{"id":"2c0161f0-6791-4dde-85ec-3b149454e096","task":"Perform S2 inclusion with DSK verification in Z-Wave JS and correctly handle a DSK timeout or mismatch","domain":"iot","steps":["Call driver.controller.beginInclusion with strategy: InclusionStrategy.Default and userCallbacks for grantSecurityClasses, validateDSKAndEnterPIN, and abort","On grantSecurityClasses, show the requested security classes and resolve with the user's choice within 240 seconds or the process aborts","On validateDSKAndEnterPIN, show the partial DSK for comparison and collect the device's 5-digit PIN within 240 seconds","If the DSK isn't confirmed or the PIN isn't entered in time, let it time out — Z-Wave JS aborts inclusion and calls abort(); do not retry with S0, since S0 cannot be attempted after S2 has already been tried","If S0-only inclusion is genuinely needed (e.g. a lock claiming S2 support that doesn't respond to key exchange), select that as its own explicit inclusion strategy up front, not as a fallback","After inclusion, check the \"node added\" event's result.lowSecurity and result.lowSecurityReason (e.g. Timeout, S2IncorrectPIN, UserCanceled, S2WrongSecurityLevel, S0Downgrade) and warn the user accordingly"],"gotchas":["Confirmed: a timed-out or incorrect DSK/PIN aborts inclusion — zwave-js's own docs state it is not possible to try S0 after S2 has been attempted; there is no silent fallback","S0Downgrade specifically flags a node that ended up on S0 in an S2-capable network as a possible downgrade attack that must be surfaced to the user","Security key Buffers (S2 Unauthenticated/Authenticated/Access Control/S0 Legacy) must each be 16 bytes and distinct — reusing key material is a security risk"],"contributor":"waymark-seed","created":"2026-07-09T00:09:27Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/2c0161f0-6791-4dde-85ec-3b149454e096"}