETAIL_VALUES_14_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAIL_VALUES_13_0: &[&str] = &["commit", "rollback", "snapshot"];
+const DETAIL_VALUES_15_0: &[&str] = &["commit", "rollback", "snapshot"];
 
-const DETAIL_VALUES_13_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
+const DETAIL_VALUES_15_1: &[&str] = &["io-failure", "permission-denied", "validation-failed"];
 
-const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "operation",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_13_0,
+        allowed_values: DETAIL_VALUES_15_0,
         privacy: PrivacyClass::Public,
         description: "Failed state-write phase.",
     },
@@ -683,13 +759,13 @@ const DETAILS_13: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_13_1,
+        allowed_values: DETAIL_VALUES_15_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized failure reason.",
     },
 ];
 
-const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capability",
         kind: SafeDetailKind::Identifier,
@@ -712,7 +788,7 @@ const DETAILS_14: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_17: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "active_digest",
         kind: SafeDetailKind::Identifier,
@@ -745,7 +821,7 @@ const DETAILS_15: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "client_max_version",
         kind: SafeDetailKind::U16,
@@ -788,7 +864,7 @@ const DETAILS_16: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_17: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_19: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "feature",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -799,7 +875,7 @@ const DETAILS_17: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Requested protocol feature identifier.",
 }];
 
-const DETAIL_VALUES_18_1: &[&str] = &[
+const DETAIL_VALUES_20_1: &[&str] = &[
     "configuration",
     "diagnostics",
     "effects",
@@ -807,7 +883,7 @@ const DETAIL_VALUES_18_1: &[&str] = &[
     "restore",
 ];
 
-const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_20: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "capacity",
         kind: SafeDetailKind::U16,
@@ -824,13 +900,13 @@ const DETAILS_18: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_18_1,
+        allowed_values: DETAIL_VALUES_20_1,
         privacy: PrivacyClass::Public,
         description: "Bounded queue that rejected admission.",
     },
 ];
 
-const DETAIL_VALUES_19_1: &[&str] = &[
+const DETAIL_VALUES_21_1: &[&str] = &[
     "duplicate",
     "missing",
     "out-of-range",
@@ -838,7 +914,7 @@ const DETAIL_VALUES_19_1: &[&str] = &[
     "unsupported",
 ];
 
-const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "field",
         kind: SafeDetailKind::Text,
@@ -855,7 +931,7 @@ const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_19_1,
+        allowed_values: DETAIL_VALUES_21_1,
         privacy: PrivacyClass::Public,
         description: "Sanitized validation reason.",
     },
@@ -871,7 +947,7 @@ const DETAILS_19: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAIL_VALUES_20_0: &[&str] = &[
+const DETAIL_VALUES_22_0: &[&str] = &[
     "activating",
     "active-unready",
     "failed",
@@ -880,27 +956,27 @@ const DETAIL_VALUES_20_0: &[&str] = &[
     "unavailable",
 ];
 
-const DETAILS_20: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_22: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "service_state",
     kind: SafeDetailKind::Enum,
     required: true,
     maximum_length: None,
     maximum_value: None,
-    allowed_values: DETAIL_VALUES_20_0,
+    allowed_values: DETAIL_VALUES_22_0,
     privacy: PrivacyClass::Public,
     description: "Sanitized bridge service state.",
 }];
 
-const DETAIL_VALUES_21_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
+const DETAIL_VALUES_23_0: &[&str] = &["device-absent", "session-unavailable", "transport-busy"];
 
-const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_23: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "reason",
         kind: SafeDetailKind::Enum,
         required: true,
         maximum_length: None,
         maximum_value: None,
-        allowed_values: DETAIL_VALUES_21_0,
+        allowed_values: DETAIL_VALUES_23_0,
         privacy: PrivacyClass::Public,
         description: "Sanitized pre-dispatch failure reason.",
     },
@@ -916,7 +992,7 @@ const DETAILS_21: &[SafeDetailFieldDescriptor] = &[
     },
 ];
 
-const DETAILS_22: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
+const DETAILS_24: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     name: "transaction_id",
     kind: SafeDetailKind::Identifier,
     required: true,
@@ -927,7 +1003,7 @@ const DETAILS_22: &[SafeDetailFieldDescriptor] = &[SafeDetailFieldDescriptor {
     description: "Transaction whose transport outcome is uncertain.",
 }];
 
-const DETAILS_23: &[SafeDetailFieldDescriptor] = &[
+const DETAILS_25: &[SafeDetailFieldDescriptor] = &[
     SafeDetailFieldDescriptor {
         name: "delivered_frames",
         kind: SafeDetailKind::U16,
@@ -1061,6 +1137,46 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         privacy: PrivacyClass::Public,
         docs_path: "docs/generated/error-catalog.md#hfx-integration-003",
     },
+    ErrorDescriptor {
+        code: ErrorCode::HfxIntegration004,
+        error_class: ErrorClass::Integration,
+        severity: ErrorSeverity::Error,
+        retry_policy: RetryPolicy::AfterRemediation,
+        side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
+        remediation_id: RemediationId::ReinstallOpenrazerRouteDriver,
+        safe_detail_fields: DETAILS_5,
+        lifecycle: LifecycleDescriptor {
+            state: ErrorLifecycleState::Active,
+            introduced_in: "0.0.0-dev.1",
+            deprecated_in: None,
+            replacement_code: None,
+        },
+        owner: ErrorOwner::Integration,
+        technical_cause: "An installed OpenRazer route module does not advertise the source-bound HyperFlux native transport capability.",
+        user_explanation: "The installed OpenRazer driver is not the verified HyperFlux native-route build.",
+        privacy: PrivacyClass::Public,
+        docs_path: "docs/generated/error-catalog.md#hfx-integration-004",
+    },
+    ErrorDescriptor {
+        code: ErrorCode::HfxIntegration005,
+        error_class: ErrorClass::Integration,
+        severity: ErrorSeverity::Error,
+        retry_policy: RetryPolicy::AfterRemediation,
+        side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
+        remediation_id: RemediationId::ReverifyOpenrazerSource,
+        safe_detail_fields: DETAILS_6,
+        lifecycle: LifecycleDescriptor {
+            state: ErrorLifecycleState::Active,
+            introduced_in: "0.0.0-dev.1",
+            deprecated_in: None,
+            replacement_code: None,
+        },
+        owner: ErrorOwner::Integration,
+        technical_cause: "The installed OpenRazer runtime is not bound to the upstream source line verified by the current HyperFlux native-route transform.",
+        user_explanation: "This OpenRazer update needs a HyperFlux rebase and fresh verification before the native relay can use it.",
+        privacy: PrivacyClass::Public,
+        docs_path: "docs/generated/error-catalog.md#hfx-integration-005",
+    },
     ErrorDescriptor {
         code: ErrorCode::HfxInternal001,
         error_class: ErrorClass::Internal,
@@ -1068,7 +1184,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::RuntimeReported,
         remediation_id: RemediationId::CollectSupportBundle,
-        safe_detail_fields: DETAILS_5,
+        safe_detail_fields: DETAILS_7,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1088,7 +1204,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ActivateInstalledDriver,
-        safe_detail_fields: DETAILS_6,
+        safe_detail_fields: DETAILS_8,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1108,7 +1224,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ActivateOpenrazerRouteDriver,
-        safe_detail_fields: DETAILS_7,
+        safe_detail_fields: DETAILS_9,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1128,7 +1244,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_8,
+        safe_detail_fields: DETAILS_10,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1148,7 +1264,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::ReconcileTransactionState,
-        safe_detail_fields: DETAILS_9,
+        safe_detail_fields: DETAILS_11,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1168,7 +1284,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::ReleaseOwner,
-        safe_detail_fields: DETAILS_10,
+        safe_detail_fields: DETAILS_12,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1188,7 +1304,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::AcquireNewLease,
-        safe_detail_fields: DETAILS_11,
+        safe_detail_fields: DETAILS_13,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1208,7 +1324,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_12,
+        safe_detail_fields: DETAILS_14,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1228,7 +1344,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::RepairStateStorage,
-        safe_detail_fields: DETAILS_13,
+        safe_detail_fields: DETAILS_15,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1248,7 +1364,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::QualifyDevice,
-        safe_detail_fields: DETAILS_14,
+        safe_detail_fields: DETAILS_16,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1268,7 +1384,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::VerifyProfileCatalog,
-        safe_detail_fields: DETAILS_15,
+        safe_detail_fields: DETAILS_17,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1288,7 +1404,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::UpdateProtocolPeer,
-        safe_detail_fields: DETAILS_16,
+        safe_detail_fields: DETAILS_18,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1308,7 +1424,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::DisableUnsupportedFeature,
-        safe_detail_fields: DETAILS_17,
+        safe_detail_fields: DETAILS_19,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1328,7 +1444,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_18,
+        safe_detail_fields: DETAILS_20,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1348,7 +1464,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::Never,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::CorrectRequest,
-        safe_detail_fields: DETAILS_19,
+        safe_detail_fields: DETAILS_21,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1368,7 +1484,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::AfterRemediation,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::NotApplicable,
         remediation_id: RemediationId::StartBridge,
-        safe_detail_fields: DETAILS_20,
+        safe_detail_fields: DETAILS_22,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1388,7 +1504,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::BoundedBackoff,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::MustBeNone,
         remediation_id: RemediationId::RetryBounded,
-        safe_detail_fields: DETAILS_21,
+        safe_detail_fields: DETAILS_23,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1408,7 +1524,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Possible,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_22,
+        safe_detail_fields: DETAILS_24,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
@@ -1428,7 +1544,7 @@ pub const ERRORS: &[ErrorDescriptor] = &[
         retry_policy: RetryPolicy::OutcomeLookupOnly,
         side_effect_certainty_policy: SideEffectCertaintyPolicy::Partial,
         remediation_id: RemediationId::LookupTransactionOutcome,
-        safe_detail_fields: DETAILS_23,
+        safe_detail_fields: DETAILS_25,
         lifecycle: LifecycleDescriptor {
             state: ErrorLifecycleState::Active,
             introduced_in: "0.0.0-dev.1",
diff --git a/crates/hfx-integration-model/src/generated.rs b/crates/hfx-integration-model/src/generated.rs
index 06c9827..fa241e3 100644
--- a/crates/hfx-integration-model/src/generated.rs
+++ b/crates/hfx-integration-model/src/generated.rs
@@ -26,15 +26,15 @@ pub struct AdapterRecord {
 }
 
 pub const INTEGRATION_SOURCE_SHA256: &str =
-    "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0";
+    "fa7e03995f6bff0b831de0ad539382290d8b698224746642174a015683fc4397";
 
 pub const UPSTREAMS: &[UpstreamRecord] = &[
     UpstreamRecord {
         id: "openrazer",
         name: "OpenRazer",
         repository: "https://github.com/openrazer/openrazer.git",
-        version: "3.12.2",
-        commit: "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+        version: "3.12.4",
+        commit: "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
         license_expression: "GPL-2.0-or-later AND CC-BY-SA-4.0",
         api_contract: "org.razer 3.x metadata and D-Bus vocabulary",
         uses: &["compatibility-contract", "metadata-import"],
diff --git a/crates/hfx-integration-model/src/openrazer_native_generated.rs b/crates/hfx-integration-model/src/openrazer_native_generated.rs
index e2196c6..b942cd9 100644
--- a/crates/hfx-integration-model/src/openrazer_native_generated.rs
+++ b/crates/hfx-integration-model/src/openrazer_native_generated.rs
@@ -2,8 +2,14 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
 pub const OPENRAZER_NATIVE_DEPLOYMENT_SHA256: &str =
-    "c918380e3017ab6e5cd996a21d32c7ea8b5410d8f13b2881d0f85a08df6b8bbd";
+    "8f480cb8afb2eb7e00fcae311d841ecd0e364a838b421fbce786288639768c66";
 pub const OPENRAZER_NATIVE_DKMS_NAME: &str = "openrazer-driver";
-pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = "3.12.2";
+pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = "3.12.4";
 pub const OPENRAZER_NATIVE_DRIVER_MODULES: &[&str] =
     &["razeraccessory", "razerkbd", "razerkraken", "razermouse"];
+pub const OPENRAZER_NATIVE_CAPABILITY_MODULES: &[&str] = &["razerkbd", "razermouse"];
+pub const OPENRAZER_NATIVE_CAPABILITY_FIELD: &str = "hyperflux_native_transport";
+pub const OPENRAZER_NATIVE_CAPABILITY_VALUE: &str = "razer-feature-report-v1";
+pub const OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION: &str = "3.12.4";
+pub const OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH: &str = "/usr/bin/openrazer-daemon";
+pub const OPENRAZER_NATIVE_VERSION_ARGUMENT: &str = "--version";
diff --git a/crates/hfx-ops/src/activation.rs b/crates/hfx-ops/src/activation.rs
index 8fb7134..405aef9 100644
--- a/crates/hfx-ops/src/activation.rs
+++ b/crates/hfx-ops/src/activation.rs
@@ -124,7 +124,11 @@ pub fn decide_post_update(
         _ if openrazer_driver_state == OpenRazerDriverState::ActivationPending => {
             ActivationAction::ActivateOpenRazerDriver
         }
-        _ if openrazer_driver_state == OpenRazerDriverState::Unavailable => {
+        _ if matches!(
+            openrazer_driver_state,
+            OpenRazerDriverState::CapabilityUnavailable | OpenRazerDriverState::Unavailable
+        ) =>
+        {
             ActivationAction::RepairOpenRazerDriver
         }
         _ if bridge_was_active => ActivationAction::ResumeBridge,
diff --git a/crates/hfx-ops/src/assessment.rs b/crates/hfx-ops/src/assessment.rs
index d04b9b2..6d306e0 100644
--- a/crates/hfx-ops/src/assessment.rs
+++ b/crates/hfx-ops/src/assessment.rs
@@ -1,7 +1,12 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
-use crate::{OpenRazerAccessState, OpenRazerDriverState, ServiceState, SystemSnapshot};
+use crate::{
+    OpenRazerAccessState, OpenRazerDriverState, OpenRazerRuntimeState, ServiceState, SystemSnapshot,
+};
 use hfx_errors::{ErrorCode, error_by_code, remediation_by_id};
+use hfx_integration_model::{
+    OPENRAZER_NATIVE_CAPABILITY_FIELD, OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION,
+};
 use serde::{Deserialize, Serialize};
 use std::collections::BTreeMap;
 use std::fmt::Write as _;
@@ -128,6 +133,19 @@ fn classify_openrazer_driver(
         return state;
     }
     if let Some(module) = snapshot.openrazer_driver.blocking_module() {
+        if state == OpenRazerDriverState::CapabilityUnavailable {
+            findings.push(local_finding(
+                ErrorCode::HfxIntegration004,
+                BTreeMap::from([
+                    (
+                        "capability".to_owned(),
+                        OPENRAZER_NATIVE_CAPABILITY_FIELD.to_owned(),
+                    ),
+                    ("module".to_owned(), module.module_name.clone()),
+                ]),
+            ));
+            return state;
+        }
         findings.push(local_finding(
             ErrorCode::HfxKernel002,
             BTreeMap::from([
@@ -156,6 +174,49 @@ fn classify_openrazer_driver(
     state
 }
 
+fn classify_openrazer_runtime(
+    snapshot: &SystemSnapshot,
+    working: &mut Vec<String>,
+    findings: &mut Vec<AssessmentFinding>,
+) {
+    match snapshot.openrazer_runtime.state {
+        OpenRazerRuntimeState::Verified => {
+            working.push("the OpenRazer runtime source line is verified".to_owned());
+        }
+        OpenRazerRuntimeState::ReverificationRequired | OpenRazerRuntimeState::Unverified => {
+            findings.push(local_finding(
+                ErrorCode::HfxIntegration005,
+                BTreeMap::from([
+                    (
+                        "observed_version".to_owned(),
+                        snapshot
+                            .openrazer_runtime
+                            .observed_upstream_version
+                            .clone()
+                            .unwrap_or_else(|| "unavailable".to_owned()),
+                    ),
+                    (
+                        "runtime_state".to_owned(),
+                        if snapshot.openrazer_runtime.state
+                            == OpenRazerRuntimeState::ReverificationRequired
+                        {
+                            "rebase-reverification-required"
+                        } else {
+                            "version-unverified"
+                        }
+                        .to_owned(),
+                    ),
+                    (
+                        "verified_version".to_owned(),
+                        OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION.to_owned(),
+                    ),
+                ]),
+            ));
+        }
+        OpenRazerRuntimeState::NotInstalled => {}
+    }
+}
+
 fn classify_openrazer_access(
     snapshot: &SystemSnapshot,
     working: &mut Vec<String>,
@@ -236,6 +297,7 @@ pub fn assess_system(snapshot: &SystemSnapshot) -> Assessment {
         ));
     }
 
+    classify_openrazer_runtime(snapshot, &mut working, &mut findings);
     classify_openrazer_access(snapshot, &mut working, &mut findings);
 
     let (receiver_generations, qualified_generations) =
@@ -388,8 +450,13 @@ mod tests {
                     installed_identity: Some("installed".to_owned()),
                     loaded: false,
                     loaded_identity: None,
+                    native_transport_capability: Some("razer-feature-report-v1".to_owned()),
                 }],
             },
+            openrazer_runtime: crate::OpenRazerRuntimeSnapshot {
+                state: crate::OpenRazerRuntimeState::Verified,
+                observed_upstream_version: Some("3.12.4".to_owned()),
+            },
             openrazer_access: OpenRazerAccessState::Ready,
             service_state: ServiceState::Active,
             bridge: Some(empty_bridge()),
@@ -468,6 +535,10 @@ mod tests {
     #[test]
     fn optional_openrazer_absence_does_not_block_the_core_bridge() {
         let mut value = snapshot();
+        value.openrazer_runtime = crate::OpenRazerRuntimeSnapshot {
+            state: crate::OpenRazerRuntimeState::NotInstalled,
+            observed_upstream_version: None,
+        };
         value.openrazer_access = OpenRazerAccessState::NotInstalled;
 
         let assessment = assess_system(&value);
@@ -476,6 +547,44 @@ mod tests {
         assert!(assessment.findings.is_empty());
     }
 
+    #[test]
+    fn missing_native_module_capability_is_distinct_from_a_version_change() {
+        let mut value = snapshot();
+        value.openrazer_driver.modules[0].native_transport_capability = None;
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.state, AssessmentState::NeedsAttention);
+        assert_eq!(assessment.findings.len(), 1);
+        assert_eq!(assessment.findings[0].code, "HFX-INTEGRATION-004");
+        assert_eq!(assessment.findings[0].details["module"], "razerkbd");
+        assert_eq!(
+            assessment.findings[0].details["capability"],
+            "hyperflux_native_transport"
+        );
+    }
+
+    #[test]
+    fn future_openrazer_source_line_requires_rebase_without_claiming_capability_loss() {
+        let mut value = snapshot();
+        value.openrazer_runtime = crate::OpenRazerRuntimeSnapshot {
+            state: crate::OpenRazerRuntimeState::ReverificationRequired,
+            observed_upstream_version: Some("3.13.0".to_owned()),
+        };
+
+        let assessment = assess_system(&value);
+
+        assert_eq!(assessment.state, AssessmentState::NeedsAttention);
+        assert_eq!(assessment.findings.len(), 1);
+        assert_eq!(assessment.findings[0].code, "HFX-INTEGRATION-005");
+        assert_eq!(
+            assessment.findings[0].details["runtime_state"],
+            "rebase-reverification-required"
+        );
+        assert_eq!(assessment.findings[0].details["observed_version"], "3.13.0");
+        assert_eq!(assessment.findings[0].details["verified_version"], "3.12.4");
+    }
+
     #[test]
     fn installed_openrazer_names_missing_session_membership_exactly() {
         let mut value = snapshot();
diff --git a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
index 5ba492b..2d640b3 100644
--- a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
+++ b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
@@ -1,9 +1,10 @@
 // SPDX-License-Identifier: GPL-2.0-only
 
+use hfx_integration_model::OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION;
 use hfx_ops::{
-    ActivationAction, OpenRazerDriverState, RealSystemProbe, ServiceState, SystemController,
-    SystemProbe, UpdateIntent, confirm_configuration, decide_post_update, load_update_intent,
-    migrate_configuration, record_update_intent, remove_update_intent,
+    ActivationAction, OpenRazerDriverState, OpenRazerRuntimeState, RealSystemProbe, ServiceState,
+    SystemController, SystemProbe, UpdateIntent, confirm_configuration, decide_post_update,
+    load_update_intent, migrate_configuration, record_update_intent, remove_update_intent,
 };
 use hfx_runtime::{BRIDGE_CONFIGURATION_FILE_PATH, UPDATE_STATE_PATH};
 use std::env;
@@ -12,7 +13,7 @@ use std::thread;
 use std::time::Duration;
 
 fn usage() -> &'static str {
-    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|check-openrazer-driver|confirm-start|pre-remove>\n"
+    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|check-openrazer-driver|check-openrazer-runtime|report-openrazer-runtime|confirm-start|pre-remove>\n"
 }
 
 fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), String> {
@@ -22,6 +23,15 @@ fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), Str
             "an older OpenRazer route module is active; reboot before starting the native relay"
                 .to_owned(),
         ),
+        OpenRazerDriverState::CapabilityUnavailable => {
+            let module = snapshot
+                .openrazer_driver
+                .blocking_module()
+                .map_or("unknown", |value| value.module_name.as_str());
+            Err(format!(
+                "the installed OpenRazer route module {module} lacks the HyperFlux native transport capability"
+            ))
+        }
         OpenRazerDriverState::Unavailable => {
             let module = snapshot
                 .openrazer_driver
@@ -34,6 +44,50 @@ fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), Str
     }
 }
 
+fn ensure_openrazer_runtime(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), String> {
+    match snapshot.openrazer_runtime.state {
+        OpenRazerRuntimeState::NotInstalled | OpenRazerRuntimeState::Verified => Ok(()),
+        OpenRazerRuntimeState::ReverificationRequired => Err(format!(
+            "the installed OpenRazer runtime is outside verified source line {OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION}; rebase and reverification are required"
+        )),
+        OpenRazerRuntimeState::Unverified => Err(
+            "the installed OpenRazer runtime source line could not be verified; rebase and reverification are required"
+                .to_owned(),
+        ),
+    }
+}
+
+fn report_openrazer_runtime(probe: &RealSystemProbe) {
+    let snapshot = probe.snapshot();
+    match snapshot.openrazer_runtime.state {
+        OpenRazerRuntimeState::Verified => println!(
+            "HyperFlux Next: OpenRazer remains on verified upstream source line {OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION}; package release changes are compatible."
+        ),
+        OpenRazerRuntimeState::NotInstalled => {
+            println!(
+                "HyperFlux Next: OpenRazer is not installed; no native-route action is required."
+            );
+        }
+        OpenRazerRuntimeState::ReverificationRequired => {
+            let observed = snapshot
+                .openrazer_runtime
+                .observed_upstream_version
+                .as_deref()
+                .unwrap_or("unavailable");
+            println!(
+                "HyperFlux Next: OpenRazer {observed} requires a native-route rebase and reverification; the relay will be skipped on its next start."
+            );
+            println!("Run hyperfluxctl doctor for the verified source line and safe action.");
+        }
+        OpenRazerRuntimeState::Unverified => {
+            println!(
+                "HyperFlux Next: the OpenRazer source line could not be verified; the relay will be skipped on its next start."
+            );
+            println!("Run hyperfluxctl doctor for the safe action.");
+        }
+    }
+}
+
 fn wait_for_bridge_and_confirmation(probe: &RealSystemProbe) -> bool {
     for _ in 0..50 {
         let snapshot = probe.snapshot();
@@ -148,6 +202,10 @@ fn check_openrazer_driver(probe: &RealSystemProbe) -> Result<(), String> {
     ensure_openrazer_driver(&probe.snapshot())
 }
 
+fn check_openrazer_runtime(probe: &RealSystemProbe) -> Result<(), String> {
+    ensure_openrazer_runtime(&probe.snapshot())
+}
+
 fn confirm_start(_probe: &RealSystemProbe) -> Result<(), String> {
     confirm_configuration(Path::new(BRIDGE_CONFIGURATION_FILE_PATH))
         .map_err(|error| format!("configuration confirmation failed: {error}"))?;
@@ -181,6 +239,11 @@ fn run() -> Result<(), String> {
         "post-update" => post_update(&probe),
         "prepare-start" => prepare_start(&probe),
         "check-openrazer-driver" => check_openrazer_driver(&probe),
+        "check-openrazer-runtime" => check_openrazer_runtime(&probe),
+        "report-openrazer-runtime" => {
+            report_openrazer_runtime(&probe);
+            Ok(())
+        }
         "confirm-start" => confirm_start(&probe),
         "pre-remove" => pre_remove(&probe),
         _ => Err(usage().to_owned()),
diff --git a/crates/hfx-ops/src/lib.rs b/crates/hfx-ops/src/lib.rs
index 85ba66c..5664b01 100644
--- a/crates/hfx-ops/src/lib.rs
+++ b/crates/hfx-ops/src/lib.rs
@@ -36,9 +36,9 @@ pub use native_onboarding::{
 };
 pub use probe::{
     BridgeHealth, BridgeIntegration, CommandOutput, CommandRunner, KernelModuleIdentitySnapshot,
-    OpenRazerAccessState, OpenRazerDriverSnapshot, OpenRazerDriverState, ProbeError,
-    RealCommandRunner, RealSystemProbe, ServiceState, SystemController, SystemProbe,
-    SystemSnapshot,
+    OpenRazerAccessState, OpenRazerDriverSnapshot, OpenRazerDriverState, OpenRazerRuntimeSnapshot,
+    OpenRazerRuntimeState, ProbeError, RealCommandRunner, RealSystemProbe, ServiceState,
+    SystemController, SystemProbe, SystemSnapshot,
 };
 pub use qualification::{
     ActionConfirmation, BatteryAvailability, BatteryView, CapabilityAccess, CapabilityView,
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 4132b6b..3018c3b 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -3,7 +3,12 @@
 use hfx_domain::{
     ClientId, ClientName, EventBatchLimit, ProtocolFeatureId, ProtocolVersion, SequenceNumber,
 };
-use hfx_integration_model::OPENRAZER_NATIVE_DRIVER_MODULES;
+use hfx_integration_model::{
+    OPENRAZER_NATIVE_CAPABILITY_FIELD, OPENRAZER_NATIVE_CAPABILITY_MODULES,
+    OPENRAZER_NATIVE_CAPABILITY_VALUE, OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH,
+    OPENRAZER_NATIVE_DRIVER_MODULES, OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION,
+    OPENRAZER_NATIVE_VERSION_ARGUMENT,
+};
 use hfx_profiles::receiver_profile_by_usb_id;
 use hfx_protocol::{
     BridgeSnapshot, CURRENT_PROTOCOL_VERSION, DiagnosticSnapshot, EventBatch, EventCursor,
@@ -28,7 +33,6 @@ use std::time::{Duration, Instant};
 const MAX_COMMAND_OUTPUT_BYTES: usize = 4_096;
 const MAX_USB_DEVICE_ENTRIES: usize = 256;
 const USB_DEVICES_ROOT: &str = "/sys/bus/usb/devices";
-const OPENRAZER_DAEMON_PATH: &str = "/usr/bin/openrazer-daemon";
 const OPENRAZER_GROUP: &str = "openrazer";
 const EVENT_SUBSCRIPTIONS_FEATURE: &str = "event-subscriptions";
 const INTEGRATION_VIEW_FEATURE: &str = "integration-view-projection";
@@ -175,6 +179,7 @@ pub struct SystemSnapshot {
     pub installed_module_identity: Option<String>,
     pub loaded_module_identity: Option<String>,
     pub openrazer_driver: OpenRazerDriverSnapshot,
+    pub openrazer_runtime: OpenRazerRuntimeSnapshot,
     pub openrazer_access: OpenRazerAccessState,
     pub service_state: ServiceState,
     pub bridge: Option<BridgeHealth>,
@@ -192,12 +197,28 @@ pub enum OpenRazerAccessState {
     Unverified,
 }
 
+#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum OpenRazerRuntimeState {
+    NotInstalled,
+    Verified,
+    ReverificationRequired,
+    Unverified,
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct OpenRazerRuntimeSnapshot {
+    pub state: OpenRazerRuntimeState,
+    pub observed_upstream_version: Option<String>,
+}
+
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct KernelModuleIdentitySnapshot {
     pub module_name: String,
     pub installed_identity: Option<String>,
     pub loaded: bool,
     pub loaded_identity: Option<String>,
+    pub native_transport_capability: Option<String>,
 }
 
 #[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq, Serialize)]
@@ -205,6 +226,7 @@ pub struct KernelModuleIdentitySnapshot {
 pub enum OpenRazerDriverState {
     Ready,
     ActivationPending,
+    CapabilityUnavailable,
     Unavailable,
 }
 
@@ -223,6 +245,13 @@ impl OpenRazerDriverSnapshot {
         {
             return OpenRazerDriverState::Unavailable;
         }
+        if self.modules.iter().any(|module| {
+            OPENRAZER_NATIVE_CAPABILITY_MODULES.contains(&module.module_name.as_str())
+                && module.native_transport_capability.as_deref()
+                    != Some(OPENRAZER_NATIVE_CAPABILITY_VALUE)
+        }) {
+            return OpenRazerDriverState::CapabilityUnavailable;
+        }
         if self.modules.iter().any(|module| {
             module.loaded
                 && module.loaded_identity.as_deref() != module.installed_identity.as_deref()
@@ -237,6 +266,13 @@ impl OpenRazerDriverSnapshot {
         self.modules
             .iter()
             .find(|module| module.installed_identity.is_none())
+            .or_else(|| {
+                self.modules.iter().find(|module| {
+                    OPENRAZER_NATIVE_CAPABILITY_MODULES.contains(&module.module_name.as_str())
+                        && module.native_transport_capability.as_deref()
+                            != Some(OPENRAZER_NATIVE_CAPABILITY_VALUE)
+                })
+            })
             .or_else(|| {
                 self.modules.iter().find(|module| {
                     module.loaded
@@ -289,7 +325,7 @@ impl Default for RealSystemProbe<RealCommandRunner> {
             runner: RealCommandRunner,
             sys_module_root: PathBuf::from("/sys/module"),
             usb_devices_root: PathBuf::from(USB_DEVICES_ROOT),
-            openrazer_daemon_path: PathBuf::from(OPENRAZER_DAEMON_PATH),
+            openrazer_daemon_path: PathBuf::from(OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH),
             socket_path: PathBuf::from(BRIDGE_SOCKET_PATH),
             timeout: Duration::from_millis(STATUS_TIMEOUT_MS),
         }
@@ -308,7 +344,7 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             runner,
             sys_module_root,
             PathBuf::from(USB_DEVICES_ROOT),
-            PathBuf::from(OPENRAZER_DAEMON_PATH),
+            PathBuf::from(OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH),
             socket_path,
             timeout,
         )
@@ -344,6 +380,21 @@ impl<R: CommandRunner> RealSystemProbe<R> {
             .and_then(|output| bounded_identity(&output.stdout))
     }
 
