diff --git a/.cargo/audit.toml b/.cargo/audit.toml
index 08346a0e..c6c46b76 100644
--- a/.cargo/audit.toml
+++ b/.cargo/audit.toml
@@ -28,5 +28,23 @@ ignore = [
     "RUSTSEC-2026-0098", # rustls-webpki: URI name constraints
     "RUSTSEC-2026-0099", # rustls-webpki: name constraints vs wildcard names
     "RUSTSEC-2026-0104", # rustls-webpki: panic in CRL parsing
-    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (transitive via rumqttc)
+    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (transitive via rumqttc and zenoh-link-commons)
+
+    # lz4_flex 0.10.0, a required dependency of zenoh-transport 1.10.1 (the
+    # latest zenoh). zenoh pins `lz4_flex = "0.10.0"`; the fixed versions are
+    # 0.11.6+ and 0.12.1+, out of semver range, so no in-range upgrade or
+    # `[patch]` exists.
+    #
+    # Not reachable through aimdb-zenoh-connector. The advisory is about
+    # decompression; zenoh-transport decompresses only in
+    # `WBatch::decompress`, behind `#[cfg(feature = "transport_compression")]`.
+    # The connector depends on zenoh without default features and never enables
+    # compression; `make test-embedded` asserts that. Its other lz4_flex calls
+    # only size buffers (`get_maximum_output_size`).
+    #
+    # Tracked upstream: eclipse-zenoh/zenoh#2589, bump in #2499. Drop this when
+    # a zenoh release takes it.
+    "RUSTSEC-2026-0041", # lz4_flex: uninitialized memory in decompression
+    "RUSTSEC-2024-0436", # paste unmaintained (via zenoh-keyexpr/token-cell)
+    "RUSTSEC-2024-0449", # unsafe-libyaml unmaintained (via serde_yaml from zenoh-config; the connector builds Config in code, never from YAML)
 ]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a4349083..541574d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -162,6 +162,27 @@ jobs:
         cargo +nightly miri test -p aimdb-embassy-adapter \
           --no-default-features --features "alloc,embassy-sync,embassy-time"
 
+  # ros2:// against real ROS 2 distributions: rmw_zenohd and the ros2 CLI
+  ros2-interop:
+    name: ROS 2 interop (${{ matrix.distro }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        distro: [jazzy, lyrical]
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        submodules: recursive
+
+    - name: Install Rust
+      uses: actions-rust-lang/setup-rust-toolchain@v2
+      with:
+        rustflags: ""
+
+    - name: Interop with ROS 2 ${{ matrix.distro }}
+      run: make ros2-interop DISTRO=${{ matrix.distro }}
+
   # Comprehensive validation using Makefile
   comprehensive-check:
     name: Comprehensive Development Check
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index ecedb550..ae3848eb 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -55,3 +55,7 @@ jobs:
     
     - name: Run cargo-deny
       run: cargo deny check
+
+    # `cargo deny check` sees default features only, which leave `zenoh` out.
+    - name: Run cargo-deny on the Zenoh connector's std graph
+      run: cargo deny --features "std,transport-tls,transport-quic,transport-ws,auth-usrpwd" --manifest-path aimdb-zenoh-connector/Cargo.toml check
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 04bdce37..8ee531d3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,9 +11,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > - [aimdb-codegen/CHANGELOG.md](aimdb-codegen/CHANGELOG.md)
 > - [aimdb-data-contracts/CHANGELOG.md](aimdb-data-contracts/CHANGELOG.md)
 > - [aimdb-derive/CHANGELOG.md](aimdb-derive/CHANGELOG.md)
+> - [aimdb-cdr/CHANGELOG.md](aimdb-cdr/CHANGELOG.md)
 > - [aimdb-tokio-adapter/CHANGELOG.md](aimdb-tokio-adapter/CHANGELOG.md)
 > - [aimdb-embassy-adapter/CHANGELOG.md](aimdb-embassy-adapter/CHANGELOG.md)
 > - [aimdb-mqtt-connector/CHANGELOG.md](aimdb-mqtt-connector/CHANGELOG.md)
+> - [aimdb-zenoh-connector/CHANGELOG.md](aimdb-zenoh-connector/CHANGELOG.md)
 > - [aimdb-knx-connector/CHANGELOG.md](aimdb-knx-connector/CHANGELOG.md)
 > - [aimdb-websocket-connector/CHANGELOG.md](aimdb-websocket-connector/CHANGELOG.md)
 > - [aimdb-uds-connector/CHANGELOG.md](aimdb-uds-connector/CHANGELOG.md)
@@ -29,6 +31,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added — Zenoh connector and ROS 2 topics
+
+- **AimDB records as ROS 2 topics, with no ROS install on the AimDB side.**
+  `Ros2Connector` speaks rmw_zenoh's conventions (data keys, liveliness
+  tokens, attachments, CDR), so `ros2 node list`, `ros2 topic info -v`,
+  `ros2 topic echo` and `ros2 topic pub` see AimDB as a ROS node. A struct
+  becomes a ROS message with `#[derive(RosMessage)]`.
+  ([aimdb-zenoh-connector](aimdb-zenoh-connector/CHANGELOG.md),
+  [aimdb-data-contracts](aimdb-data-contracts/CHANGELOG.md),
+  [aimdb-derive](aimdb-derive/CHANGELOG.md))
+- **`zenoh://` links** with Zenoh key expressions, captures and keys, and a
+  gateway that bridges devices on plain Zenoh to ROS 2 on one router
+  connection. ([aimdb-zenoh-connector](aimdb-zenoh-connector/CHANGELOG.md))
+- **`aimdb-cdr`**: `no_std` serde for OMG CDR, the ROS 2 wire format.
+  ([aimdb-cdr](aimdb-cdr/CHANGELOG.md))
+- **Connectors learn each link's record type and wire format**:
+  `RouteInfo::type_id`, `InboundDispatch::routes()` and the reserved
+  `aimdb.wire_format` link key. ([aimdb-core](aimdb-core/CHANGELOG.md))
+
 ### Added — wildcard inbound links
 
 - **One inbound link can feed many topics into one record.**
diff --git a/Cargo.lock b/Cargo.lock
index b775a6e2..d5c7e307 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 4
 
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
 [[package]]
 name = "aead"
 version = "0.5.2"
@@ -44,6 +50,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
 dependencies = [
  "cfg-if",
+ "getrandom 0.3.4",
  "once_cell",
  "version_check",
  "zerocopy",
@@ -79,6 +86,14 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "aimdb-cdr"
+version = "0.1.0"
+dependencies = [
+ "hiroz-cdr",
+ "serde",
+]
+
 [[package]]
 name = "aimdb-cli"
 version = "0.7.0"
@@ -128,7 +143,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "serde",
- "syn 2.0.108",
+ "syn 2.0.119",
  "toml 0.8.23",
 ]
 
@@ -149,7 +164,7 @@ dependencies = [
  "portable-atomic",
  "serde",
  "serde_json",
- "spin",
+ "spin 0.9.9",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
@@ -159,6 +174,7 @@ dependencies = [
 name = "aimdb-data-contracts"
 version = "0.2.0"
 dependencies = [
+ "aimdb-cdr",
  "aimdb-core",
  "aimdb-derive",
  "futures",
@@ -175,7 +191,7 @@ version = "0.2.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -276,7 +292,7 @@ dependencies = [
  "futures",
  "heapless 0.8.0",
  "rand 0.8.6",
- "rcgen",
+ "rcgen 0.13.2",
  "rumqttc",
  "rustls-native-certs",
  "serde",
@@ -426,6 +442,21 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "aimdb-zenoh-connector"
+version = "0.1.0"
+dependencies = [
+ "aimdb-core",
+ "aimdb-data-contracts",
+ "aimdb-tokio-adapter",
+ "serde",
+ "tokio",
+ "trybuild",
+ "twox-hash 2.1.5",
+ "zenoh",
+ "zenoh-keyexpr",
+]
+
 [[package]]
 name = "aligned"
 version = "0.4.3"
@@ -435,6 +466,12 @@ dependencies = [
  "as-slice",
 ]
 
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
@@ -506,6 +543,21 @@ version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "array-init"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
+
 [[package]]
 name = "as-slice"
 version = "0.2.1"
@@ -515,6 +567,45 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror 2.0.17",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "async-channel"
 version = "2.5.0"
@@ -546,7 +637,7 @@ checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -656,7 +747,7 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5deb64efa5bd81e31fcd1938615a6d98c82eafcbcd787162b6f63b91d6bac5b3"
 dependencies = [
- "rustc_version",
+ "rustc_version 0.2.3",
 ]
 
 [[package]]
@@ -677,6 +768,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -692,6 +789,15 @@ dependencies = [
  "const-init",
 ]
 
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bit_field"
 version = "0.10.3"
@@ -715,6 +821,9 @@ name = "bitflags"
 version = "2.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "block-buffer"
@@ -734,6 +843,15 @@ dependencies = [
  "aligned",
 ]
 
+[[package]]
+name = "bs58"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
+dependencies = [
+ "tinyvec",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.19.0"
@@ -746,6 +864,26 @@ version = "0.6.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
 
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+dependencies = [
+ "bytemuck_derive",
+]
+
+[[package]]
+name = "bytemuck_derive"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a1f896587b6f2c069c73d2f0913e2d590c3990285cd2f0b6aa02b786b4c679c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -808,6 +946,7 @@ dependencies = [
  "iana-time-zone",
  "js-sys",
  "num-traits",
+ "serde",
  "wasm-bindgen",
  "windows-link 0.2.1",
 ]
@@ -880,7 +1019,7 @@ dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -932,6 +1071,16 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "combine"
+version = "4.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfc320937d09e6de266b31b9afb480f197d7a861be86be7cb2ea7e5d1bfffc5e"
+dependencies = [
+ "bytes",
+ "memchr",
+]
+
 [[package]]
 name = "concurrent-queue"
 version = "2.5.0"
@@ -965,6 +1114,27 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
+[[package]]
+name = "const_format"
+version = "0.2.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4481a617ad9a412be3b97c5d403fef8ed023103368908b9c50af598ff467cc1e"
+dependencies = [
+ "const_format_proc_macros",
+ "konst",
+]
+
+[[package]]
+name = "const_format_proc_macros"
+version = "0.2.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d57c2eccfb16dbac1f4e61e206105db5820c9d26c3c472bc17c774259ef7744"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
 [[package]]
 name = "cordyceps"
 version = "0.3.4"
@@ -1031,7 +1201,7 @@ checksum = "e37549a379a9e0e6e576fd208ee60394ccb8be963889eebba3ffe0980364f472"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1052,6 +1222,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "crc32fast"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01a7799fd6b852db0e61728dde9a204c423b44d689dbd432522543614b490e78"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "criterion"
 version = "0.5.1"
@@ -1064,7 +1243,7 @@ dependencies = [
  "clap",
  "criterion-plot",
  "is-terminal",
- "itertools",
+ "itertools 0.10.5",
  "num-traits",
  "once_cell",
  "oorandom",
@@ -1083,7 +1262,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"
 dependencies = [
  "cast",
- "itertools",
+ "itertools 0.10.5",
 ]
 
