Bridge serves an EMPTY aggregator after restart — Apple resets rooms on every reboot

[simons-plugins]

The defect

After any bridge-node restart the node comes online with zero child endpoints and stays that way until the plugin connects and attaches. Measured on jarvis after a full reboot:

10:59:30.177  indigo-matter-bridge is online        <- aggregator EMPTY
10:59:53.198  Client attached, reconciling 4 endpoint(s)
10:59:53.773  Endpoint 287885105  added as number 3
...

23 seconds advertising as a bridge with no accessories. Apple reconnects inside that window, reads an empty PartsList, and concludes every accessory has gone. When they reappear it treats them as new arrivals: assigned to the bridge's own room, with metadata the user can no longer edit ("cannot change settings").

Why this is the root cause

It is the only theory consistent with every observation:

Observation	Explained by
Rooms broke after the E5 plugin/node upgrade	node restart → empty window
A fresh unpair + re-pair fixed them	accessories present from the moment of pairing
Rooms broke again after a full reboot	node restart → empty window
A newly exported device was roomable	added while the node was up; never vanished
…but broke once un-exported and re-exported	Apple saw that one endpoint vanish and return

Three earlier theories were tested and disproved (no-Matter-traffic; un-export identity reuse; configurationVersion reset — matter.js does persist and restore it). This one is measured, not inferred.

Impact

Every restart of the bridge node — reboot, plugin upgrade, agent restart, crash recovery — costs the user their room assignments for all exported accessories, and they cannot be set again without a full unpair/re-pair cycle. That is the single most user-visible defect in the export feature.

Fix

The node must never serve an empty aggregator. It should reconstruct its last-known endpoint set at startup, independently of the plugin, with reachable: false until the plugin attaches and confirms real state. Apple then sees a bridge whose accessories were briefly unreachable — a state it handles routinely — rather than a bridge that lost everything.

Implementation notes:

• endpoint-map.json already persists identity (uniqueId → endpoint number) and already survives factoryReset. It needs the role and label too so an endpoint can be rebuilt without the plugin.
• Restore before server.start() so the node is never online-and-empty.
• The plugin's attach remains authoritative: it reconciles the restored set, which is what removes anything genuinely un-exported while the plugin was away.
• Watch the interaction with §3.1's mass-removal guard — a restored set the plugin then legitimately empties must still be refused without intent: replace_all.
• reachable: false on restore also makes XAC8 honest: accessories show as unavailable until the plugin is actually driving them.

Related

• No way to clear a drift report on a healthy node — Rebuild is gated on the refusal state #140 (no way to clear a drift report) — same restart path.
• Apple Home: room edits fail on accessories from a previous pairing (SOLVED — document the remedy) #139 documents the unpair/re-pair remedy, which this would make unnecessary.
• docs/INSTALL.md's troubleshooting row for room edits should point here once fixed.

[simons-plugins]

CONFIRMED FIXED — live on jarvis, 2026-08-06

Rooms held across three separate restarts: a plugin restart, an Install/update the Matter export bridge (which restarts the agent), and an independent launchctl kickstart of the bridge node.

The log shows the mechanism doing exactly what the fix intends:

11:34:38.103  Endpoint 287885105 (onOffLight) added as number 3
11:34:38.202  Endpoint 459564566 (dimmableLight) added as number 2
11:34:38.298  Endpoint 1736047509 (onOffLight) added as number 4
11:34:38.356  Endpoint 1664427354 (onOffLight) added as number 6
11:34:38.356  Restored 4 of 4 endpoint(s) from the endpoint map before going
              online, all unreachable until the plugin attaches
11:34:38.431  Matter node online                     <- accessories already present
11:34:41.876  Client attached, reconciling 4 endpoint(s)
11:34:42.118  Reconciled: 0 created, 4 updated, 0 recreated, 0 removed

Before the fix the node went online with an empty aggregator and populated only when the plugin attached — 3.4s here, 23s after a full reboot. Apple read the empty PartsList, concluded every accessory was gone, and re-homed them as new arrivals on their return.

The v1→v2 map migration also worked in place on a live paired bridge: role and label were recorded during the first attach on 0.6.0, and the following restart was the first able to restore.

Closing once PR #142 merges (hardening batch in flight for the ghost-accessory and halt findings from review).