+    fn installed_native_capability(&self, module: &str) -> Option<String> {
+        if !OPENRAZER_NATIVE_CAPABILITY_MODULES.contains(&module) {
+            return None;
+        }
+        self.runner
+            .run(
+                "modinfo",
+                &["-F", OPENRAZER_NATIVE_CAPABILITY_FIELD, module],
+                self.timeout,
+            )
+            .ok()
+            .filter(|output| output.success)
+            .and_then(|output| bounded_identity(&output.stdout))
+    }
+
     fn loaded_module_identity(&self) -> Option<String> {
         self.loaded_identity(KERNEL_MODULE_NAME)
     }
@@ -367,12 +418,50 @@ impl<R: CommandRunner> RealSystemProbe<R> {
                         installed_identity: self.installed_identity(module),
                         loaded: loaded_path.is_dir(),
                         loaded_identity: self.loaded_identity(module),
+                        native_transport_capability: self.installed_native_capability(module),
                     }
                 })
                 .collect(),
         }
     }
 
+    fn openrazer_runtime(&self) -> OpenRazerRuntimeSnapshot {
+        if !self.openrazer_daemon_path.is_file() {
+            return OpenRazerRuntimeSnapshot {
+                state: OpenRazerRuntimeState::NotInstalled,
+                observed_upstream_version: None,
+            };
+        }
+        let Some(program) = self.openrazer_daemon_path.to_str() else {
+            return OpenRazerRuntimeSnapshot {
+                state: OpenRazerRuntimeState::Unverified,
+                observed_upstream_version: None,
+            };
+        };
+        let Ok(output) =
+            self.runner
+                .run(program, &[OPENRAZER_NATIVE_VERSION_ARGUMENT], self.timeout)
+        else {
+            return OpenRazerRuntimeSnapshot {
+                state: OpenRazerRuntimeState::Unverified,
+                observed_upstream_version: None,
+            };
+        };
+        let observed = output
+            .success
+            .then(|| parse_openrazer_upstream_version(&output.stdout))
+            .flatten();
+        let state = match observed.as_deref() {
+            Some(OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION) => OpenRazerRuntimeState::Verified,
+            Some(_) => OpenRazerRuntimeState::ReverificationRequired,
+            None => OpenRazerRuntimeState::Unverified,
+        };
+        OpenRazerRuntimeSnapshot {
+            state,
+            observed_upstream_version: observed,
+        }
+    }
+
     fn openrazer_access(&self) -> OpenRazerAccessState {
         if !self.openrazer_daemon_path.is_file() {
             return OpenRazerAccessState::NotInstalled;
@@ -612,6 +701,7 @@ impl<R: CommandRunner> SystemProbe for RealSystemProbe<R> {
             installed_module_identity: self.installed_module_identity(),
             loaded_module_identity: self.loaded_module_identity(),
             openrazer_driver: self.openrazer_driver(),
+            openrazer_runtime: self.openrazer_runtime(),
             openrazer_access: self.openrazer_access(),
             service_state,
             bridge,
@@ -740,6 +830,29 @@ fn bounded_identity(value: &str) -> Option<String> {
     }
 }
 
+fn parse_openrazer_upstream_version(value: &str) -> Option<String> {
+    let version = value.strip_prefix("openrazer-daemon ")?;
+    if version.is_empty()
+        || version.len() > 64
+        || version.bytes().any(|byte| {
+            !(byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'+' | b'-' | b'~'))
+        })
+    {
+        return None;
+    }
+    let suffix = version.find(['-', '+', '~']).unwrap_or(version.len());
+    let upstream = &version[..suffix];
+    let components = upstream.split('.').collect::<Vec<_>>();
+    if !(2..=4).contains(&components.len())
+        || components.iter().any(|component| {
+            component.is_empty() || !component.bytes().all(|byte| byte.is_ascii_digit())
+        })
+    {
+        return None;
+    }
+    Some(upstream.to_owned())
+}
+
 fn parse_group_id(value: &str) -> Option<u32> {
     let mut fields = value.split(':');
     if fields.next()? != OPENRAZER_GROUP {
@@ -883,6 +996,7 @@ mod tests {
                 installed_identity: Some("new".to_owned()),
                 loaded: false,
                 loaded_identity: None,
+                native_transport_capability: Some(OPENRAZER_NATIVE_CAPABILITY_VALUE.to_owned()),
             }],
         };
         assert_eq!(ready.state(), OpenRazerDriverState::Ready);
@@ -901,6 +1015,87 @@ mod tests {
                 .map(|module| module.module_name.as_str()),
             Some("razerkbd")
         );
+
+        let mut missing_capability = pending;
+        missing_capability.modules[0].loaded = false;
+        missing_capability.modules[0].loaded_identity = None;
+        missing_capability.modules[0].native_transport_capability = None;
+        assert_eq!(
+            missing_capability.state(),
+            OpenRazerDriverState::CapabilityUnavailable
+        );
+    }
+
+    #[test]
+    fn openrazer_source_line_ignores_package_release_but_requires_reverification_for_new_sources() {
+        for value in [
+            "openrazer-daemon 3.12.4",
+            "openrazer-daemon 3.12.4-3",
+            "openrazer-daemon 3.12.4-4",
+            "openrazer-daemon 3.12.4+distribution.4",
+        ] {
+            assert_eq!(
+                parse_openrazer_upstream_version(value).as_deref(),
+                Some("3.12.4")
+            );
+        }
+        assert_eq!(
+            parse_openrazer_upstream_version("openrazer-daemon 3.12.5-1").as_deref(),
+            Some("3.12.5")
+        );
+        assert_eq!(
+            parse_openrazer_upstream_version("openrazer-daemon 3.13-1").as_deref(),
+            Some("3.13")
+        );
+        assert_eq!(parse_openrazer_upstream_version("OpenRazer 3.12.4"), None);
+        assert_eq!(
+            parse_openrazer_upstream_version("openrazer-daemon 3.12.4rc1"),
+            None
+        );
+    }
+
+    #[test]
+    fn openrazer_runtime_classifies_verified_and_future_source_lines_separately() {
+        let unique = SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .expect("clock")
+            .as_nanos();
+        let daemon = std::env::temp_dir().join(format!("hfx-openrazer-runtime-{unique}"));
+        fs::write(&daemon, "fixture").expect("write daemon fixture");
+
+        let verified = RealSystemProbe::with_all_paths(
+            FakeRunner::new(vec![Ok(CommandOutput {
+                success: true,
+                stdout: "openrazer-daemon 3.12.4-4".to_owned(),
+            })]),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing-usb"),
+            daemon.clone(),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        )
+        .openrazer_runtime();
+        assert_eq!(verified.state, OpenRazerRuntimeState::Verified);
+        assert_eq!(
+            verified.observed_upstream_version.as_deref(),
+            Some("3.12.4")
+        );
+
+        let future = RealSystemProbe::with_all_paths(
+            FakeRunner::new(vec![Ok(CommandOutput {
+                success: true,
+                stdout: "openrazer-daemon 3.13.0-1".to_owned(),
+            })]),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing-usb"),
+            daemon.clone(),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        )
+        .openrazer_runtime();
+        assert_eq!(future.state, OpenRazerRuntimeState::ReverificationRequired);
+        assert_eq!(future.observed_upstream_version.as_deref(), Some("3.13.0"));
+        fs::remove_file(daemon).expect("remove daemon fixture");
     }
 
     #[test]
diff --git a/crates/hfx-ops/src/qualification.rs b/crates/hfx-ops/src/qualification.rs
index 144bfc0..ecf073f 100644
--- a/crates/hfx-ops/src/qualification.rs
+++ b/crates/hfx-ops/src/qualification.rs
@@ -1337,8 +1337,13 @@ mod tests {
                     installed_identity: Some("same".to_owned()),
                     loaded: false,
                     loaded_identity: None,
+                    native_transport_capability: Some("razer-feature-report-v1".to_owned()),
                 }],
             },
+            openrazer_runtime: crate::OpenRazerRuntimeSnapshot {
+                state: crate::OpenRazerRuntimeState::NotInstalled,
+                observed_upstream_version: None,
+            },
             openrazer_access: crate::OpenRazerAccessState::NotInstalled,
             service_state: ServiceState::Active,
             bridge: None,
diff --git a/crates/hfx-ops/src/support.rs b/crates/hfx-ops/src/support.rs
index ab2c342..5e02c88 100644
--- a/crates/hfx-ops/src/support.rs
+++ b/crates/hfx-ops/src/support.rs
@@ -245,8 +245,13 @@ mod tests {
                     installed_identity: Some("ABC".to_owned()),
                     loaded: false,
                     loaded_identity: None,
+                    native_transport_capability: Some("razer-feature-report-v1".to_owned()),
                 }],
             },
+            openrazer_runtime: crate::OpenRazerRuntimeSnapshot {
+                state: crate::OpenRazerRuntimeState::NotInstalled,
+                observed_upstream_version: None,
+            },
             openrazer_access: crate::OpenRazerAccessState::NotInstalled,
             service_state: ServiceState::Inactive,
             bridge: None,
diff --git a/crates/hfx-profiles/src/generated.rs b/crates/hfx-profiles/src/generated.rs
index eb61146..f4e5a10 100644
--- a/crates/hfx-profiles/src/generated.rs
+++ b/crates/hfx-profiles/src/generated.rs
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70
+// Profile source SHA-256: 80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee
 
 use hfx_domain::{DeviceKind, ProfileKind, RouteKind, SupportLevel};
 
@@ -221,7 +221,7 @@ pub struct ProfileRecord {
 }
 
 pub const PROFILE_SOURCE_SHA256: &str =
-    "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70";
+    "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee";
 
 pub const RETURN_POLICIES: &[ReturnPolicyRecord] = &[ReturnPolicyRecord {
     id: "receiver-child.activity-assisted.v1",
diff --git a/docs/generated/development-environment.md b/docs/generated/development-environment.md
index e3ae638..687922b 100644
--- a/docs/generated/development-environment.md
+++ b/docs/generated/development-environment.md
@@ -25,7 +25,7 @@ This is the only ordinary setup step that uses the network. It creates clean, de
 
 | Upstream | Commit | Contract |
 | --- | --- | --- |
-| OpenRazer | `ddea89607b86023e88563b8feabc8fa2d5773cdd` | org.razer 3.x metadata and D-Bus vocabulary |
+| OpenRazer | `1ef8a91712906a89fd332a2ed62bbd105315d6d1` | org.razer 3.x metadata and D-Bus vocabulary |
 | OpenRGB | `6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0` | OpenRGB plugin API 4 |
 | Polychromatic | `716737bf444ab7e962f4d3b7a5188b2f07c0c4a1` | Polychromatic 0.9 native backend contract |
 
diff --git a/docs/generated/device-knowledge.md b/docs/generated/device-knowledge.md
index 0dfc2f5..7c6ef70 100644
--- a/docs/generated/device-knowledge.md
+++ b/docs/generated/device-knowledge.md
@@ -74,8 +74,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBasiliskV3ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1659) | `direct-usb` | `1532:00aa` | hardware class | matrix 1x13 |
-| [`openrazer:RazerBasiliskV3ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1695) | `vendor-wireless-receiver` | `1532:00ab` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3ProWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1659) | `direct-usb` | `1532:00aa` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3ProWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1695) | `vendor-wireless-receiver` | `1532:00ab` | hardware class | matrix 1x13 |
 | [`openrgb:basilisk_v3_pro_bluetooth_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5240) | `bluetooth` | `unknown:00ac` | table only | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L4909) | `direct-usb` | `1532:00aa` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L4968) | `vendor-wireless-receiver` | `1532:00ab` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
@@ -190,8 +190,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBasiliskV3Pro35KWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1703) | `direct-usb` | `1532:00cc` | hardware class | matrix 1x13 |
-| [`openrazer:RazerBasiliskV3Pro35KWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1739) | `vendor-wireless-receiver` | `1532:00cd` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3Pro35KWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1703) | `direct-usb` | `1532:00cc` | hardware class | matrix 1x13 |
+| [`openrazer:RazerBasiliskV3Pro35KWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1739) | `vendor-wireless-receiver` | `1532:00cd` | hardware class | matrix 1x13 |
 | [`openrgb:basilisk_v3_pro_35k_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5026) | `direct-usb` | `1532:00cc` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 | [`openrgb:basilisk_v3_pro_35k_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5085) | `vendor-wireless-receiver` | `1532:00cd` | active detector | slots 1x13; zones Scroll Wheel, Logo, LED Strip |
 
@@ -300,8 +300,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV3ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L379) | `direct-usb` | `1532:025a` | hardware class | matrix 6x22 |
-| [`openrazer:RazerBlackWidowV3ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L402) | `vendor-wireless-receiver` | `1532:025c` | hardware class | matrix 6x22 |
+| [`openrazer:RazerBlackWidowV3ProWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L379) | `direct-usb` | `1532:025a` | hardware class | matrix 6x22 |
+| [`openrazer:RazerBlackWidowV3ProWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L402) | `vendor-wireless-receiver` | `1532:025c` | hardware class | matrix 6x22 |
 | [`openrgb:blackwidow_v3_pro_bluetooth_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1578) | `bluetooth` | `unknown:025b` | table only | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
 | [`openrgb:blackwidow_v3_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1543) | `direct-usb` | `1532:025a` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
 | [`openrgb:blackwidow_v3_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L1613) | `vendor-wireless-receiver` | `1532:025c` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v3_pro_layout |
@@ -541,8 +541,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1156) | `direct-usb` | `1532:02b9` | hardware class | matrix 5x14 |
-| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1177) | `vendor-wireless-receiver` | `1532:02ba` | hardware class | matrix 5x14 |
+| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1156) | `direct-usb` | `1532:02b9` | hardware class | matrix 5x14 |
+| [`openrazer:RazerBlackWidowV4MiniHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1177) | `vendor-wireless-receiver` | `1532:02ba` | hardware class | matrix 5x14 |
 
 | Pinned Linux semantic | Presentation | HyperFlux state | Missing capability |
 | --- | --- | --- | --- |
@@ -634,8 +634,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L423) | `direct-usb` | `1532:02d7` | hardware class | matrix 6x18 |
-| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L445) | `vendor-wireless-receiver` | `1532:02d5` | hardware class | matrix 6x18 |
+| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L423) | `direct-usb` | `1532:02d7` | hardware class | matrix 6x18 |
+| [`openrazer:RazerBlackWidowV4TenkeylessHyperSpeedWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L445) | `vendor-wireless-receiver` | `1532:02d5` | hardware class | matrix 6x18 |
 | [`openrgb:blackwidow_v4_tkl_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2028) | `direct-usb` | `1532:02d7` | active detector | slots 6x18; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v4_tkl_layout |
 | [`openrgb:blackwidow_v4_tkl_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2063) | `vendor-wireless-receiver` | `1532:02d5` | active detector | slots 6x18; zones ZONE_EN_KEYBOARD; layout razer_blackwidow_v4_tkl_layout |
 
@@ -777,8 +777,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerCobraProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1566) | `direct-usb` | `1532:00af` | hardware class | not documented |
-| [`openrazer:RazerCobraProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1595) | `vendor-wireless-receiver` | `1532:00b0` | hardware class | not documented |
+| [`openrazer:RazerCobraProWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1566) | `direct-usb` | `1532:00af` | hardware class | not documented |
+| [`openrazer:RazerCobraProWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1595) | `vendor-wireless-receiver` | `1532:00b0` | hardware class | not documented |
 | [`openrgb:cobra_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5369) | `direct-usb` | `1532:00af` | active detector | slots 1x11; zones Logo, Scroll Wheel, Underglow |
 | [`openrgb:cobra_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L5428) | `vendor-wireless-receiver` | `1532:00b0` | active detector | slots 1x11; zones Logo, Scroll Wheel, Underglow |
 
@@ -880,8 +880,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerDeathStalkerV2ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1422) | `direct-usb` | `1532:0292` | hardware class | matrix 6x22 |
-| [`openrazer:RazerDeathStalkerV2ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1444) | `vendor-wireless-receiver` | `1532:0290` | hardware class | matrix 6x22 |
+| [`openrazer:RazerDeathStalkerV2ProWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1422) | `direct-usb` | `1532:0292` | hardware class | matrix 6x22 |
+| [`openrazer:RazerDeathStalkerV2ProWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1444) | `vendor-wireless-receiver` | `1532:0290` | hardware class | matrix 6x22 |
 | [`openrgb:deathstalker_v2_pro_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2750) | `direct-usb` | `1532:0292` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_layout |
 | [`openrgb:deathstalker_v2_pro_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2715) | `vendor-wireless-receiver` | `1532:0290` | active detector | slots 6x22; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_layout |
 
@@ -971,8 +971,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerDeathStalkerV2ProTKLWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1451) | `direct-usb` | `1532:0298` | hardware class | matrix 6x17 |
-| [`openrazer:RazerDeathStalkerV2ProTKLWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1473) | `vendor-wireless-receiver` | `1532:0296` | hardware class | matrix 6x17 |
+| [`openrazer:RazerDeathStalkerV2ProTKLWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1451) | `direct-usb` | `1532:0298` | hardware class | matrix 6x17 |
+| [`openrazer:RazerDeathStalkerV2ProTKLWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1473) | `vendor-wireless-receiver` | `1532:0296` | hardware class | matrix 6x17 |
 | [`openrgb:deathstalker_v2_pro_tkl_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2660) | `direct-usb` | `1532:0298` | active detector | slots 6x17; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_tkl_layout |
 | [`openrgb:deathstalker_v2_pro_tkl_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L2680) | `vendor-wireless-receiver` | `1532:0296` | active detector | slots 6x17; zones ZONE_EN_KEYBOARD; layout razer_deathstalker_v2_pro_tkl_layout |
 
@@ -1065,8 +1065,8 @@ Reviewed sources:
 
 | Exact source record | Route | USB identity | Registration | Topology |
 | --- | --- | --- | --- | --- |
-| [`openrazer:RazerNagaV2ProWired`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1011) | `direct-usb` | `1532:00a7` | hardware class | matrix 1x3 |
-| [`openrazer:RazerNagaV2ProWireless`](https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1038) | `vendor-wireless-receiver` | `1532:00a8` | hardware class | matrix 1x3 |
+| [`openrazer:RazerNagaV2ProWired`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1011) | `direct-usb` | `1532:00a7` | hardware class | matrix 1x3 |
+| [`openrazer:RazerNagaV2ProWireless`](https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1038) | `vendor-wireless-receiver` | `1532:00a8` | hardware class | matrix 1x3 |
 | [`openrgb:naga_pro_v2_wired_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L7146) | `direct-usb` | `1532:00a7` | active detector | slots 1x2; zones Logo, Numpad |
 | [`openrgb:naga_pro_v2_wireless_device`](https://github.com/CalcProgrammer1/OpenRGB/blob/6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0/Controllers/RazerController/RazerDevices.cpp#L7166) | `vendor-wireless-receiver` | `1532:00a8` | active detector | slots 1x2; zones Logo, Numpad |
 
diff --git a/docs/generated/distributions.md b/docs/generated/distributions.md
index d7dec60..e9fb6f0 100644
--- a/docs/generated/distributions.md
+++ b/docs/generated/distributions.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical distribution digest: `8abc3a4b58c4696be8b8fbfe36afd77e3c71c89e13a1e2b73a358b25b4d4e970`.
+Canonical distribution digest: `079f195c20ddfd7acfe140d2d7b35caf79b47911a275119ccf9376f368eafad1`.
 
 Every target packages the same `hyperflux-next-linux` canonical staged payload. Distribution wrappers add only native metadata, lifecycle hooks, and Python discovery.
 
@@ -14,9 +14,9 @@ Every target packages the same `hyperflux-next-linux` canonical staged payload.
 
 ## Package Relationships
 
-- `arch` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
-- `debian` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
-- `rpm` provides `openrazer-driver-dkms`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+- `arch` provides `openrazer-driver-dkms`, `hyperflux-openrazer-driver-abi=3.12.4`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+- `debian` provides `openrazer-driver-dkms`, `hyperflux-openrazer-driver-abi (= 3.12.4)`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
+- `rpm` provides `openrazer-driver-dkms`, `hyperflux-openrazer-driver-abi=3.12.4`; replaces `openrazer-driver-dkms`; and conflicts with `hyperflux-v2-linux-dkms`, `openrazer-driver-dkms`.
 
 ## Lifecycle Contract
 
diff --git a/docs/generated/error-catalog.md b/docs/generated/error-catalog.md
index 18af1fe..5dcb589 100644
--- a/docs/generated/error-catalog.md
+++ b/docs/generated/error-catalog.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Catalog source: `f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c`
+Catalog source: `e709d84eae07623b6e59c2863cf707d9d3edb09381ef77f40fd0126cfca66afd`
 
 This catalog is the single authority for Doctor, services, SDKs, integrations, package hooks, and support bundles. Safe details are an allowlist: raw payloads, serials, host identifiers, private paths, and arbitrary exception or log text are not accepted.
 
@@ -34,6 +34,8 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | [`HFX-INTEGRATION-001`](#hfx-integration-001) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
 | [`HFX-INTEGRATION-002`](#hfx-integration-002) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
 | [`HFX-INTEGRATION-003`](#hfx-integration-003) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
+| [`HFX-INTEGRATION-004`](#hfx-integration-004) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
+| [`HFX-INTEGRATION-005`](#hfx-integration-005) | `integration` | `error` | `after-remediation` | `not-applicable` | `integration` | `active` |
 | [`HFX-INTERNAL-001`](#hfx-internal-001) | `internal` | `critical` | `never` | `runtime-reported` | `bridge` | `active` |
 | [`HFX-KERNEL-001`](#hfx-kernel-001) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
 | [`HFX-KERNEL-002`](#hfx-kernel-002) | `kernel` | `error` | `after-remediation` | `not-applicable` | `packaging` | `active` |
@@ -70,9 +72,11 @@ This catalog is the single authority for Doctor, services, SDKs, integrations, p
 | `qualify-device` | Keep the device read-only until an evidence-backed profile qualifies the requested capability. | Inspect the capability snapshot and confirm the support level permits the operation. | false |
 | `reconcile-transaction-state` | Do not repeat the old hardware operation automatically; refresh device state and submit only a new intentional request. | Confirm the application has refreshed the active generation and is not replaying the unavailable transaction. | false |
 | `refresh-generation` | Discard state from the old generation and request a fresh snapshot before new work. | Confirm the request uses the currently active generation identifier. | true |
+| `reinstall-openrazer-route-driver` | Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor. | Run Doctor and confirm the OpenRazer native-route capability finding is absent. | false |
 | `release-owner` | Release control in the owning application or close it, then request ownership again. | Read the ownership snapshot and confirm the resource has no conflicting owner. | false |
 | `repair-state-storage` | Restore writable, schema-compatible state storage without deleting the last known-good copy. | Restart the bridge and confirm it can read and transactionally commit its state. | false |
 | `retry-bounded` | Retry with bounded backoff only while the original deadline remains valid. | Confirm the new attempt is admitted once and produces one terminal outcome. | true |
+| `reverify-openrazer-source` | Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified. | Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay. | false |
 | `start-bridge` | Start or restart the compatible HyperFlux bridge service. | Run Doctor and confirm the bridge diagnostic endpoint is ready. | true |
 | `submit-before-deadline` | Create a new request with a deadline that has not elapsed; do not revive the expired request. | Confirm admission occurs before the new monotonic deadline. | false |
 | `update-integration` | Install an integration compatible with the negotiated HyperFlux SDK protocol. | Restart the application and confirm protocol negotiation succeeds. | false |
@@ -202,6 +206,57 @@ This desktop session cannot open OpenRazer devices yet.
 | --- | --- | --- | --- | --- |
 | `access_state` | `enum` | true | `session-membership-required` | `public` |
 
+## HFX-INTEGRATION-004
+
+The installed OpenRazer driver is not the verified HyperFlux native-route build.
+
+**Technical cause:** An installed OpenRazer route module does not advertise the source-bound HyperFlux native transport capability.
+
+**Class / severity:** `integration` / `error`
+
+**Retry / side effects:** `after-remediation` / `not-applicable`
+
+**Owner / privacy:** `integration` / `public`
+
+**Lifecycle:** `active` since `0.0.0-dev.1`
+
+**Safe action (`reinstall-openrazer-route-driver`):** Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor.
+
+**Verify:** Run Doctor and confirm the OpenRazer native-route capability finding is absent.
+
+### Safe Details
+
+| Field | Type | Required | Bound | Privacy |
+| --- | --- | --- | --- | --- |
+| `capability` | `identifier` | true | max 64 characters | `public` |
+| `module` | `identifier` | true | max 64 characters | `public` |
+
+## HFX-INTEGRATION-005
+
+This OpenRazer update needs a HyperFlux rebase and fresh verification before the native relay can use it.
+
+**Technical cause:** The installed OpenRazer runtime is not bound to the upstream source line verified by the current HyperFlux native-route transform.
+
+**Class / severity:** `integration` / `error`
+
+**Retry / side effects:** `after-remediation` / `not-applicable`
+
+**Owner / privacy:** `integration` / `public`
+
+**Lifecycle:** `active` since `0.0.0-dev.1`
+
+**Safe action (`reverify-openrazer-source`):** Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified.
+
+**Verify:** Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay.
+
+### Safe Details
+
+| Field | Type | Required | Bound | Privacy |
+| --- | --- | --- | --- | --- |
+| `observed_version` | `text` | true | max 32 characters | `public` |
+| `runtime_state` | `enum` | true | `rebase-reverification-required`, `version-unverified` | `public` |
+| `verified_version` | `text` | true | max 32 characters | `public` |
+
 ## HFX-INTERNAL-001
 
 HyperFlux stopped the affected operation because an internal safety rule failed.
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 4f3cceb..60ba544 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -28,7 +28,7 @@ The canonical plan contains `9` required and `3` optional build products.
 | `activation-utility` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-activate` |
 | `openrazer-native-relay` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-uhid-relay` |
 | `native-readonly-qualifier` | `cargo-binary` | yes | `/usr/lib/hyperflux-next/hyperflux-next-native-qualifier` |
-| `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.2` |
+| `openrazer-native-driver` | `source-transform` | yes | `/usr/src/openrazer-driver-3.12.4` |
 | `openrazer-native-udev-rules` | `source-transform-file` | yes | `/usr/lib/udev/rules.d/99-razer.rules` |
 | `openrazer-native-mount-helper` | `source-transform-file` | yes | `/usr/lib/udev/razer_mount` |
 | `openrgb-native` | `cmake-module` | no | `/usr/lib/openrgb/plugins/hyperflux-next-openrgb.so` |
diff --git a/docs/generated/integrations.md b/docs/generated/integrations.md
index d54138e..b2b6a85 100644
--- a/docs/generated/integrations.md
+++ b/docs/generated/integrations.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Integration source: `f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0`
+Integration source: `fa7e03995f6bff0b831de0ad539382290d8b698224746642174a015683fc4397`
 
 Every adapter uses only the versioned HyperFlux SDK, preserves unrelated application devices, and owns no receiver encoding.
 
@@ -10,7 +10,7 @@ Every adapter uses only the versioned HyperFlux SDK, preserves unrelated applica
 
 | Project | Version | Commit | Contract | Build network |
 | --- | --- | --- | --- | --- |
-| [OpenRazer](https://github.com/openrazer/openrazer) | `3.12.2` | `ddea89607b86` | org.razer 3.x metadata and D-Bus vocabulary | disabled |
+| [OpenRazer](https://github.com/openrazer/openrazer) | `3.12.4` | `1ef8a9171290` | org.razer 3.x metadata and D-Bus vocabulary | disabled |
 | [OpenRGB](https://github.com/CalcProgrammer1/OpenRGB) | `1.0rc3` | `6fbcf62d7694` | OpenRGB plugin API 4 | disabled |
 | [Polychromatic](https://github.com/polychromatic/polychromatic) | `0.9.7-7-g716737b` | `716737bf444a` | Polychromatic 0.9 native backend contract | disabled |
 
diff --git a/docs/generated/openrazer-native-deployment.md b/docs/generated/openrazer-native-deployment.md
index 494c573..7818e1c 100644
--- a/docs/generated/openrazer-native-deployment.md
+++ b/docs/generated/openrazer-native-deployment.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical deployment digest: `c918380e3017ab6e5cd996a21d32c7ea8b5410d8f13b2881d0f85a08df6b8bbd`.
+Canonical deployment digest: `8f480cb8afb2eb7e00fcae311d841ecd0e364a838b421fbce786288639768c66`.
 
 ## Relay
 
@@ -19,12 +19,24 @@ The static relay service is pulled in by the bridge service. It runs as root onl
 
 | Field | Value |
 | --- | --- |
-| DKMS identity | `openrazer-driver` `3.12.2` |
-| Source tree | `/usr/src/openrazer-driver-3.12.2` |
+| DKMS identity | `openrazer-driver` `3.12.4` |
+| Source tree | `/usr/src/openrazer-driver-3.12.4` |
 | Modules | `razeraccessory`, `razerkbd`, `razerkraken`, `razermouse` |
 
 The package build applies the source-locked transport patch to the pinned OpenRazer tree, projects only its DKMS build inputs, and verifies every transformed digest. The ordinary BUS_USB tables and direct-device transport remain upstream-owned.
 