 [[package]]
@@ -1092,6 +1271,56 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
 
+[[package]]
+name = "crossbeam"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e71406cd8807725f7ac2f999a4cdd32e98f829fdf65f528343cebf945e41df1e"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-epoch",
+ "crossbeam-queue",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc74980687109a3b14c72fd458107bf0baa1da1a1a805e178d15501ba9b86d9d"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03e8bd762f7479489c70ed6c768ddca99d7296857de437a68dcb2a94365b3fae"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-utils"
 version = "0.8.21"
@@ -1141,8 +1370,18 @@ version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc7f46116c46ff9ab3eb1597a45688b6715c6e628b5c133e288e709a29bcb4ee"
 dependencies = [
- "darling_core",
- "darling_macro",
+ "darling_core 0.20.11",
+ "darling_macro 0.20.11",
+]
+
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core 0.23.0",
+ "darling_macro 0.23.0",
 ]
 
 [[package]]
@@ -1156,7 +1395,20 @@ dependencies = [
  "proc-macro2",
  "quote",
  "strsim",
- "syn 2.0.108",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1165,9 +1417,20 @@ version = "0.20.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc34b93ccb385b40dc71c6fceac4b2ad23662c7eeb248cf10d529b7e055b6ead"
 dependencies = [
- "darling_core",
+ "darling_core 0.20.11",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core 0.23.0",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1218,7 +1481,7 @@ dependencies = [
  "defmt-parser",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1262,6 +1525,20 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
 [[package]]
 name = "der_derive"
 version = "0.8.0"
@@ -1270,7 +1547,7 @@ checksum = "59600e2c2d636fde9b65e99cc6445ac770c63d3628195ff39932b8d6d7409903"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1278,6 +1555,9 @@ name = "deranged"
 version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "digest"
@@ -1291,6 +1571,27 @@ dependencies = [
  "subtle",
 ]
 
+[[package]]
+name = "dirs"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e8aa94d75141228480295a7d0e7feb620b1a5ad9f12bc40be62411e38cce4e"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.5"
@@ -1299,7 +1600,7 @@ checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1317,6 +1618,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 
+[[package]]
+name = "dyn-clone"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
+
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
@@ -1416,10 +1723,10 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d11a246f53de5f97a387f40ac24726817cd0b6f833e7603baac784f29d6ff276"
 dependencies = [
- "darling",
+ "darling 0.20.11",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1899,6 +2206,7 @@ version = "5.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a23add41df1562121a9393cb065eab5146a1242410f23a644851e90cfd669d2"
 dependencies = [
+ "parking",
  "pin-project-lite",
 ]
 
@@ -1924,6 +2232,18 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
+[[package]]
+name = "fastbloom"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef975e30683b2d965054bb0a836f8973857c4ebf6acf274fe46617cd285060d8"
+dependencies = [
+ "foldhash 0.2.0",
+ "libm",
+ "portable-atomic",
+ "siphasher",
+]
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
@@ -1952,6 +2272,17 @@ version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
 
+[[package]]
+name = "flate2"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
+ "zlib-rs",
+]
+
 [[package]]
 name = "flume"
 version = "0.11.1"
@@ -1960,7 +2291,8 @@ checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
 dependencies = [
  "futures-core",
  "futures-sink",
- "spin",
+ "nanorand",
+ "spin 0.9.9",
 ]
 
 [[package]]
@@ -1975,6 +2307,12 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -2071,7 +2409,7 @@ checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -2135,8 +2473,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "335ff9f135e4384c8150d6f27c6daed433577f86b4750418338c01a1a2528592"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2158,11 +2498,13 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.0",
  "wasip2",
  "wasip3",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2175,6 +2517,26 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "git-version"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad568aa3db0fcbc81f2f116137f263d7304f512a1209b35b85150d3ef88ad19"
+dependencies = [
+ "git-version-macro",
+]
+
+[[package]]
+name = "git-version-macro"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53010ccb100b96a67bc32c0175f0ed1426b31b655d562898e57325f81c023ac0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "glob"
 version = "0.3.3"
@@ -2204,7 +2566,7 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http",
- "indexmap",
+ "indexmap 2.12.0",
  "slab",
  "tokio",
  "tokio-util",
@@ -2231,6 +2593,12 @@ dependencies = [
  "byteorder",
 ]
 
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
 [[package]]
 name = "hashbrown"
 version = "0.14.5"
@@ -2238,6 +2606,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 dependencies = [
  "ahash",
+ "allocator-api2",
 ]
 
 [[package]]
@@ -2246,7 +2615,7 @@ version = "0.15.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
 dependencies = [
- "foldhash",
+ "foldhash 0.1.5",
 ]
 
 [[package]]
@@ -2254,6 +2623,11 @@ name = "hashbrown"
 version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "hashlink"
@@ -2353,13 +2727,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c"
 
 [[package]]
-name = "hkdf"
-version = "0.12.4"
+name = "hex"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
-dependencies = [
- "hmac",
-]
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hiroz-cdr"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69398421bf7e64822904d8a4744186af65c56fce141756965c86ad27565c2e43"
+dependencies = [
+ "bytemuck",
+ "byteorder",
+ "serde",
+ "thiserror 2.0.17",
+ "zenoh-buffers",
+]
+
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
 
 [[package]]
 name = "hmac"
@@ -2370,6 +2763,15 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "home"
+version = "0.5.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc627f471c528ff0c4a49e1d5e60450c8f6461dd6d10ba9dcd3a61d3dff7728d"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -2415,6 +2817,12 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "humantime"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
+
 [[package]]
 name = "hyper"
 version = "1.8.1"
@@ -2486,7 +2894,7 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.1",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -2632,6 +3040,17 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.12.0"
@@ -2669,6 +3088,15 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
+[[package]]
+name = "ipnetwork"
+version = "0.20.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf466541e9d546596ee94f9f69590f89473455f88372423e0008fc1a7daf100e"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "iri-string"
 version = "0.7.12"
@@ -2705,12 +3133,124 @@ dependencies = [
  "either",
 ]
 
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
+[[package]]
+name = "jiff"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2b005715dcbeb0089a3c0dab99f2ff1cc3b2525323552703d648585d342a383"
+dependencies = [
+ "defmt 1.1.1",
+ "jiff-core",
+ "jiff-static",
+ "jiff-tzdb-platform",
+ "log",
+ "portable-atomic",
+ "portable-atomic-util",
+ "serde_core",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jiff-core"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e52fe76043ccecc9005d2305ebaadf7d7fc0cc89ca6baa10a94d6bc68c7128c"
+dependencies = [
+ "defmt 1.1.1",
+ "log",
+]
+
+[[package]]
+name = "jiff-static"
+version = "0.2.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cc9817253cf7c7ee4684451bd327e88d6f3658014e54a29198625590650695c"
+dependencies = [
+ "jiff-core",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jiff-tzdb"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa8377070c6bae868759445e5a77f66d84f0b72f3a054bfb00e6d038b8282da7"
+
+[[package]]
+name = "jiff-tzdb-platform"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "875a5a69ac2bab1a891711cf5eccbec1ce0341ea805560dcd90b7a2e925132e8"
+dependencies = [
+ "jiff-tzdb",
+]
+
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.17",
+ "walkdir",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version 0.4.1",
+ "simd_cesu8",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.35"
@@ -2732,6 +3272,35 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "json5"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b0db21af676c1ce64250b5f40f3ce2cf27e4e47cb91ed91eb6fe9350b430c1"
+dependencies = [
+ "pest",
+ "pest_derive",
+ "serde",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "keyed-set"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89d255a6b6ecd77bb93ce91de984d7039bff7503f500eb4851a1269732f22baf"
+dependencies = [
+ "hashbrown 0.14.5",
+]
+
 [[package]]
 name = "knx-connector-demo-common"
 version = "0.1.0"
@@ -2742,13 +3311,28 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "konst"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "128133ed7824fcd73d6e7b17957c5eb7bacb885649bd8c69708b2331a10bcefb"
+dependencies = [
+ "konst_macro_rules",
+]
+
+[[package]]
+name = "konst_macro_rules"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 dependencies = [
- "spin",
+ "spin 0.9.9",
 ]
 
 [[package]]
@@ -2763,12 +3347,31 @@ version = "0.2.177"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2874a2af47a2325c2001a6e6fad9b16a53b802102b528163885171cf92b15976"
 
+[[package]]
+name = "libloading"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+dependencies = [
+ "cfg-if",
+ "windows-link 0.2.1",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.30.1"
@@ -2832,6 +3435,21 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "lru-slab"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4050469837a6ff301cd14c1f8f24f88549e6d548f24f64e2148eb0f72cebc51f"
+
+[[package]]
+name = "lz4_flex"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b8c72594ac26bfd34f2d99dfced2edfaddfe8a476e3ff2ca0eb293d925c4f83"
+dependencies = [
+ "twox-hash 1.6.3",
+]
+
 [[package]]
 name = "mach2"
 version = "0.4.3"
@@ -2890,6 +3508,22 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b63fbc4a50860e98e7b2aa7804ded1db5cbc3aff9193adaff57a6931bf7c4b4c"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "mio"
 version = "1.1.0"
@@ -2926,6 +3560,15 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "nanorand"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a51313c5820b0b02bd422f4b44776fbf47961755c74ce64afc73bfad10226c3"
+dependencies = [
+ "getrandom 0.2.16",
+]
+
 [[package]]
 name = "native-tls"
 version = "0.2.14"
@@ -2981,6 +3624,31 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "no-std-net"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43794a0ace135be66a25d3ae77d41b91615fb68ae937f904090203e81f755b65"
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nonempty-collections"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e216d0e8cf9d54fa66e5780f6e1d5dc96d1c1b3c25aeba3b6758548bcbbd8b9d"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2990,6 +3658,16 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
@@ -3041,6 +3719,25 @@ dependencies = [
  "libm",
 ]
 
+[[package]]
+name = "num_cpus"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91df4bbde75afed763b708b7eee1e8e7651e02d97f6d5dd763e89367e957b23b"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.21.4"
@@ -3087,7 +3784,7 @@ checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3114,6 +3811,12 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
 [[package]]
 name = "p256"
 version = "0.13.2"
@@ -3159,6 +3862,12 @@ dependencies = [
  "unicode-width 0.2.2",
 ]
 
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -3182,6 +3891,12 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "pem"
 version = "3.0.6"
@@ -3192,6 +3907,16 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "pem"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
+dependencies = [
+ "base64 0.23.1",
+ "serde_core",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -3199,26 +3924,123 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
-name = "pin-project-lite"
-version = "0.2.16"
+name = "pest"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+checksum = "45d3aca230fad2e6f6317ca0a72724338c4960cb97168a85cdee66df4a9a21a8"
+dependencies = [
+ "memchr",
+ "ucd-trie",
+]
 
 [[package]]
-name = "pin-utils"
-version = "0.1.0"
+name = "pest_derive"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "284b60557f2c4a2e72ad3f2d34d42685a2fa4a6a61d0d2a10c0ae2a5e916c2cf"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
 
