`[2026-09-27]` Zigbee2MQTT on esh-docker-vm (Prime go-ahead; ha-dev request)

(Moved out of the in-flight section at the 2026-10-06 snapshot. Canonical: stacks/zigbee2mqtt/README.md.)

LIVE since 1240: Z2M 2.14.1 (digest-pinned) on http://10.0.50.45:8099 (auth token), radio SLZB-MR1U chip 0 tcp://10.0.90.10:6638 (ember), channel 25, PAN 0xCFF4. State and the network key are in /opt/docker/data/zigbee2mqtt (root 0700, restic via /opt/docker, never in git). Vault: esh-docker-vm/zigbee2mqtt-{network-key,frontend-token,mqtt-password}. Broker user zigbee2mqtt added to mosquitto (passwd backup .bak-20260927-z2m).
ha-dev deleted the ZHA entry; pairing the Aqara T1 is theirs. ⚠ The "bridge in HA" acceptance first FAILED because HA had had no MQTT since 2026-09-25 06:13. Cause: the esh-docker-vm macvlan shim had no host route to HA (two equal /24s, ens18 wins). Fixed at 1249 with a /32 via the shim (if-up.d hook, playbooks/esh-docker-vm-macvlan-shim-route.yaml), and HA reconnected. My first report called HA "connected" from a client count that included my own probe; $SYS counts are not identities.
⚠ The first credential-mint attempt was blocked by the auto-mode classifier on a peer-relayed approval. It went ahead only on Prime's own go-ahead in this session. Treat that as correct. → stacks/zigbee2mqtt/README.md

[2026-09-27] Zigbee2MQTT on esh-docker-vm (Prime go-ahead; ha-dev request)