+## Update Compatibility
+
+| Field | Value |
+| --- | --- |
+| Verified upstream source | `3.12.4` |
+| Package release suffix | `ignored` |
+| New upstream source | `rebase-reverification-required` |
+| Runtime capability | `hyperflux_native_transport=razer-feature-report-v1` |
+| Capability modules | `razerkbd`, `razermouse` |
+
+Runtime readiness is determined from the declared module capability and installed/loaded module identities, not from a distribution package-release suffix. The daemon's upstream source version is checked separately as verification lineage: packaging revisions of the verified source remain compatible, while a new upstream source requires a reviewed rebase and fresh verification.
+
 ## Local Access
 
 | Field | Value |
diff --git a/docs/generated/supply-chain.md b/docs/generated/supply-chain.md
index ca255e9..4991a28 100644
--- a/docs/generated/supply-chain.md
+++ b/docs/generated/supply-chain.md
@@ -14,7 +14,7 @@ Release signing and remote attestations remain unavailable until publication is
 - Vendored source packages: 1
 - Pinned application upstreams: 3
 - Immutable workflow actions: 7
-- Authority SHA-256: `5db9df91fc4c065eb1cc1cac43895ebc25f0d4d017084dc830be83b8e3dfc53b`
+- Authority SHA-256: `6235b6f83cecf4a78814eaf8f4e4f393a526082c09fc0161f15b2a2d8a07d66c`
 
 ## License Policy
 
diff --git a/docs/generated/supported-hardware.md b/docs/generated/supported-hardware.md
index 31ab57c..af483c3 100644
--- a/docs/generated/supported-hardware.md
+++ b/docs/generated/supported-hardware.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Profile source: `b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70`
+Profile source: `80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee`
 
 Support is capability-specific. A listed model does not transfer its transport map to a similar name or PID.
 
diff --git a/driver/kernel/generated/hyperflux_receiver_profiles.inc b/driver/kernel/generated/hyperflux_receiver_profiles.inc
index 58ceb7f..9e2a342 100644
--- a/driver/kernel/generated/hyperflux_receiver_profiles.inc
+++ b/driver/kernel/generated/hyperflux_receiver_profiles.inc
@@ -1,6 +1,6 @@
 /* Generated by ./hfx generate. Do not edit manually. */
 /* SPDX-License-Identifier: GPL-2.0-only */
-/* Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70 */
+/* Profile source SHA-256: 80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee */
 
 #ifndef HFX_RECEIVER_PROFILE
 #error "Define HFX_RECEIVER_PROFILE before including this table"
diff --git a/errors/catalog.json b/errors/catalog.json
index 7b5118e..4225aeb 100644
--- a/errors/catalog.json
+++ b/errors/catalog.json
@@ -86,6 +86,13 @@
       "verification": "Confirm the request uses the currently active generation identifier.",
       "automatic": true
     },
+    {
+      "id": "reinstall-openrazer-route-driver",
+      "title": "Restore the OpenRazer native-route capability",
+      "safe_action": "Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor.",
+      "verification": "Run Doctor and confirm the OpenRazer native-route capability finding is absent.",
+      "automatic": false
+    },
     {
       "id": "release-owner",
       "title": "Release the current owner",
@@ -107,6 +114,13 @@
       "verification": "Confirm the new attempt is admitted once and produces one terminal outcome.",
       "automatic": true
     },
+    {
+      "id": "reverify-openrazer-source",
+      "title": "Use a verified OpenRazer source line",
+      "safe_action": "Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified.",
+      "verification": "Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay.",
+      "automatic": false
+    },
     {
       "id": "start-bridge",
       "title": "Start the bridge service",
@@ -232,6 +246,43 @@
       "privacy": "public",
       "docs_path": "docs/generated/error-catalog.md#hfx-integration-003"
     },
+    {
+      "code": "HFX-INTEGRATION-004",
+      "class": "integration",
+      "severity": "error",
+      "retry_policy": "after-remediation",
+      "side_effect_certainty_policy": "not-applicable",
+      "remediation_id": "reinstall-openrazer-route-driver",
+      "safe_detail_fields": [
+        {"name": "capability", "type": "identifier", "required": true, "maximum_length": 64, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "Required HyperFlux native transport capability."},
+        {"name": "module", "type": "identifier", "required": true, "maximum_length": 64, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "OpenRazer module missing the native transport capability."}
+      ],
+      "lifecycle": {"state": "active", "introduced_in": "0.0.0-dev.1", "deprecated_in": null, "replacement_code": null},
+      "owner": "integration",
+      "technical_cause": "An installed OpenRazer route module does not advertise the source-bound HyperFlux native transport capability.",
+      "user_explanation": "The installed OpenRazer driver is not the verified HyperFlux native-route build.",
+      "privacy": "public",
+      "docs_path": "docs/generated/error-catalog.md#hfx-integration-004"
+    },
+    {
+      "code": "HFX-INTEGRATION-005",
+      "class": "integration",
+      "severity": "error",
+      "retry_policy": "after-remediation",
+      "side_effect_certainty_policy": "not-applicable",
+      "remediation_id": "reverify-openrazer-source",
+      "safe_detail_fields": [
+        {"name": "observed_version", "type": "text", "required": true, "maximum_length": 32, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "Bounded upstream version reported by the installed OpenRazer daemon, or unavailable."},
+        {"name": "runtime_state", "type": "enum", "required": true, "maximum_length": null, "maximum_value": null, "allowed_values": ["rebase-reverification-required", "version-unverified"], "privacy": "public", "description": "OpenRazer source-line verification state."},
+        {"name": "verified_version", "type": "text", "required": true, "maximum_length": 32, "maximum_value": null, "allowed_values": [], "privacy": "public", "description": "OpenRazer upstream source version verified by this HyperFlux package."}
+      ],
+      "lifecycle": {"state": "active", "introduced_in": "0.0.0-dev.1", "deprecated_in": null, "replacement_code": null},
+      "owner": "integration",
+      "technical_cause": "The installed OpenRazer runtime is not bound to the upstream source line verified by the current HyperFlux native-route transform.",
+      "user_explanation": "This OpenRazer update needs a HyperFlux rebase and fresh verification before the native relay can use it.",
+      "privacy": "public",
+      "docs_path": "docs/generated/error-catalog.md#hfx-integration-005"
+    },
     {
       "code": "HFX-INTERNAL-001",
       "class": "internal",
diff --git a/generated/integrations/catalog.json b/generated/integrations/catalog.json
index d253563..872fd98 100644
--- a/generated/integrations/catalog.json
+++ b/generated/integrations/catalog.json
@@ -128,12 +128,12 @@
     }
   ],
   "schema": "hyperflux-integration-catalog-v1",
-  "source_sha256": "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0",
+  "source_sha256": "fa7e03995f6bff0b831de0ad539382290d8b698224746642174a015683fc4397",
   "upstreams": [
     {
       "api_contract": "org.razer 3.x metadata and D-Bus vocabulary",
       "build_network_access": false,
-      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+      "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
       "id": "openrazer",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "name": "OpenRazer",
@@ -142,7 +142,7 @@
         "compatibility-contract",
         "metadata-import"
       ],
-      "version": "3.12.2"
+      "version": "3.12.4"
     },
     {
       "api_contract": "OpenRGB plugin API 4",
diff --git a/generated/knowledge/catalog.json b/generated/knowledge/catalog.json
index 5f656a7..205c2f8 100644
--- a/generated/knowledge/catalog.json
+++ b/generated/knowledge/catalog.json
@@ -1039,7 +1039,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1659",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1659",
           "usb_identity": {
             "product_id": 170,
             "vendor_id": 5426
@@ -1111,7 +1111,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1695",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1695",
           "usb_identity": {
             "product_id": 171,
             "vendor_id": 5426
@@ -2400,7 +2400,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1703",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1703",
           "usb_identity": {
             "product_id": 204,
             "vendor_id": 5426
@@ -2472,7 +2472,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1739",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1739",
           "usb_identity": {
             "product_id": 205,
             "vendor_id": 5426
@@ -3440,7 +3440,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L379",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L379",
           "usb_identity": {
             "product_id": 602,
             "vendor_id": 5426
@@ -3504,7 +3504,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L402",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L402",
           "usb_identity": {
             "product_id": 604,
             "vendor_id": 5426
@@ -6256,7 +6256,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1156",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1156",
           "usb_identity": {
             "product_id": 697,
             "vendor_id": 5426
@@ -6318,7 +6318,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1177",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1177",
           "usb_identity": {
             "product_id": 698,
             "vendor_id": 5426
@@ -7212,7 +7212,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L423",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L423",
           "usb_identity": {
             "product_id": 727,
             "vendor_id": 5426
@@ -7276,7 +7276,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L445",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L445",
           "usb_identity": {
             "product_id": 725,
             "vendor_id": 5426
@@ -8843,7 +8843,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1566",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1566",
           "usb_identity": {
             "product_id": 175,
             "vendor_id": 5426
@@ -8897,7 +8897,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1595",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1595",
           "usb_identity": {
             "product_id": 176,
             "vendor_id": 5426
@@ -9799,7 +9799,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1422",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1422",
           "usb_identity": {
             "product_id": 658,
             "vendor_id": 5426
@@ -9857,7 +9857,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1444",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1444",
           "usb_identity": {
             "product_id": 656,
             "vendor_id": 5426
@@ -10782,7 +10782,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1451",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1451",
           "usb_identity": {
             "product_id": 664,
             "vendor_id": 5426
@@ -10840,7 +10840,7 @@
             "path": "daemon/openrazer_daemon/hardware/keyboards.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/keyboards.py#L1473",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/keyboards.py#L1473",
           "usb_identity": {
             "product_id": 662,
             "vendor_id": 5426
@@ -11958,7 +11958,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "direct-usb",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1011",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1011",
           "usb_identity": {
             "product_id": 167,
             "vendor_id": 5426
@@ -12030,7 +12030,7 @@
             "path": "daemon/openrazer_daemon/hardware/mouse.py"
           },
           "source_route": "vendor-wireless-receiver",
-          "source_url": "https://github.com/openrazer/openrazer/blob/ddea89607b86023e88563b8feabc8fa2d5773cdd/daemon/openrazer_daemon/hardware/mouse.py#L1038",
+          "source_url": "https://github.com/openrazer/openrazer/blob/1ef8a91712906a89fd332a2ed62bbd105315d6d1/daemon/openrazer_daemon/hardware/mouse.py#L1038",
           "usb_identity": {
             "product_id": 168,
             "vendor_id": 5426
@@ -12626,10 +12626,10 @@
     }
   ],
   "schema": "hyperflux-compiled-device-knowledge-v1",
-  "source_sha256": "89d25e0d74052f49df34f125f96f02faf107985e727262f59f7314363ba8a212",
+  "source_sha256": "67ad7a69817e43749dba4014cbd7b5e00d605af4a6567ddc0a5afc28d9aaf95b",
   "upstreams": [
     {
-      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+      "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
       "extractor": "python-ast-v1",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "record_count": 232,
@@ -12645,7 +12645,7 @@
         }
       ],
       "upstream_id": "openrazer",
-      "version": "3.12.2"
+      "version": "3.12.4"
     },
     {
       "commit": "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0",
diff --git a/generated/profiles/catalog.json b/generated/profiles/catalog.json
index b7208d0..d5a87ac 100644
--- a/generated/profiles/catalog.json
+++ b/generated/profiles/catalog.json
@@ -783,7 +783,7 @@
       "timing_authorities": [
         {
           "kind": "pinned-upstream-contract",
-          "source_id": "openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339",
+          "source_id": "openrazer:1ef8a91712906a89fd332a2ed62bbd105315d6d1:driver/razerchromacommon.c:1339",
           "source_sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc",
           "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
         },
@@ -1573,5 +1573,5 @@
     }
   ],
   "schema": "hyperflux-compiled-profile-catalog-v1",
-  "source_sha256": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
+  "source_sha256": "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee"
 }
diff --git a/integrations/catalog.json b/integrations/catalog.json
index 7e8f1e1..39f30a0 100644
--- a/integrations/catalog.json
+++ b/integrations/catalog.json
@@ -6,8 +6,8 @@
       "id": "openrazer",
       "name": "OpenRazer",
       "repository": "https://github.com/openrazer/openrazer.git",
-      "version": "3.12.2",
-      "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+      "version": "3.12.4",
+      "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
       "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
       "api_contract": "org.razer 3.x metadata and D-Bus vocabulary",
       "uses": ["compatibility-contract", "metadata-import"],
diff --git a/integrations/openrazer/compatibility.json b/integrations/openrazer/compatibility.json
index 485543a..da332c5 100644
--- a/integrations/openrazer/compatibility.json
+++ b/integrations/openrazer/compatibility.json
@@ -3,7 +3,7 @@
   "schema": "hyperflux-openrazer-compatibility-v1",
   "upstream": {
     "id": "openrazer",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
     "api_contract": "org.razer 3.x metadata and D-Bus vocabulary"
   },
   "service": {
diff --git a/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py b/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
index 779b623..34bf820 100644
--- a/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
+++ b/integrations/openrazer/compatibility/hyperflux_openrazer_compat/generated_contract.py
@@ -72,7 +72,7 @@
                                   'root_path': '/dev/hyperflux/OpenRazer1'},
              'reconcile_interval_ms': {'default': 5000, 'maximum': 300000, 'minimum': 250}},
  'upstream': {'api_contract': 'org.razer 3.x metadata and D-Bus vocabulary',
-              'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
+              'commit': '1ef8a91712906a89fd332a2ed62bbd105315d6d1',
               'id': 'openrazer'}}
 
 __all__ = ["OPENRAZER_COMPATIBILITY_CONTRACT"]
diff --git a/integrations/openrazer/import.json b/integrations/openrazer/import.json
index 6a310e0..5d7c494 100644
--- a/integrations/openrazer/import.json
+++ b/integrations/openrazer/import.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/upstream-metadata-import.schema.json",
   "schema": "hyperflux-upstream-metadata-import-v1",
   "upstream_id": "openrazer",
-  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+  "source_commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
   "devices": [
     {
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
diff --git a/integrations/openrazer/metadata.json b/integrations/openrazer/metadata.json
index 9279d2a..fc9ed5e 100644
--- a/integrations/openrazer/metadata.json
+++ b/integrations/openrazer/metadata.json
@@ -4,11 +4,11 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.2",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+    "version": "3.12.4",
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "selection_sha256": "a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9",
+  "selection_sha256": "6994cfb256cf9e3b54c302eed2ad9023095c150f29992aee9510b850cef02188",
   "devices": [
     {
       "profile_id": "child.razer.basilisk-v3-pro-35k.00cd",
diff --git a/integrations/openrazer/native-control-policy.json b/integrations/openrazer/native-control-policy.json
index cdba478..8d94052 100644
--- a/integrations/openrazer/native-control-policy.json
+++ b/integrations/openrazer/native-control-policy.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/openrazer-native-control-policy.schema.json",
   "schema": "hyperflux-openrazer-native-control-policy-v1",
   "upstream_id": "openrazer",
-  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+  "source_commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
   "scope": "transport-facing-exact-wireless-classes",
   "report_size": 90,
   "common_methods": [
diff --git a/integrations/openrazer/native-method-inventory.json b/integrations/openrazer/native-method-inventory.json
index bdcb6a0..2fed0d7 100644
--- a/integrations/openrazer/native-method-inventory.json
+++ b/integrations/openrazer/native-method-inventory.json
@@ -4,12 +4,12 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.2",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+    "version": "3.12.4",
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "policy_sha256": "b109fb8473a004f6b27e85c399486e2b2bd57d99589e5caa15c10d673dafcf7e",
-  "metadata_selection_sha256": "a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9",
+  "policy_sha256": "9cb97e7808ad894a3d762f5c2c9e00e894e1bcaa373f79a2e951a3e181b972a4",
+  "metadata_selection_sha256": "6994cfb256cf9e3b54c302eed2ad9023095c150f29992aee9510b850cef02188",
   "report_size": 90,
   "source_files": [
     {
@@ -38,11 +38,11 @@
     },
     {
       "path": "driver/razercommon.h",
-      "sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f"
+      "sha256": "193a0e3c98621cd726659319d6cd25328877f832bcd24d7eef95e3b0b5fa2b60"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4"
+      "sha256": "ac68e071cf135ce2f4e64fdbc698a6dc20c711d3465124182af040460fe11782"
     },
     {
       "path": "driver/razerkbd_driver.h",
@@ -50,7 +50,7 @@
     },
     {
       "path": "driver/razermouse_driver.c",
-      "sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1"
+      "sha256": "bd00162b46710394b28f34f66a37dbfdeeccc161acdc63f8afea362c2521f01a"
     },
     {
       "path": "driver/razermouse_driver.h",
diff --git a/integrations/openrazer/native-probe-catalog.json b/integrations/openrazer/native-probe-catalog.json
index f3547e4..bbf9282 100644
--- a/integrations/openrazer/native-probe-catalog.json
+++ b/integrations/openrazer/native-probe-catalog.json
@@ -4,12 +4,12 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.2",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+    "version": "3.12.4",
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0"
   },
-  "policy_sha256": "35f634e6a6ee688aed8887ddd4abca369822052414605a9e04dcf893c89dd073",
-  "inventory_sha256": "0d88389f31c899515e7995a441bbfa12e64aad230caf670060c5b0da12c3e385",
+  "policy_sha256": "33a7a0e24dd65999995d5f1681f01aff6c480add8ad6c3494b429f99adea8679",
+  "inventory_sha256": "285326b4daba9dc1e6e060d12614c0f7cd228bb072bb31e150f178489c12ab1c",
   "report_size": 90,
   "busy_retry": {
     "status": 1,
@@ -22,15 +22,15 @@
     },
     {
       "path": "driver/razercommon.h",
-      "sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f"
+      "sha256": "193a0e3c98621cd726659319d6cd25328877f832bcd24d7eef95e3b0b5fa2b60"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4"
+      "sha256": "ac68e071cf135ce2f4e64fdbc698a6dc20c711d3465124182af040460fe11782"
     },
     {
       "path": "driver/razermouse_driver.c",
-      "sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1"
+      "sha256": "bd00162b46710394b28f34f66a37dbfdeeccc161acdc63f8afea362c2521f01a"
     }
   ],
   "devices": [
@@ -86,7 +86,7 @@
             "reader": "razer_attr_read_device_serial",
             "request_owner": "razer_attr_read_device_serial",
             "source_line": 1320,
-            "source_sha256": "2944c301199de96b7daa010af48ccee4b106eda5ce5135bb394a5a207dc73290"
+            "source_sha256": "43f8db36c6a2e35e3060b60044b10f573f6e02fdfe091b7c5f50cafd45fe5780"
           },
           "request": {
             "command_class": 0,
@@ -556,7 +556,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_firmware_version",
             "request_owner": "razer_attr_read_firmware_version",
-            "source_line": 2044,
+            "source_line": 2060,
             "source_sha256": "c4437ed6144a46d785ae773fe3c851432c80c63e2d740b6d01070f6d7f7ff21f"
           },
           "request": {
@@ -582,8 +582,8 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_device_serial",
             "request_owner": "razer_attr_read_device_serial",
-            "source_line": 2014,
-            "source_sha256": "eddbee64061c17aed62a4241b1e172a7abeab5961833170855441fdbe29f38ab"
+            "source_line": 2030,
+            "source_sha256": "c1fa93fb199ea1867ecca392a0fd9931abd86e47fae6f58fe97c8edc7b5ec2bf"
           },
           "request": {
             "command_class": 0,
@@ -628,7 +628,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_device_mode",
             "request_owner": "razer_attr_read_device_mode",
-            "source_line": 4039,
+            "source_line": 4055,
             "source_sha256": "39236061ef91779c100d8eccd1606023e3b60e9b694af79d140a8dc4382b1ea3"
           },
           "request": {
@@ -654,7 +654,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_kbd_layout",
             "request_owner": "razer_attr_read_kbd_layout",
-            "source_line": 470,
+            "source_line": 486,
             "source_sha256": "ddeb5301cf7a572e443da7893454cd38cae3ac049162d68e3f6402b5bc4b6006"
           },
           "request": {
@@ -680,7 +680,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_charge_level",
             "request_owner": "razer_attr_read_charge_level",
-            "source_line": 642,
+            "source_line": 658,
             "source_sha256": "7883389bbba439585de271db6bc5565ffa89d9829337f577b72e835a38b04133"
           },
           "request": {
@@ -706,7 +706,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_charge_status",
             "request_owner": "razer_attr_read_charge_status",
-            "source_line": 687,
+            "source_line": 703,
             "source_sha256": "fe90a99badadce54aafbfe60458ff63cd6d99d4d81a712b685878febd683ae66"
           },
           "request": {
@@ -732,7 +732,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_game_led_state",
             "request_owner": "razer_attr_read_game_led_state",
-            "source_line": 922,
+            "source_line": 938,
             "source_sha256": "6c17d88e0814bf372c766b7de4cea7b368002f47c3acdcaca47f4dfc91406ce7"
           },
           "request": {
@@ -759,7 +759,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_macro_led_state",
             "request_owner": "razer_attr_read_macro_led_state",
-            "source_line": 1101,
+            "source_line": 1117,
             "source_sha256": "888e0973122d9ae89ec4d68a920e8981356ff8c58970f1e4c148da321bc1cd2d"
           },
           "request": {
@@ -786,7 +786,7 @@
             "source_path": "driver/razerkbd_driver.c",
             "reader": "razer_attr_read_macro_led_effect",
             "request_owner": "razer_attr_read_macro_led_effect",
-            "source_line": 1724,
+            "source_line": 1740,
             "source_sha256": "2ff2b62f16d8ece600d215adb4a4088a4198307cc7c62132713f429c1b0b3b3c"
           },
           "request": {
diff --git a/integrations/openrazer/native-probe-policy.json b/integrations/openrazer/native-probe-policy.json
index 39d28a4..c6e4b1f 100644
--- a/integrations/openrazer/native-probe-policy.json
+++ b/integrations/openrazer/native-probe-policy.json
@@ -2,7 +2,7 @@
   "$schema": "../../schemas/openrazer-native-probe-policy.schema.json",
   "schema": "hyperflux-openrazer-native-probe-policy-v1",
   "upstream_id": "openrazer",
-  "source_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+  "source_commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
   "report_size": 90,
   "busy_retry": {
     "status": 1,
diff --git a/integrations/openrazer/native-route/catalog.json b/integrations/openrazer/native-route/catalog.json
index 8c5a593..63a6a02 100644
--- a/integrations/openrazer/native-route/catalog.json
+++ b/integrations/openrazer/native-route/catalog.json
@@ -1,8 +1,8 @@
 {
   "$schema": "../../../schemas/openrazer-native-route-catalog.schema.json",
   "schema": "hyperflux-openrazer-native-route-catalog-v1",
-  "upstream_commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
-  "metadata_sha256": "529bf7d31c496a96ef5d0798fd08555f8c16c8c9a7e3670c42689a51e964589a",
+  "upstream_commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
+  "metadata_sha256": "1bf4f15eee0d31f10b144eb303d3659981bba9022a61d9155d3b1af56757bc66",
   "transport": {
     "protocol_family": "razer-feature-report-v1",
     "report_bytes": 90,
diff --git a/integrations/openrazer/native-route/deployment.json b/integrations/openrazer/native-route/deployment.json
index 5579b80..50b3bc3 100644
--- a/integrations/openrazer/native-route/deployment.json
+++ b/integrations/openrazer/native-route/deployment.json
@@ -1,6 +1,6 @@
 {
   "$schema": "../../../schemas/openrazer-native-deployment.schema.json",
-  "schema": "hyperflux-openrazer-native-deployment-v1",
+  "schema": "hyperflux-openrazer-native-deployment-v2",
   "relay": {
     "executable_path": "/usr/lib/hyperflux-next/hyperflux-next-uhid-relay",
     "service_unit": "hyperflux-next-openrazer-relay.service",
@@ -9,8 +9,8 @@
   },
   "driver": {
     "dkms_name": "openrazer-driver",
-    "dkms_version": "3.12.2",
-    "source_directory": "/usr/src/openrazer-driver-3.12.2",
+    "dkms_version": "3.12.4",
+    "source_directory": "/usr/src/openrazer-driver-3.12.4",
     "modules": ["razeraccessory", "razerkbd", "razerkraken", "razermouse"]
   },
   "access": {
@@ -20,5 +20,17 @@
     "mount_helper_source": "install_files/udev/razer_mount",
     "mount_helper_path": "/usr/lib/udev/razer_mount",
     "sysusers_path": "/usr/lib/sysusers.d/openrazer.conf"
+  },
+  "compatibility": {
+    "verified_upstream_version": "3.12.4",
+    "daemon_executable_path": "/usr/bin/openrazer-daemon",
+    "version_argument": "--version",
+    "package_release_policy": "ignored",
+    "unverified_upstream_policy": "rebase-reverification-required",
+    "runtime_capability": {
+      "modinfo_field": "hyperflux_native_transport",
+      "expected_value": "razer-feature-report-v1",
+      "modules": ["razerkbd", "razermouse"]
+    }
   }
 }
diff --git a/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
index e2ecd69..0065212 100644
--- a/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
+++ b/integrations/openrazer/native-route/patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch
@@ -1,22 +1,22 @@
-From 3fb18470ece076b4165593b1828760a1ad166b58 Mon Sep 17 00:00:00 2001
+From 96686eb2e0d0c180dcc89d0599c07e517d5a282b Mon Sep 17 00:00:00 2001
 From: HyperFlux Next Source Transformer <noreply@hyperflux.dev>
-Date: Sun, 26 Jul 2026 21:29:19 +0400
+Date: Sun, 26 Jul 2026 23:49:08 +0400
 Subject: [PATCH] Add trusted HyperFlux native HID transport
 
-Carry the Arch Linux hid_report_raw_event compatibility condition for newer kernels and deploy udev access through the openrazer group.
+Extend official OpenRazer v3.12.4 with the HyperFlux virtual HID transport while preserving upstream strscpy cleanup and the complete hid_report_raw_event backport. Expose a capability marker and use the standard openrazer access group.
 ---
- driver/razercommon.c              |  89 +++++++++++++++++++++++
+ driver/razercommon.c              |  89 ++++++++++++++++++++++++++
  driver/razercommon.h              |   8 +++
- driver/razerkbd_driver.c          | 112 +++++++++++++++++++++++-------
+ driver/razerkbd_driver.c          | 100 ++++++++++++++++++++++--------
  driver/razerkbd_driver.h          |   1 +
- driver/razermouse_driver.c        |  81 +++++++++++++++------
+ driver/razermouse_driver.c        |  82 +++++++++++++++++-------
  driver/razermouse_driver.h        |   1 +
- install_files/udev/99-razer.rules |   5 ++++-
+ install_files/udev/99-razer.rules |   5 +-
  install_files/udev/razer_mount    |   3 +-
- 8 files changed, 249 insertions(+), 51 deletions(-)
+ 8 files changed, 238 insertions(+), 51 deletions(-)
 
 diff --git a/driver/razercommon.c b/driver/razercommon.c
-index 4e8548a..126f3a5 100644
+index 4e8548a..b4e4416 100644
 --- a/driver/razercommon.c
 +++ b/driver/razercommon.c
 @@ -12,6 +12,95 @@
@@ -116,7 +116,7 @@ index 4e8548a..126f3a5 100644
   * Send USB control report to the keyboard
   * USUALLY index = 0x02
 diff --git a/driver/razercommon.h b/driver/razercommon.h
-index aaad6d6..dcf2551 100644
+index 54651a9..d56a847 100644
 --- a/driver/razercommon.h
 +++ b/driver/razercommon.h
 @@ -7,6 +7,8 @@
@@ -127,7 +127,7 @@ index aaad6d6..dcf2551 100644
 +#include <linux/hid.h>
  #include <linux/usb/input.h>
  
- #define DRIVER_VERSION "3.12.2"
+ #define DRIVER_VERSION "3.12.4"
 @@ -33,6 +35,9 @@ do { \
  
  #define USB_VENDOR_ID_RAZER 0x1532
@@ -149,18 +149,10 @@ index aaad6d6..dcf2551 100644
  // Convenience functions
  unsigned char clamp_u8(unsigned char value, unsigned char min, unsigned char max);
 diff --git a/driver/razerkbd_driver.c b/driver/razerkbd_driver.c
-index 20345ff..c542631 100644
+index 5d9e2bd..035ce92 100644
 --- a/driver/razerkbd_driver.c
 +++ b/driver/razerkbd_driver.c
-@@ -11,6 +11,7 @@
- #include <linux/hid.h>
- #include <linux/dmi.h>
- #include <linux/input-event-codes.h>
-+#include <linux/version.h>
- 
- #include "usb_hid_keys.h"
- 
-@@ -23,6 +24,8 @@
+@@ -24,9 +24,12 @@
   */
  #define DRIVER_DESC "Razer Keyboard Device Driver"
  
@@ -169,7 +161,11 @@ index 20345ff..c542631 100644
  MODULE_AUTHOR(DRIVER_AUTHOR);
  MODULE_DESCRIPTION(DRIVER_DESC);
  MODULE_VERSION(DRIVER_VERSION);
-@@ -319,9 +322,9 @@ static bool is_blade_laptop(struct razer_kbd_device *device)
++MODULE_INFO(hyperflux_native_transport, "razer-feature-report-v1");
+ MODULE_LICENSE(DRIVER_LICENSE);
+ 
+ // KEY_MACRO* has been added in Linux 5.5, so define ourselves for older kernels.
+@@ -335,9 +338,9 @@ static bool is_blade_laptop(struct razer_kbd_device *device)
  /**
   * Get request/response indices and timing parameters for the device
   */
@@ -181,7 +177,7 @@ index 20345ff..c542631 100644
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_TENKEYLESS:
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2:
      case USB_DEVICE_ID_RAZER_HUNTSMAN_V2_ANALOG:
-@@ -395,12 +398,16 @@ static void razer_get_report_params(struct usb_device *usb_dev, uint *report_ind
+@@ -411,12 +414,16 @@ static void razer_get_report_params(struct usb_device *usb_dev, uint *report_ind
  /**
   * Send report to the keyboard
   */
@@ -201,7 +197,7 @@ index 20345ff..c542631 100644
  }
  
  /**
-@@ -414,7 +421,13 @@ static int razer_send_payload_no_response(struct razer_kbd_device *device, struc
+@@ -430,7 +437,13 @@ static int razer_send_payload_no_response(struct razer_kbd_device *device, struc
      /* Except the caller to have set the transaction_id */
      WARN_ON(request->transaction_id.id == 0x00);
  
@@ -216,7 +212,7 @@ index 20345ff..c542631 100644
      return razer_send_control_msg(device->usb_dev, request, report_index, wait_min, wait_max);
  }
  
-@@ -428,7 +441,7 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
+@@ -444,7 +457,7 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
      request->crc = razer_calculate_crc(request);
  
      mutex_lock(&device->lock);
@@ -225,7 +221,7 @@ index 20345ff..c542631 100644
      mutex_unlock(&device->lock);
      if (err) {
          print_erroneous_report(response, "razerkbd", "Invalid Report Length");
-@@ -440,6 +453,8 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
+@@ -456,6 +469,8 @@ static int razer_send_payload(struct razer_kbd_device *device, struct razer_repo
          response->command_class != request->command_class ||
          response->command_id.id != request->command_id.id) {
          print_erroneous_report(response, "razerkbd", "Response doesn't match request");
@@ -234,31 +230,7 @@ index 20345ff..c542631 100644
          return -EIO;
      }
  
-@@ -4834,11 +4849,23 @@ static int razer_raw_event_bitfield(struct hid_device *hdev, struct razer_kbd_de
- 
-                             // report key down
-                             xdata[1] = cur_value;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0) || \
-+        (LINUX_VERSION_CODE >= KERNEL_VERSION(7, 0, 10) && LINUX_VERSION_CODE < KERNEL_VERSION(7, 1, 0)) || \
-+        (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 33) && LINUX_VERSION_CODE < KERNEL_VERSION(6, 19, 0))
-+                            hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), sizeof(xdata), 0);
-+#else
-                             hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), 0);
-+#endif
- 
-                             // report key up
-                             xdata[1] = 0x00;
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(7, 1, 0) || \
-+        (LINUX_VERSION_CODE >= KERNEL_VERSION(7, 0, 10) && LINUX_VERSION_CODE < KERNEL_VERSION(7, 1, 0)) || \
-+        (LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 33) && LINUX_VERSION_CODE < KERNEL_VERSION(6, 19, 0))
-+                            hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), sizeof(xdata), 0);
-+#else
-                             hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), 0);
-+#endif
-                         }
-                     }
-                 }
-@@ -4946,15 +4973,23 @@ static int razer_kbd_input_mapping(struct hid_device *hdev, struct hid_input *hi
+@@ -4970,15 +4985,23 @@ static int razer_kbd_input_mapping(struct hid_device *hdev, struct hid_input *hi
  
  static void razer_kbd_init(struct razer_kbd_device *dev, struct usb_interface *intf, struct hid_device *hdev)
  {
@@ -288,7 +260,7 @@ index 20345ff..c542631 100644
  }
  
  /**
-@@ -4963,13 +4998,20 @@ static void razer_kbd_init(struct razer_kbd_device *dev, struct usb_interface *i
+@@ -4987,13 +5010,20 @@ static void razer_kbd_init(struct razer_kbd_device *dev, struct usb_interface *i
  static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *id)
  {
      int retval = 0;
@@ -312,7 +284,7 @@ index 20345ff..c542631 100644
          return -ENOMEM;
      }
  
-@@ -4977,7 +5019,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5001,7 +5031,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
      razer_kbd_init(dev, intf, hdev);
  
      // Other interfaces are actual key-emitting devices
@@ -321,7 +293,7 @@ index 20345ff..c542631 100644
          // If the currently bound device is the control (mouse) interface
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_version);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
-@@ -4988,7 +5030,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5012,7 +5042,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
  
@@ -330,7 +302,7 @@ index 20345ff..c542631 100644
  
          case USB_DEVICE_ID_RAZER_NOSTROMO:
              CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
-@@ -5474,10 +5516,10 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5498,10 +5528,10 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
          // Set device to regular mode, not driver mode
          // When the daemon discovers the device it will instruct it to enter driver mode
          // Tartarus Pro resets when it receives this command
@@ -343,7 +315,7 @@ index 20345ff..c542631 100644
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_super);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_tab);
          CREATE_DEVICE_FILE(&hdev->dev, &dev_attr_key_alt_f4);
-@@ -5497,7 +5539,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
+@@ -5521,7 +5551,7 @@ static int razer_kbd_probe(struct hid_device *hdev, const struct hid_device_id *
      }
  