 [[package]]
-name = "pkcs1"
-version = "0.7.5"
+name = "pest_generator"
+version = "2.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+checksum = "1d9d1f08a115309ee99268cf85e5228e0e56aa9caf8841ec12866b6be07c3109"
 dependencies = [
- "der 0.7.10",
- "pkcs8",
- "spki",
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed93ba1a9ffcca32130a5188701c81c0c49cf00d4b7c5007d5148951d743adcb"
+dependencies = [
+ "pest",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8701b58ea97060d5e5b155d383a69952a60943f0e6dfe30b04c287beb0b27455"
+dependencies = [
+ "fixedbitset",
+ "hashbrown 0.15.5",
+ "indexmap 2.12.0",
+ "serde",
+]
+
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der 0.7.10",
+ "pkcs8",
+ "spki",
 ]
 
 [[package]]
@@ -3237,6 +4059,38 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
+[[package]]
+name = "pnet_base"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffc190d4067df16af3aba49b3b74c469e611cad6314676eaf1157f31aa0fb2f7"
+dependencies = [
+ "no-std-net",
+]
+
+[[package]]
+name = "pnet_datalink"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e79e70ec0be163102a332e1d2d5586d362ad76b01cec86f830241f2b6452a7b7"
+dependencies = [
+ "ipnetwork",
+ "libc",
+ "pnet_base",
+ "pnet_sys",
+ "winapi",
+]
+
+[[package]]
+name = "pnet_sys"
+version = "0.35.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d4643d3d4db6b08741050c2f3afa9a892c4244c085a72fcda93c9c2c9a00f4b"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "polyval"
 version = "0.6.2"
@@ -3251,13 +4105,22 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.11.1"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f84267b20a16ea918e43c6a88433c2d54fa145c92a811b5b047ccbe153674483"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
 dependencies = [
  "critical-section",
 ]
 
+[[package]]
+name = "portable-atomic-util"
+version = "0.2.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10ab3eb7f3becc3a1cbc4f2c6f20267996cfc1a6467a873763411b136a122715"
+dependencies = [
+ "portable-atomic",
+]
+
 [[package]]
 name = "postcard"
 version = "1.1.3"
@@ -3301,7 +4164,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
 dependencies = [
  "proc-macro2",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3313,6 +4176,15 @@ dependencies = [
  "elliptic-curve",
 ]
 
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.6+spec-1.1.0",
+]
+
 [[package]]
 name = "proc-macro-error-attr2"
 version = "2.0.0"
@@ -3332,7 +4204,7 @@ dependencies = [
  "proc-macro-error-attr2",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3344,6 +4216,64 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4051e23e9185c255a7e33ef59cdbca87a22d359052eecd22fc6b901fb37d9d11"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2 0.6.1",
+ "thiserror 2.0.17",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e750cca55fe4f0439a15d0bb529da9651e79993e8e72c61a899a36d462befbe"
+dependencies = [
+ "bytes",
+ "fastbloom",
+ "getrandom 0.4.2",
+ "lru-slab",
+ "rand 0.10.1",
+ "rand_pcg",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "rustls-platform-verifier",
+ "slab",
+ "thiserror 2.0.17",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af66907df18639dcf4db56ca65490cabc4b27a97dbadd96f2926cca73298f016"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2 0.6.1",
+ "tracing",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.47"
@@ -3441,17 +4371,40 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"
 
+[[package]]
+name = "rand_pcg"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "caa0f4137e1c0a72f4c651489402276c8e8e1cf081f3b0ba156d2cbeef09e86a"
+dependencies = [
+ "rand_core 0.10.0",
+]
+
 [[package]]
 name = "rcgen"
 version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
- "pem",
+ "pem 3.0.6",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "yasna 0.5.2",
+]
+
+[[package]]
+name = "rcgen"
+version = "0.14.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8"
+dependencies = [
+ "pem 4.0.0",
  "ring",
  "rustls-pki-types",
  "time",
- "yasna",
+ "x509-parser",
+ "yasna 0.6.0",
 ]
 
 [[package]]
@@ -3472,6 +4425,36 @@ dependencies = [
  "bitflags 2.13.1",
 ]
 
+[[package]]
+name = "redox_users"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
+dependencies = [
+ "libredox",
+ "thiserror 2.0.17",
+]
+
+[[package]]
+name = "ref-cast"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e440fb4e4b4147295338efb76001ab9e4efc0e5839df2c47fc5ac2381d365c3"
+dependencies = [
+ "ref-cast-impl",
+]
+
+[[package]]
+name = "ref-cast-impl"
+version = "1.0.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92ecd8964f8453721699a1ed72037b0db49ce2f5a5138486ee89bed6f67cdf3a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "regex"
 version = "1.13.1"
@@ -3582,6 +4565,16 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "ringbuffer-spsc"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3e7aa0a681b232e7cd7f856a53b10603df88ca74b79a8d8088845185492e35"
+dependencies = [
+ "array-init",
+ "crossbeam",
+]
+
 [[package]]
 name = "rlsf"
 version = "0.2.1"
@@ -3594,6 +4587,20 @@ dependencies = [
  "svgbobdoc",
 ]
 
+[[package]]
+name = "ron"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81116b9531d61eabc41aeb228e4b6b2435bcca3233b98cf3b3077d4e6e9debb3"
+dependencies = [
+ "bitflags 2.13.1",
+ "once_cell",
+ "serde",
+ "serde_derive",
+ "typeid",
+ "unicode-ident",
+]
+
 [[package]]
 name = "rsa"
 version = "0.9.10"
@@ -3652,6 +4659,12 @@ dependencies = [
  "smallvec",
 ]
 
+[[package]]
+name = "rustc-hash"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
+
 [[package]]
 name = "rustc_version"
 version = "0.2.3"
@@ -3661,6 +4674,24 @@ dependencies = [
  "semver 0.9.0",
 ]
 
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver 1.0.28",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.2"
@@ -3683,6 +4714,7 @@ dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
+ "ring",
  "rustls-pki-types",
  "rustls-webpki 0.103.15",
  "subtle",
@@ -3716,9 +4748,37 @@ version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94182ad936a0c91c324cd46c6511b9510ed16af436d7b5bab34beab0afd55f7a"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
+[[package]]
+name = "rustls-platform-verifier"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1167586491e2b18b8bfbb293e8180ec17c201c4f076d7cb3070ca964e7598f98"
+dependencies = [
+ "core-foundation 0.10.1",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki 0.103.15",
+ "security-framework 3.7.0",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.102.8"
@@ -3772,6 +4832,44 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "schemars"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd191f9397d57d581cddd31014772520aa448f65ef991055d7f61582c65165f"
+dependencies = [
+ "dyn-clone",
+ "ref-cast",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "687274d293b6cdc6e73e0fee520bf2049650090d7164f87672d212a3c530cf4a"
+dependencies = [
+ "dyn-clone",
+ "either",
+ "ref-cast",
+ "schemars_derive",
+ "serde",
+ "serde_json",
+]
+
+[[package]]
+name = "schemars_derive"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d98c67716b46af2f0b8cf752abc930f6f9aecfbf671ecfb531db8a31dbe4e2ba"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde_derive_internals",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "scoped-tls"
 version = "1.0.1"
@@ -3803,6 +4901,16 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "secrecy"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9bd1c54ea06cfd2f6b63219704de0b9b4f72dcc2b8fdef820be6cd799780e91e"
+dependencies = [
+ "serde",
+ "zeroize",
+]
+
 [[package]]
 name = "security-framework"
 version = "2.11.1"
@@ -3898,11 +5006,22 @@ checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
-name = "serde_json"
+name = "serde_derive_internals"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f852137cce035d6a4df67ccce505ff6b3e9fd3a10e3e52b24dc71e650bb1a9bd"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_json"
 version = "1.0.145"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
@@ -3955,13 +5074,46 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serde_with"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee78f1fbe43ac4a0e47aadb3dbd357b69eb0d3793e948624cd03dd2750ab1c0a"
+dependencies = [
+ "base64 0.22.1",
+ "bs58",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.12.0",
+ "jiff",
+ "schemars 0.9.0",
+ "schemars 1.2.2",
+ "serde_core",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8705578779c2b6bd90d84d66eb2e206b708b1a4d7b9f17641b293545bf1c7e46"
+dependencies = [
+ "darling 0.23.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "serde_yaml"
 version = "0.9.34+deprecated"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.0",
  "itoa",
  "ryu",
  "serde",
@@ -4008,6 +5160,22 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha2-const-stable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f179d4e11094a893b82fff208f74d448a7512f99f5a0acbd5c679b705f83ed9"
+
+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest",
+ "keccak",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4017,6 +5185,15 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "shellexpand"
+version = "3.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32824fab5e16e6c4d86dc1ba84489390419a39f97699852b66480bb87d297ed8"
+dependencies = [
+ "dirs",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -4042,6 +5219,34 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "simd_cesu8"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version 0.4.1",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
+[[package]]
+name = "siphasher"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33f4fe9184a62d842c9ef383018f3306d8ba224fd9d836f56d7288308847c256"
+
 [[package]]
 name = "slab"
 version = "0.4.11"
@@ -4068,6 +5273,16 @@ dependencies = [
  "managed",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.5.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "socket2"
 version = "0.6.1"
@@ -4087,6 +5302,12 @@ dependencies = [
  "lock_api",
 ]
 
+[[package]]
+name = "spin"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
+
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -4097,6 +5318,40 @@ dependencies = [
  "der 0.7.10",
 ]
 
+[[package]]
+name = "stabby"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d53d2428934c46277fafd2d41e39357595aa1e47954c75db2b14ed90632f3cc"
+dependencies = [
+ "rustversion",
+ "stabby-abi",
+]
+
+[[package]]
+name = "stabby-abi"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f375eae680bb54203ee5e47d4cd2ae7b79c0a79ed90919279f38f500ad53f190"
+dependencies = [
+ "rustc_version 0.4.1",
+ "rustversion",
+ "sha2-const-stable",
+ "stabby-macros",
+]
+
+[[package]]
+name = "stabby-macros"
+version = "72.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea664671a576c5f7e32fee291ac123d82af5e92b0689beb3555347c00c76eef1"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -4185,9 +5440,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.108"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da58917d35242480a05c2897064da0a80589a2a0476c9a3f2fdc83b53502e917"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4235,7 +5490,7 @@ checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4280,7 +5535,7 @@ dependencies = [
  "proc-macro-error2",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4346,7 +5601,7 @@ checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4357,7 +5612,7 @@ checksum = "3ff15c8ecd7de3849db632e14d18d2571fa09dfc5ed93479bc4485c7a517c913"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4380,6 +5635,7 @@ dependencies = [
  "powerfmt",
  "serde_core",
  "time-core",
+ "time-macros",
 ]
 