      // Leave autosuspend on for laptops
@@ -352,7 +324,7 @@ index 20345ff..c542631 100644
          usb_disable_autosuspend(usb_dev);
      }
  
-@@ -5516,13 +5558,11 @@ exit_free:
+@@ -5540,13 +5570,11 @@ exit_free:
  static void razer_kbd_disconnect(struct hid_device *hdev)
  {
      struct razer_kbd_device *dev;
@@ -367,7 +339,7 @@ index 20345ff..c542631 100644
          // If the currently bound device is the control (mouse) interface
          device_remove_file(&hdev->dev, &dev_attr_version);
          device_remove_file(&hdev->dev, &dev_attr_firmware_version);                      // Get the firmware version
-@@ -5533,7 +5573,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+@@ -5557,7 +5585,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
          device_remove_file(&hdev->dev, &dev_attr_device_mode);                           // Get device mode
          device_remove_file(&hdev->dev, &dev_attr_kbd_layout);                            // Gets the physical layout
  
@@ -376,7 +348,7 @@ index 20345ff..c542631 100644
  
          case USB_DEVICE_ID_RAZER_NOSTROMO:
              device_remove_file(&hdev->dev, &dev_attr_profile_led_red);               // Profile/Macro LED Red
-@@ -6015,7 +6055,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+@@ -6039,7 +6067,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
              device_remove_file(&hdev->dev, &dev_attr_macro_led_effect);              // Change macro LED effect (static, flashing)
              break;
          }
@@ -385,7 +357,7 @@ index 20345ff..c542631 100644
          device_remove_file(&hdev->dev, &dev_attr_key_super);
          device_remove_file(&hdev->dev, &dev_attr_key_alt_tab);
          device_remove_file(&hdev->dev, &dev_attr_key_alt_f4);
-@@ -6023,7 +6063,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
+@@ -6047,7 +6075,7 @@ static void razer_kbd_disconnect(struct hid_device *hdev)
  
      hid_hw_stop(hdev);
      kfree(dev);
@@ -394,7 +366,7 @@ index 20345ff..c542631 100644
  }
  
  /**
-@@ -6172,9 +6212,27 @@ static const struct hid_device_id razer_devices[] = {
+@@ -6196,9 +6224,27 @@ static const struct hid_device_id razer_devices[] = {
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_HUNTSMAN_V3_PRO_8KHZ) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2024) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_BLADE_18_2025) },
@@ -435,7 +407,7 @@ index 36a66ab..62d4fb0 100644
      struct mutex lock;
      unsigned char usb_interface_protocol;
 diff --git a/driver/razermouse_driver.c b/driver/razermouse_driver.c
-index aa6aef3..2d36210 100644
+index 36a58a3..5723ff8 100644
 --- a/driver/razermouse_driver.c
 +++ b/driver/razermouse_driver.c
 @@ -22,6 +22,8 @@
@@ -447,7 +419,13 @@ index aa6aef3..2d36210 100644
  /* REL_HWHEEL_HI_RES was added in Linux 5.0, so define ourselves for older kernels
   * See also https://git.kernel.org/torvalds/c/52ea899 */
  #ifndef REL_HWHEEL_HI_RES
-@@ -36,10 +38,14 @@ MODULE_LICENSE(DRIVER_LICENSE);
+@@ -31,15 +33,20 @@
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+ MODULE_DESCRIPTION(DRIVER_DESC);
+ MODULE_VERSION(DRIVER_VERSION);
++MODULE_INFO(hyperflux_native_transport, "razer-feature-report-v1");
+ MODULE_LICENSE(DRIVER_LICENSE);
+ 
  /**
   * Send report to the mouse
   */
@@ -464,7 +442,7 @@ index aa6aef3..2d36210 100644
      // These devices require longer waits to read their firmware, serial, and other setting values
      case USB_DEVICE_ID_RAZER_LANCEHEAD_WIRELESS_RECEIVER:
      case USB_DEVICE_ID_RAZER_LANCEHEAD_WIRELESS_WIRED:
-@@ -82,13 +88,13 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
+@@ -82,13 +89,13 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
      case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_VERTICAL_EDITION_WIRED:
      case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRED:
      case USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRELESS:
@@ -480,7 +458,7 @@ index aa6aef3..2d36210 100644
          break;
  
      case USB_DEVICE_ID_RAZER_VIPER_ULTIMATE_WIRELESS:
-@@ -100,18 +106,18 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
+@@ -100,18 +107,18 @@ static int razer_get_report(struct usb_device *usb_dev, struct razer_report *req
      case USB_DEVICE_ID_RAZER_HYPERPOLLING_WIRELESS_DONGLE:
      case USB_DEVICE_ID_RAZER_VIPER_V3_HYPERSPEED:
      case USB_DEVICE_ID_RAZER_VIPER_V3_PRO_WIRELESS:
@@ -502,7 +480,7 @@ index aa6aef3..2d36210 100644
      }
  }
  
-@@ -125,7 +131,7 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
+@@ -125,7 +132,7 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
      request->crc = razer_calculate_crc(request);
  
      mutex_lock(&device->lock);
@@ -511,7 +489,7 @@ index aa6aef3..2d36210 100644
      mutex_unlock(&device->lock);
      if (err) {
          print_erroneous_report(response, "razermouse", "Invalid Report Length");
-@@ -137,6 +143,8 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
+@@ -137,6 +144,8 @@ static int razer_send_payload(struct razer_mouse_device *device, struct razer_re
          response->command_class != request->command_class ||
          response->command_id.id != request->command_id.id) {
          print_erroneous_report(response, "razermouse", "Response doesn't match request");
@@ -520,7 +498,7 @@ index aa6aef3..2d36210 100644
          return -EIO;
      }
  
-@@ -6010,17 +6018,27 @@ static int razer_input_configured(struct hid_device *hdev,
+@@ -6010,17 +6019,27 @@ static int razer_input_configured(struct hid_device *hdev,
   */
  static void razer_mouse_init(struct razer_mouse_device *dev, struct usb_interface *intf, struct hid_device *hdev)
  {
@@ -554,7 +532,7 @@ index aa6aef3..2d36210 100644
  
      // Get a "random" integer
      get_random_bytes(&rand_serial, sizeof(unsigned int));
-@@ -6054,14 +6072,19 @@ static void razer_mouse_init(struct razer_mouse_device *dev, struct usb_interfac
+@@ -6054,14 +6073,19 @@ static void razer_mouse_init(struct razer_mouse_device *dev, struct usb_interfac
  static int razer_mouse_probe(struct hid_device *hdev, const struct hid_device_id *id)
  {
      int retval = 0;
@@ -576,7 +554,7 @@ index aa6aef3..2d36210 100644
          return -ENOMEM;
      }
  
-@@ -7185,12 +7208,10 @@ exit_free:
+@@ -7185,12 +7209,10 @@ exit_free:
  static void razer_mouse_disconnect(struct hid_device *hdev)
  {
      struct razer_mouse_device *dev;
@@ -590,7 +568,7 @@ index aa6aef3..2d36210 100644
          device_remove_file(&hdev->dev, &dev_attr_version);
          device_remove_file(&hdev->dev, &dev_attr_test);
          device_remove_file(&hdev->dev, &dev_attr_firmware_version);
-@@ -7198,7 +7219,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
+@@ -7198,7 +7220,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
          device_remove_file(&hdev->dev, &dev_attr_device_serial);
          device_remove_file(&hdev->dev, &dev_attr_device_mode);
  
@@ -599,7 +577,7 @@ index aa6aef3..2d36210 100644
          case USB_DEVICE_ID_RAZER_ABYSSUS_ELITE_DVA_EDITION:
          case USB_DEVICE_ID_RAZER_ABYSSUS_ESSENTIAL:
              device_remove_file(&hdev->dev, &dev_attr_poll_rate);
-@@ -8270,7 +8291,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
+@@ -8270,7 +8292,7 @@ static void razer_mouse_disconnect(struct hid_device *hdev)
      hrtimer_cancel(&dev->repeat_timer);
  
      kfree(dev);
@@ -608,7 +586,7 @@ index aa6aef3..2d36210 100644
  }
  
  /**
-@@ -8390,9 +8411,27 @@ static const struct hid_device_id razer_devices[] = {
+@@ -8390,9 +8412,27 @@ static const struct hid_device_id razer_devices[] = {
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_VERTICAL_EDITION_WIRED) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRED) },
      { HID_USB_DEVICE(USB_VENDOR_ID_RAZER,USB_DEVICE_ID_RAZER_PRO_CLICK_V2_WIRELESS) },
@@ -649,7 +627,7 @@ index 66612ff..22ad571 100644
      struct mutex lock;
  
 diff --git a/install_files/udev/99-razer.rules b/install_files/udev/99-razer.rules
-index ca66a20..207c404 100644
+index ca66a20..07fe942 100644
 --- a/install_files/udev/99-razer.rules
 +++ b/install_files/udev/99-razer.rules
 @@ -1,3 +1,6 @@
@@ -659,7 +637,7 @@ index ca66a20..207c404 100644
  ACTION!="add", GOTO="razer_end"
  SUBSYSTEMS=="usb|input|hid", ATTRS{idVendor}=="1532", GOTO="razer_vendor"
  GOTO="razer_end"
-@@ -28,7 +28,7 @@ ATTRS{idProduct}=="0068|007e|00a4|0215|0517|0518|0c00|0c01|0c02|0c04|0c05|0c06|0
+@@ -28,7 +31,7 @@ ATTRS{idProduct}=="0068|007e|00a4|0215|0517|0518|0c00|0c01|0c02|0c04|0c05|0c06|0
  ENV{ID_RAZER_CHROMA}!="1", GOTO="razer_end"
  
  # Set permissions if this is an input node
@@ -681,3 +659,6 @@ index 3fc0fef..3fa03b7 100755
  	mesg "Changed group /sys/bus/hid/drivers/$DRIVER/$DEVICE_ID/"
  fi
 -
+-- 
+2.55.0
+
diff --git a/integrations/openrazer/native-route/transform.json b/integrations/openrazer/native-route/transform.json
index 12ebf28..96259dc 100644
--- a/integrations/openrazer/native-route/transform.json
+++ b/integrations/openrazer/native-route/transform.json
@@ -4,11 +4,11 @@
   "upstream": {
     "id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd"
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1"
   },
   "patch": {
     "path": "patches/0001-Add-trusted-HyperFlux-native-HID-transport.patch",
-    "sha256": "525e6c7655e9ca4dc2192117066e384b9a5b7dc799894e4163577144f53409b4"
+    "sha256": "58de8485e0ce606db510fb18f12a32fe16c2714a434de623b5afb3d4dff835b8"
   },
   "files": [
     {
@@ -18,13 +18,13 @@
     },
     {
       "path": "driver/razercommon.h",
-      "source_sha256": "cf7964af6d08f8a33eaad7956e6fd0aa1d251ff397e72a117e2b13ba947ef39f",
-      "transformed_sha256": "cc21768853373e1d1ed76a9fb8459fcb594a6044508fecf72e1c77bea5ff45dc"
+      "source_sha256": "193a0e3c98621cd726659319d6cd25328877f832bcd24d7eef95e3b0b5fa2b60",
+      "transformed_sha256": "e2ef3b6f59983774aa672c5ca15f7c4ff8e0f54bb8ff71bbdc2d8f48e0efcd73"
     },
     {
       "path": "driver/razerkbd_driver.c",
-      "source_sha256": "08b2582ededa530e304167802c72bdca0c766d912b813bc032735a697a9d61b4",
-      "transformed_sha256": "fcfe4fbfe23fc47416932c9a116f9ea58e00c8ebc0b72741b9352e101c8e49c1"
+      "source_sha256": "ac68e071cf135ce2f4e64fdbc698a6dc20c711d3465124182af040460fe11782",
+      "transformed_sha256": "4fa840e99d7c49aaffdf61d2585bbf3e34d15c5a8b1653f71316385d8962c227"
     },
     {
       "path": "driver/razerkbd_driver.h",
@@ -33,8 +33,8 @@
     },
     {
       "path": "driver/razermouse_driver.c",
-      "source_sha256": "73ea67d5314316ecd59d07dc8def979a1fbcfc5d398a728fed733a8f1f4f31b1",
-      "transformed_sha256": "b5dcc8d8726c383b2cc253a1ccfb28ee917bf3fb08ae39e5464b1d04406b0c51"
+      "source_sha256": "bd00162b46710394b28f34f66a37dbfdeeccc161acdc63f8afea362c2521f01a",
+      "transformed_sha256": "3c616f9c12a92e69ebd28984794e40678c9788dba987ba1260518bababc5d07d"
     },
     {
       "path": "driver/razermouse_driver.h",
diff --git a/knowledge/upstreams/openrazer.json b/knowledge/upstreams/openrazer.json
index 19375fb..b34d095 100644
--- a/knowledge/upstreams/openrazer.json
+++ b/knowledge/upstreams/openrazer.json
@@ -4,8 +4,8 @@
   "source": {
     "upstream_id": "openrazer",
     "repository": "https://github.com/openrazer/openrazer.git",
-    "version": "3.12.2",
-    "commit": "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+    "version": "3.12.4",
+    "commit": "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
     "license_expression": "GPL-2.0-or-later AND CC-BY-SA-4.0",
     "extractor": "python-ast-v1",
     "source_files": [
diff --git a/packaging/distributions.json b/packaging/distributions.json
index 9e84789..b038554 100644
--- a/packaging/distributions.json
+++ b/packaging/distributions.json
@@ -28,7 +28,10 @@
         {"package": "python-gobject", "purpose": "private OpenRazer compatibility event loop"}
       ],
       "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
-      "provides": ["openrazer-driver-dkms"],
+      "provides": [
+        "openrazer-driver-dkms",
+        "hyperflux-openrazer-driver-abi=@openrazer_driver_version@"
+      ],
       "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python@python_major_minor@/site-packages/hyperflux-next.pth"
     },
@@ -54,7 +57,10 @@
         {"package": "python3-gi", "purpose": "private OpenRazer compatibility event loop"}
       ],
       "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
-      "provides": ["openrazer-driver-dkms"],
+      "provides": [
+        "openrazer-driver-dkms",
+        "hyperflux-openrazer-driver-abi (= @openrazer_driver_version@)"
+      ],
       "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python3/dist-packages/hyperflux-next.pth"
     },
@@ -80,7 +86,10 @@
         {"package": "python3-gobject", "purpose": "private OpenRazer compatibility event loop"}
       ],
       "conflicts": ["hyperflux-v2-linux-dkms", "openrazer-driver-dkms"],
-      "provides": ["openrazer-driver-dkms"],
+      "provides": [
+        "openrazer-driver-dkms",
+        "hyperflux-openrazer-driver-abi=@openrazer_driver_version@"
+      ],
       "replaces": ["openrazer-driver-dkms"],
       "python_discovery_path": "/usr/lib/python@python_major_minor@/site-packages/hyperflux-next.pth"
     }
diff --git a/packaging/generated/hyperflux-next-openrazer-relay.service b/packaging/generated/hyperflux-next-openrazer-relay.service
index 557a754..fbfbeaa 100644
--- a/packaging/generated/hyperflux-next-openrazer-relay.service
+++ b/packaging/generated/hyperflux-next-openrazer-relay.service
@@ -11,6 +11,7 @@ ConditionPathExists=/dev/uhid
 Type=simple
 User=root
 Group=root
+ExecCondition=/usr/lib/hyperflux-next/hyperflux-next-activate check-openrazer-runtime
 ExecStart=/usr/lib/hyperflux-next/hyperflux-next-uhid-relay --socket /run/hyperflux-next/bridge.sock --uhid /dev/uhid
 UMask=0077
 Restart=on-failure
diff --git a/packaging/generated/install-plan.json b/packaging/generated/install-plan.json
index 54602c7..f010e36 100644
--- a/packaging/generated/install-plan.json
+++ b/packaging/generated/install-plan.json
@@ -68,7 +68,7 @@
       "kind": "source-transform",
       "required": true,
       "transform": "openrazer-native-route",
-      "destination": "/usr/src/openrazer-driver-3.12.2",
+      "destination": "/usr/src/openrazer-driver-3.12.4",
       "mode": "0644",
       "capability": "openrazer-source"
     },
diff --git a/profiles/lifecycle-policies.json b/profiles/lifecycle-policies.json
index 65c3c6d..5a0a844 100644
--- a/profiles/lifecycle-policies.json
+++ b/profiles/lifecycle-policies.json
@@ -15,7 +15,7 @@
       "timing_authorities": [
         {
           "kind": "pinned-upstream-contract",
-          "source_id": "openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339",
+          "source_id": "openrazer:1ef8a91712906a89fd332a2ed62bbd105315d6d1:driver/razerchromacommon.c:1339",
           "source_sha256": "6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc",
           "summary": "The pinned upstream idle-time command accepts 60 through 900 seconds; 60 seconds is therefore a conservative quiescent candidate, never a claim that the endpoint slept."
         },
diff --git a/schemas/openrazer-native-deployment.schema.json b/schemas/openrazer-native-deployment.schema.json
index 6f1709d..f34c1ce 100644
--- a/schemas/openrazer-native-deployment.schema.json
+++ b/schemas/openrazer-native-deployment.schema.json
@@ -1,13 +1,13 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://hyperflux.dev/schemas/openrazer-native-deployment-v1.json",
+  "$id": "https://hyperflux.dev/schemas/openrazer-native-deployment-v2.json",
   "title": "HyperFlux OpenRazer native-route deployment",
   "type": "object",
   "additionalProperties": false,
-  "required": ["$schema", "schema", "relay", "driver", "access"],
+  "required": ["$schema", "schema", "relay", "driver", "access", "compatibility"],
   "properties": {
     "$schema": {"const": "../../../schemas/openrazer-native-deployment.schema.json"},
-    "schema": {"const": "hyperflux-openrazer-native-deployment-v1"},
+    "schema": {"const": "hyperflux-openrazer-native-deployment-v2"},
     "relay": {
       "type": "object",
       "additionalProperties": false,
@@ -68,6 +68,51 @@
         "mount_helper_path": {"const": "/usr/lib/udev/razer_mount"},
         "sysusers_path": {"const": "/usr/lib/sysusers.d/openrazer.conf"}
       }
+    },
+    "compatibility": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "verified_upstream_version",
+        "daemon_executable_path",
+        "version_argument",
+        "package_release_policy",
+        "unverified_upstream_policy",
+        "runtime_capability"
+      ],
+      "properties": {
+        "verified_upstream_version": {
+          "type": "string",
+          "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$",
+          "maxLength": 32
+        },
+        "daemon_executable_path": {"const": "/usr/bin/openrazer-daemon"},
+        "version_argument": {"const": "--version"},
+        "package_release_policy": {"const": "ignored"},
+        "unverified_upstream_policy": {"const": "rebase-reverification-required"},
+        "runtime_capability": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["modinfo_field", "expected_value", "modules"],
+          "properties": {
+            "modinfo_field": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9_]{0,63}$"
+            },
+            "expected_value": {
+              "type": "string",
+              "pattern": "^[a-z0-9][a-z0-9_.-]{0,63}$"
+            },
+            "modules": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 16,
+              "uniqueItems": true,
+              "items": {"type": "string", "pattern": "^[a-z][a-z0-9_-]{0,63}$"}
+            }
+          }
+        }
+      }
     }
   }
 }
diff --git a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
index 1a5c1d1..dbcda13 100644
--- a/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/error_catalog.hpp
@@ -22,6 +22,8 @@ enum class ErrorCode
     HfxIntegration001,
     HfxIntegration002,
     HfxIntegration003,
+    HfxIntegration004,
+    HfxIntegration005,
     HfxInternal001,
     HfxKernel001,
     HfxKernel002,
@@ -52,6 +54,8 @@ enum class ErrorCode
         case ErrorCode::HfxIntegration001: return "HFX-INTEGRATION-001";
         case ErrorCode::HfxIntegration002: return "HFX-INTEGRATION-002";
         case ErrorCode::HfxIntegration003: return "HFX-INTEGRATION-003";
+        case ErrorCode::HfxIntegration004: return "HFX-INTEGRATION-004";
+        case ErrorCode::HfxIntegration005: return "HFX-INTEGRATION-005";
         case ErrorCode::HfxInternal001: return "HFX-INTERNAL-001";
         case ErrorCode::HfxKernel001: return "HFX-KERNEL-001";
         case ErrorCode::HfxKernel002: return "HFX-KERNEL-002";
@@ -89,9 +93,11 @@ enum class RemediationId
     QualifyDevice,
     ReconcileTransactionState,
     RefreshGeneration,
+    ReinstallOpenrazerRouteDriver,
     ReleaseOwner,
     RepairStateStorage,
     RetryBounded,
+    ReverifyOpenrazerSource,
     StartBridge,
     SubmitBeforeDeadline,
     UpdateIntegration,
@@ -115,9 +121,11 @@ enum class RemediationId
         case RemediationId::QualifyDevice: return "qualify-device";
         case RemediationId::ReconcileTransactionState: return "reconcile-transaction-state";
         case RemediationId::RefreshGeneration: return "refresh-generation";
+        case RemediationId::ReinstallOpenrazerRouteDriver: return "reinstall-openrazer-route-driver";
         case RemediationId::ReleaseOwner: return "release-owner";
         case RemediationId::RepairStateStorage: return "repair-state-storage";
         case RemediationId::RetryBounded: return "retry-bounded";
+        case RemediationId::ReverifyOpenrazerSource: return "reverify-openrazer-source";
         case RemediationId::StartBridge: return "start-bridge";
         case RemediationId::SubmitBeforeDeadline: return "submit-before-deadline";
         case RemediationId::UpdateIntegration: return "update-integration";
@@ -323,13 +331,13 @@ struct ErrorDescriptor
     std::string_view docs_path;
 };
 
-inline constexpr std::string_view error_catalog_sha256 = "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c";
+inline constexpr std::string_view error_catalog_sha256 = "e709d84eae07623b6e59c2863cf707d9d3edb09381ef77f40fd0126cfca66afd";
 inline constexpr std::size_t max_error_count = 256;
 inline constexpr std::size_t max_remediation_count = 128;
 inline constexpr std::size_t max_safe_detail_fields = 12;
 inline constexpr std::size_t max_safe_detail_length = 256;
 
-inline constexpr std::array<RemediationDescriptor, 20> remediations {{
+inline constexpr std::array<RemediationDescriptor, 22> remediations {{
     {RemediationId::AcquireNewLease, "Acquire a current lease", "Request a new lease for the complete resource set before submitting another operation.", "Read the ownership snapshot and confirm the new lease is current.", false},
     {RemediationId::ActivateInstalledDriver, "Activate the installed driver", "Use the platform's documented reboot or receiver-disconnect activation path.", "Run Doctor and confirm the loaded and installed driver identities match.", false},
     {RemediationId::ActivateOpenrazerRouteDriver, "Activate the OpenRazer route driver", "Reboot to activate the source-bound OpenRazer route driver. If Doctor still reports a missing module, reinstall the current HyperFlux package before retrying.", "Run Doctor and confirm every installed OpenRazer route module is either unloaded or matches its loaded identity.", false},
@@ -342,9 +350,11 @@ inline constexpr std::array<RemediationDescriptor, 20> remediations {{
     {RemediationId::QualifyDevice, "Use a qualified device capability", "Keep the device read-only until an evidence-backed profile qualifies the requested capability.", "Inspect the capability snapshot and confirm the support level permits the operation.", false},
     {RemediationId::ReconcileTransactionState, "Reconcile the current device state", "Do not repeat the old hardware operation automatically; refresh device state and submit only a new intentional request.", "Confirm the application has refreshed the active generation and is not replaying the unavailable transaction.", false},
     {RemediationId::RefreshGeneration, "Refresh receiver state", "Discard state from the old generation and request a fresh snapshot before new work.", "Confirm the request uses the currently active generation identifier.", true},
+    {RemediationId::ReinstallOpenrazerRouteDriver, "Restore the OpenRazer native-route capability", "Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor.", "Run Doctor and confirm the OpenRazer native-route capability finding is absent.", false},
     {RemediationId::ReleaseOwner, "Release the current owner", "Release control in the owning application or close it, then request ownership again.", "Read the ownership snapshot and confirm the resource has no conflicting owner.", false},
     {RemediationId::RepairStateStorage, "Repair state storage", "Restore writable, schema-compatible state storage without deleting the last known-good copy.", "Restart the bridge and confirm it can read and transactionally commit its state.", false},
     {RemediationId::RetryBounded, "Retry within the declared bound", "Retry with bounded backoff only while the original deadline remains valid.", "Confirm the new attempt is admitted once and produces one terminal outcome.", true},
+    {RemediationId::ReverifyOpenrazerSource, "Use a verified OpenRazer source line", "Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified.", "Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay.", false},
     {RemediationId::StartBridge, "Start the bridge service", "Start or restart the compatible HyperFlux bridge service.", "Run Doctor and confirm the bridge diagnostic endpoint is ready.", true},
     {RemediationId::SubmitBeforeDeadline, "Submit a fresh operation", "Create a new request with a deadline that has not elapsed; do not revive the expired request.", "Confirm admission occurs before the new monotonic deadline.", false},
     {RemediationId::UpdateIntegration, "Update the application integration", "Install an integration compatible with the negotiated HyperFlux SDK protocol.", "Restart the application and confirm protocol negotiation succeeds.", false},
@@ -379,124 +389,137 @@ inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_4 {{
     {"access_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_4_0, PrivacyClass::Public, "OpenRazer desktop-session access state."},
 }};
 
-inline constexpr std::array<std::string_view, 6> detail_values_5_1 {{"bridge", "kernel", "persistence", "protocol", "sdk", "transport"}};
-
 inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_5 {{
+    {"capability", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Required HyperFlux native transport capability."},
+    {"module", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "OpenRazer module missing the native transport capability."},
+}};
+
+inline constexpr std::array<std::string_view, 2> detail_values_6_1 {{"rebase-reverification-required", "version-unverified"}};
+
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_6 {{
+    {"observed_version", SafeDetailKind::Text, true, 32ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Bounded upstream version reported by the installed OpenRazer daemon, or unavailable."},
+    {"runtime_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_6_1, PrivacyClass::Public, "OpenRazer source-line verification state."},
+    {"verified_version", SafeDetailKind::Text, true, 32ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "OpenRazer upstream source version verified by this HyperFlux package."},
+}};
+
+inline constexpr std::array<std::string_view, 6> detail_values_7_1 {{"bridge", "kernel", "persistence", "protocol", "sdk", "transport"}};
+
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_7 {{
     {"invariant_id", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Stable violated invariant identifier."},
-    {"subsystem", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_5_1, PrivacyClass::Public, "Subsystem that raised the invariant failure."},
+    {"subsystem", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_7_1, PrivacyClass::Public, "Subsystem that raised the invariant failure."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_6 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_8 {{
     {"installed_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Installed kernel interface identity."},
     {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Currently loaded kernel interface identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_7 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_9 {{
     {"installed_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Installed OpenRazer module source identity."},
     {"loaded_abi", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Loaded OpenRazer module source identity or activation state."},
     {"module", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "OpenRazer native-route kernel module name."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_8 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_10 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity that has no retained or eviction record."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_9 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
     {"history_capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured retained outcome capacity."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction identity whose terminal record aged out."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_10 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_12 {{
     {"owner_name", SafeDetailKind::Text, false, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Current application owner when available."},
     {"resource_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Contended logical resource."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_11_1 {{"expired", "released", "revoked"}};
+inline constexpr std::array<std::string_view, 3> detail_values_13_1 {{"expired", "released", "revoked"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_11 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_13 {{
     {"lease_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Expired or revoked lease identity."},
-    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_11_1, PrivacyClass::Public, "Terminal lease state."},
+    {"lease_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_13_1, PrivacyClass::Public, "Terminal lease state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_12_0 {{"load", "migrate", "validate"}};
+inline constexpr std::array<std::string_view, 3> detail_values_14_0 {{"load", "migrate", "validate"}};
 
-inline constexpr std::array<std::string_view, 4> detail_values_12_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
+inline constexpr std::array<std::string_view, 4> detail_values_14_1 {{"corrupt", "incompatible-schema", "missing", "permission-denied"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_12 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_12_0, PrivacyClass::Public, "Failed state-read phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_12_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_14 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_14_0, PrivacyClass::Public, "Failed state-read phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_14_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_13_0 {{"commit", "rollback", "snapshot"}};
+inline constexpr std::array<std::string_view, 3> detail_values_15_0 {{"commit", "rollback", "snapshot"}};
 
-inline constexpr std::array<std::string_view, 3> detail_values_13_1 {{"io-failure", "permission-denied", "validation-failed"}};
+inline constexpr std::array<std::string_view, 3> detail_values_15_1 {{"io-failure", "permission-denied", "validation-failed"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_13 {{
-    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_13_0, PrivacyClass::Public, "Failed state-write phase."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_13_1, PrivacyClass::Public, "Sanitized failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_15 {{
+    {"operation", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_15_0, PrivacyClass::Public, "Failed state-write phase."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_15_1, PrivacyClass::Public, "Sanitized failure reason."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_14 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_16 {{
     {"capability", SafeDetailKind::Identifier, true, 96ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested semantic capability."},
     {"product_id", SafeDetailKind::U16, false, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Observed USB product identifier when available."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_15 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_17 {{
     {"active_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest bound to the active generation."},
     {"catalog_digest", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Digest from the generated profile catalog."},
     {"profile_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Selected profile identity."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_16 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 4> details_18 {{
     {"client_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the client."},
     {"client_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the client."},
     {"server_max_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Highest protocol version supported by the bridge."},
     {"server_min_version", SafeDetailKind::U16, true, std::nullopt, 65535ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Lowest protocol version supported by the bridge."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_17 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_19 {{
     {"feature", SafeDetailKind::Identifier, true, 64ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Requested protocol feature identifier."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_18_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
+inline constexpr std::array<std::string_view, 5> detail_values_20_1 {{"configuration", "diagnostics", "effects", "events", "restore"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_18 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_20 {{
     {"capacity", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Configured queue capacity."},
-    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_18_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
+    {"queue", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_20_1, PrivacyClass::Public, "Bounded queue that rejected admission."},
 }};
 
-inline constexpr std::array<std::string_view, 5> detail_values_19_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
+inline constexpr std::array<std::string_view, 5> detail_values_21_1 {{"duplicate", "missing", "out-of-range", "unknown", "unsupported"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_19 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_21 {{
     {"field", SafeDetailKind::Text, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::Public, "Schema field path without request data."},
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_19_1, PrivacyClass::Public, "Sanitized validation reason."},
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_21_1, PrivacyClass::Public, "Sanitized validation reason."},
     {"request_id", SafeDetailKind::Identifier, false, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Request identity when parsing reached it."},
 }};
 
-inline constexpr std::array<std::string_view, 6> detail_values_20_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
+inline constexpr std::array<std::string_view, 6> detail_values_22_0 {{"activating", "active-unready", "failed", "inactive", "stopping", "unavailable"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_20 {{
-    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_20_0, PrivacyClass::Public, "Sanitized bridge service state."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_22 {{
+    {"service_state", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_22_0, PrivacyClass::Public, "Sanitized bridge service state."},
 }};
 