 [[package]]
@@ -4388,6 +5644,16 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
+[[package]]
+name = "time-macros"
+version = "0.2.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
 [[package]]
 name = "tinystr"
 version = "0.8.2"
@@ -4408,6 +5674,36 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "tinyvec"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd3ca314f692efd6c868f8408f53fe444634a845f96c028b97d35f6a1f79f0ee"
+
+[[package]]
+name = "tls-listener"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1461056cc1ef47003f7ee16e4cef3741068d4c7f6b627bfce49b7c00c120a530"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "thiserror 2.0.17",
+ "tokio",
+ "tokio-rustls",
+]
+
+[[package]]
+name = "token-cell"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb48920ae769b58126c8c93269805011c793201f95fde28b479b81a9a531bbde"
+dependencies = [
+ "paste",
+ "portable-atomic",
+ "rustversion",
+]
+
 [[package]]
 name = "tokio"
 version = "1.48.0"
@@ -4420,7 +5716,7 @@ dependencies = [
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "socket2 0.6.1",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -4449,7 +5745,7 @@ checksum = "af407857209536a95c8e56f8231ef2c2e2aff839b22e07a1ffcbc617e9db9fa5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4526,6 +5822,18 @@ dependencies = [
  "tokio-stream",
 ]
 
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.24.0",
+]
+
 [[package]]
 name = "tokio-tungstenite"
 version = "0.26.2"
@@ -4559,6 +5867,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
+ "futures-util",
  "pin-project-lite",
  "tokio",
 ]
@@ -4572,7 +5881,7 @@ dependencies = [
  "serde",
  "serde_spanned 0.6.9",
  "toml_datetime 0.6.11",
- "toml_edit",
+ "toml_edit 0.22.27",
 ]
 
 [[package]]
@@ -4581,7 +5890,7 @@ version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8195ca05e4eb728f4ba94f3e3291661320af739c4e43779cbdfae82ab239fcc"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.0",
  "serde_core",
  "serde_spanned 1.1.1",
  "toml_datetime 1.1.1+spec-1.1.0",
@@ -4614,7 +5923,7 @@ version = "0.22.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
 dependencies = [
- "indexmap",
+ "indexmap 2.12.0",
  "serde",
  "serde_spanned 0.6.9",
  "toml_datetime 0.6.11",
@@ -4622,6 +5931,18 @@ dependencies = [
  "winnow 0.7.14",
 ]
 
+[[package]]
+name = "toml_edit"
+version = "0.25.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0db3bae107c9522f86d361697dee1d7386a2ddcf659d5aea5159819a21a3c4a7"
+dependencies = [
+ "indexmap 2.12.0",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.3",
+]
+
 [[package]]
 name = "toml_parser"
 version = "1.1.2+spec-1.1.0"
@@ -4709,7 +6030,7 @@ checksum = "81383ab64e72a7a8b8e13130c49e3dab29def6d0c7d76a03087b3cf71c5c6903"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4733,6 +6054,16 @@ dependencies = [
  "tracing-core",
 ]
 
+[[package]]
+name = "tracing-serde"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "704b1aeb7be0d0a84fc9828cae51dab5970fee5088f83d1dd7ee6f6246fc6ff1"
+dependencies = [
+ "serde",
+ "tracing-core",
+]
+
 [[package]]
 name = "tracing-subscriber"
 version = "0.3.20"
@@ -4743,12 +6074,15 @@ dependencies = [
  "nu-ansi-term",
  "once_cell",
  "regex-automata",
+ "serde",
+ "serde_json",
  "sharded-slab",
  "smallvec",
  "thread_local",
  "tracing",
  "tracing-core",
  "tracing-log",
+ "tracing-serde",
 ]
 
 [[package]]
@@ -4769,7 +6103,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04659ddb06c87d233c566112c1c9c5b9e98256d9af50ec3bc9c8327f873a7568"
 dependencies = [
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -4804,6 +6138,24 @@ dependencies = [
  "toml 1.1.0+spec-1.1.0",
 ]
 
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.8.6",
+ "sha1",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
 [[package]]
 name = "tungstenite"
 version = "0.26.2"
@@ -4838,12 +6190,54 @@ dependencies = [
  "utf-8",
 ]
 
+[[package]]
+name = "twox-hash"
+version = "1.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97fee6b57c6a41524a810daee9286c02d7752c4253064d0b05472833a438f675"
+dependencies = [
+ "cfg-if",
+ "static_assertions",
+]
+
+[[package]]
+name = "twox-hash"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "86a801b3cea342a06d468c8710662aa29e5e05e4f5c0d62f00bbb7f2ad7941c2"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
 [[package]]
 name = "typenum"
 version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb"
 
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "uhlc"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b62a645e3e4e6c85b7abe49b086aa3204119431f42b6123b0070419fb6e9d24e"
+dependencies = [
+ "humantime",
+ "lazy_static",
+ "log",
+ "rand 0.8.6",
+ "serde",
+ "spin 0.10.1",
+]
+
 [[package]]
 name = "unescaper"
 version = "0.1.8"
@@ -4899,6 +6293,17 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "unzip-n"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b5bb2756c16fb66f80cfbf5fb0e0c09a7001e739f453c9ec241b9c8b1556fda"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "url"
 version = "2.5.7"
@@ -4940,6 +6345,30 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "validated_struct"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "869a93e8a7286e339e1128630051d82babbcd75d585975af07b9f3327220e60e"
+dependencies = [
+ "json5",
+ "serde",
+ "serde_json",
+ "validated_struct_macros",
+]
+
+[[package]]
+name = "validated_struct_macros"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c44ce98e7227a04eeb4cf9c784109a5c9710e54849ceb4f09f8597247897f1e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "unzip-n",
+]
+
 [[package]]
 name = "valuable"
 version = "0.1.1"
@@ -4958,6 +6387,12 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
+[[package]]
+name = "vec_map"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -5064,7 +6499,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
@@ -5107,7 +6542,7 @@ checksum = "94eb68555b95bcea5e8cf4abe280b529049479fa995bfc23734af96a6aedc120"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5133,7 +6568,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
 dependencies = [
  "anyhow",
- "indexmap",
+ "indexmap 2.12.0",
  "wasm-encoder",
  "wasmparser",
 ]
@@ -5146,7 +6581,7 @@ checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
 dependencies = [
  "bitflags 2.13.1",
  "hashbrown 0.15.5",
- "indexmap",
+ "indexmap 2.12.0",
  "semver 1.0.28",
 ]
 
@@ -5251,6 +6686,34 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -5336,7 +6799,7 @@ checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5347,7 +6810,7 @@ checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5598,6 +7061,9 @@ name = "winnow"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0592e1c9d151f854e6fd382574c3a0855250e1d9b2f99d9281c6e6391af352f1"
+dependencies = [
+ "memchr",
+]
 
 [[package]]
 name = "wit-bindgen"
@@ -5633,9 +7099,9 @@ checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
 dependencies = [
  "anyhow",
  "heck",
- "indexmap",
+ "indexmap 2.12.0",
  "prettyplease",
- "syn 2.0.108",
+ "syn 2.0.119",
  "wasm-metadata",
  "wit-bindgen-core",
  "wit-component",
@@ -5651,7 +7117,7 @@ dependencies = [
  "prettyplease",
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
  "wit-bindgen-core",
  "wit-bindgen-rust",
 ]
@@ -5664,7 +7130,7 @@ checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
 dependencies = [
  "anyhow",
  "bitflags 2.13.1",
- "indexmap",
+ "indexmap 2.12.0",
  "log",
  "serde",
  "serde_derive",
@@ -5683,7 +7149,7 @@ checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
 dependencies = [
  "anyhow",
  "id-arena",
- "indexmap",
+ "indexmap 2.12.0",
  "log",
  "semver 1.0.28",
  "serde",
@@ -5699,6 +7165,24 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror 2.0.17",
+ "time",
+]
+
 [[package]]
 name = "yasna"
 version = "0.5.2"
@@ -5709,8 +7193,18 @@ dependencies = [
 ]
 
 [[package]]
-name = "yoke"
-version = "0.8.1"
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec",
+ "time",
+]
+
+[[package]]
+name = "yoke"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
 dependencies = [
@@ -5727,10 +7221,499 @@ checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
  "synstructure",
 ]
 