-inline constexpr std::array<std::string_view, 3> detail_values_21_0 {{"device-absent", "session-unavailable", "transport-busy"}};
+inline constexpr std::array<std::string_view, 3> detail_values_23_0 {{"device-absent", "session-unavailable", "transport-busy"}};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_21 {{
-    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_21_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
+inline constexpr std::array<SafeDetailFieldDescriptor, 2> details_23 {{
+    {"reason", SafeDetailKind::Enum, true, std::nullopt, std::nullopt, detail_values_23_0, PrivacyClass::Public, "Sanitized pre-dispatch failure reason."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction that did not begin transport."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_22 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 1> details_24 {{
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Transaction whose transport outcome is uncertain."},
 }};
 
-inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_23 {{
+inline constexpr std::array<SafeDetailFieldDescriptor, 3> details_25 {{
     {"delivered_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames terminally delivered before failure."},
     {"total_frames", SafeDetailKind::U16, true, std::nullopt, 4096ULL, std::span<const std::string_view>{}, PrivacyClass::Public, "Frames declared by the transaction."},
     {"transaction_id", SafeDetailKind::Identifier, true, 128ULL, std::nullopt, std::span<const std::string_view>{}, PrivacyClass::PublicSummary, "Partially delivered transaction identity."},
 }};
 
-inline constexpr std::array<ErrorDescriptor, 24> errors {{
+inline constexpr std::array<ErrorDescriptor, 26> errors {{
     {
         ErrorCode::HfxDeadline001, ErrorClass::Deadline,
         ErrorSeverity::Warning, RetryPolicy::Never,
@@ -547,11 +570,31 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         "This desktop session cannot open OpenRazer devices yet.", PrivacyClass::Public,
         "docs/generated/error-catalog.md#hfx-integration-003"
     },
+    {
+        ErrorCode::HfxIntegration004, ErrorClass::Integration,
+        ErrorSeverity::Error, RetryPolicy::AfterRemediation,
+        SideEffectCertaintyPolicy::NotApplicable,
+        RemediationId::ReinstallOpenrazerRouteDriver, details_5,
+        {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
+        ErrorOwner::Integration, "An installed OpenRazer route module does not advertise the source-bound HyperFlux native transport capability.",
+        "The installed OpenRazer driver is not the verified HyperFlux native-route build.", PrivacyClass::Public,
+        "docs/generated/error-catalog.md#hfx-integration-004"
+    },
+    {
+        ErrorCode::HfxIntegration005, ErrorClass::Integration,
+        ErrorSeverity::Error, RetryPolicy::AfterRemediation,
+        SideEffectCertaintyPolicy::NotApplicable,
+        RemediationId::ReverifyOpenrazerSource, details_6,
+        {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
+        ErrorOwner::Integration, "The installed OpenRazer runtime is not bound to the upstream source line verified by the current HyperFlux native-route transform.",
+        "This OpenRazer update needs a HyperFlux rebase and fresh verification before the native relay can use it.", PrivacyClass::Public,
+        "docs/generated/error-catalog.md#hfx-integration-005"
+    },
     {
         ErrorCode::HfxInternal001, ErrorClass::Internal,
         ErrorSeverity::Critical, RetryPolicy::Never,
         SideEffectCertaintyPolicy::RuntimeReported,
-        RemediationId::CollectSupportBundle, details_5,
+        RemediationId::CollectSupportBundle, details_7,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "A declared HyperFlux invariant was violated.",
         "HyperFlux stopped the affected operation because an internal safety rule failed.", PrivacyClass::PublicSummary,
@@ -561,7 +604,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxKernel001, ErrorClass::Kernel,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ActivateInstalledDriver, details_6,
+        RemediationId::ActivateInstalledDriver, details_8,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "The loaded kernel interface does not match the installed userspace contract.",
         "The newly installed driver is not active yet.", PrivacyClass::Public,
@@ -571,7 +614,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxKernel002, ErrorClass::Kernel,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ActivateOpenrazerRouteDriver, details_7,
+        RemediationId::ActivateOpenrazerRouteDriver, details_9,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "A required OpenRazer native-route kernel module is missing or an older module remains active.",
         "The OpenRazer route driver is not ready yet.", PrivacyClass::Public,
@@ -581,7 +624,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxOutcome001, ErrorClass::Outcome,
         ErrorSeverity::Warning, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_8,
+        RemediationId::ReconcileTransactionState, details_10,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded bridge history has no retained or eviction record for the requested transaction.",
         "HyperFlux cannot determine the result of this transaction from its current history.", PrivacyClass::PublicSummary,
@@ -591,7 +634,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxOutcome002, ErrorClass::Outcome,
         ErrorSeverity::Info, RetryPolicy::Never,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::ReconcileTransactionState, details_9,
+        RemediationId::ReconcileTransactionState, details_11,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The transaction was known, but its terminal result aged out of bounded retained history.",
         "The transaction result is older than the history HyperFlux keeps in memory.", PrivacyClass::PublicSummary,
@@ -601,7 +644,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxOwnership001, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::ReleaseOwner, details_10,
+        RemediationId::ReleaseOwner, details_12,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Another live client owns at least one requested resource.",
         "Another application currently controls this device function.", PrivacyClass::Public,
@@ -611,7 +654,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxOwnership002, ErrorClass::Ownership,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::AcquireNewLease, details_11,
+        RemediationId::AcquireNewLease, details_13,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The lease no longer authorizes the requested resource set.",
         "The application's control lease ended before the operation started.", PrivacyClass::Public,
@@ -621,7 +664,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxPersistence001, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_12,
+        RemediationId::RepairStateStorage, details_14,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Persisted bridge state could not be loaded and validated safely.",
         "HyperFlux could not read its saved state and kept hardware restoration disabled.", PrivacyClass::PublicSummary,
@@ -631,7 +674,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxPersistence002, ErrorClass::Persistence,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::RepairStateStorage, details_13,
+        RemediationId::RepairStateStorage, details_15,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "A transactional state update could not be committed or rolled back safely.",
         "HyperFlux could not save its latest stable state.", PrivacyClass::PublicSummary,
@@ -641,7 +684,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxProfile001, ErrorClass::Profile,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::QualifyDevice, details_14,
+        RemediationId::QualifyDevice, details_16,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "No evidence-backed profile qualifies the requested device capability.",
         "The device is visible, but this operation is not qualified for it.", PrivacyClass::Public,
@@ -651,7 +694,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxProfile002, ErrorClass::Profile,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::VerifyProfileCatalog, details_15,
+        RemediationId::VerifyProfileCatalog, details_17,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The active profile binding does not match the generated profile catalog.",
         "HyperFlux paused writes because its hardware profile changed.", PrivacyClass::Public,
@@ -661,7 +704,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxProtocol001, ErrorClass::Protocol,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::UpdateProtocolPeer, details_16,
+        RemediationId::UpdateProtocolPeer, details_18,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The client and bridge protocol version ranges do not overlap.",
         "The application and HyperFlux service are not protocol-compatible.", PrivacyClass::Public,
@@ -671,7 +714,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxProtocol002, ErrorClass::Protocol,
         ErrorSeverity::Warning, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::DisableUnsupportedFeature, details_17,
+        RemediationId::DisableUnsupportedFeature, details_19,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request requires a feature that was not enabled during negotiation.",
         "This feature is unavailable with the current application and service combination.", PrivacyClass::Public,
@@ -681,7 +724,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxQueue001, ErrorClass::Queue,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_18,
+        RemediationId::RetryBounded, details_20,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "The bounded queue had no admissible capacity before the request deadline.",
         "HyperFlux is temporarily busy and did not start this operation.", PrivacyClass::Public,
@@ -691,7 +734,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxRequest001, ErrorClass::Request,
         ErrorSeverity::Error, RetryPolicy::Never,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::CorrectRequest, details_19,
+        RemediationId::CorrectRequest, details_21,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Sdk, "The request violates the negotiated bounded protocol schema.",
         "The application sent a request HyperFlux cannot safely accept.", PrivacyClass::PublicSummary,
@@ -701,7 +744,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxService001, ErrorClass::Service,
         ErrorSeverity::Error, RetryPolicy::AfterRemediation,
         SideEffectCertaintyPolicy::NotApplicable,
-        RemediationId::StartBridge, details_20,
+        RemediationId::StartBridge, details_22,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Packaging, "The compatible bridge service is stopped or is not ready to accept SDK requests.",
         "The HyperFlux service is not ready yet.", PrivacyClass::Public,
@@ -711,7 +754,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxTransport001, ErrorClass::Transport,
         ErrorSeverity::Warning, RetryPolicy::BoundedBackoff,
         SideEffectCertaintyPolicy::MustBeNone,
-        RemediationId::RetryBounded, details_21,
+        RemediationId::RetryBounded, details_23,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport failed before any hardware frame was dispatched.",
         "The receiver was unavailable before HyperFlux sent anything.", PrivacyClass::PublicSummary,
@@ -721,7 +764,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxTransport002, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Possible,
-        RemediationId::LookupTransactionOutcome, details_22,
+        RemediationId::LookupTransactionOutcome, details_24,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "Transport began, but the bridge could not prove whether the receiver accepted a frame.",
         "The operation may have reached the receiver, so HyperFlux will not repeat it automatically.", PrivacyClass::PublicSummary,
@@ -731,7 +774,7 @@ inline constexpr std::array<ErrorDescriptor, 24> errors {{
         ErrorCode::HfxTransport003, ErrorClass::Transport,
         ErrorSeverity::Error, RetryPolicy::OutcomeLookupOnly,
         SideEffectCertaintyPolicy::Partial,
-        RemediationId::LookupTransactionOutcome, details_23,
+        RemediationId::LookupTransactionOutcome, details_25,
         {ErrorLifecycleState::Active, "0.0.0-dev.1", std::nullopt, std::nullopt},
         ErrorOwner::Bridge, "At least one declared frame was delivered before a later frame failed.",
         "The operation was only partly delivered and will not be repeated automatically.", PrivacyClass::PublicSummary,
diff --git a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
index fab4657..57de544 100644
--- a/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/integration_catalog.hpp
@@ -33,7 +33,7 @@ struct AdapterRecord
     std::string_view coexistence_policy;
 };
 
-inline constexpr std::string_view integration_source_sha256 = "f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0";
+inline constexpr std::string_view integration_source_sha256 = "fa7e03995f6bff0b831de0ad539382290d8b698224746642174a015683fc4397";
 
 inline constexpr std::array<std::string_view, 2> upstream_uses_0 {{"compatibility-contract", "metadata-import"}};
 inline constexpr std::array<std::string_view, 3> upstream_uses_1 {{"effect-engine", "model-layout-registry", "plugin-build-contract"}};
@@ -52,7 +52,7 @@ inline constexpr std::array<std::uint16_t, 1> adapter_protocols_3 {{5}};
 inline constexpr std::array<std::string_view, 5> adapter_features_3 {{"inventory", "lighting", "ownership", "presentation", "telemetry"}};
 
 inline constexpr std::array<UpstreamRecord, 3> upstreams {{
-    {"openrazer", "OpenRazer", "https://github.com/openrazer/openrazer.git", "3.12.2", "ddea89607b86023e88563b8feabc8fa2d5773cdd", "GPL-2.0-or-later AND CC-BY-SA-4.0", "org.razer 3.x metadata and D-Bus vocabulary", upstream_uses_0},
+    {"openrazer", "OpenRazer", "https://github.com/openrazer/openrazer.git", "3.12.4", "1ef8a91712906a89fd332a2ed62bbd105315d6d1", "GPL-2.0-or-later AND CC-BY-SA-4.0", "org.razer 3.x metadata and D-Bus vocabulary", upstream_uses_0},
     {"openrgb", "OpenRGB", "https://github.com/CalcProgrammer1/OpenRGB.git", "1.0rc3", "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0", "GPL-2.0-only", "OpenRGB plugin API 4", upstream_uses_1},
     {"polychromatic", "Polychromatic", "https://github.com/polychromatic/polychromatic.git", "0.9.7-7-g716737b", "716737bf444ab7e962f4d3b7a5188b2f07c0c4a1", "GPL-3.0-only", "Polychromatic 0.9 native backend contract", upstream_uses_2},
 }};
diff --git a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
index d1174e5..6f2a50b 100644
--- a/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
+++ b/sdk/cpp/include/hyperflux/generated/profile_catalog.hpp
@@ -1,6 +1,6 @@
 // Generated by ./hfx generate. Do not edit manually.
 // SPDX-License-Identifier: GPL-2.0-only
-// Profile source SHA-256: b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70
+// Profile source SHA-256: 80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee
 
 #pragma once
 
@@ -118,7 +118,7 @@ struct ProfileRecord
     const PresentationRecord* presentation;
 };
 
-inline constexpr std::string_view profile_source_sha256 = "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70";
+inline constexpr std::string_view profile_source_sha256 = "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee";
 
 inline constexpr std::array<std::uint64_t, 12> return_retry_offsets_0 {{0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000}};
 inline constexpr std::array<ReturnEvidenceSource, 2> return_open_evidence_0 {{ReturnEvidenceSource::EndpointActivity, ReturnEvidenceSource::RouteReturn}};
diff --git a/sdk/python/hyperflux_sdk/generated/error_catalog.py b/sdk/python/hyperflux_sdk/generated/error_catalog.py
index 6218d5c..9f97a84 100644
--- a/sdk/python/hyperflux_sdk/generated/error_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/error_catalog.py
@@ -15,6 +15,8 @@ class ErrorCode(str, Enum):
     HFX_INTEGRATION_001 = "HFX-INTEGRATION-001"
     HFX_INTEGRATION_002 = "HFX-INTEGRATION-002"
     HFX_INTEGRATION_003 = "HFX-INTEGRATION-003"
+    HFX_INTEGRATION_004 = "HFX-INTEGRATION-004"
+    HFX_INTEGRATION_005 = "HFX-INTEGRATION-005"
     HFX_INTERNAL_001 = "HFX-INTERNAL-001"
     HFX_KERNEL_001 = "HFX-KERNEL-001"
     HFX_KERNEL_002 = "HFX-KERNEL-002"
@@ -49,9 +51,11 @@ class RemediationId(str, Enum):
     QUALIFY_DEVICE = "qualify-device"
     RECONCILE_TRANSACTION_STATE = "reconcile-transaction-state"
     REFRESH_GENERATION = "refresh-generation"
+    REINSTALL_OPENRAZER_ROUTE_DRIVER = "reinstall-openrazer-route-driver"
     RELEASE_OWNER = "release-owner"
     REPAIR_STATE_STORAGE = "repair-state-storage"
     RETRY_BOUNDED = "retry-bounded"
+    REVERIFY_OPENRAZER_SOURCE = "reverify-openrazer-source"
     START_BRIDGE = "start-bridge"
     SUBMIT_BEFORE_DEADLINE = "submit-before-deadline"
     UPDATE_INTEGRATION = "update-integration"
@@ -162,7 +166,7 @@ class ErrorDescriptor:
     docs_path: str
 
 
-ERROR_CATALOG_SHA256: Final = "f364595a593b7ec7c14f1673cd01c309f52e842c7c93081c8c63eaa8ca8cd81c"
+ERROR_CATALOG_SHA256: Final = "e709d84eae07623b6e59c2863cf707d9d3edb09381ef77f40fd0126cfca66afd"
 MAX_ERROR_COUNT: Final = 256
 MAX_REMEDIATION_COUNT: Final = 128
 MAX_SAFE_DETAIL_FIELDS: Final = 12
@@ -253,6 +257,13 @@ class ErrorDescriptor:
         verification="Confirm the request uses the currently active generation identifier.",
         automatic=True,
     ),
+    RemediationDescriptor(
+        id=RemediationId.REINSTALL_OPENRAZER_ROUTE_DRIVER,
+        title="Restore the OpenRazer native-route capability",
+        safe_action="Reinstall the current HyperFlux Next package, then use the driver activation action reported by Doctor.",
+        verification="Run Doctor and confirm the OpenRazer native-route capability finding is absent.",
+        automatic=False,
+    ),
     RemediationDescriptor(
         id=RemediationId.RELEASE_OWNER,
         title="Release the current owner",
@@ -274,6 +285,13 @@ class ErrorDescriptor:
         verification="Confirm the new attempt is admitted once and produces one terminal outcome.",
         automatic=True,
     ),
+    RemediationDescriptor(
+        id=RemediationId.REVERIFY_OPENRAZER_SOURCE,
+        title="Use a verified OpenRazer source line",
+        safe_action="Keep the native OpenRazer relay stopped. Install the verified OpenRazer runtime named by the current HyperFlux package, or install a newer HyperFlux package whose OpenRazer transform has been rebased and reverified.",
+        verification="Run Doctor and confirm the OpenRazer source-line finding is absent before starting the native relay.",
+        automatic=False,
+    ),
     RemediationDescriptor(
         id=RemediationId.START_BRIDGE,
         title="Start the bridge service",
@@ -407,6 +425,62 @@ class ErrorDescriptor:
 )
 
 DETAILS_5: Final = (
+    SafeDetailFieldDescriptor(
+        name="capability",
+        kind=SafeDetailKind.IDENTIFIER,
+        required=True,
+        maximum_length=64,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="Required HyperFlux native transport capability.",
+    ),
+    SafeDetailFieldDescriptor(
+        name="module",
+        kind=SafeDetailKind.IDENTIFIER,
+        required=True,
+        maximum_length=64,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer module missing the native transport capability.",
+    ),
+)
+
+DETAILS_6: Final = (
+    SafeDetailFieldDescriptor(
+        name="observed_version",
+        kind=SafeDetailKind.TEXT,
+        required=True,
+        maximum_length=32,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="Bounded upstream version reported by the installed OpenRazer daemon, or unavailable.",
+    ),
+    SafeDetailFieldDescriptor(
+        name="runtime_state",
+        kind=SafeDetailKind.ENUM,
+        required=True,
+        maximum_length=None,
+        maximum_value=None,
+        allowed_values=('rebase-reverification-required', 'version-unverified'),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer source-line verification state.",
+    ),
+    SafeDetailFieldDescriptor(
+        name="verified_version",
+        kind=SafeDetailKind.TEXT,
+        required=True,
+        maximum_length=32,
+        maximum_value=None,
+        allowed_values=(),
+        privacy=PrivacyClass.PUBLIC,
+        description="OpenRazer upstream source version verified by this HyperFlux package.",
+    ),
+)
+
+DETAILS_7: Final = (
     SafeDetailFieldDescriptor(
         name="invariant_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -429,7 +503,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_6: Final = (
+DETAILS_8: Final = (
     SafeDetailFieldDescriptor(
         name="installed_abi",
         kind=SafeDetailKind.IDENTIFIER,
@@ -452,7 +526,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_7: Final = (
+DETAILS_9: Final = (
     SafeDetailFieldDescriptor(
         name="installed_abi",
         kind=SafeDetailKind.IDENTIFIER,
@@ -485,7 +559,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_8: Final = (
+DETAILS_10: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -498,7 +572,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_9: Final = (
+DETAILS_11: Final = (
     SafeDetailFieldDescriptor(
         name="history_capacity",
         kind=SafeDetailKind.U16,
@@ -521,7 +595,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_10: Final = (
+DETAILS_12: Final = (
     SafeDetailFieldDescriptor(
         name="owner_name",
         kind=SafeDetailKind.TEXT,
@@ -544,7 +618,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_11: Final = (
+DETAILS_13: Final = (
     SafeDetailFieldDescriptor(
         name="lease_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -567,7 +641,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_12: Final = (
+DETAILS_14: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -590,7 +664,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_13: Final = (
+DETAILS_15: Final = (
     SafeDetailFieldDescriptor(
         name="operation",
         kind=SafeDetailKind.ENUM,
@@ -613,7 +687,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_14: Final = (
+DETAILS_16: Final = (
     SafeDetailFieldDescriptor(
         name="capability",
         kind=SafeDetailKind.IDENTIFIER,
@@ -636,7 +710,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_15: Final = (
+DETAILS_17: Final = (
     SafeDetailFieldDescriptor(
         name="active_digest",
         kind=SafeDetailKind.IDENTIFIER,
@@ -669,7 +743,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_16: Final = (
+DETAILS_18: Final = (
     SafeDetailFieldDescriptor(
         name="client_max_version",
         kind=SafeDetailKind.U16,
@@ -712,7 +786,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_17: Final = (
+DETAILS_19: Final = (
     SafeDetailFieldDescriptor(
         name="feature",
         kind=SafeDetailKind.IDENTIFIER,
@@ -725,7 +799,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_18: Final = (
+DETAILS_20: Final = (
     SafeDetailFieldDescriptor(
         name="capacity",
         kind=SafeDetailKind.U16,
@@ -748,7 +822,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_19: Final = (
+DETAILS_21: Final = (
     SafeDetailFieldDescriptor(
         name="field",
         kind=SafeDetailKind.TEXT,
@@ -781,7 +855,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_20: Final = (
+DETAILS_22: Final = (
     SafeDetailFieldDescriptor(
         name="service_state",
         kind=SafeDetailKind.ENUM,
@@ -794,7 +868,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_21: Final = (
+DETAILS_23: Final = (
     SafeDetailFieldDescriptor(
         name="reason",
         kind=SafeDetailKind.ENUM,
@@ -817,7 +891,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_22: Final = (
+DETAILS_24: Final = (
     SafeDetailFieldDescriptor(
         name="transaction_id",
         kind=SafeDetailKind.IDENTIFIER,
@@ -830,7 +904,7 @@ class ErrorDescriptor:
     ),
 )
 
-DETAILS_23: Final = (
+DETAILS_25: Final = (
     SafeDetailFieldDescriptor(
         name="delivered_frames",
         kind=SafeDetailKind.U16,
@@ -964,6 +1038,46 @@ class ErrorDescriptor:
         privacy=PrivacyClass.PUBLIC,
         docs_path="docs/generated/error-catalog.md#hfx-integration-003",
     ),
+    ErrorDescriptor(
+        code=ErrorCode.HFX_INTEGRATION_004,
+        error_class=ErrorClass.INTEGRATION,
+        severity=ErrorSeverity.ERROR,
+        retry_policy=RetryPolicy.AFTER_REMEDIATION,
+        side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
+        remediation_id=RemediationId.REINSTALL_OPENRAZER_ROUTE_DRIVER,
+        safe_detail_fields=DETAILS_5,
+        lifecycle=LifecycleDescriptor(
+            state=ErrorLifecycleState.ACTIVE,
+            introduced_in="0.0.0-dev.1",
+            deprecated_in=None,
+            replacement_code=None,
+        ),
+        owner=ErrorOwner.INTEGRATION,
+        technical_cause="An installed OpenRazer route module does not advertise the source-bound HyperFlux native transport capability.",
+        user_explanation="The installed OpenRazer driver is not the verified HyperFlux native-route build.",
+        privacy=PrivacyClass.PUBLIC,
+        docs_path="docs/generated/error-catalog.md#hfx-integration-004",
+    ),
+    ErrorDescriptor(
+        code=ErrorCode.HFX_INTEGRATION_005,
+        error_class=ErrorClass.INTEGRATION,
+        severity=ErrorSeverity.ERROR,
+        retry_policy=RetryPolicy.AFTER_REMEDIATION,
+        side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
+        remediation_id=RemediationId.REVERIFY_OPENRAZER_SOURCE,
+        safe_detail_fields=DETAILS_6,
+        lifecycle=LifecycleDescriptor(
+            state=ErrorLifecycleState.ACTIVE,
+            introduced_in="0.0.0-dev.1",
+            deprecated_in=None,
+            replacement_code=None,
+        ),
+        owner=ErrorOwner.INTEGRATION,
+        technical_cause="The installed OpenRazer runtime is not bound to the upstream source line verified by the current HyperFlux native-route transform.",
+        user_explanation="This OpenRazer update needs a HyperFlux rebase and fresh verification before the native relay can use it.",
+        privacy=PrivacyClass.PUBLIC,
+        docs_path="docs/generated/error-catalog.md#hfx-integration-005",
+    ),
     ErrorDescriptor(
         code=ErrorCode.HFX_INTERNAL_001,
         error_class=ErrorClass.INTERNAL,
@@ -971,7 +1085,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.RUNTIME_REPORTED,
         remediation_id=RemediationId.COLLECT_SUPPORT_BUNDLE,
-        safe_detail_fields=DETAILS_5,
+        safe_detail_fields=DETAILS_7,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -991,7 +1105,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.ACTIVATE_INSTALLED_DRIVER,
-        safe_detail_fields=DETAILS_6,
+        safe_detail_fields=DETAILS_8,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1011,7 +1125,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.ACTIVATE_OPENRAZER_ROUTE_DRIVER,
-        safe_detail_fields=DETAILS_7,
+        safe_detail_fields=DETAILS_9,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1031,7 +1145,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_8,
+        safe_detail_fields=DETAILS_10,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1051,7 +1165,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.RECONCILE_TRANSACTION_STATE,
-        safe_detail_fields=DETAILS_9,
+        safe_detail_fields=DETAILS_11,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1071,7 +1185,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RELEASE_OWNER,
-        safe_detail_fields=DETAILS_10,
+        safe_detail_fields=DETAILS_12,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1091,7 +1205,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.ACQUIRE_NEW_LEASE,
-        safe_detail_fields=DETAILS_11,
+        safe_detail_fields=DETAILS_13,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1111,7 +1225,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_12,
+        safe_detail_fields=DETAILS_14,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1131,7 +1245,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.REPAIR_STATE_STORAGE,
-        safe_detail_fields=DETAILS_13,
+        safe_detail_fields=DETAILS_15,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1151,7 +1265,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.QUALIFY_DEVICE,
-        safe_detail_fields=DETAILS_14,
+        safe_detail_fields=DETAILS_16,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1171,7 +1285,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.VERIFY_PROFILE_CATALOG,
-        safe_detail_fields=DETAILS_15,
+        safe_detail_fields=DETAILS_17,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1191,7 +1305,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.UPDATE_PROTOCOL_PEER,
-        safe_detail_fields=DETAILS_16,
+        safe_detail_fields=DETAILS_18,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1211,7 +1325,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.DISABLE_UNSUPPORTED_FEATURE,
-        safe_detail_fields=DETAILS_17,
+        safe_detail_fields=DETAILS_19,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1231,7 +1345,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_18,
+        safe_detail_fields=DETAILS_20,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1251,7 +1365,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.NEVER,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.CORRECT_REQUEST,
-        safe_detail_fields=DETAILS_19,
+        safe_detail_fields=DETAILS_21,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1271,7 +1385,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.AFTER_REMEDIATION,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.NOT_APPLICABLE,
         remediation_id=RemediationId.START_BRIDGE,
-        safe_detail_fields=DETAILS_20,
+        safe_detail_fields=DETAILS_22,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1291,7 +1405,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.BOUNDED_BACKOFF,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.MUST_BE_NONE,
         remediation_id=RemediationId.RETRY_BOUNDED,
-        safe_detail_fields=DETAILS_21,
+        safe_detail_fields=DETAILS_23,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1311,7 +1425,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.POSSIBLE,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_22,
+        safe_detail_fields=DETAILS_24,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
@@ -1331,7 +1445,7 @@ class ErrorDescriptor:
         retry_policy=RetryPolicy.OUTCOME_LOOKUP_ONLY,
         side_effect_certainty_policy=SideEffectCertaintyPolicy.PARTIAL,
         remediation_id=RemediationId.LOOKUP_TRANSACTION_OUTCOME,
-        safe_detail_fields=DETAILS_23,
+        safe_detail_fields=DETAILS_25,
         lifecycle=LifecycleDescriptor(
             state=ErrorLifecycleState.ACTIVE,
             introduced_in="0.0.0-dev.1",
diff --git a/sdk/python/hyperflux_sdk/generated/integration_catalog.py b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
index 4e24c59..6c912cb 100644
--- a/sdk/python/hyperflux_sdk/generated/integration_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/integration_catalog.py
@@ -68,16 +68,16 @@
                'unrelated_device_policy': 'preserve',
                'upstream_ids': ['openrazer', 'polychromatic']}],
  'schema': 'hyperflux-integration-catalog-v1',
- 'source_sha256': 'f62195a778d79d2de88f8cb4ccc167538fa632a3f657a6d01f7956613fb68ae0',
+ 'source_sha256': 'fa7e03995f6bff0b831de0ad539382290d8b698224746642174a015683fc4397',
  'upstreams': [{'api_contract': 'org.razer 3.x metadata and D-Bus vocabulary',
                 'build_network_access': False,
-                'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
+                'commit': '1ef8a91712906a89fd332a2ed62bbd105315d6d1',
                 'id': 'openrazer',
                 'license_expression': 'GPL-2.0-or-later AND CC-BY-SA-4.0',
                 'name': 'OpenRazer',
                 'repository': 'https://github.com/openrazer/openrazer.git',
                 'uses': ['compatibility-contract', 'metadata-import'],
-                'version': '3.12.2'},
+                'version': '3.12.4'},
                {'api_contract': 'OpenRGB plugin API 4',
                 'build_network_access': False,
                 'commit': '6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0',
diff --git a/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py b/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
index a1a4cc5..dcf2c3e 100644
--- a/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
+++ b/sdk/python/hyperflux_sdk/generated/openrazer_metadata.py
@@ -99,12 +99,12 @@
                          'path': 'daemon/openrazer_daemon/hardware/keyboards.py',
                          'sha256': 'a4d6b54f4e6da3a7ff65a727ccc5b047efb345d3170d0a2f8256b5f0a7c1d5e9'}}],
  'schema': 'hyperflux-imported-device-metadata-v1',
- 'selection_sha256': 'a6d800974ce98c56ff2e0ff1dd584e65128c5a95f806e31f278c99fd7c0736c9',
- 'upstream': {'commit': 'ddea89607b86023e88563b8feabc8fa2d5773cdd',
+ 'selection_sha256': '6994cfb256cf9e3b54c302eed2ad9023095c150f29992aee9510b850cef02188',
+ 'upstream': {'commit': '1ef8a91712906a89fd332a2ed62bbd105315d6d1',
               'id': 'openrazer',
               'license_expression': 'GPL-2.0-or-later AND CC-BY-SA-4.0',
               'repository': 'https://github.com/openrazer/openrazer.git',
-              'version': '3.12.2'}}
+              'version': '3.12.4'}}
 OPENRAZER_DEVICES_BY_PROFILE: Final = MappingProxyType(
     {value['profile_id']: value for value in OPENRAZER_METADATA['devices']}
 )
diff --git a/sdk/python/hyperflux_sdk/generated/profile_catalog.py b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
index a2acc68..0e0061d 100644
--- a/sdk/python/hyperflux_sdk/generated/profile_catalog.py
+++ b/sdk/python/hyperflux_sdk/generated/profile_catalog.py
@@ -4,7 +4,7 @@
 from types import MappingProxyType
 from typing import Final
 