+[[package]]
+name = "zenoh"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "453ba5d28a1197653aae4bb024fd74a9d5c7051d5a19a77f3a43d83f40c22584"
+dependencies = [
+ "ahash",
+ "arc-swap",
+ "async-trait",
+ "bytes",
+ "const_format",
+ "flate2",
+ "flume",
+ "futures",
+ "git-version",
+ "itertools 0.14.0",
+ "json5",
+ "lazy_static",
+ "nonempty-collections",
+ "once_cell",
+ "petgraph",
+ "phf",
+ "rand 0.8.6",
+ "rustc_version 0.4.1",
+ "serde",
+ "serde_json",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "uhlc",
+ "vec_map",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-collections",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-keyexpr",
+ "zenoh-link",
+ "zenoh-link-commons",
+ "zenoh-macros",
+ "zenoh-plugin-trait",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-sync",
+ "zenoh-task",
+ "zenoh-transport",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-buffers"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "555a8169c9888fc5571f1b38d2843a63db786621e153abad1b075c40b20e83b4"
+dependencies = [
+ "zenoh-collections",
+]
+
+[[package]]
+name = "zenoh-codec"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc959f727893eab9b66ec051c8f4a2d6f66b4ee70bf23f2ed244aa754705e854"
+dependencies = [
+ "rand 0.8.6",
+ "tracing",
+ "uhlc",
+ "zenoh-buffers",
+ "zenoh-protocol",
+]
+
+[[package]]
+name = "zenoh-collections"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c05abd8dcfd2239a8dfb5b79bd4ed85094c6bb6d6b991d3529bff364cc48e29"
+dependencies = [
+ "ahash",
+]
+
+[[package]]
+name = "zenoh-config"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59799d556b4fac79886cb0a9c90f3bc48d0894816b99c8a90a3509b1809a02dd"
+dependencies = [
+ "json5",
+ "nonempty-collections",
+ "num_cpus",
+ "secrecy",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "serde_yaml",
+ "tracing",
+ "uhlc",
+ "validated_struct",
+ "zenoh-core",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-core"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "975073c51353c1c33e81a98370bf3560863540913e5f30091923f5a328fc46d4"
+dependencies = [
+ "lazy_static",
+ "tokio",
+ "zenoh-result",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-crypto"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e281a36cfd351ba9232a24899d946a782d0ff3ac0c3d759f87f3e7cbe09a4553"
+dependencies = [
+ "aes",
+ "hmac",
+ "rand 0.8.6",
+ "rand_chacha 0.3.1",
+ "sha3",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-keyexpr"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02c6fcb7f18846b4e9b097c61ed7c656ec8d7858ab54a12d5f5025fe1514caae"
+dependencies = [
+ "getrandom 0.2.16",
+ "hashbrown 0.16.0",
+ "keyed-set",
+ "rand 0.8.6",
+ "schemars 1.2.2",
+ "serde",
+ "token-cell",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c55c4fbc923328f0b62b1b492723ff53b757a36421f70218e652f0aa899cde6c"
+dependencies = [
+ "zenoh-config",
+ "zenoh-link-commons",
+ "zenoh-link-quic",
+ "zenoh-link-tcp",
+ "zenoh-link-tls",
+ "zenoh-link-udp",
+ "zenoh-link-ws",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-commons"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d52520b4c22d05173c8621e3cbe18d838a17d74477891ed9c59a7aeedaa325d"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "bytes",
+ "flume",
+ "futures",
+ "quinn",
+ "quinn-proto",
+ "rcgen 0.14.10",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.15",
+ "secrecy",
+ "serde",
+ "socket2 0.5.10",
+ "time",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "webpki-roots",
+ "x509-parser",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-link-quic"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9fecc8832bb943631f75d7c4e4839a414d7bebbe80c0f695f14b2cd8c84759"
+dependencies = [
+ "async-trait",
+ "rustls-webpki 0.103.15",
+ "time",
+ "tracing",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-link-quic_datagram",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-quic_datagram"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1af3abf41c719c82ca356864b5ddeeb7c77cb29fe777776b40b31eb4d19de288"
+dependencies = [
+ "async-trait",
+ "rustls-webpki 0.103.15",
+ "time",
+ "tokio-util",
+ "tracing",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-tcp"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d4702d55fe9f17cbd1d3b601901f8ba0a693a7ad1ce685a1ea4c60f775552b7"
+dependencies = [
+ "async-trait",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-link-tls"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cce65fd71b4631821a85058542e28faac0151af6c53cd61f2dfafc7e16c4d6c4"
+dependencies = [
+ "async-trait",
+ "base64 0.22.1",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
+ "rustls-webpki 0.103.15",
+ "secrecy",
+ "socket2 0.5.10",
+ "time",
+ "tls-listener",
+ "tokio",
+ "tokio-rustls",
+ "tokio-util",
+ "tracing",
+ "webpki-roots",
+ "x509-parser",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-link-udp"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b140e7b65715fe8b29b706b2b9fc3009fc6181346931c8926d290113fe38df4b"
+dependencies = [
+ "async-trait",
+ "libc",
+ "socket2 0.5.10",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "windows-sys 0.61.2",
+ "zenoh-buffers",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-link-quic_datagram",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-sync",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-link-ws"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e317201b8e0da26395e21c68dfe45197eca8ffddd32a3ba5a15f8ef24514069"
+dependencies = [
+ "async-trait",
+ "futures-util",
+ "tokio",
+ "tokio-tungstenite 0.24.0",
+ "tokio-util",
+ "tracing",
+ "url",
+ "zenoh-core",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-macros"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f483b343fd79b6c1bd7d79f130b5c6c208e7fef243a4d7966a6bf9fdecbd70f8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "zenoh-keyexpr",
+]
+
+[[package]]
+name = "zenoh-plugin-trait"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d57f491f63afa7413d68ee68e4de2bc9ce361c4ac89a76d5a0a0e3ca0624e21"
+dependencies = [
+ "git-version",
+ "libloading",
+ "serde",
+ "stabby",
+ "tracing",
+ "zenoh-config",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-result",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-protocol"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4492192986df044627f33c8eeb8aa237fb4d3bbd2d8cc68bc7eee16748c2fb61"
+dependencies = [
+ "const_format",
+ "rand 0.8.6",
+ "serde",
+ "uhlc",
+ "zenoh-buffers",
+ "zenoh-keyexpr",
+ "zenoh-macros",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-result"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d6d0ca24186d9cfbf14f2d08b8b0a09afac690fe5cd68899d8f896f9247a3dd"
+dependencies = [
+ "anyhow",
+]
+
+[[package]]
+name = "zenoh-runtime"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e8ea6ed9fb3300d02bc303b3202a21a758aa5d7a1e7dcc38610428910af9f9"
+dependencies = [
+ "lazy_static",
+ "ron",
+ "serde",
+ "tokio",
+ "tracing",
+ "zenoh-macros",
+ "zenoh-result",
+]
+
+[[package]]
+name = "zenoh-sync"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d57ed2156b61df6e877b03fb13dd72227d3d286a7fa689120109bad289ddf12b"
+dependencies = [
+ "arc-swap",
+ "event-listener",
+ "futures",
+ "tokio",
+ "zenoh-buffers",
+ "zenoh-collections",
+ "zenoh-core",
+]
+
+[[package]]
+name = "zenoh-task"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "887115c0f81c72ff8c9b99e6fccd9e1c3829d83e16b8b063174786b9fba08810"
+dependencies = [
+ "futures",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-core",
+ "zenoh-runtime",
+]
+
+[[package]]
+name = "zenoh-transport"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72bae2e0aca56ac6431bd6c37c6ac3fcc9367446cbb356bd44137cc01d1493ee"
+dependencies = [
+ "async-trait",
+ "crossbeam-utils",
+ "flume",
+ "futures",
+ "lazy_static",
+ "lz4_flex",
+ "rand 0.8.6",
+ "ringbuffer-spsc",
+ "serde",
+ "sha3",
+ "tokio",
+ "tokio-util",
+ "tracing",
+ "zenoh-buffers",
+ "zenoh-codec",
+ "zenoh-config",
+ "zenoh-core",
+ "zenoh-crypto",
+ "zenoh-link",
+ "zenoh-link-commons",
+ "zenoh-protocol",
+ "zenoh-result",
+ "zenoh-runtime",
+ "zenoh-sync",
+ "zenoh-task",
+ "zenoh-util",
+]
+
+[[package]]
+name = "zenoh-util"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a473dcc62026b9d9589acc22c62b04cb7dab4070bba5543d2afac741ddf947"
+dependencies = [
+ "async-trait",
+ "const_format",
+ "flume",
+ "home",
+ "humantime",
+ "lazy_static",
+ "libc",
+ "libloading",
+ "pnet_datalink",
+ "schemars 1.2.2",
+ "serde",
+ "serde_json",
+ "shellexpand",
+ "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "winapi",
+ "zenoh-core",
+ "zenoh-result",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.8.27"
@@ -5748,7 +7731,7 @@ checksum = "88d2b8d9c68ad2b9e4340d7832716a4d21a22a1154777ad56ea55c51a9cf3831"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -5768,7 +7751,7 @@ checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
  "synstructure",
 ]
 
@@ -5808,5 +7791,11 @@ checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.108",
+ "syn 2.0.119",
 ]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b268e58e7c693d7c271f93ffc4ba3b380412554231c85bf61ca7af91042a4112"
diff --git a/Cargo.toml b/Cargo.toml
index 34ffbd3f..a102801e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,7 @@
 [workspace]
 members = [
     "aimdb-derive",
+    "aimdb-cdr",
     "aimdb-data-contracts",
     "aimdb-core",
     "aimdb-client",
@@ -11,6 +12,7 @@ members = [
     "aimdb-persistence",
     "aimdb-persistence-sqlite",
     "aimdb-mqtt-connector",
+    "aimdb-zenoh-connector",
     "aimdb-knx-connector",
     "aimdb-websocket-connector",
     "aimdb-uds-connector",
diff --git a/Makefile b/Makefile
index dc085e25..697df0ef 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # AimDB Makefile
 # Simple automation for common development tasks
 
-.PHONY: help build test clean clean-embedded fmt fmt-check clippy doc all check test-embedded test-wasm wasm wasm-test wasm-test-deps examples deny audit security publish publish-check readme-check codegen-drift check-no-sim check-no-globals check-toolchain-pin bench-gate
+.PHONY: ros2-interop help build test clean clean-embedded fmt fmt-check clippy doc all check test-embedded test-wasm wasm wasm-test wasm-test-deps examples deny audit security publish publish-check readme-check codegen-drift check-no-sim check-no-globals check-toolchain-pin bench-gate
 .DEFAULT_GOAL := help
 
 # Separate target dir for embedded checks so an interrupted example build
@@ -31,6 +31,10 @@ SYNC_NO_STD_FORBIDDEN := tokio|libc
 # executor, network stack, adapter or logger may reach its graph.
 MQTT_EMBEDDED_FORBIDDEN := embassy-net|embassy-executor|embassy-time|static_cell|aimdb-embassy-adapter|defmt|embedded-hal-async
 MQTT_DEPENDENCY_FORBIDDEN := embedded-io|embedded-hal|tokio
+# The `zenoh` crate (not `zenoh-nostd`/`zenoh-keyexpr`) and tokio are std-only.
+ZENOH_EMBEDDED_FORBIDDEN := (^|[^-])zenoh v[0-9]|tokio
+# `cargo deny check` sees default features only, which leave `zenoh` out.
+ZENOH_DENY := cargo deny --features "std,transport-tls,transport-quic,transport-ws,auth-usrpwd" --manifest-path aimdb-zenoh-connector/Cargo.toml
 # The guards below grep `cargo tree`'s stdout only — never `2>&1`. Cargo writes
 # progress to stderr, so on a cold cache "Downloaded embedded-hal-nb v1.0.0"
 # matches these patterns and fails the build.
@@ -55,6 +59,7 @@ help:
 	@printf "    test-embedded        Test embedded/MCU cross-compilation compatibility\n"
 	@printf "    test-wasm            Test WASM cross-compilation compatibility\n"
 	@printf "    readme-check         Verify the README quickstart matches its compiled example\n"
+	@printf "    ros2-interop         ros2:// against a ROS 2 distribution in Docker (DISTRO=lyrical)\n"
 	@printf "    codegen-drift        Compile codegen output against the workspace API\n"
 	@printf "    bench-gate           Assert connector allocation counts (b0_alloc_connector)\n"
 	@printf "\n"
@@ -78,8 +83,14 @@ help:
 ## Core commands
 build:
 	@printf "$(GREEN)Building AimDB (all valid combinations)...$(NC)\n"
+	@printf "$(YELLOW)  → Building aimdb-cdr (alloc, no_std)$(NC)\n"
+	cargo build --package aimdb-cdr
+	cargo build --package aimdb-cdr --no-default-features
+	@printf "$(YELLOW)  → Building aimdb-zenoh-connector (std, embedded)$(NC)\n"
+	cargo build --package aimdb-zenoh-connector --features "std"
+	cargo build --package aimdb-zenoh-connector --no-default-features --features "embedded"
 	@printf "$(YELLOW)  → Building aimdb-data-contracts (std)$(NC)\n"
-	cargo build --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard"
+	cargo build --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard,linkable-cdr,ros2"
 	@printf "$(YELLOW)  → Building aimdb-data-contracts (no_std)$(NC)\n"
 	cargo build --package aimdb-data-contracts --no-default-features --features alloc
 	@printf "$(YELLOW)  → Building aimdb-data-contracts (no_std + format-neutral linkable)$(NC)\n"
@@ -149,14 +160,21 @@ build:
 
 test:
 	@printf "$(GREEN)Running all tests (valid combinations)...$(NC)\n"
+	@printf "$(YELLOW)  → Testing aimdb-cdr (alloc, no_std)$(NC)\n"
+	cargo test --package aimdb-cdr
+	cargo test --package aimdb-cdr --no-default-features
 	@printf "$(YELLOW)  → Testing aimdb-data-contracts (std)$(NC)\n"
-	cargo test --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard"
+	cargo test --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard,linkable-cdr,ros2"
 	@printf "$(YELLOW)  → Testing aimdb-data-contracts (no_std + alloc + format-neutral linkable)$(NC)\n"
 	cargo test --package aimdb-data-contracts --no-default-features --features alloc,linkable
 	@printf "$(YELLOW)  → Testing aimdb-data-contracts (no_std + alloc + linkable-postcard)$(NC)\n"
 	cargo test --package aimdb-data-contracts --no-default-features --features alloc,linkable-postcard
 	@printf "$(YELLOW)  → Testing aimdb-data-contracts (no_std + alloc + linkable-json + migratable)$(NC)\n"
 	cargo test --package aimdb-data-contracts --no-default-features --features alloc,linkable-json,migratable
+	@printf "$(YELLOW)  → Testing aimdb-data-contracts (no_std + alloc + ros2)$(NC)\n"
+	cargo test --package aimdb-data-contracts --no-default-features --features alloc,ros2
+	@printf "$(YELLOW)  → Testing aimdb-data-contracts (no_std + alloc + linkable-cdr)$(NC)\n"
+	cargo test --package aimdb-data-contracts --no-default-features --features alloc,linkable-cdr
 	@printf "$(YELLOW)  → Testing aimdb-core (no_std + alloc)$(NC)\n"
 	cargo test --package aimdb-core --no-default-features --features alloc
 	@printf "$(YELLOW)  → Testing aimdb-core (std platform)$(NC)\n"
@@ -219,6 +237,10 @@ test:
 	cargo test --package aimdb-persistence
 	@printf "$(YELLOW)  → Testing persistence SQLite backend$(NC)\n"
 	cargo test --package aimdb-persistence-sqlite
+	@printf "$(YELLOW)  → Testing Zenoh connector (std)$(NC)\n"
+	cargo test --package aimdb-zenoh-connector --features "std"
+	@printf "$(YELLOW)  → Testing Zenoh connector (embedded, no_std+alloc)$(NC)\n"
+	cargo test --package aimdb-zenoh-connector --no-default-features --features "embedded"
 	@printf "$(YELLOW)  → Testing MQTT connector (tokio, no TLS backend)$(NC)\n"
 	cargo test --package aimdb-mqtt-connector --features "std"
 	@printf "$(YELLOW)  → Testing MQTT connector (tokio + native-tls)$(NC)\n"
@@ -264,7 +286,7 @@ test:
 
 fmt:
 	@printf "$(GREEN)Formatting code (workspace members only)...$(NC)\n"
-	@for pkg in aimdb-derive aimdb-data-contracts aimdb-core aimdb-client aimdb-embassy-adapter aimdb-tokio-adapter aimdb-wasm-adapter aimdb-sync aimdb-persistence aimdb-persistence-sqlite aimdb-mqtt-connector aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector aimdb-serial-connector aimdb-tcp-connector aimdb-codegen aimdb-cli aimdb-mcp sync-api-demo tokio-mqtt-connector-demo embassy-mqtt-connector-demo tokio-knx-connector-demo embassy-knx-connector-demo embassy-serial-connector-demo embassy-bench-stm32h5 weather-mesh-common weather-hub weather-station-alpha weather-station-beta hello-mailbox hello-mailbox-async hello-single-latest hello-single-latest-async hello-spmc-ring hello-spmc-ring-async aimdb-bench; do \
+	@for pkg in aimdb-derive aimdb-cdr aimdb-data-contracts aimdb-core aimdb-client aimdb-embassy-adapter aimdb-tokio-adapter aimdb-wasm-adapter aimdb-sync aimdb-persistence aimdb-persistence-sqlite aimdb-mqtt-connector aimdb-zenoh-connector aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector aimdb-serial-connector aimdb-tcp-connector aimdb-codegen aimdb-cli aimdb-mcp sync-api-demo tokio-mqtt-connector-demo embassy-mqtt-connector-demo tokio-knx-connector-demo embassy-knx-connector-demo embassy-serial-connector-demo embassy-bench-stm32h5 weather-mesh-common weather-hub weather-station-alpha weather-station-beta hello-mailbox hello-mailbox-async hello-single-latest hello-single-latest-async hello-spmc-ring hello-spmc-ring-async aimdb-bench; do \
 		printf "$(YELLOW)  → Formatting $$pkg$(NC)\n"; \
 		cargo fmt -p $$pkg 2>/dev/null || true; \
 	done
@@ -273,7 +295,7 @@ fmt:
 fmt-check:
 	@printf "$(GREEN)Checking code formatting (workspace members only)...$(NC)\n"
 	@FAILED=0; \
-	for pkg in aimdb-derive aimdb-data-contracts aimdb-core aimdb-client aimdb-embassy-adapter aimdb-tokio-adapter aimdb-wasm-adapter aimdb-sync aimdb-persistence aimdb-persistence-sqlite aimdb-mqtt-connector aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector aimdb-serial-connector aimdb-tcp-connector aimdb-codegen aimdb-cli aimdb-mcp sync-api-demo tokio-mqtt-connector-demo embassy-mqtt-connector-demo tokio-knx-connector-demo embassy-knx-connector-demo embassy-serial-connector-demo embassy-bench-stm32h5 weather-mesh-common weather-hub weather-station-alpha weather-station-beta hello-mailbox hello-mailbox-async hello-single-latest hello-single-latest-async hello-spmc-ring hello-spmc-ring-async aimdb-bench; do \
+	for pkg in aimdb-derive aimdb-cdr aimdb-data-contracts aimdb-core aimdb-client aimdb-embassy-adapter aimdb-tokio-adapter aimdb-wasm-adapter aimdb-sync aimdb-persistence aimdb-persistence-sqlite aimdb-mqtt-connector aimdb-zenoh-connector aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector aimdb-serial-connector aimdb-tcp-connector aimdb-codegen aimdb-cli aimdb-mcp sync-api-demo tokio-mqtt-connector-demo embassy-mqtt-connector-demo tokio-knx-connector-demo embassy-knx-connector-demo embassy-serial-connector-demo embassy-bench-stm32h5 weather-mesh-common weather-hub weather-station-alpha weather-station-beta hello-mailbox hello-mailbox-async hello-single-latest hello-single-latest-async hello-spmc-ring hello-spmc-ring-async aimdb-bench; do \
 		printf "$(YELLOW)  → Checking $$pkg$(NC)\n"; \
 		if ! cargo fmt -p $$pkg -- --check 2>&1; then \
 			printf "$(RED)❌ Formatting check failed for $$pkg$(NC)\n"; \
@@ -290,8 +312,11 @@ clippy:
 	@printf "$(GREEN)Running clippy (all valid combinations)...$(NC)\n"
 	@printf "$(YELLOW)  → Clippy on aimdb-derive$(NC)\n"
 	cargo clippy --package aimdb-derive --all-targets -- -D warnings
+	@printf "$(YELLOW)  → Clippy on aimdb-cdr (alloc, no_std)$(NC)\n"
+	cargo clippy --package aimdb-cdr --all-targets -- -D warnings
+	cargo clippy --package aimdb-cdr --no-default-features --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (std)$(NC)\n"
-	cargo clippy --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard" --all-targets -- -D warnings
+	cargo clippy --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard,linkable-cdr,ros2" --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (no_std + alloc)$(NC)\n"
 	cargo clippy --package aimdb-data-contracts --no-default-features --features alloc -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (no_std + alloc + format-neutral linkable)$(NC)\n"
@@ -300,6 +325,10 @@ clippy:
 	cargo clippy --package aimdb-data-contracts --no-default-features --features alloc,linkable-postcard --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (no_std + alloc + linkable-json + migratable)$(NC)\n"
 	cargo clippy --package aimdb-data-contracts --no-default-features --features alloc,linkable-json,migratable --all-targets -- -D warnings
+	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (no_std + alloc + ros2)$(NC)\n"
+	cargo clippy --package aimdb-data-contracts --no-default-features --features alloc,ros2 --all-targets -- -D warnings
+	@printf "$(YELLOW)  → Clippy on aimdb-data-contracts (no_std + alloc + linkable-cdr)$(NC)\n"
+	cargo clippy --package aimdb-data-contracts --no-default-features --features alloc,linkable-cdr --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-core (no_std + alloc)$(NC)\n"
 	cargo clippy --package aimdb-core --no-default-features --features alloc --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on aimdb-core (no_std + alloc + remote)$(NC)\n"
@@ -360,6 +389,12 @@ clippy:
 	cargo clippy --package aimdb-knx-connector --no-default-features --features "std" --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on KNX connector (neutral, no_std+alloc)$(NC)\n"
 	cargo clippy --package aimdb-knx-connector --target thumbv7em-none-eabihf --no-default-features --features "connector" -- -D warnings
+	@printf "$(YELLOW)  → Clippy on Zenoh connector (std)$(NC)\n"
+	cargo clippy --package aimdb-zenoh-connector --features "std" --all-targets -- -D warnings
+	cargo clippy --package aimdb-zenoh-connector --features "std,tracing,transport-tls,transport-quic,transport-ws,auth-usrpwd" -- -D warnings
+	@printf "$(YELLOW)  → Clippy on Zenoh connector (embedded, no_std+alloc)$(NC)\n"
+	cargo clippy --package aimdb-zenoh-connector --no-default-features --features "embedded" --all-targets -- -D warnings
+	cargo clippy --package aimdb-zenoh-connector --target thumbv7em-none-eabihf --no-default-features --features "embedded" -- -D warnings
 	@printf "$(YELLOW)  → Clippy on MQTT connector (tokio, no TLS backend)$(NC)\n"
 	cargo clippy --package aimdb-mqtt-connector --features "std" --all-targets -- -D warnings
 	@printf "$(YELLOW)  → Clippy on MQTT connector (tokio + native-tls)$(NC)\n"
@@ -428,11 +463,12 @@ doc:
 	@mkdir -p target/doc-final/cloud
 	@mkdir -p target/doc-final/embedded
 	@printf "$(YELLOW)  → Building cloud/edge documentation$(NC)\n"
-	cargo doc --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard" --no-deps
+	cargo doc --package aimdb-data-contracts --features "std,simulatable,migratable,observable,linkable-json,linkable-postcard,linkable-cdr,ros2" --no-deps
 	cargo doc --package aimdb-core --features "std,tracing,observability" --no-deps
 	cargo doc --package aimdb-tokio-adapter --features "tokio-runtime,tracing,observability,net,embedded-io" --no-deps
 	cargo doc --package aimdb-sync --no-deps
 	cargo doc --package aimdb-mqtt-connector --features "std" --no-deps
+	cargo doc --package aimdb-zenoh-connector --features "std" --no-deps
 	cargo doc --package aimdb-knx-connector --no-default-features --features "std" --no-deps
 	cargo doc --package aimdb-codegen --no-deps
 	cargo doc --package aimdb-cli --no-deps
@@ -449,14 +485,17 @@ doc:
 	cargo doc --package aimdb-tcp-connector --no-default-features --features "std" --no-deps
 	cargo doc --package aimdb-client --features "transport-serial,transport-tcp" --no-deps
 	cargo doc --package aimdb-derive --no-deps
+	cargo doc --package aimdb-cdr --no-deps
 	@cp -r target/doc/* target/doc-final/cloud/
 	@printf "$(YELLOW)  → Building embedded documentation$(NC)\n"
 	cargo doc --package aimdb-core --no-default-features --features alloc --no-deps
+	cargo doc --package aimdb-cdr --no-default-features --no-deps
 	cargo doc --package aimdb-embassy-adapter --features "embassy-runtime,net" --no-deps
 	cargo doc --package aimdb-mqtt-connector --no-default-features --features "embedded" --no-deps
 	cargo doc --package aimdb-mqtt-connector --no-default-features --features "embedded-tls" --no-deps
 	cargo doc --package aimdb-mqtt-connector --no-default-features --features "embassy-runtime" --no-deps
 	cargo doc --package aimdb-mqtt-connector --no-default-features --features "embassy-tls" --no-deps
+	cargo doc --package aimdb-zenoh-connector --no-default-features --features "embedded" --no-deps
 	cargo doc --package aimdb-knx-connector --no-default-features --features "connector" --no-deps
 	cargo doc --package aimdb-serial-connector --no-default-features --features "connector" --no-deps
 	cargo doc --package aimdb-tcp-connector --no-default-features --features "connector" --no-deps
@@ -486,6 +525,9 @@ test-wasm:
 