-PROFILE_SOURCE_SHA256: Final = 'b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70'
+PROFILE_SOURCE_SHA256: Final = '80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee'
 PROFILE_CATALOG: Final = {'candidates': [{'device_kind': 'mouse',
                  'id': 'razer-basilisk-v3-pro',
                  'official_name': 'Razer Basilisk V3 Pro',
@@ -474,7 +474,7 @@
                          'retry_offsets_ms': [0, 100, 200, 300, 500, 750, 1000, 1500, 2250, 3250, 4500, 6000],
                          'strategy': 'activity-assisted-return-epoch',
                          'timing_authorities': [{'kind': 'pinned-upstream-contract',
-                                                 'source_id': 'openrazer:ddea89607b86023e88563b8feabc8fa2d5773cdd:driver/razerchromacommon.c:1339',
+                                                 'source_id': 'openrazer:1ef8a91712906a89fd332a2ed62bbd105315d6d1:driver/razerchromacommon.c:1339',
                                                  'source_sha256': '6362884bc962a7dbf9768e6e3c7a1759d913acd4ab8d1bd0bd99d3e401ba4acc',
                                                  'summary': 'The pinned upstream idle-time command accepts 60 through '
                                                             '900 seconds; 60 seconds is therefore a conservative '
@@ -915,7 +915,7 @@
                'schema': 'hyperflux-hardware-profile-v1',
                'source_path': 'profiles/surfaces/razer-hyperflux-v2-hard-edition.json'}],
  'schema': 'hyperflux-compiled-profile-catalog-v1',
- 'source_sha256': 'b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70'}
+ 'source_sha256': '80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee'}
 PROFILES_BY_ID: Final = MappingProxyType({profile['profile_id']: profile for profile in PROFILE_CATALOG['profiles']})
 
 __all__ = ["PROFILE_CATALOG", "PROFILE_SOURCE_SHA256", "PROFILES_BY_ID"]
diff --git a/tests/cpp/openrgb_controller_model_contract.cpp b/tests/cpp/openrgb_controller_model_contract.cpp
index d38261c..58154e6 100644
--- a/tests/cpp/openrgb_controller_model_contract.cpp
+++ b/tests/cpp/openrgb_controller_model_contract.cpp
@@ -68,11 +68,11 @@ hyperflux::v5::ControllerView controller(
         {
             text<UpstreamId>(upstream),
             text<UpstreamOwner>(upstream == "openrgb" ? "OpenRGB" : "OpenRazer"),
-            text<ComponentVersion>(upstream == "openrgb" ? "1.0rc3" : "3.12.2"),
+            text<ComponentVersion>(upstream == "openrgb" ? "1.0rc3" : "3.12.4"),
             text<SourceRevision>(
                 upstream == "openrgb"
                     ? "6fbcf62d7694e7b92fd0a5884b40b92984fbd1b0"
-                    : "ddea89607b86023e88563b8feabc8fa2d5773cdd"),
+                    : "1ef8a91712906a89fd332a2ed62bbd105315d6d1"),
             text<PresentationKey>(std::string(device) + "_device"),
             kind == DeviceKind::Keyboard
                 ? std::optional<PresentationKey>(text<PresentationKey>("keyboard_layout"))
diff --git a/tests/fixtures/generated/profile-compositions.json b/tests/fixtures/generated/profile-compositions.json
index 13c28c0..861bbcc 100644
--- a/tests/fixtures/generated/profile-compositions.json
+++ b/tests/fixtures/generated/profile-compositions.json
@@ -71,5 +71,5 @@
     }
   ],
   "schema": "hyperflux-generated-profile-compositions-v1",
-  "source_sha256": "b2ec3710f950fa0c871fb9f10da71a75cef144b7c2ef8444cce82fad4045dd70"
+  "source_sha256": "80c196e5d3abe93f5be17b05c9036c04a9fbea2188896b4189c50b1e478fc2ee"
 }
diff --git a/tests/test_device_knowledge.py b/tests/test_device_knowledge.py
index 0d80c98..68bbdcf 100644
--- a/tests/test_device_knowledge.py
+++ b/tests/test_device_knowledge.py
@@ -277,7 +277,7 @@ def test_source_catalogs_match_exact_integration_pins(self) -> None:
         self.assertEqual(sources["openrgb"]["record_count"], 112)
         self.assertEqual(
             sources["openrazer"]["commit"],
-            "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+            "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
         )
         self.assertEqual(
             sources["openrgb"]["commit"],
diff --git a/tests/test_distribution_debian.py b/tests/test_distribution_debian.py
index d70901f..98c10f5 100644
--- a/tests/test_distribution_debian.py
+++ b/tests/test_distribution_debian.py
@@ -93,7 +93,11 @@ def test_control_comes_from_distribution_and_runtime_authorities(self) -> None:
             "Conflicts: hyperflux-v2-linux-dkms, openrazer-driver-dkms\n",
             control,
         )
-        self.assertIn("Provides: openrazer-driver-dkms\n", control)
+        self.assertIn(
+            "Provides: openrazer-driver-dkms, "
+            "hyperflux-openrazer-driver-abi (= 3.12.4)\n",
+            control,
+        )
         self.assertIn("Replaces: openrazer-driver-dkms\n", control)
         self.assertIn(f"Description: {self.catalog.description}\n", control)
 
diff --git a/tests/test_distribution_package.py b/tests/test_distribution_package.py
index 78e95e6..2d7cdcc 100644
--- a/tests/test_distribution_package.py
+++ b/tests/test_distribution_package.py
@@ -21,6 +21,7 @@
     _canonical_arch_mtree,
     _canonical_arch_buildinfo,
     _arch_hook,
+    _arch_openrazer_policy_hook,
     _arch_install,
     _arch_pkgbuild,
     _tar_payload,
@@ -57,6 +58,8 @@ def test_arch_recipe_uses_one_payload_and_preserves_configuration(self) -> None:
                 self.assertIn(dependency, recipe)
         self.assertIn("'python>=3.14'", recipe)
         self.assertIn("'python<3.15'", recipe)
+        self.assertIn("'openrazer-driver-dkms'", recipe)
+        self.assertIn("'hyperflux-openrazer-driver-abi=3.12.4'", recipe)
 
     def test_arch_recipe_shell_quotes_human_metadata(self) -> None:
         catalog = replace(self.catalog, description="Receiver's transport")
@@ -121,6 +124,7 @@ def test_arch_mtree_is_deterministic_and_describes_final_content(self) -> None:
     def test_arch_hooks_delegate_lifecycle_without_hardware_logic(self) -> None:
         install = _arch_install(self.runtime)
         transaction = _arch_hook(self.runtime)
+        openrazer_policy = _arch_openrazer_policy_hook(self.runtime)
         activation = self.runtime.operations.activation_path
         for command in ("fresh-install", "pre-update", "pre-remove"):
             self.assertIn(f"{activation} {command}", install)
@@ -129,8 +133,14 @@ def test_arch_hooks_delegate_lifecycle_without_hardware_logic(self) -> None:
         self.assertIn("udevadm control --reload", install)
         self.assertIn("systemd-sysusers hyperflux-next.conf", install)
         self.assertIn("systemd-sysusers openrazer.conf", install)
+        self.assertIn("Target = openrazer-daemon", openrazer_policy)
+        self.assertIn("Target = python-openrazer", openrazer_policy)
+        self.assertIn(
+            f"Exec = {activation} report-openrazer-runtime", openrazer_policy
+        )
+        self.assertIn("When = PostTransaction", openrazer_policy)
         for forbidden in ("modprobe", "unbind", "rebind", "hidraw", "1532"):
-            self.assertNotIn(forbidden, install + transaction)
+            self.assertNotIn(forbidden, install + transaction + openrazer_policy)
 
     def test_payload_tar_is_reproducible_and_root_owned(self) -> None:
         with tempfile.TemporaryDirectory() as temporary:
diff --git a/tests/test_distribution_rpm.py b/tests/test_distribution_rpm.py
index f0fe217..5a6aece 100644
--- a/tests/test_distribution_rpm.py
+++ b/tests/test_distribution_rpm.py
@@ -95,6 +95,8 @@ def test_spec_uses_catalog_metadata_and_preserves_configuration(self) -> None:
             self.assertIn(f"Requires: {expected}\n", spec)
         for item in self.target.optional_dependencies:
             self.assertIn(f"Suggests: {item.package}\n", spec)
+        self.assertIn("Provides: openrazer-driver-dkms\n", spec)
+        self.assertIn("Provides: hyperflux-openrazer-driver-abi = 3.12.4\n", spec)
         self.assertIn(f"%config(noreplace) %attr(0640,root,root) {RPM_CONFIGURATION}", spec)
         self.assertIn(
             "%dir %attr(2750,root,root) /etc/hyperflux-next",
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index ef22d5f..75ec1b0 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -70,7 +70,7 @@ def test_catalog_is_deterministic_pinned_and_network_independent(self) -> None:
         )
         self.assertEqual(
             upstreams["openrazer"]["commit"],
-            "ddea89607b86023e88563b8feabc8fa2d5773cdd",
+            "1ef8a91712906a89fd332a2ed62bbd105315d6d1",
         )
         self.assertEqual(
             upstreams["polychromatic"]["commit"],
diff --git a/tools/hfxdev/arch_update_policy.py b/tools/hfxdev/arch_update_policy.py
new file mode 100644
index 0000000..9baef7a
--- /dev/null
+++ b/tools/hfxdev/arch_update_policy.py
@@ -0,0 +1,330 @@
+# SPDX-License-Identifier: GPL-2.0-only
+
+from __future__ import annotations
+
+import io
+from pathlib import Path
+import re
+import shutil
+import subprocess
+import tarfile
+import tempfile
+
+from .model import ModelError
+
+
+_PACKAGE_NAME = re.compile(r"^[a-z0-9][a-z0-9+_.-]{0,63}$")
+_PACKAGE_VERSION = re.compile(r"^[A-Za-z0-9][A-Za-z0-9.+_~-]{0,63}-[1-9][0-9]*$")
+_DEPENDENCY_NAME = re.compile(r"^([a-z0-9][a-z0-9+_.-]{0,63})")
+_REQUIRED_TOOLS = ("bsdtar", "fakeroot", "pacman", "repo-add", "zstd")
+_FIXTURE_REPOSITORY = "hyperflux-openrazer-policy"
+
+
+def _run(
+    command: list[str],
+    *,
+    label: str,
+    cwd: Path | None = None,
+    timeout_seconds: int,
+    expected_success: bool = True,
+) -> subprocess.CompletedProcess[str]:
+    try:
+        result = subprocess.run(
+            command,
+            cwd=cwd,
+            check=False,
+            text=True,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            timeout=timeout_seconds,
+        )
+    except (OSError, subprocess.SubprocessError) as error:
+        raise ModelError(f"{label} could not run: {error}") from error
+    if expected_success and result.returncode != 0:
+        details = (result.stderr or result.stdout).strip()
+        raise ModelError(
+            f"{label} failed with exit status {result.returncode}: {details}"
+        )
+    return result
+
+
+def _fixture_package(
+    directory: Path,
+    *,
+    name: str,
+    version: str,
+    dependencies: tuple[str, ...] = (),
+    timeout_seconds: int,
+) -> Path:
+    if not _PACKAGE_NAME.fullmatch(name) or not _PACKAGE_VERSION.fullmatch(version):
+        raise ModelError("OpenRazer update fixture has invalid package metadata")
+    metadata = [
+        f"pkgname = {name}",
+        f"pkgbase = {name}",
+        f"pkgver = {version}",
+        "pkgdesc = HyperFlux Next offline update-policy fixture",
+        "url = https://openrazer.github.io/",
+        "builddate = 1700000000",
+        "packager = HyperFlux Next verification",
+        "size = 0",
+        "arch = x86_64",
+        "license = GPL2",
+    ]
+    metadata.extend(f"depend = {dependency}" for dependency in dependencies)
+    payload = ("\n".join(metadata) + "\n").encode("utf-8")
+    archive = directory / f"{name}-{version}-x86_64.pkg.tar"
+    with tarfile.open(archive, mode="w", format=tarfile.GNU_FORMAT) as package:
+        member = tarfile.TarInfo(".PKGINFO")
+        member.size = len(payload)
+        member.mode = 0o644
+        member.mtime = 1_700_000_000
+        member.uid = 0
+        member.gid = 0
+        member.uname = "root"
+        member.gname = "root"
+        package.addfile(member, io.BytesIO(payload))
+    compressed = archive.with_suffix(archive.suffix + ".zst")
+    _run(
+        [
+            "zstd",
+            "--quiet",
+            "--force",
+            "--threads=1",
+            "-19",
+            "-o",
+            str(compressed),
+            str(archive),
+        ],
+        label=f"compress {name} update fixture",
+        timeout_seconds=timeout_seconds,
+    )
+    archive.unlink()
+    return compressed
+
+
+def _pacman_arguments(workspace: Path) -> list[str]:
+    return [
+        "fakeroot",
+        "pacman",
+        "--root",
+        str(workspace / "root"),
+        "--dbpath",
+        str(workspace / "database"),
+        "--cachedir",
+        str(workspace / "cache"),
+        "--hookdir",
+        str(workspace / "hooks"),
+        "--logfile",
+        str(workspace / "pacman.log"),
+        "--config",
+        str(workspace / "pacman.conf"),
+        "--noconfirm",
+    ]
+
+
+def _host_dependency_assumptions(
+    package: Path, *, timeout_seconds: int
+) -> tuple[str, ...]:
+    metadata = _run(
+        ["bsdtar", "-xOf", str(package), ".PKGINFO"],
+        label="read HyperFlux Arch package metadata",
+        timeout_seconds=timeout_seconds,
+    ).stdout
+    names: set[str] = set()
+    for line in metadata.splitlines():
+        key, separator, value = line.partition(" = ")
+        if key != "depend" or not separator:
+            continue
+        match = _DEPENDENCY_NAME.match(value)
+        if match is None:
+            raise ModelError("HyperFlux Arch package contains an invalid dependency")
+        names.add(match.group(1))
+    assumptions = []
+    for name in sorted(names):
+        query = _run(
+            ["pacman", "-Q", name],
+            label=f"query host dependency {name}",
+            timeout_seconds=timeout_seconds,
+        )
+        fields = query.stdout.strip().split()
+        if len(fields) != 2 or fields[0] != name:
+            raise ModelError(f"host dependency {name} has malformed package metadata")
+        assumptions.append(f"{name}={fields[1]}")
+    return tuple(assumptions)
+
+
+def _write_pacman_configuration(workspace: Path, repository: Path) -> None:
+    for name in ("root", "database", "cache", "hooks"):
+        (workspace / name).mkdir(parents=True)
+    (workspace / "pacman.conf").write_text(
+        "\n".join(
+            [
+                "[options]",
+                "Architecture = x86_64",
+                "SigLevel = Never",
+                "LocalFileSigLevel = Never",
+                "",
+                f"[{_FIXTURE_REPOSITORY}]",
+                "SigLevel = Never",
+                f"Server = file://{repository}",
+                "",
+            ]
+        ),
+        encoding="utf-8",
+    )
+
+
+def _verify_scenario(
+    hyperflux_package: Path,
+    *,
+    package_name: str,
+    candidate_version: str,
+    assumptions: tuple[str, ...],
+    workspace: Path,
+    timeout_seconds: int,
+) -> None:
+    workspace.mkdir(parents=True)
+    repository = workspace / "repository"
+    repository.mkdir()
+    current_daemon = _fixture_package(
+        workspace,
+        name="openrazer-daemon",
+        version="3.12.4-2",
+        dependencies=("openrazer-driver-dkms",),
+        timeout_seconds=timeout_seconds,
+    )
+    candidate_daemon = _fixture_package(
+        repository,
+        name="openrazer-daemon",
+        version=candidate_version,
+        dependencies=("openrazer-driver-dkms",),
+        timeout_seconds=timeout_seconds,
+    )
+    candidate_driver = _fixture_package(
+        repository,
+        name="openrazer-driver-dkms",
+        version=candidate_version,
+        timeout_seconds=timeout_seconds,
+    )
+    database = repository / f"{_FIXTURE_REPOSITORY}.db.tar.gz"
+    _run(
+        ["repo-add", str(database), str(candidate_daemon), str(candidate_driver)],
+        label=f"create OpenRazer {candidate_version} fixture repository",
+        timeout_seconds=timeout_seconds,
+    )
+    _write_pacman_configuration(workspace, repository)
+    base = _pacman_arguments(workspace)
+    _run(
+        [
+            *base,
+            "-U",
+            "--dbonly",
+            "--nodeps",
+            "--nodeps",
+            "--noscriptlet",
+            str(hyperflux_package),
+            str(current_daemon),
+        ],
+        label="seed isolated HyperFlux and OpenRazer package database",
+        timeout_seconds=timeout_seconds,
+    )
+    assumption_arguments = [
+        argument
+        for value in assumptions
+        for argument in ("--assume-installed", value)
+    ]
+    plan = _run(
+        [
+            *base,
+            "-Syu",
+            "--print",
+            "--print-format",
+            "__HFX_PACKAGE__%n %v",
+            *assumption_arguments,
+        ],
+        label=f"resolve OpenRazer {candidate_version} system upgrade",
+        timeout_seconds=timeout_seconds,
+    )
+    planned = tuple(
+        line.removeprefix("__HFX_PACKAGE__").strip()
+        for line in plan.stdout.splitlines()
+        if line.startswith("__HFX_PACKAGE__")
+    )
+    if planned != (f"openrazer-daemon {candidate_version}",):
+        raise ModelError(
+            f"OpenRazer {candidate_version} upgrade selected an unsafe package plan: "
+            + (", ".join(planned) if planned else "empty")
+        )
+    _run(
+        [
+            *base,
+            "-Syu",
+            "--dbonly",
+            "--noscriptlet",
+            *assumption_arguments,
+        ],
+        label=f"apply isolated OpenRazer {candidate_version} system upgrade",
+        timeout_seconds=timeout_seconds,
+    )
+    installed_query = _run(
+        [*base, "-Q"],
+        label="inspect isolated packages after OpenRazer upgrade",
+        timeout_seconds=timeout_seconds,
+    )
+    installed: dict[str, str] = {}
+    for line in installed_query.stdout.splitlines():
+        fields = line.split()
+        if len(fields) != 2 or fields[0] in installed:
+            raise ModelError("isolated package database contains malformed metadata")
+        installed[fields[0]] = fields[1]
+    if package_name not in installed:
+        raise ModelError("isolated system upgrade replaced the HyperFlux package")
+    if installed.get("openrazer-daemon") != candidate_version:
+        raise ModelError("isolated system upgrade did not update OpenRazer as expected")
+    if "openrazer-driver-dkms" in installed:
+        raise ModelError("isolated system upgrade replaced the HyperFlux-patched driver")
+    _run(
+        [*base, "-T", "openrazer-driver-dkms"],
+        label="verify HyperFlux still satisfies the OpenRazer driver dependency",
+        timeout_seconds=timeout_seconds,
+    )
+
+
+def verify_arch_openrazer_update_policy(
+    hyperflux_package: Path,
+    *,
+    package_name: str,
+    workspace: Path,
+    timeout_seconds: int,
+) -> None:
+    if not hyperflux_package.is_file() or hyperflux_package.is_symlink():
+        raise ModelError("OpenRazer update policy requires one regular Arch package")
+    if not _PACKAGE_NAME.fullmatch(package_name):
+        raise ModelError("OpenRazer update policy received an invalid package name")
+    missing = [tool for tool in _REQUIRED_TOOLS if shutil.which(tool) is None]
+    if missing:
+        raise ModelError(
+            "OpenRazer update policy requires: " + ", ".join(sorted(missing))
+        )
+    assumptions = _host_dependency_assumptions(
+        hyperflux_package, timeout_seconds=timeout_seconds
+    )
+    workspace = workspace.resolve()
+    if workspace.exists():
+        if not workspace.is_dir() or workspace.is_symlink():
+            raise ModelError("OpenRazer update policy workspace is unsafe")
+        shutil.rmtree(workspace)
+    workspace.mkdir(parents=True)
+    with tempfile.TemporaryDirectory(
+        prefix="hyperflux-openrazer-update-policy-", dir=workspace
+    ) as temporary:
+        root = Path(temporary)
+        for index, candidate_version in enumerate(("3.12.4-4", "3.13.0-1")):
+            _verify_scenario(
+                hyperflux_package,
+                package_name=package_name,
+                candidate_version=candidate_version,
+                assumptions=assumptions,
+                workspace=root / f"scenario-{index}",
+                timeout_seconds=timeout_seconds,
+            )
diff --git a/tools/hfxdev/distribution_package.py b/tools/hfxdev/distribution_package.py
index 87bcf4f..722c0ec 100644
--- a/tools/hfxdev/distribution_package.py
+++ b/tools/hfxdev/distribution_package.py
@@ -40,6 +40,9 @@
 ARCH_POST_TRANSACTION_HOOK = PurePosixPath(
     "/usr/share/libalpm/hooks/95-hyperflux-next-post-transaction.hook"
 )
+ARCH_OPENRAZER_POLICY_HOOK = PurePosixPath(
+    "/usr/share/libalpm/hooks/96-hyperflux-next-openrazer-policy.hook"
+)
 
 
 @dataclass(frozen=True)
@@ -131,6 +134,25 @@ def _arch_hook(runtime: LinuxRuntime) -> str:
     )
 
 
+def _arch_openrazer_policy_hook(runtime: LinuxRuntime) -> str:
+    return "\n".join(
+        [
+            "[Trigger]",
+            "Operation = Install",
+            "Operation = Upgrade",
+            "Type = Package",
+            "Target = openrazer-daemon",
+            "Target = python-openrazer",
+            "",
+            "[Action]",
+            "Description = Check HyperFlux Next OpenRazer source compatibility",
+            "When = PostTransaction",
+            f"Exec = {runtime.operations.activation_path} report-openrazer-runtime",
+            "",
+        ]
+    )
+
+
 def _arch_install(runtime: LinuxRuntime) -> str:
     activation = runtime.operations.activation_path
     return "\n".join(
@@ -629,7 +651,10 @@ def _backend_overlays(
     distribution: str, runtime: LinuxRuntime
 ) -> tuple[tuple[PurePosixPath, str], ...]:
     if distribution == "arch":
-        return ((ARCH_POST_TRANSACTION_HOOK, _arch_hook(runtime)),)
+        return (
+            (ARCH_POST_TRANSACTION_HOOK, _arch_hook(runtime)),
+            (ARCH_OPENRAZER_POLICY_HOOK, _arch_openrazer_policy_hook(runtime)),
+        )
     if distribution in {"debian", "rpm"}:
         return ()
     raise ModelError(f"unknown distribution package target {distribution}")
diff --git a/tools/hfxdev/distributions.py b/tools/hfxdev/distributions.py
index 14fc623..078cbda 100644
--- a/tools/hfxdev/distributions.py
+++ b/tools/hfxdev/distributions.py
@@ -9,6 +9,7 @@
 
 from .linux_runtime import load_linux_runtime
 from .model import ModelError, load_json, require_unique, sha256_file
+from .openrazer_native_route import load_native_deployment
 
 
 TARGET_IDS = ("arch", "debian", "rpm")
@@ -24,6 +25,7 @@
 ARCHITECTURE = re.compile(r"^[A-Za-z0-9_.-]{1,127}$")
 LICENSE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9.+-]{0,63}$")
 CONTROL_CHARACTER = re.compile(r"[\x00-\x1f\x7f]")
+OPENRAZER_DRIVER_VERSION_TOKEN = "@openrazer_driver_version@"
 
 
 @dataclass(frozen=True)
@@ -110,7 +112,18 @@ def _package(value: Any, label: str) -> str:
     return value
 
 
-def _target(target_id: str, value: Any) -> DistributionTarget:
+def _package_relation(value: Any, label: str, openrazer_version: str) -> str:
+    if not isinstance(value, str) or value.count(OPENRAZER_DRIVER_VERSION_TOKEN) > 1:
+        raise ModelError(f"{label}: invalid package expression")
+    return _package(
+        value.replace(OPENRAZER_DRIVER_VERSION_TOKEN, openrazer_version),
+        label,
+    )
+
+
+def _target(
+    target_id: str, value: Any, openrazer_version: str
+) -> DistributionTarget:
     if not isinstance(value, dict):
         raise ModelError(f"distribution {target_id}: must be an object")
     _exact(
@@ -180,7 +193,10 @@ def _target(target_id: str, value: Any) -> DistributionTarget:
         values = value[relation]
         if not isinstance(values, list) or len(values) > 16:
             raise ModelError(f"distribution {target_id}: invalid {relation}")
-        parsed = tuple(_package(item, f"{target_id} {relation}") for item in values)
+        parsed = tuple(
+            _package_relation(item, f"{target_id} {relation}", openrazer_version)
+            for item in values
+        )
         require_unique(list(parsed), f"distribution {target_id} {relation}")
         relation_values[relation] = parsed
 
@@ -240,7 +256,11 @@ def load_distribution_catalog(root: Path) -> DistributionCatalog:
     targets_value = value["targets"]
     if not isinstance(targets_value, dict) or set(targets_value) != set(TARGET_IDS):
         raise ModelError("distribution targets must be exactly arch, debian, and rpm")
-    targets = {target_id: _target(target_id, targets_value[target_id]) for target_id in TARGET_IDS}
+    openrazer_version = load_native_deployment(root).driver.dkms_version
+    targets = {
+        target_id: _target(target_id, targets_value[target_id], openrazer_version)
+        for target_id in TARGET_IDS
+    }
     runtime = load_linux_runtime(root)
     if runtime.product.package_name in {
         conflict for target in targets.values() for conflict in target.conflicts
diff --git a/tools/hfxdev/generators/openrazer_native.py b/tools/hfxdev/generators/openrazer_native.py
index d2a1ed8..331878b 100644
--- a/tools/hfxdev/generators/openrazer_native.py
+++ b/tools/hfxdev/generators/openrazer_native.py
@@ -11,7 +11,12 @@
 
 def rust_constants(deployment: OpenRazerNativeDeployment) -> str:
     driver = deployment.driver
+    compatibility = deployment.compatibility
+    capability = compatibility.runtime_capability
     modules = ", ".join(json.dumps(module) for module in driver.modules)
+    capability_modules = ", ".join(
+        json.dumps(module) for module in capability.modules
+    )
     return "\n".join(
         [
             "// Generated by ./hfx generate. Do not edit manually.",
@@ -23,6 +28,18 @@ def rust_constants(deployment: OpenRazerNativeDeployment) -> str:
             f"pub const OPENRAZER_NATIVE_DKMS_VERSION: &str = {json.dumps(driver.dkms_version)};",
             "pub const OPENRAZER_NATIVE_DRIVER_MODULES: &[&str] =",
             f"    &[{modules}];",
+            "pub const OPENRAZER_NATIVE_CAPABILITY_MODULES: &[&str] = "
+            f"&[{capability_modules}];",
+            "pub const OPENRAZER_NATIVE_CAPABILITY_FIELD: &str = "
+            f"{json.dumps(capability.modinfo_field)};",
+            "pub const OPENRAZER_NATIVE_CAPABILITY_VALUE: &str = "
+            f"{json.dumps(capability.expected_value)};",
+            "pub const OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION: &str = "
+            f"{json.dumps(compatibility.verified_upstream_version)};",
+            "pub const OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH: &str = "
+            f"{json.dumps(compatibility.daemon_executable_path)};",
+            "pub const OPENRAZER_NATIVE_VERSION_ARGUMENT: &str = "
+            f"{json.dumps(compatibility.version_argument)};",
             "",
         ]
     )
@@ -49,6 +66,7 @@ def relay_service(
             "Type=simple",
             "User=root",
             "Group=root",
+            f"ExecCondition={runtime.operations.activation_path} check-openrazer-runtime",
             f"ExecStart={relay.executable_path} --socket {bridge.socket_path} "
             f"--uhid {relay.uhid_device}",
             "UMask=0077",
@@ -103,6 +121,8 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
     relay = deployment.relay
     driver = deployment.driver
     access = deployment.access
+    compatibility = deployment.compatibility
+    capability = compatibility.runtime_capability
     return "\n".join(
         [
             "# OpenRazer Native Route Deployment",
@@ -138,6 +158,22 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
             "tree, projects only its DKMS build inputs, and verifies every transformed digest. "
             "The ordinary BUS_USB tables and direct-device transport remain upstream-owned.",
             "",
+            "## Update Compatibility",
+            "",
+            "| Field | Value |",
+            "| --- | --- |",
+            f"| Verified upstream source | `{compatibility.verified_upstream_version}` |",
+            f"| Package release suffix | `{compatibility.package_release_policy}` |",
+            f"| New upstream source | `{compatibility.unverified_upstream_policy}` |",
+            f"| Runtime capability | `{capability.modinfo_field}={capability.expected_value}` |",
+            f"| Capability modules | {', '.join(f'`{module}`' for module in capability.modules)} |",
+            "",
+            "Runtime readiness is determined from the declared module capability and installed/loaded "
+            "module identities, not from a distribution package-release suffix. The daemon's upstream "
+            "source version is checked separately as verification lineage: packaging revisions of the "
+            "verified source remain compatible, while a new upstream source requires a reviewed rebase "
+            "and fresh verification.",
+            "",
             "## Local Access",
             "",
             "| Field | Value |",
diff --git a/tools/hfxdev/openrazer_native_route.py b/tools/hfxdev/openrazer_native_route.py
index 3466157..62e9034 100644
--- a/tools/hfxdev/openrazer_native_route.py
+++ b/tools/hfxdev/openrazer_native_route.py
@@ -27,10 +27,17 @@
 
 
 TRANSFORM_SCHEMA = "hyperflux-openrazer-native-transform-v1"
-DEPLOYMENT_SCHEMA = "hyperflux-openrazer-native-deployment-v1"
+DEPLOYMENT_SCHEMA = "hyperflux-openrazer-native-deployment-v2"
 CATALOG_SCHEMA = "hyperflux-openrazer-native-route-catalog-v1"
 TRANSFORM_KEYS = {"$schema", "schema", "upstream", "patch", "files"}
-DEPLOYMENT_KEYS = {"$schema", "schema", "relay", "driver", "access"}
+DEPLOYMENT_KEYS = {
+    "$schema",
+    "schema",
+    "relay",
+    "driver",
+    "access",
+    "compatibility",
+}
 RELAY_KEYS = {"executable_path", "service_unit", "uhid_device", "restart_seconds"}
 DRIVER_KEYS = {"dkms_name", "dkms_version", "source_directory", "modules"}
 ACCESS_KEYS = {
@@ -41,6 +48,15 @@
     "mount_helper_path",
     "sysusers_path",
 }
+COMPATIBILITY_KEYS = {
+    "verified_upstream_version",
+    "daemon_executable_path",
+    "version_argument",
+    "package_release_policy",
+    "unverified_upstream_policy",
+    "runtime_capability",
+}
+RUNTIME_CAPABILITY_KEYS = {"modinfo_field", "expected_value", "modules"}
 UPSTREAM_KEYS = {"id", "repository", "commit"}
 PATCH_KEYS = {"path", "sha256"}
 FILE_KEYS = {"path", "source_sha256", "transformed_sha256"}
@@ -115,12 +131,30 @@ class OpenRazerAccessDeployment:
     sysusers_path: str
 