 test-embedded:
 	@printf "$(BLUE)Testing embedded/MCU cross-compilation compatibility...$(NC)\n"
+	@printf "$(YELLOW)  → Checking aimdb-cdr (alloc, no_std) on thumbv7em-none-eabihf target$(NC)\n"
+	cargo check --package aimdb-cdr --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR)
+	cargo check --package aimdb-cdr --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features
 	@printf "$(YELLOW)  → Checking aimdb-data-contracts (no_std + alloc) on thumbv7em-none-eabihf target$(NC)\n"
 	cargo check --package aimdb-data-contracts --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features alloc
 	@printf "$(YELLOW)  → Checking aimdb-data-contracts (no_std + alloc + format-neutral linkable) on thumbv7em-none-eabihf target$(NC)\n"
@@ -494,6 +536,10 @@ test-embedded:
 	cargo check --package aimdb-data-contracts --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features alloc,linkable-postcard
 	@printf "$(YELLOW)  → Checking aimdb-data-contracts (no_std + alloc + linkable-json + migratable) on thumbv7em-none-eabihf target$(NC)\n"
 	cargo check --package aimdb-data-contracts --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features alloc,linkable-json,migratable
+	@printf "$(YELLOW)  → Checking aimdb-data-contracts (no_std + alloc + ros2) on thumbv7em-none-eabihf target$(NC)\n"
+	cargo check --package aimdb-data-contracts --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features alloc,ros2
+	@printf "$(YELLOW)  → Checking aimdb-data-contracts (no_std + alloc + linkable-cdr) on thumbv7em-none-eabihf target$(NC)\n"
+	cargo check --package aimdb-data-contracts --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features alloc,linkable-cdr
 	@printf "$(YELLOW)  → Checking weather-mesh-common (no_std migratable, real TemperatureV1ToV2 chain, no direct serde_json dep) on thumbv7em-none-eabihf target$(NC)\n"
 	cargo check --package weather-mesh-common --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features migratable
 	@printf "$(YELLOW)  → Checking aimdb-core (no_std minimal) on thumbv7em-none-eabihf target$(NC)\n"
@@ -545,6 +591,31 @@ test-embedded:
 		printf '%s\n' "$$out" | grep -iE '$(MQTT_DEPENDENCY_FORBIDDEN)'; exit 1; \
 	fi
 	@printf "$(BLUE)✓ mountain-mqtt is the codec alone$(NC)\n"
+	@printf "$(YELLOW)  → Checking aimdb-zenoh-connector (embedded backend) on thumbv7em-none-eabihf target$(NC)\n"
+	cargo check --package aimdb-zenoh-connector --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features "embedded"
+	@printf "$(YELLOW)  → Asserting no std-only Zenoh crates in the embedded Zenoh backend$(NC)\n"
+	@err=$$(mktemp); \
+	out=$$(cargo tree -p aimdb-zenoh-connector --target thumbv7em-none-eabihf --no-default-features --features "embedded" -e features,no-dev 2>$$err) || { \
+		printf "$(RED)✗ cargo tree failed — refusing to pass vacuously:$(NC)\n"; \
+		cat $$err; rm -f $$err; exit 1; \
+	}; \
+	rm -f $$err; \
+	if printf '%s\n' "$$out" | grep -qE '$(ZENOH_EMBEDDED_FORBIDDEN)'; then \
+		printf "$(RED)✗ a std-only crate leaked into the embedded Zenoh graph$(NC)\n"; \
+		printf '%s\n' "$$out" | grep -E '$(ZENOH_EMBEDDED_FORBIDDEN)'; exit 1; \
+	fi
+	@printf "$(BLUE)✓ embedded Zenoh graph is free of the zenoh crate and tokio$(NC)\n"
+	@printf "$(YELLOW)  → Asserting the std Zenoh backend leaves transport compression off$(NC)\n"
+	@err=$$(mktemp); \
+	out=$$(cargo tree -p aimdb-zenoh-connector --features "std,tracing,transport-tls,transport-quic,transport-ws" -e features -i zenoh-transport 2>$$err) || { \
+		printf "$(RED)✗ cargo tree failed — refusing to pass vacuously:$(NC)\n"; \
+		cat $$err; rm -f $$err; exit 1; \
+	}; \
+	rm -f $$err; \
+	if printf '%s\n' "$$out" | grep -q 'zenoh-transport feature "transport_compression"'; then \
+		printf "$(RED)✗ zenoh transport compression is enabled; RUSTSEC-2026-0041 is ignored only because it is not$(NC)\n"; exit 1; \
+	fi
+	@printf "$(BLUE)✓ zenoh transport compression is off$(NC)\n"
 	@printf "$(YELLOW)  → Checking aimdb-mqtt-connector (Embassy bundle) on thumbv7em-none-eabihf target$(NC)\n"
 	cargo check --package aimdb-mqtt-connector --target thumbv7em-none-eabihf --target-dir $(EMBEDDED_CHECK_TARGET_DIR) --no-default-features --features "embassy-runtime"
 	@printf "$(YELLOW)  → Checking aimdb-mqtt-connector (Embassy + defmt) on thumbv7em-none-eabihf target$(NC)\n"
@@ -629,6 +700,8 @@ deny:
 	@printf "$(YELLOW)  → Checking banned dependencies$(NC)\n"
 	@printf "$(YELLOW)  → Checking dependency sources$(NC)\n"
 	cargo deny check
+	@printf "$(YELLOW)  → Checking the Zenoh connector's std graph (not a default feature)$(NC)\n"
+	$(ZENOH_DENY) check
 
 audit:
 	@printf "$(GREEN)Auditing dependencies for vulnerabilities...$(NC)\n"
@@ -674,6 +747,7 @@ publish-check:
 PUBLISH_ORDER := \
 	aimdb-codegen \
 	aimdb-derive \
+	aimdb-cdr \
 	aimdb-core \
 	aimdb-data-contracts \
 	aimdb-embassy-adapter \
@@ -682,6 +756,7 @@ PUBLISH_ORDER := \
 	aimdb-uds-connector \
 	aimdb-knx-connector \
 	aimdb-mqtt-connector \
+	aimdb-zenoh-connector \
 	aimdb-persistence-sqlite \
 	aimdb-serial-connector \
 	aimdb-sync \
@@ -759,6 +834,15 @@ bench-gate:
 	@printf "$(GREEN)Checking connector allocation counts...$(NC)\n"
 	cargo bench --package aimdb-bench --bench b0_alloc_connector
 
+## Interop
+# ros2:// against a real ROS 2 distribution (rmw_zenohd and the ros2 CLI in
+# Docker, host networking). DISTRO is a ros:<distro> image tag.
+DISTRO ?= lyrical
+ros2-interop:
+	@printf "$(GREEN)ROS 2 interop on $(DISTRO)...$(NC)\n"
+	cargo build --package aimdb-zenoh-connector --features "std" --examples
+	./aimdb-zenoh-connector/tests/interop/ros2_interop.sh $(DISTRO)
+
 ## Drift guards
 # The README quickstart is compiled as examples/readme-quickstart; this target
 # fails when the README code block and the example diverge, or when the
@@ -820,10 +904,10 @@ check-no-sim:
 # Applications may, so `tools/`, `examples/` and codegen's generated `main` are
 # not scanned. The one exception: the fork detector owns the runtime thread it
 # protects. A positive control keeps the guard from failing open.
-GLOBALS_SCANNED := aimdb-core aimdb-data-contracts aimdb-derive aimdb-client \
+GLOBALS_SCANNED := aimdb-core aimdb-cdr aimdb-data-contracts aimdb-derive aimdb-client \
 	aimdb-tokio-adapter aimdb-embassy-adapter aimdb-wasm-adapter aimdb-sync \
 	aimdb-persistence aimdb-persistence-sqlite aimdb-mqtt-connector \
-	aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector \
+	aimdb-zenoh-connector aimdb-knx-connector aimdb-websocket-connector aimdb-uds-connector \
 	aimdb-serial-connector aimdb-tcp-connector
 GLOBALS_PATTERN := tracing_subscriber::|set_global_default|set_boxed_logger|set_logger\(|set_max_level|panic::set_hook|panic::take_hook|pthread_atfork|sigaction|signal_hook|set_var\(
 GLOBALS_ALLOWED := aimdb-sync/src/fork\.rs
diff --git a/README.md b/README.md
index 2d510adb..18e66f18 100644
--- a/README.md
+++ b/README.md
@@ -201,7 +201,7 @@ docker compose up
 | Containers / Kubernetes | Tokio | `aimdb-tokio-adapter` | ~10 MB+ |
 | Browser | WASM | `aimdb-wasm-adapter` | ~2 MB+ |
 
-**Connectors today:** MQTT · KNX · WebSocket · TCP · Serial · Unix sockets. Kafka and Modbus are planned. A new connector is one trait impl.
+**Connectors today:** MQTT · KNX · Zenoh and ROS 2 · WebSocket · TCP · Serial · Unix sockets. Kafka and Modbus are planned. A new connector is one trait impl.
 