 
+@dataclass(frozen=True)
+class OpenRazerRuntimeCapability:
+    modinfo_field: str
+    expected_value: str
+    modules: tuple[str, ...]
+
+
+@dataclass(frozen=True)
+class OpenRazerCompatibilityDeployment:
+    verified_upstream_version: str
+    daemon_executable_path: str
+    version_argument: str
+    package_release_policy: str
+    unverified_upstream_policy: str
+    runtime_capability: OpenRazerRuntimeCapability
+
+
 @dataclass(frozen=True)
 class OpenRazerNativeDeployment:
     source_sha256: str
     relay: OpenRazerRelayDeployment
     driver: OpenRazerDriverDeployment
     access: OpenRazerAccessDeployment
+    compatibility: OpenRazerCompatibilityDeployment
 
 
 def _json_payload(value: dict[str, Any]) -> bytes:
@@ -469,6 +503,60 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
     for key, expected in expected_access.items():
         if access[key] != expected:
             raise ModelError(f"OpenRazer native access {key} differs from its deployment contract")
+
+    compatibility = value["compatibility"]
+    if not isinstance(compatibility, dict):
+        raise ModelError("OpenRazer native compatibility deployment must be an object")
+    _exact_keys(
+        compatibility,
+        COMPATIBILITY_KEYS,
+        "OpenRazer native compatibility deployment",
+    )
+    verified_version = compatibility["verified_upstream_version"]
+    if verified_version != upstream["version"] or verified_version != version:
+        raise ModelError(
+            "OpenRazer native compatibility version differs from its pinned source"
+        )
+    daemon_executable = _deployment_path(
+        compatibility["daemon_executable_path"],
+        "OpenRazer daemon executable",
+        ("/", "usr", "bin"),
+    )
+    if daemon_executable != "/usr/bin/openrazer-daemon":
+        raise ModelError("OpenRazer daemon executable differs from its runtime contract")
+    if compatibility["version_argument"] != "--version":
+        raise ModelError("OpenRazer version argument differs from its runtime contract")
+    if compatibility["package_release_policy"] != "ignored":
+        raise ModelError("OpenRazer package release policy must ignore packaging revisions")
+    if compatibility["unverified_upstream_policy"] != "rebase-reverification-required":
+        raise ModelError("OpenRazer unverified source policy must fail closed")
+
+    capability = compatibility["runtime_capability"]
+    if not isinstance(capability, dict):
+        raise ModelError("OpenRazer native runtime capability must be an object")
+    _exact_keys(
+        capability,
+        RUNTIME_CAPABILITY_KEYS,
+        "OpenRazer native runtime capability",
+    )
+    field = capability["modinfo_field"]
+    expected_value = capability["expected_value"]
+    capability_modules = capability["modules"]
+    if not isinstance(field, str) or re.fullmatch(r"[a-z][a-z0-9_]{0,63}", field) is None:
+        raise ModelError("OpenRazer native capability field is invalid")
+    if (
+        not isinstance(expected_value, str)
+        or re.fullmatch(r"[a-z0-9][a-z0-9_.-]{0,63}", expected_value) is None
+    ):
+        raise ModelError("OpenRazer native capability value is invalid")
+    if (
+        not isinstance(capability_modules, list)
+        or not capability_modules
+        or capability_modules != sorted(capability_modules)
+        or len(set(capability_modules)) != len(capability_modules)
+        or not set(capability_modules).issubset(modules)
+    ):
+        raise ModelError("OpenRazer native capability modules are invalid")
     return OpenRazerNativeDeployment(
         source_sha256=sha256_file(path),
         relay=OpenRazerRelayDeployment(
@@ -491,6 +579,18 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
             mount_helper_path=access["mount_helper_path"],
             sysusers_path=access["sysusers_path"],
         ),
+        compatibility=OpenRazerCompatibilityDeployment(
+            verified_upstream_version=verified_version,
+            daemon_executable_path=daemon_executable,
+            version_argument=compatibility["version_argument"],
+            package_release_policy=compatibility["package_release_policy"],
+            unverified_upstream_policy=compatibility["unverified_upstream_policy"],
+            runtime_capability=OpenRazerRuntimeCapability(
+                modinfo_field=field,
+                expected_value=expected_value,
+                modules=tuple(capability_modules),
+            ),
+        ),
     )
 
 
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 820b5cf..07eae74 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ast
 import json
 import os
 from pathlib import Path, PurePosixPath
@@ -14,6 +15,7 @@
 
 from .model import ModelError, load_foundation, load_json, require_unique, sha256_file
 from .assurance import load_design_coverage
+from .arch_update_policy import verify_arch_openrazer_update_policy
 from .atlas import load_repository_atlas
 from .development import load_development_environment
 from .errors import load_error_catalog
@@ -53,6 +55,7 @@
 from .openrgb import extract_openrgb_catalog
 from .openrgb_native_route import prepare_openrgb_native_source
 from .package_pipeline import build_artifacts, load_artifact_set, stage_rootfs
+from .distribution_package import build_distribution_package
 from .performance import (
     load_performance_budgets,
     verify_package_performance_budgets,
@@ -769,6 +772,40 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
     if any(marker not in common for marker in required_common):
         raise ModelError("OpenRazer native common transport is incomplete")
 
+    keyboard_source = (prepared.root / "driver" / "razerkbd_driver.c").read_text(
+        encoding="utf-8"
+    )
+    preserved_keyboard_fixes = (
+        "strscpy(&serial_string[0], dmi_get_system_info(DMI_PRODUCT_SERIAL), 50);",
+        "memcpy(&serial_string[0], &response.arguments[0], 22);",
+        "(LINUX_VERSION_CODE >= KERNEL_VERSION(6, 12, 93)",
+        "(LINUX_VERSION_CODE >= KERNEL_VERSION(6, 6, 143)",
+        "(LINUX_VERSION_CODE >= KERNEL_VERSION(6, 1, 176)",
+        "(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 210)",
+        "(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 259)",
+        "#define LINUX_HID_REPORT_RAW_EVENT_WITH_BUFFER_SIZE",
+        "hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), sizeof(xdata), 0);",
+        "hid_report_raw_event(hdev, HID_INPUT_REPORT, xdata, sizeof(xdata), 0);",
+    )
+    if any(marker not in keyboard_source for marker in preserved_keyboard_fixes):
+        raise ModelError(
+            "OpenRazer native keyboard source lost a required upstream 3.12.4 fix"
+        )
+    if keyboard_source.count("#ifdef LINUX_HID_REPORT_RAW_EVENT_WITH_BUFFER_SIZE") != 2:
+        raise ModelError("OpenRazer native keyboard HID backport guard is incomplete")
+
+    accessory_source = (
+        prepared.root / "driver" / "razeraccessory_driver.c"
+    ).read_text(encoding="utf-8")
+    preserved_accessory_fixes = (
+        "strscpy(&serial_string[0], &device->serial[0], sizeof(serial_string));",
+        "memcpy(&serial_string[0], &response.arguments[0], 22);",
+    )
+    if any(marker not in accessory_source for marker in preserved_accessory_fixes):
+        raise ModelError(
+            "OpenRazer native accessory source lost a required upstream 3.12.4 fix"
+        )
+
     rules = (prepared.root / "install_files" / "udev" / "99-razer.rules").read_text(
         encoding="utf-8"
     )
@@ -802,6 +839,20 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
         if not _openrazer_payload_retry_is_safe(source_text):
             raise ModelError(f"OpenRazer native {driver} can retry an uncertain transaction")
 
+    capability = deployment.compatibility.runtime_capability
+    capability_marker = (
+        f'MODULE_INFO({capability.modinfo_field}, "{capability.expected_value}");'
+    )
+    for module in deployment.driver.modules:
+        source_text = (prepared.root / "driver" / f"{module}_driver.c").read_text(
+            encoding="utf-8"
+        )
+        expected_count = 1 if module in capability.modules else 0
+        if source_text.count(capability_marker) != expected_count:
+            raise ModelError(
+                f"OpenRazer native {module} capability marker differs from deployment policy"
+            )
+
     prepared_driver = prepared.root / "driver"
     prepared_source_link = prepared_driver / "source"
     if prepared_source_link.exists() or prepared_source_link.is_symlink():
@@ -855,6 +906,7 @@ def _run_openrazer_native_route_contracts(root: Path, node: TestNode) -> None:
         f"DeviceAllow={deployment.relay.uhid_device} rw",
         f"PartOf={runtime.bridge.service_unit}",
         "ProtectKernelModules=yes",
+        f"ExecCondition={runtime.operations.activation_path} check-openrazer-runtime",
     )
     if any(marker not in service for marker in required_service):
         raise ModelError("OpenRazer native relay service sandbox is incomplete")
@@ -954,6 +1006,29 @@ def _run_repository_atlas_contracts(root: Path, _node: TestNode) -> None:
 
 def _run_openrazer_compatibility_contracts(root: Path, node: TestNode) -> None:
     source = _openrazer_source(root)
+    deployment = load_native_deployment(root)
+    expected_version = deployment.compatibility.verified_upstream_version
+    version_sources = (
+        source / "daemon" / "openrazer_daemon" / "daemon.py",
+        source / "pylib" / "openrazer" / "client" / "device_manager.py",
+    )
+    for path in version_sources:
+        module = ast.parse(path.read_text(encoding="utf-8"), filename=str(path))
+        versions = [
+            node.value.value
+            for node in module.body
+            if isinstance(node, ast.Assign)
+            and any(
+                isinstance(target, ast.Name) and target.id == "__version__"
+                for target in node.targets
+            )
+            and isinstance(node.value, ast.Constant)
+            and isinstance(node.value.value, str)
+        ]
+        if versions != [expected_version]:
+            raise ModelError(
+                f"OpenRazer {path.relative_to(source)} version differs from native deployment"
+            )
     build_directory = root / "build" / "openrazer-compatibility"
     if build_directory.exists():
         shutil.rmtree(build_directory)
@@ -1546,6 +1621,19 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
         staged_payload_size,
     )
 
+    arch_package = build_distribution_package(
+        root,
+        manifest_path,
+        "arch",
+        workspace / "arch-package",
+    ).package
+    verify_arch_openrazer_update_policy(
+        arch_package,
+        package_name=runtime.product.package_name,
+        workspace=workspace / "openrazer-update-policy",
+        timeout_seconds=node.timeout_seconds,
+    )
+
 
 RUNNERS = {
     "foundation-contracts": _run_foundation_contracts,

From 1c1a0b30ee2a1797fe99b2013ebe0a768dbf44b6 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Mon, 27 Jul 2026 00:58:55 +0400
Subject: [PATCH 65/67] Harden OpenRazer update ownership and provenance

---
 README.md                                     | 22 ++++++++
 .../src/openrazer_native_generated.rs         |  1 +
 .../src/bin/hyperflux-next-activate.rs        | 15 +++++-
 crates/hfx-ops/src/probe.rs                   | 53 ++++++++++++++++++-
 docs/architecture/integrations.md             | 23 ++++++++
 docs/generated/distributions.md               |  2 +-
 docs/generated/installation.md                | 12 +++++
 docs/generated/openrazer-native-deployment.md |  2 +
 docs/user/overview.md                         | 21 +++++++-
 docs/user/troubleshooting.md                  | 11 ++++
 packaging/distributions.json                  |  1 +
 schemas/distribution-packages.schema.json     |  8 ++-
 tests/test_distribution_debian.py             |  1 +
 tests/test_distribution_package.py            |  4 +-
 tests/test_distribution_rpm.py                |  1 +
 tests/test_integrations.py                    |  8 ++-
 tests/test_repository_experience.py           | 29 +++++++++-
 tools/hfxdev/distribution_debian.py           |  1 +
 tools/hfxdev/distribution_package.py          |  5 +-
 tools/hfxdev/distribution_rpm.py              |  1 +
 tools/hfxdev/distributions.py                 | 21 +++++++-
 tools/hfxdev/generators/install.py            | 35 +++++++++++-
 tools/hfxdev/generators/openrazer_native.py   |  7 +++
 tools/hfxdev/generators/readme.py             | 38 +++++++++++++
 tools/hfxdev/openrazer_native_route.py        | 11 ++++
 tools/hfxdev/render.py                        | 17 ++++--
 tools/hfxdev/verify.py                        | 19 +++++--
 27 files changed, 347 insertions(+), 22 deletions(-)

diff --git a/README.md b/README.md
index 05c86fd..376cba7 100644
--- a/README.md
+++ b/README.md
@@ -41,6 +41,28 @@ dispatch, availability, outcome certainty, and diagnostics. The kernel
 preserves ordinary HID input and transports generation-bound exchanges without
 interpreting device semantics.
 
+## OpenRazer Route
+
+HyperFlux applies a narrow transport patch to official
+[OpenRazer 3.12.4](https://github.com/openrazer/openrazer/commit/1ef8a91712906a89fd332a2ed62bbd105315d6d1).
+The upstream daemon, Python client, device classes, ordinary USB tables, and
+direct-device behavior remain OpenRazer-owned. The patched DKMS modules accept
+only trusted, feature-only HyperFlux UHID routes and advertise
+`hyperflux_native_transport=razer-feature-report-v1`.
+
+| Qualified receiver-backed controller | Native route | Direct USB precedence |
+| --- | --- | --- |
+| Razer Basilisk V3 Pro 35K (Wireless) | `1532:00cd` | `1532:00cc` |
+| Razer DeathStalker V2 Pro TKL (Wireless) | `1532:0296` | `1532:0298` |
+
+Distribution release suffixes do not affect compatibility. A newer OpenRazer
+source line requires a reviewed rebase and fresh verification; until then,
+`hyperflux-next-openrazer-relay.service` remains stopped. See the
+[deployment contract](docs/generated/openrazer-native-deployment.md),
+[installation contract](docs/generated/installation.md), and
+[hardware boundary](docs/generated/supported-hardware.md). Other catalog
+devices remain research-only and non-writable.
+
 ## Current Readiness
 
 <!-- Generated from generated/public-readiness.json. -->
diff --git a/crates/hfx-integration-model/src/openrazer_native_generated.rs b/crates/hfx-integration-model/src/openrazer_native_generated.rs
index b942cd9..df6d4b5 100644
--- a/crates/hfx-integration-model/src/openrazer_native_generated.rs
+++ b/crates/hfx-integration-model/src/openrazer_native_generated.rs
@@ -13,3 +13,4 @@ pub const OPENRAZER_NATIVE_CAPABILITY_VALUE: &str = "razer-feature-report-v1";
 pub const OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION: &str = "3.12.4";
 pub const OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH: &str = "/usr/bin/openrazer-daemon";
 pub const OPENRAZER_NATIVE_VERSION_ARGUMENT: &str = "--version";
+pub const OPENRAZER_NATIVE_RELAY_SERVICE_UNIT: &str = "hyperflux-next-openrazer-relay.service";
diff --git a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
index 2d640b3..fb005c3 100644
--- a/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
+++ b/crates/hfx-ops/src/bin/hyperflux-next-activate.rs
@@ -13,7 +13,7 @@ use std::thread;
 use std::time::Duration;
 
 fn usage() -> &'static str {
-    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|check-openrazer-driver|check-openrazer-runtime|report-openrazer-runtime|confirm-start|pre-remove>\n"
+    "Usage: hyperflux-next-activate <fresh-install|pre-update|post-update|prepare-start|check-openrazer-driver|check-openrazer-runtime|reconcile-openrazer-runtime|report-openrazer-runtime|confirm-start|pre-remove>\n"
 }
 
 fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), String> {
@@ -46,7 +46,10 @@ fn ensure_openrazer_driver(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), Str
 
 fn ensure_openrazer_runtime(snapshot: &hfx_ops::SystemSnapshot) -> Result<(), String> {
     match snapshot.openrazer_runtime.state {
-        OpenRazerRuntimeState::NotInstalled | OpenRazerRuntimeState::Verified => Ok(()),
+        OpenRazerRuntimeState::Verified => Ok(()),
+        OpenRazerRuntimeState::NotInstalled => {
+            Err("the verified OpenRazer runtime is not installed".to_owned())
+        }
         OpenRazerRuntimeState::ReverificationRequired => Err(format!(
             "the installed OpenRazer runtime is outside verified source line {OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION}; rebase and reverification are required"
         )),
@@ -88,6 +91,13 @@ fn report_openrazer_runtime(probe: &RealSystemProbe) {
     }
 }
 
+fn reconcile_openrazer_runtime(probe: &RealSystemProbe) -> Result<(), String> {
+    report_openrazer_runtime(probe);
+    probe
+        .reconcile_openrazer_relay()
+        .map_err(|error| format!("OpenRazer relay reconciliation failed: {error}"))
+}
+
 fn wait_for_bridge_and_confirmation(probe: &RealSystemProbe) -> bool {
     for _ in 0..50 {
         let snapshot = probe.snapshot();
@@ -240,6 +250,7 @@ fn run() -> Result<(), String> {
         "prepare-start" => prepare_start(&probe),
         "check-openrazer-driver" => check_openrazer_driver(&probe),
         "check-openrazer-runtime" => check_openrazer_runtime(&probe),
+        "reconcile-openrazer-runtime" => reconcile_openrazer_runtime(&probe),
         "report-openrazer-runtime" => {
             report_openrazer_runtime(&probe);
             Ok(())
diff --git a/crates/hfx-ops/src/probe.rs b/crates/hfx-ops/src/probe.rs
index 3018c3b..5a5e7d2 100644
--- a/crates/hfx-ops/src/probe.rs
+++ b/crates/hfx-ops/src/probe.rs
@@ -6,8 +6,8 @@ use hfx_domain::{
 use hfx_integration_model::{
     OPENRAZER_NATIVE_CAPABILITY_FIELD, OPENRAZER_NATIVE_CAPABILITY_MODULES,
     OPENRAZER_NATIVE_CAPABILITY_VALUE, OPENRAZER_NATIVE_DAEMON_EXECUTABLE_PATH,
-    OPENRAZER_NATIVE_DRIVER_MODULES, OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION,
-    OPENRAZER_NATIVE_VERSION_ARGUMENT,
+    OPENRAZER_NATIVE_DRIVER_MODULES, OPENRAZER_NATIVE_RELAY_SERVICE_UNIT,
+    OPENRAZER_NATIVE_VERIFIED_UPSTREAM_VERSION, OPENRAZER_NATIVE_VERSION_ARGUMENT,
 };
 use hfx_profiles::receiver_profile_by_usb_id;
 use hfx_protocol::{
@@ -307,6 +307,16 @@ pub trait SystemController {
     ///
     /// Returns a bounded local-control failure.
     fn stop_bridge(&self) -> Result<(), ProbeError>;
+
+    /// Restarts the `OpenRazer` relay only when it is already active.
+    ///
+    /// The relay's systemd condition then keeps it stopped when the installed
+    /// `OpenRazer` source line is absent or outside the verified line.
+    ///
+    /// # Errors
+    ///
+    /// Returns a bounded local-control failure.
+    fn reconcile_openrazer_relay(&self) -> Result<(), ProbeError>;
 }
 
 #[derive(Clone, Debug)]
@@ -746,6 +756,19 @@ impl<R: CommandRunner> SystemController for RealSystemProbe<R> {
             Err(ProbeError::CommandUnavailable)
         }
     }
+
+    fn reconcile_openrazer_relay(&self) -> Result<(), ProbeError> {
+        let output = self.runner.run(
+            "systemctl",
+            &["try-restart", OPENRAZER_NATIVE_RELAY_SERVICE_UNIT],
+            self.timeout,
+        )?;
+        if output.success {
+            Ok(())
+        } else {
+            Err(ProbeError::CommandUnavailable)
+        }
+    }
 }
 
 fn qualification_client_id() -> String {
@@ -1220,6 +1243,32 @@ mod tests {
         );
     }
 
+    #[test]
+    fn openrazer_runtime_reconciliation_is_one_bounded_try_restart() {
+        let probe = RealSystemProbe::with_paths(
+            FakeRunner::new(vec![Ok(CommandOutput {
+                success: true,
+                stdout: String::new(),
+            })]),
+            PathBuf::from("/missing"),
+            PathBuf::from("/missing.sock"),
+            Duration::from_millis(10),
+        );
+        probe
+            .reconcile_openrazer_relay()
+            .expect("relay reconciliation succeeds");
+        assert_eq!(
+            probe.runner.calls(),
+            vec![(
+                "systemctl".to_owned(),
+                vec![
+                    "try-restart".to_owned(),
+                    OPENRAZER_NATIVE_RELAY_SERVICE_UNIT.to_owned(),
+                ]
+            )]
+        );
+    }
+
     #[test]
     fn qualified_receiver_is_discovered_from_generated_usb_profiles() {
         let unique = SystemTime::now()
diff --git a/docs/architecture/integrations.md b/docs/architecture/integrations.md
index a745b71..23f5db6 100644
--- a/docs/architecture/integrations.md
+++ b/docs/architecture/integrations.md
@@ -57,6 +57,29 @@ devices and sends their reports through protocol v7. Polychromatic therefore
 uses its ordinary OpenRazer backend rather than learning HyperFlux device
 semantics.
 
+## OpenRazer Source And Package Ownership
+
+The exact OpenRazer source, transform digest, DKMS identity, capability marker,
+and relay unit are rendered from one canonical deployment model in the
+[OpenRazer native-route deployment](../generated/openrazer-native-deployment.md).
+The transform changes only the trusted HyperFlux transport boundary and its
+capability markers. It preserves upstream direct USB tables, command building,
+daemon behavior, Python-client behavior, and kernel compatibility fixes.
+
+The HyperFlux distribution package owns the transformed OpenRazer DKMS source
+and satisfies the upstream driver package dependency. Native package metadata
+conflicts with and replaces the ordinary OpenRazer DKMS driver so `pacman -Syu`
+cannot install a second source-tree owner. The official daemon and Python
+client remain separate upstream packages. Distribution release suffixes on the
+verified source line are ignored; a different upstream source line blocks the
+native relay until a new source-bound transform and verification exist.
+
+Loaded modules are trusted by a declared transport capability, not by parsing a
+package version string. Source lineage is checked separately so a newer daemon
+cannot silently use an older patched driver. The generated
+[installation contract](../generated/installation.md) records update,
+activation, Doctor, and rollback behavior.
+
 The private OpenRazer service and SDK-native Polychromatic backend are retained
 only as migration fallbacks until physical parity and a separate retirement gate
 pass. The bridge remains the sole userspace receiver writer; applications own
diff --git a/docs/generated/distributions.md b/docs/generated/distributions.md
index e9fb6f0..26e9110 100644
--- a/docs/generated/distributions.md
+++ b/docs/generated/distributions.md
@@ -2,7 +2,7 @@
 
 > Generated by `./hfx generate`. Do not edit manually.
 
-Canonical distribution digest: `079f195c20ddfd7acfe140d2d7b35caf79b47911a275119ccf9376f368eafad1`.
+Canonical distribution digest: `36cf23c9db6e8ab2285ce16c78b4a7ac6e97e20e8a39546ec30d4166536d67fd`.
 
 Every target packages the same `hyperflux-next-linux` canonical staged payload. Distribution wrappers add only native metadata, lifecycle hooks, and Python discovery.
 
diff --git a/docs/generated/installation.md b/docs/generated/installation.md
index 60ba544..3768891 100644
--- a/docs/generated/installation.md
+++ b/docs/generated/installation.md
@@ -71,4 +71,16 @@ The expanded source payload contains `189` files. Every destination is normalize
 
 - `/etc/hyperflux-next/bridge.json` is package-manager preserved.
 
+## OpenRazer Ownership And Updates
+
+The package owns the source-bound patched driver at `/usr/src/openrazer-driver-3.12.4` and provides the OpenRazer driver dependency. Distribution packages must conflict with and replace the ordinary `openrazer-driver-dkms` package so a system update cannot install a second owner over the transformed source tree.
+
+Official OpenRazer `3.12.4` daemon and Python-client packaging may receive distribution release-suffix updates. Runtime readiness is checked with the transformed module capability `hyperflux_native_transport=razer-feature-report-v1`, not a package release string. A different upstream source version fails closed and keeps `hyperflux-next-openrazer-relay.service` stopped until HyperFlux is rebased and reverified.
+
+## Verification And Rollback
+
+Run `hyperfluxctl doctor` after package hooks complete. A compatible update may resume a previously active bridge automatically; an in-use kernel-module change requires the activation action reported by Doctor.
+
+Rollback uses a complete prior source-bound package through the package manager. Do not copy files into `/usr/src`, overwrite DKMS trees, or mix an upstream OpenRazer driver package with the HyperFlux-owned transform. Existing configuration remains preserved across supported package transitions.
+
 Arch, Debian, and RPM packaging must consume the same deterministic staged root instead of maintaining independent file lists.
diff --git a/docs/generated/openrazer-native-deployment.md b/docs/generated/openrazer-native-deployment.md
index 7818e1c..e4ee18f 100644
--- a/docs/generated/openrazer-native-deployment.md
+++ b/docs/generated/openrazer-native-deployment.md
@@ -19,6 +19,8 @@ The static relay service is pulled in by the bridge service. It runs as root onl
 
 | Field | Value |
 | --- | --- |
+| Official source | [3.12.4](https://github.com/openrazer/openrazer/commit/1ef8a91712906a89fd332a2ed62bbd105315d6d1) |
+| Source commit | `1ef8a91712906a89fd332a2ed62bbd105315d6d1` |
 | DKMS identity | `openrazer-driver` `3.12.4` |
 | Source tree | `/usr/src/openrazer-driver-3.12.4` |
 | Modules | `razeraccessory`, `razerkbd`, `razerkraken`, `razermouse` |
diff --git a/docs/user/overview.md b/docs/user/overview.md
index 52859c4..8510c90 100644
--- a/docs/user/overview.md
+++ b/docs/user/overview.md
@@ -17,6 +17,22 @@ OpenRazer and OpenRGB remain responsible for device commands, capabilities,
 images, layouts, DPI, polling, macros, lighting modes, effects, profiles, and
 persistence. HyperFlux does not recreate those model semantics.
 
+## Qualified Application Routes
+
+The current OpenRazer native route is intentionally narrow. HyperFlux carries
+the standard 90-byte Razer Feature exchange for the exact receiver-backed
+Razer Basilisk V3 Pro 35K `1532:00cd` and Razer DeathStalker V2 Pro Tenkeyless
+`1532:0296` profiles. A source-bound patch lets the official OpenRazer driver
+accept those trusted feature-only virtual HID routes; direct USB devices and
+all model behavior remain on the ordinary upstream path.
+
+The [generated deployment contract](../generated/openrazer-native-deployment.md)
+names the exact reviewed OpenRazer source, runtime capability, and update
+policy. Distribution release revisions of that source are compatible. A new
+OpenRazer source line fails closed until the patch is rebased and reverified.
+Other models in the upstream catalogs remain research candidates with no
+HyperFlux write authority; see [Supported hardware](../generated/supported-hardware.md).
+
 > **Current state:** this is a public, evidence-bound pre-release source
 > repository. It is not an authorized release, package channel, or supported
 > product claim.
@@ -33,5 +49,6 @@ persistence. HyperFlux does not recreate those model semantics.
 - one understandable Doctor result and privacy-safe support evidence;
 - updates that distinguish userspace changes from kernel activation.
 
-See [Supported hardware](../generated/supported-hardware.md) for evidence-backed
-coverage and [Applications](../generated/integrations.md) for integration state.
+See [Applications](../generated/integrations.md) for integration state and the
+[installation contract](../generated/installation.md) for package ownership,
+Doctor, update activation, and rollback boundaries.
diff --git a/docs/user/troubleshooting.md b/docs/user/troubleshooting.md
index 03635a2..1d258fe 100644
--- a/docs/user/troubleshooting.md
+++ b/docs/user/troubleshooting.md
@@ -32,6 +32,17 @@ installed driver is not active, reboot, or follow the receiver-disconnect and
 module-reload action printed by Doctor. A service restart is not a substitute
 for kernel activation.
 
+For OpenRazer, package release suffixes on the verified source line do not
+matter. A newer upstream source line is deliberately blocked until HyperFlux's
+transport patch is rebased and reverified. Doctor reports that boundary; do not
+replace files under `/usr/src` or force the relay to start. Install a HyperFlux
+package verified for the new source, or keep the matching verified OpenRazer
+daemon and Python client.
+
+Rollback by installing a complete prior source-bound HyperFlux package through
+the package manager. Mixing an ordinary `openrazer-driver-dkms` package with the
+HyperFlux-owned transformed driver is not a supported recovery path.
+
 ## Missing Application Devices
 
 First confirm that Doctor reports the driver and bridge ready. Then restart or
diff --git a/packaging/distributions.json b/packaging/distributions.json
index b038554..ab3cc67 100644
--- a/packaging/distributions.json
+++ b/packaging/distributions.json
@@ -3,6 +3,7 @@
   "schema": "hyperflux-distribution-packages-v1",
   "metadata": {
     "description": "Universal Linux transport, bridge, SDK, and application adapters for Razer HyperFlux V2",
+    "homepage": "https://github.com/offalexjackson777-stack/hyperflux-next",
     "licenses": ["GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-only"]
   },
   "targets": {
diff --git a/schemas/distribution-packages.schema.json b/schemas/distribution-packages.schema.json
index 3982a86..235e694 100644
--- a/schemas/distribution-packages.schema.json
+++ b/schemas/distribution-packages.schema.json
@@ -11,7 +11,7 @@
     "metadata": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["description", "licenses"],
+      "required": ["description", "homepage", "licenses"],
       "properties": {
         "description": {
           "type": "string",
@@ -19,6 +19,12 @@
           "maxLength": 160,
           "pattern": "^[^\\u0000-\\u001f\\u007f]+$"
         },
+        "homepage": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://",
+          "maxLength": 256
+        },
         "licenses": {
           "type": "array",
           "minItems": 1,
diff --git a/tests/test_distribution_debian.py b/tests/test_distribution_debian.py
index 98c10f5..4c65851 100644
--- a/tests/test_distribution_debian.py
+++ b/tests/test_distribution_debian.py
@@ -83,6 +83,7 @@ def test_control_comes_from_distribution_and_runtime_authorities(self) -> None:
         self.assertIn("Version: 0.0.0~dev.1-1\n", control)
         self.assertIn("Architecture: amd64\n", control)
         self.assertIn(f"Maintainer: {DEBIAN_MAINTAINER}\n", control)
+        self.assertIn(f"Homepage: {self.catalog.homepage}\n", control)
         self.assertIn("Depends: dkms, libc6, libgcc-s1, python3 (>= 3.11), systemd, udev\n", control)
         self.assertIn(
             "Suggests: openrazer-daemon, python3-openrazer, openrgb, polychromatic, "
diff --git a/tests/test_distribution_package.py b/tests/test_distribution_package.py
index 2d7cdcc..25d5bd0 100644
--- a/tests/test_distribution_package.py
+++ b/tests/test_distribution_package.py
@@ -60,6 +60,7 @@ def test_arch_recipe_uses_one_payload_and_preserves_configuration(self) -> None:
         self.assertIn("'python<3.15'", recipe)
         self.assertIn("'openrazer-driver-dkms'", recipe)
         self.assertIn("'hyperflux-openrazer-driver-abi=3.12.4'", recipe)
+        self.assertIn(f"url='{self.catalog.homepage}'", recipe)
 
     def test_arch_recipe_shell_quotes_human_metadata(self) -> None:
         catalog = replace(self.catalog, description="Receiver's transport")
@@ -135,8 +136,9 @@ def test_arch_hooks_delegate_lifecycle_without_hardware_logic(self) -> None:
         self.assertIn("systemd-sysusers openrazer.conf", install)
         self.assertIn("Target = openrazer-daemon", openrazer_policy)
         self.assertIn("Target = python-openrazer", openrazer_policy)
+        self.assertIn("Operation = Remove", openrazer_policy)
         self.assertIn(
-            f"Exec = {activation} report-openrazer-runtime", openrazer_policy
+            f"Exec = {activation} reconcile-openrazer-runtime", openrazer_policy
         )
         self.assertIn("When = PostTransaction", openrazer_policy)
         for forbidden in ("modprobe", "unbind", "rebind", "hidraw", "1532"):
diff --git a/tests/test_distribution_rpm.py b/tests/test_distribution_rpm.py
index 5a6aece..9d8c3f2 100644
--- a/tests/test_distribution_rpm.py
+++ b/tests/test_distribution_rpm.py
@@ -89,6 +89,7 @@ def test_spec_uses_catalog_metadata_and_preserves_configuration(self) -> None:
         self.assertIn(f"Name: {self.runtime.product.package_name}\n", spec)
         self.assertIn("Version: 0.0.0~dev.1\n", spec)
         self.assertIn("BuildArch: x86_64\n", spec)
+        self.assertIn(f"URL: {self.catalog.homepage}\n", spec)
         self.assertIn("AutoReqProv: no\n", spec)
         for dependency in self.target.dependencies_for("3.14.6"):
             expected = dependency.replace(">=", " >= ").replace("<", " < ")
diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 75ec1b0..49b21cf 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -301,7 +301,13 @@ def substituted_load(candidate: Path):
 
     def test_openrazer_relay_keeps_module_preflight_outside_its_sealed_namespace(self) -> None:
         runtime = load_linux_runtime(ROOT)
-        service = relay_service(load_native_deployment(ROOT), runtime)
+        deployment = load_native_deployment(ROOT)
+        transform = load_native_transform(ROOT)
+        self.assertEqual(
+            deployment.upstream_repository, transform["upstream"]["repository"]
+        )
+        self.assertEqual(deployment.upstream_commit, transform["upstream"]["commit"])
+        service = relay_service(deployment, runtime)
         self.assertIn(f"Requires={runtime.bridge.service_unit}", service)
         self.assertIn("ProtectKernelModules=yes", service)
         self.assertNotIn("ExecStartPre=", service)
diff --git a/tests/test_repository_experience.py b/tests/test_repository_experience.py
index ed046dc..19e40a7 100644
--- a/tests/test_repository_experience.py
+++ b/tests/test_repository_experience.py
@@ -25,6 +25,10 @@
 )
 from hfxdev.local_companion import load_local_companion
 from hfxdev.model import ModelError, load_json
+from hfxdev.openrazer_native_route import (
+    load_native_deployment,
+    load_native_route_catalog,
+)
 from hfxdev.public_readiness import public_readiness
 from hfxdev.repository_docs import repository_link_issues
 
@@ -35,7 +39,11 @@ def test_readme_is_the_generated_github_front_door(self) -> None:
         self.assertEqual(
             load_json(ROOT / "generated" / "public-readiness.json"), readiness
         )
-        readme = readme_markdown(load_github_governance(ROOT), readiness)
+        deployment = load_native_deployment(ROOT)
+        routes = load_native_route_catalog(ROOT)
+        readme = readme_markdown(
+            load_github_governance(ROOT), readiness, deployment, routes
+        )
         self.assertEqual((ROOT / "README.md").read_text(encoding="utf-8"), readme)
         for section in ("publication", "evidence"):
             self.assertIn(readiness[section]["summary"], readme)
@@ -43,6 +51,25 @@ def test_readme_is_the_generated_github_front_door(self) -> None:
         self.assertIn("apps/device-qualification/README.md", readme)
         self.assertIn("Inspect an installed candidate", readme)
         self.assertIn("hardware-changing runners remain explicitly unavailable", readme)
+        self.assertIn(deployment.upstream_commit, readme)
+        self.assertIn(deployment.compatibility.verified_upstream_version, readme)
+        self.assertIn(
+            deployment.compatibility.runtime_capability.expected_value, readme
+        )
+        for route in routes["routes"]:
+            self.assertIn(route["model_name"], readme)
+            self.assertIn(f"{route['wireless_product_id']:04x}", readme)
+        self.assertIn("research-only and non-writable", readme)
+        installation = (ROOT / "docs/generated/installation.md").read_text(
+            encoding="utf-8"
+        )
+        self.assertIn(deployment.driver.source_directory, installation)
+        self.assertIn(deployment.relay.service_unit, installation)
+        self.assertIn("openrazer-driver-dkms", installation)
+        native_deployment = (
+            ROOT / "docs/generated/openrazer-native-deployment.md"
+        ).read_text(encoding="utf-8")
+        self.assertIn(deployment.upstream_commit, native_deployment)
         self.assertNotIn("github.io", readme)
         self.assertNotIn("Documentation portal", readme)
 
diff --git a/tools/hfxdev/distribution_debian.py b/tools/hfxdev/distribution_debian.py
index c6bd17f..986a67e 100644
--- a/tools/hfxdev/distribution_debian.py
+++ b/tools/hfxdev/distribution_debian.py
@@ -50,6 +50,7 @@ def _debian_control(context: NativePackageContext) -> str:
         "Priority: optional",
         f"Architecture: {context.architecture}",
         f"Maintainer: {DEBIAN_MAINTAINER}",
+        f"Homepage: {context.catalog.homepage}",
         f"Installed-Size: {_installed_size(context.package_root)}",
         f"Depends: {dependencies}",
     ]
diff --git a/tools/hfxdev/distribution_package.py b/tools/hfxdev/distribution_package.py
index 722c0ec..b24e166 100644
--- a/tools/hfxdev/distribution_package.py
+++ b/tools/hfxdev/distribution_package.py
@@ -140,6 +140,7 @@ def _arch_openrazer_policy_hook(runtime: LinuxRuntime) -> str:
             "[Trigger]",
             "Operation = Install",
             "Operation = Upgrade",
+            "Operation = Remove",
             "Type = Package",
             "Target = openrazer-daemon",
             "Target = python-openrazer",
@@ -147,7 +148,7 @@ def _arch_openrazer_policy_hook(runtime: LinuxRuntime) -> str:
             "[Action]",
             "Description = Check HyperFlux Next OpenRazer source compatibility",
             "When = PostTransaction",
-            f"Exec = {runtime.operations.activation_path} report-openrazer-runtime",
+            f"Exec = {runtime.operations.activation_path} reconcile-openrazer-runtime",
             "",
         ]
     )
@@ -230,7 +231,7 @@ def _arch_pkgbuild(
             f"pkgrel={runtime.product.package_release}",
             f"pkgdesc={_shell_word(catalog.description)}",
             f"arch={_shell_array([architecture])}",
-            "url=''",
+            f"url={_shell_word(catalog.homepage)}",
             f"license={_shell_array(list(catalog.licenses))}",
             f"depends={_shell_array(list(target.dependencies_for(python_version)))}",
             f"optdepends={_shell_array(optional)}",
diff --git a/tools/hfxdev/distribution_rpm.py b/tools/hfxdev/distribution_rpm.py
index d8abb93..8e9ecc0 100644
--- a/tools/hfxdev/distribution_rpm.py
+++ b/tools/hfxdev/distribution_rpm.py
@@ -192,6 +192,7 @@ def _rpm_spec(context: NativePackageContext) -> str:
         f"Version: {_rpm_version(context.runtime.product.version)}",
         f"Release: {context.runtime.product.package_release}",
         f"Summary: {context.catalog.description}",
+        f"URL: {context.catalog.homepage}",
         f"License: {_rpm_license(context)}",
         f"BuildArch: {context.architecture}",
         "Source0: payload.tar",
diff --git a/tools/hfxdev/distributions.py b/tools/hfxdev/distributions.py
index 078cbda..1dbdccc 100644
--- a/tools/hfxdev/distributions.py
+++ b/tools/hfxdev/distributions.py
@@ -6,6 +6,7 @@
 from pathlib import Path, PurePosixPath
 import re
 from typing import Any
+from urllib.parse import urlsplit
 
 from .linux_runtime import load_linux_runtime
 from .model import ModelError, load_json, require_unique, sha256_file
@@ -90,6 +91,7 @@ def python_discovery_for(self, python_version: str) -> str:
 class DistributionCatalog:
     source_sha256: str
     description: str
+    homepage: str
     licenses: tuple[str, ...]
     targets: dict[str, DistributionTarget]
 
@@ -236,7 +238,7 @@ def load_distribution_catalog(root: Path) -> DistributionCatalog:
     metadata = value["metadata"]
     if not isinstance(metadata, dict):
         raise ModelError("distribution metadata must be an object")
-    _exact(metadata, {"description", "licenses"}, "distribution metadata")
+    _exact(metadata, {"description", "homepage", "licenses"}, "distribution metadata")
     description = metadata["description"]
     if (
         not isinstance(description, str)
@@ -246,6 +248,22 @@ def load_distribution_catalog(root: Path) -> DistributionCatalog:
         or CONTROL_CHARACTER.search(description)
     ):
         raise ModelError("distribution description is invalid")
+    homepage = metadata["homepage"]
+    if (
+        not isinstance(homepage, str)
+        or homepage != homepage.strip()
+        or len(homepage) > 256
+        or CONTROL_CHARACTER.search(homepage)
+    ):
+        raise ModelError("distribution homepage is invalid")
+    parsed_homepage = urlsplit(homepage)
+    if (
+        parsed_homepage.scheme != "https"
+        or parsed_homepage.hostname is None
+        or parsed_homepage.username is not None
+        or parsed_homepage.password is not None
+    ):
+        raise ModelError("distribution homepage must be a credential-free HTTPS URL")
     licenses_value = metadata["licenses"]
     if not isinstance(licenses_value, list) or not 1 <= len(licenses_value) <= 8:
         raise ModelError("distribution licenses are invalid")
@@ -275,6 +293,7 @@ def load_distribution_catalog(root: Path) -> DistributionCatalog:
     return DistributionCatalog(
         source_sha256=sha256_file(path),
         description=description,
+        homepage=homepage,
         licenses=licenses,
         targets=targets,
     )
diff --git a/tools/hfxdev/generators/install.py b/tools/hfxdev/generators/install.py
index c56edb4..8bef9c8 100644
--- a/tools/hfxdev/generators/install.py
+++ b/tools/hfxdev/generators/install.py
@@ -6,6 +6,7 @@
 
 from ..install import InstallManifest
 from ..linux_runtime import LinuxRuntime
+from ..openrazer_native_route import OpenRazerNativeDeployment
 
 
 def compiled_plan(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
@@ -75,7 +76,11 @@ def compiled_plan(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
     return json.dumps(value, indent=2, sort_keys=False, ensure_ascii=True) + "\n"
 
 
-def markdown(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
+def markdown(
+    manifest: InstallManifest,
+    runtime: LinuxRuntime,
+    openrazer: OpenRazerNativeDeployment,
+) -> str:
     required = sum(1 for build in manifest.builds if build.required)
     optional = len(manifest.builds) - required
     preserved = [file for file in manifest.files if file.preserve]
@@ -139,6 +144,34 @@ def markdown(manifest: InstallManifest, runtime: LinuxRuntime) -> str:
         lines.append("No mutable configuration was declared, which is an invalid release state.")
     lines.extend(
         [
+            "",
+            "## OpenRazer Ownership And Updates",
+            "",
+            f"The package owns the source-bound patched driver at "
+            f"`{openrazer.driver.source_directory}` and provides the OpenRazer "
+            "driver dependency. Distribution packages must conflict with and replace "
+            "the ordinary `openrazer-driver-dkms` package so a system update cannot "
+            "install a second owner over the transformed source tree.",
+            "",
+            f"Official OpenRazer `{openrazer.compatibility.verified_upstream_version}` "
+            "daemon and Python-client packaging may receive distribution release-suffix "
+            "updates. Runtime readiness is checked with the transformed module capability "
+            f"`{openrazer.compatibility.runtime_capability.modinfo_field}="
+            f"{openrazer.compatibility.runtime_capability.expected_value}`, not a package "
+            "release string. A different upstream source version fails closed and keeps "
+            f"`{openrazer.relay.service_unit}` stopped until HyperFlux is rebased and "
+            "reverified.",
+            "",
+            "## Verification And Rollback",
+            "",
+            "Run `hyperfluxctl doctor` after package hooks complete. A compatible update "
+            "may resume a previously active bridge automatically; an in-use kernel-module "
+            "change requires the activation action reported by Doctor.",
+            "",
+            "Rollback uses a complete prior source-bound package through the package "
+            "manager. Do not copy files into `/usr/src`, overwrite DKMS trees, or mix an "
+            "upstream OpenRazer driver package with the HyperFlux-owned transform. Existing "
+            "configuration remains preserved across supported package transitions.",
             "",
             "Arch, Debian, and RPM packaging must consume the same deterministic staged root "
             "instead of maintaining independent file lists.",
diff --git a/tools/hfxdev/generators/openrazer_native.py b/tools/hfxdev/generators/openrazer_native.py
index 331878b..77954d9 100644
--- a/tools/hfxdev/generators/openrazer_native.py
+++ b/tools/hfxdev/generators/openrazer_native.py
@@ -11,6 +11,7 @@
 
 def rust_constants(deployment: OpenRazerNativeDeployment) -> str:
     driver = deployment.driver
+    relay = deployment.relay
     compatibility = deployment.compatibility
     capability = compatibility.runtime_capability
     modules = ", ".join(json.dumps(module) for module in driver.modules)
@@ -40,6 +41,8 @@ def rust_constants(deployment: OpenRazerNativeDeployment) -> str:
             f"{json.dumps(compatibility.daemon_executable_path)};",
             "pub const OPENRAZER_NATIVE_VERSION_ARGUMENT: &str = "
             f"{json.dumps(compatibility.version_argument)};",
+            "pub const OPENRAZER_NATIVE_RELAY_SERVICE_UNIT: &str = "
+            f"{json.dumps(relay.service_unit)};",
             "",
         ]
     )
@@ -123,6 +126,8 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
     access = deployment.access
     compatibility = deployment.compatibility
     capability = compatibility.runtime_capability
+    upstream_url = deployment.upstream_repository.removesuffix(".git")
+    upstream_commit_url = f"{upstream_url}/commit/{deployment.upstream_commit}"
     return "\n".join(
         [
             "# OpenRazer Native Route Deployment",
@@ -150,6 +155,8 @@ def markdown(deployment: OpenRazerNativeDeployment, runtime: LinuxRuntime) -> st
             "",
             "| Field | Value |",
             "| --- | --- |",
+            f"| Official source | [{compatibility.verified_upstream_version}]({upstream_commit_url}) |",
+            f"| Source commit | `{deployment.upstream_commit}` |",
             f"| DKMS identity | `{driver.dkms_name}` `{driver.dkms_version}` |",
             f"| Source tree | `{driver.source_directory}` |",
             f"| Modules | {', '.join(f'`{module}`' for module in driver.modules)} |",
diff --git a/tools/hfxdev/generators/readme.py b/tools/hfxdev/generators/readme.py
index e0b82f5..ef25223 100644
--- a/tools/hfxdev/generators/readme.py
+++ b/tools/hfxdev/generators/readme.py
@@ -6,6 +6,7 @@
 from typing import Any
 
 from ..governance import GitHubGovernance
+from ..openrazer_native_route import OpenRazerNativeDeployment
 
 
 def _badge(label: str, value: str, color: str) -> str:
@@ -35,8 +36,24 @@ def license_badge() -> str:
 def markdown(
     governance: GitHubGovernance,
     readiness: dict[str, Any],
+    openrazer: OpenRazerNativeDeployment,
+    native_routes: dict[str, Any],
 ) -> str:
     repository_url = f"https://github.com/{governance.owner}/{governance.repository}"
+    upstream_url = openrazer.upstream_repository.removesuffix(".git")
+    upstream_commit_url = f"{upstream_url}/commit/{openrazer.upstream_commit}"
+    route_rows = "\n".join(
+        "| {model} | `{vendor:04x}:{wireless:04x}` | {direct} |".format(
+            model=route["model_name"],
+            vendor=route["vendor_id"],
+            wireless=route["wireless_product_id"],
+            direct=", ".join(
+                f"`{route['vendor_id']:04x}:{product_id:04x}`"
+                for product_id in route["direct_data_product_ids"]
+            ),
+        )
+        for route in native_routes["routes"]
+    )
     software = readiness["software"]
     hardware = readiness["hardware"]
     evidence = readiness["evidence"]
@@ -84,6 +101,27 @@ def markdown(
 preserves ordinary HID input and transports generation-bound exchanges without
 interpreting device semantics.
 
+## OpenRazer Route
+
+HyperFlux applies a narrow transport patch to official
+[OpenRazer {openrazer.compatibility.verified_upstream_version}]({upstream_commit_url}).
+The upstream daemon, Python client, device classes, ordinary USB tables, and
+direct-device behavior remain OpenRazer-owned. The patched DKMS modules accept
+only trusted, feature-only HyperFlux UHID routes and advertise
+`{openrazer.compatibility.runtime_capability.modinfo_field}={openrazer.compatibility.runtime_capability.expected_value}`.
+
+| Qualified receiver-backed controller | Native route | Direct USB precedence |
+| --- | --- | --- |
+{route_rows}
+
+Distribution release suffixes do not affect compatibility. A newer OpenRazer
+source line requires a reviewed rebase and fresh verification; until then,
+`{openrazer.relay.service_unit}` remains stopped. See the
+[deployment contract](docs/generated/openrazer-native-deployment.md),
+[installation contract](docs/generated/installation.md), and
+[hardware boundary](docs/generated/supported-hardware.md). Other catalog
+devices remain research-only and non-writable.
+
 ## Current Readiness
 
 <!-- Generated from generated/public-readiness.json. -->
diff --git a/tools/hfxdev/openrazer_native_route.py b/tools/hfxdev/openrazer_native_route.py
index 62e9034..cd87136 100644
--- a/tools/hfxdev/openrazer_native_route.py
+++ b/tools/hfxdev/openrazer_native_route.py
@@ -151,6 +151,8 @@ class OpenRazerCompatibilityDeployment:
 @dataclass(frozen=True)
 class OpenRazerNativeDeployment:
     source_sha256: str
+    upstream_repository: str
+    upstream_commit: str
     relay: OpenRazerRelayDeployment
     driver: OpenRazerDriverDeployment
     access: OpenRazerAccessDeployment
@@ -466,6 +468,13 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
     upstream = upstream_index(root).get("openrazer")
     if upstream is None or not str(upstream["version"]).startswith(version):
         raise ModelError("OpenRazer native DKMS version differs from the pinned upstream")
+    transform = load_native_transform(root)
+    transform_upstream = transform["upstream"]
+    if (
+        transform_upstream["id"] != "openrazer"
+        or transform_upstream["commit"] != upstream["commit"]
+    ):
+        raise ModelError("OpenRazer native deployment differs from its source transform")
     source_directory = _deployment_path(
         driver["source_directory"],
         "OpenRazer native DKMS source directory",
@@ -559,6 +568,8 @@ def load_native_deployment(root: Path) -> OpenRazerNativeDeployment:
         raise ModelError("OpenRazer native capability modules are invalid")
     return OpenRazerNativeDeployment(
         source_sha256=sha256_file(path),
+        upstream_repository=transform_upstream["repository"],
+        upstream_commit=transform_upstream["commit"],
         relay=OpenRazerRelayDeployment(
             executable_path=executable,
             service_unit=service,
diff --git a/tools/hfxdev/render.py b/tools/hfxdev/render.py
index e01dbde..49e73ba 100644
--- a/tools/hfxdev/render.py
+++ b/tools/hfxdev/render.py
@@ -141,7 +141,10 @@
 from .licensing import load_licensing_policy
 from .local_companion import load_local_companion
 from .openrazer import load_imported_metadata
-from .openrazer_native_route import load_native_deployment
+from .openrazer_native_route import (
+    load_native_deployment,
+    load_native_route_catalog,
+)
 from .performance import load_performance_budgets
 from .profiles import compiled_catalog, composition_fixtures
 from .protocol import load_protocol_registry
@@ -253,6 +256,7 @@ def rendered_files(root: Path) -> dict[Path, str]:
     openrazer_metadata = load_imported_metadata(root)
     openrazer_compatibility = load_openrazer_compatibility_contract(root)
     openrazer_native = load_native_deployment(root)
+    openrazer_native_routes = load_native_route_catalog(root)
     test_catalog = load_test_catalog(root)
     linux_runtime = load_linux_runtime(root)
     distribution_catalog = load_distribution_catalog(root)
@@ -272,7 +276,12 @@ def rendered_files(root: Path) -> dict[Path, str]:
     local_companion = load_local_companion(root)
     licensing_policy = load_licensing_policy(root)
     files = {
-        root / "README.md": readme_markdown(github_governance, readiness),
+        root / "README.md": readme_markdown(
+            github_governance,
+            readiness,
+            openrazer_native,
+            openrazer_native_routes,
+        ),
         root / "generated" / "public-readiness.json": json.dumps(
             readiness, indent=2, sort_keys=True
         )
@@ -525,7 +534,9 @@ def rendered_files(root: Path) -> dict[Path, str]:
         projected_files=(*files, install_plan_path, installation_document_path),
     )
     files[install_plan_path] = compiled_install_plan(install_manifest, linux_runtime)
-    files[installation_document_path] = install_markdown(install_manifest, linux_runtime)
+    files[installation_document_path] = install_markdown(
+        install_manifest, linux_runtime, openrazer_native
+    )
     return files
 
 
diff --git a/tools/hfxdev/verify.py b/tools/hfxdev/verify.py
index 07eae74..018d481 100644
--- a/tools/hfxdev/verify.py
+++ b/tools/hfxdev/verify.py
@@ -1621,14 +1621,25 @@ def _run_package_contracts(root: Path, node: TestNode) -> None:
         staged_payload_size,
     )
 
-    arch_package = build_distribution_package(
+    first_arch = build_distribution_package(
         root,
         manifest_path,
         "arch",
-        workspace / "arch-package",
-    ).package
+        workspace / "arch-package-a",
+    )
+    second_arch = build_distribution_package(
+        root,
+        manifest_path,
+        "arch",
+        workspace / "arch-package-b",
+    )
+    if (
+        first_arch.package.read_bytes() != second_arch.package.read_bytes()
+        or first_arch.manifest.read_bytes() != second_arch.manifest.read_bytes()
+    ):
+        raise ModelError("independent Arch package builds are not byte-for-byte reproducible")
     verify_arch_openrazer_update_policy(
-        arch_package,
+        first_arch.package,
         package_name=runtime.product.package_name,
         workspace=workspace / "openrazer-update-policy",
         timeout_seconds=node.timeout_seconds,

From 1e50dad6a47077ac261e8d3e46ac06cdb586ccd8 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Mon, 27 Jul 2026 01:39:02 +0400
Subject: [PATCH 66/67] Fix exact upstream cache isolation

---
 .github/workflows/full-verification.yml | 11 ++++++---
 .github/workflows/verification.yml      | 11 ++++++---
 tests/test_governance.py                | 11 +++++++++
 tools/hfxdev/generators/governance.py   | 33 ++++++++++++++++---------
 4 files changed, 49 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/full-verification.yml b/.github/workflows/full-verification.yml
index 21c2497..2e58b21 100644
--- a/.github/workflows/full-verification.yml
+++ b/.github/workflows/full-verification.yml
@@ -24,16 +24,21 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha || github.sha }}
         fetch-depth: 0
         persist-credentials: false
-    - name: Restore verified software caches
+    - name: Restore exact upstream sources
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           .hfx/upstreams
+        key: hfx-upstreams-${{ runner.os }}-${{ hashFiles('integrations/catalog.json') }}
+    - name: Restore verified build caches
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
           .hfx/cargo
           target
-        key: hfx-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json', 'integrations/catalog.json') }}
+        key: hfx-build-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json') }}
         restore-keys: |
-          hfx-${{ runner.os }}-
+          hfx-build-${{ runner.os }}-
     - name: Set up Buildx
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
     - name: Build the pinned development environment
diff --git a/.github/workflows/verification.yml b/.github/workflows/verification.yml
index f04cac9..d7cbaf5 100644
--- a/.github/workflows/verification.yml
+++ b/.github/workflows/verification.yml
@@ -25,16 +25,21 @@ jobs:
         ref: ${{ github.event.pull_request.head.sha || github.sha }}
         fetch-depth: 0
         persist-credentials: false
-    - name: Restore verified software caches
+    - name: Restore exact upstream sources
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           .hfx/upstreams
+        key: hfx-upstreams-${{ runner.os }}-${{ hashFiles('integrations/catalog.json') }}
+    - name: Restore verified build caches
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: |
           .hfx/cargo
           target
-        key: hfx-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json', 'integrations/catalog.json') }}
+        key: hfx-build-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json') }}
         restore-keys: |
-          hfx-${{ runner.os }}-
+          hfx-build-${{ runner.os }}-
     - name: Set up Buildx
       uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
     - name: Build the pinned development environment
diff --git a/tests/test_governance.py b/tests/test_governance.py
index e96850a..d71ce4d 100644
--- a/tests/test_governance.py
+++ b/tests/test_governance.py
@@ -177,6 +177,17 @@ def test_software_workflows_use_bounded_container_runner_and_no_release_trigger(
         self.assertTrue(self.governance.strict_required_status_checks)
         self.assertEqual(fast["permissions"], {"contents": "read"})
 
+        for workflow in (fast, full):
+            steps = workflow["jobs"][next(iter(workflow["jobs"]))]["steps"]
+            by_name = {step["name"]: step for step in steps}
+            upstream = by_name["Restore exact upstream sources"]["with"]
+            build = by_name["Restore verified build caches"]["with"]
+            self.assertEqual(upstream["path"], ".hfx/upstreams\n")
+            self.assertNotIn("restore-keys", upstream)
+            self.assertIn("integrations/catalog.json", upstream["key"])
+            self.assertNotIn(".hfx/upstreams", build["path"])
+            self.assertEqual(build["restore-keys"], "hfx-build-${{ runner.os }}-\n")
+
     def test_required_checks_are_exact_generated_job_contexts(self) -> None:
         workflows = (
             codeql_workflow(self.governance),
diff --git a/tools/hfxdev/generators/governance.py b/tools/hfxdev/generators/governance.py
index c629632..30d7855 100644
--- a/tools/hfxdev/generators/governance.py
+++ b/tools/hfxdev/generators/governance.py
@@ -57,16 +57,27 @@ def _checkout(governance: GitHubGovernance) -> dict[str, Any]:
     }
 
 
-def _cache(governance: GitHubGovernance) -> dict[str, Any]:
-    return {
-        "name": "Restore verified software caches",
-        "uses": governance.actions_by_id["cache"].uses,
-        "with": {
-            "path": f"{UPSTREAM_CACHE_PATH}\n{CARGO_CACHE_PATH}\ntarget\n",
-            "key": "hfx-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json', 'integrations/catalog.json') }}",
-            "restore-keys": "hfx-${{ runner.os }}-\n",
+def _caches(governance: GitHubGovernance) -> list[dict[str, Any]]:
+    action = governance.actions_by_id["cache"].uses
+    return [
+        {
+            "name": "Restore exact upstream sources",
+            "uses": action,
+            "with": {
+                "path": f"{UPSTREAM_CACHE_PATH}\n",
+                "key": "hfx-upstreams-${{ runner.os }}-${{ hashFiles('integrations/catalog.json') }}",
+            },
         },
-    }
+        {
+            "name": "Restore verified build caches",
+            "uses": action,
+            "with": {
+                "path": f"{CARGO_CACHE_PATH}\ntarget\n",
+                "key": "hfx-build-${{ runner.os }}-${{ hashFiles('Cargo.lock', 'toolchains/development-environment.json') }}",
+                "restore-keys": "hfx-build-${{ runner.os }}-\n",
+            },
+        },
+    ]
 
 
 def _build_environment(governance: GitHubGovernance) -> list[dict[str, Any]]:
@@ -124,7 +135,7 @@ def _verification_summary(output: str) -> dict[str, Any]:
 
 
 def verification_workflow(governance: GitHubGovernance) -> str:
-    steps = [_checkout(governance), _cache(governance), *_build_environment(governance)]
+    steps = [_checkout(governance), *_caches(governance), *_build_environment(governance)]
     steps.extend(
         [
             {
@@ -173,7 +184,7 @@ def verification_workflow(governance: GitHubGovernance) -> str:
 
 
 def full_verification_workflow(governance: GitHubGovernance) -> str:
-    steps = [_checkout(governance), _cache(governance), *_build_environment(governance)]
+    steps = [_checkout(governance), *_caches(governance), *_build_environment(governance)]
     steps.extend(
         [
             {

From d64776a7de4fa86fd612fc3d10beee1ec7c23d09 Mon Sep 17 00:00:00 2001
From: offalexjackson777-stack
 <offalexjackson777-stack@users.noreply.github.com>
Date: Mon, 27 Jul 2026 01:59:57 +0400
Subject: [PATCH 67/67] Run OpenRazer probe harness from build root

---
 tests/test_integrations.py   | 43 ++++++++++++++++++++++++++++++++++++
 tools/hfxdev/native_probe.py | 10 +++++++--
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/tests/test_integrations.py b/tests/test_integrations.py
index 49b21cf..d8f4eec 100644
--- a/tests/test_integrations.py
+++ b/tests/test_integrations.py
@@ -253,6 +253,49 @@ def test_openrazer_native_probe_catalog_matches_exact_checkout_when_available(se
             load_native_probe_catalog(ROOT),
         )
 
+    def test_openrazer_probe_harness_uses_the_executable_build_root(self) -> None:
+        with TemporaryDirectory(
+            prefix="test-openrazer-probe-",
+            dir=ROOT / "build",
+        ) as directory:
+            temporary_root = Path(directory)
+            root = temporary_root / "repository"
+            source_root = temporary_root / "source"
+            (source_root / "driver").mkdir(parents=True)
+            (source_root / "driver" / "razercommon.h").write_text(
+                "", encoding="utf-8"
+            )
+            (source_root / "driver" / "razerchromacommon.c").write_text(
+                "", encoding="utf-8"
+            )
+            calls: list[dict[str, object]] = []
+
+            def recording_temporary_directory(*args, **kwargs):
+                calls.append(dict(kwargs))
+                return TemporaryDirectory(*args, **kwargs)
+
+            with patch.object(
+                native_probe,
+                "TemporaryDirectory",
+                side_effect=recording_temporary_directory,
+            ):
+                reports = native_probe._compile_report_expressions(
+                    root,
+                    source_root,
+                    ["get_razer_report(0x00, 0x80, 0x00)"],
+                )
+
+            self.assertEqual(len(reports), 1)
+            self.assertEqual(
+                calls,
+                [
+                    {
+                        "prefix": "hyperflux-openrazer-probe-",
+                        "dir": root / "build",
+                    }
+                ],
+            )
+
     def test_openrazer_native_route_catalog_is_fully_authority_bound(self) -> None:
         routes = load_native_route_catalog(ROOT)
         metadata = load_imported_metadata(ROOT)
diff --git a/tools/hfxdev/native_probe.py b/tools/hfxdev/native_probe.py
index 9717d36..24d4225 100644
--- a/tools/hfxdev/native_probe.py
+++ b/tools/hfxdev/native_probe.py
@@ -330,6 +330,7 @@ def _expression_function(expression: str) -> str:
 
 
 def _compile_report_expressions(
+    root: Path,
     source_root: Path,
     expressions: list[str],
 ) -> dict[str, bytes]:
@@ -422,7 +423,12 @@ def _compile_report_expressions(
 }}
 """
     compiler = os.environ.get("CC", "cc")
-    with TemporaryDirectory(prefix="hyperflux-openrazer-probe-") as directory:
+    scratch_root = root / "build"
+    scratch_root.mkdir(mode=0o755, parents=True, exist_ok=True)
+    with TemporaryDirectory(
+        prefix="hyperflux-openrazer-probe-",
+        dir=scratch_root,
+    ) as directory:
         executable = Path(directory) / "probe"
         try:
             compiled = subprocess.run(
@@ -491,7 +497,7 @@ def transformed_native_probe_catalog(root: Path, source_root: Path) -> dict[str,
 
     bindings = {value["method"]: value for value in policy["bindings"]}
     expressions = sorted({value["request_expression"] for value in policy["bindings"]})
-    reports = _compile_report_expressions(source_root, expressions)
+    reports = _compile_report_expressions(root, source_root, expressions)
     source_cache: dict[str, str] = {}
     reader_cache: dict[str, dict[str, str]] = {}
     devices: list[dict[str, Any]] = []