 ## Under the hood
 
diff --git a/aimdb-cdr/CHANGELOG.md b/aimdb-cdr/CHANGELOG.md
new file mode 100644
index 00000000..5ce47c8d
--- /dev/null
+++ b/aimdb-cdr/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog - aimdb-cdr
+
+All notable changes to the `aimdb-cdr` crate will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- **First release: serde for OMG CDR (XCDR1)**, the ROS 2 wire format, with
+  its 4-byte encapsulation header. `no_std`, `alloc` optional.
+  - `to_slice` encodes little-endian into caller storage without allocating;
+    `to_vec` needs `alloc`.
+  - `from_bytes` decodes both byte orders, taken from the header (`CDR_LE` or
+    `CDR_BE`); any other representation is an error.
+  - Alignment is measured from the end of the header; strings carry a `u32`
+    length including the NUL, sequences a `u32` count, fixed arrays none.
+  - Tested against golden bytes, byte for byte against `hiroz-cdr` for
+    little-endian output, and with random and malformed input.
diff --git a/aimdb-cdr/Cargo.toml b/aimdb-cdr/Cargo.toml
new file mode 100644
index 00000000..ba682107
--- /dev/null
+++ b/aimdb-cdr/Cargo.toml
@@ -0,0 +1,25 @@
+[package]
+name = "aimdb-cdr"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "no_std serde encoding for OMG CDR (XCDR1), the ROS 2 wire format"
+keywords = ["cdr", "ros2", "serde", "no-std", "aimdb"]
+categories = ["encoding", "no-std", "embedded"]
+
+[features]
+default = ["alloc"]
+# `to_vec`, owned `String`/`Vec` decoding, and error messages from serde impls.
+alloc = ["serde/alloc"]
+
+[dependencies]
+serde = { version = "1.0", default-features = false }
+
+[dev-dependencies]
+serde = { version = "1.0", features = ["derive"] }
+# Reference encoder: byte-for-byte oracle for the little-endian output.
+hiroz-cdr = "0.2"
diff --git a/aimdb-cdr/README.md b/aimdb-cdr/README.md
new file mode 100644
index 00000000..1a24bccf
--- /dev/null
+++ b/aimdb-cdr/README.md
@@ -0,0 +1,24 @@
+# aimdb-cdr
+
+`no_std` serde encoding for OMG CDR (XCDR1) with the 4-byte encapsulation
+header — the payload format ROS 2 puts on the wire.
+
+- Encodes little-endian; decodes little- and big-endian.
+- `to_slice` writes into caller storage without allocating. `to_vec` and owned
+  `String`/`Vec` fields need the default `alloc` feature.
+- Strings carry a `u32` length including the NUL; sequences a `u32` count;
+  fixed arrays and structs no prefix. Alignment is measured from the end of the
+  header.
+
+```rust
+#[derive(serde::Serialize, serde::Deserialize, PartialEq, Debug)]
+struct Temperature { temperature: f64, variance: f64 }
+
+let mut buf = [0u8; 20];
+let len = aimdb_cdr::to_slice(&Temperature { temperature: 21.5, variance: 0.0 }, &mut buf).unwrap();
+let back: Temperature = aimdb_cdr::from_bytes(&buf[..len]).unwrap();
+assert_eq!(back.temperature, 21.5);
+```
+
+`Option`, enums, maps and `char` have no XCDR1 mapping in ROS 2 and are
+rejected with `Error::Unsupported`.
diff --git a/aimdb-cdr/src/de.rs b/aimdb-cdr/src/de.rs
new file mode 100644
index 00000000..a55ac97b
--- /dev/null
+++ b/aimdb-cdr/src/de.rs
@@ -0,0 +1,272 @@
+use serde::de::{self, DeserializeSeed, Visitor};
+
+use crate::{Error, Result};
+
+/// XCDR1 body deserializer. `pos` counts from the end of the header.
+pub(crate) struct Deserializer<'de> {
+    input: &'de [u8],
+    pos: usize,
+    big_endian: bool,
+}
+
+macro_rules! read_primitive {
+    ($name:ident, $ty:ty) => {
+        fn $name(&mut self) -> Result<$ty> {
+            let bytes = self.primitive::<{ core::mem::size_of::<$ty>() }>()?;
+            Ok(if self.big_endian {
+                <$ty>::from_be_bytes(bytes)
+            } else {
+                <$ty>::from_le_bytes(bytes)
+            })
+        }
+    };
+}
+
+impl<'de> Deserializer<'de> {
+    pub(crate) fn new(input: &'de [u8], big_endian: bool) -> Self {
+        Self {
+            input,
+            pos: 0,
+            big_endian,
+        }
+    }
+
+    fn remaining(&self) -> usize {
+        self.input.len() - self.pos
+    }
+
+    fn take(&mut self, len: usize) -> Result<&'de [u8]> {
+        let end = self.pos.checked_add(len).ok_or(Error::UnexpectedEof)?;
+        let bytes = self.input.get(self.pos..end).ok_or(Error::UnexpectedEof)?;
+        self.pos = end;
+        Ok(bytes)
+    }
+
+    fn align(&mut self, alignment: usize) -> Result<()> {
+        let padding = (alignment - self.pos % alignment) % alignment;
+        self.take(padding).map(drop)
+    }
+
+    fn primitive<const N: usize>(&mut self) -> Result<[u8; N]> {
+        self.align(N)?;
+        let mut bytes = [0; N];
+        bytes.copy_from_slice(self.take(N)?);
+        Ok(bytes)
+    }
+
+    read_primitive!(read_u16, u16);
+    read_primitive!(read_u32, u32);
+    read_primitive!(read_u64, u64);
+    read_primitive!(read_i16, i16);
+    read_primitive!(read_i32, i32);
+    read_primitive!(read_i64, i64);
+    read_primitive!(read_f32, f32);
+    read_primitive!(read_f64, f64);
+
+    fn read_u8(&mut self) -> Result<u8> {
+        Ok(self.take(1)?[0])
+    }
+
+    /// A `u32` length prefix. Every ROS element takes at least one byte, so a
+    /// count beyond the remaining input is rejected before anything allocates.
+    fn read_length(&mut self) -> Result<usize> {
+        let len = usize::try_from(self.read_u32()?).map_err(|_| Error::UnexpectedEof)?;
+        if len > self.remaining() {
+            return Err(Error::UnexpectedEof);
+        }
+        Ok(len)
+    }
+
+    fn read_str(&mut self) -> Result<&'de str> {
+        let len = self.read_length()?;
+        if len == 0 {
+            return Ok("");
+        }
+        let (text, nul) = self.take(len)?.split_at(len - 1);
+        if nul != [0] {
+            return Err(Error::MissingNul);
+        }
+        core::str::from_utf8(text).map_err(|_| Error::InvalidUtf8)
+    }
+}
+
+impl<'de> de::Deserializer<'de> for &mut Deserializer<'de> {
+    type Error = Error;
+
+    fn deserialize_any<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("self-describing deserialize"))
+    }
+
+    fn deserialize_bool<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        match self.read_u8()? {
+            0 => visitor.visit_bool(false),
+            1 => visitor.visit_bool(true),
+            other => Err(Error::InvalidBool(other)),
+        }
+    }
+
+    fn deserialize_i8<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_i8(i8::from_le_bytes([self.read_u8()?]))
+    }
+
+    fn deserialize_i16<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_i16(self.read_i16()?)
+    }
+
+    fn deserialize_i32<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_i32(self.read_i32()?)
+    }
+
+    fn deserialize_i64<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_i64(self.read_i64()?)
+    }
+
+    fn deserialize_u8<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_u8(self.read_u8()?)
+    }
+
+    fn deserialize_u16<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_u16(self.read_u16()?)
+    }
+
+    fn deserialize_u32<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_u32(self.read_u32()?)
+    }
+
+    fn deserialize_u64<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_u64(self.read_u64()?)
+    }
+
+    fn deserialize_f32<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_f32(self.read_f32()?)
+    }
+
+    fn deserialize_f64<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_f64(self.read_f64()?)
+    }
+
+    fn deserialize_char<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("char"))
+    }
+
+    fn deserialize_str<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_borrowed_str(self.read_str()?)
+    }
+
+    fn deserialize_string<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        self.deserialize_str(visitor)
+    }
+
+    fn deserialize_bytes<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        let len = self.read_length()?;
+        visitor.visit_borrowed_bytes(self.take(len)?)
+    }
+
+    fn deserialize_byte_buf<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        self.deserialize_bytes(visitor)
+    }
+
+    fn deserialize_option<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("Option"))
+    }
+
+    fn deserialize_unit<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        visitor.visit_unit()
+    }
+
+    fn deserialize_unit_struct<V: Visitor<'de>>(
+        self,
+        _name: &'static str,
+        visitor: V,
+    ) -> Result<V::Value> {
+        visitor.visit_unit()
+    }
+
+    fn deserialize_newtype_struct<V: Visitor<'de>>(
+        self,
+        _name: &'static str,
+        visitor: V,
+    ) -> Result<V::Value> {
+        visitor.visit_newtype_struct(self)
+    }
+
+    fn deserialize_seq<V: Visitor<'de>>(self, visitor: V) -> Result<V::Value> {
+        let len = self.read_length()?;
+        visitor.visit_seq(Elements {
+            de: self,
+            left: len,
+        })
+    }
+
+    fn deserialize_tuple<V: Visitor<'de>>(self, len: usize, visitor: V) -> Result<V::Value> {
+        visitor.visit_seq(Elements {
+            de: self,
+            left: len,
+        })
+    }
+
+    fn deserialize_tuple_struct<V: Visitor<'de>>(
+        self,
+        _name: &'static str,
+        len: usize,
+        visitor: V,
+    ) -> Result<V::Value> {
+        self.deserialize_tuple(len, visitor)
+    }
+
+    fn deserialize_map<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("map"))
+    }
+
+    fn deserialize_struct<V: Visitor<'de>>(
+        self,
+        _name: &'static str,
+        fields: &'static [&'static str],
+        visitor: V,
+    ) -> Result<V::Value> {
+        self.deserialize_tuple(fields.len(), visitor)
+    }
+
+    fn deserialize_enum<V: Visitor<'de>>(
+        self,
+        _name: &'static str,
+        _variants: &'static [&'static str],
+        _visitor: V,
+    ) -> Result<V::Value> {
+        Err(Error::Unsupported("enum"))
+    }
+
+    fn deserialize_identifier<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("identifier"))
+    }
+
+    fn deserialize_ignored_any<V: Visitor<'de>>(self, _visitor: V) -> Result<V::Value> {
+        Err(Error::Unsupported("ignored field"))
+    }
+
+    fn is_human_readable(&self) -> bool {
+        false
+    }
+}
+
+/// Fixed-count access for sequences, arrays and struct fields.
+struct Elements<'a, 'de> {
+    de: &'a mut Deserializer<'de>,
+    left: usize,
+}
+
+impl<'de> de::SeqAccess<'de> for Elements<'_, 'de> {
+    type Error = Error;
+
+    fn next_element_seed<T: DeserializeSeed<'de>>(&mut self, seed: T) -> Result<Option<T::Value>> {
+        if self.left == 0 {
+            return Ok(None);
+        }
+        self.left -= 1;
+        seed.deserialize(&mut *self.de).map(Some)
+    }
+
+    fn size_hint(&self) -> Option<usize> {
+        Some(self.left.min(self.de.remaining()))
+    }
+}
diff --git a/aimdb-cdr/src/error.rs b/aimdb-cdr/src/error.rs
new file mode 100644
index 00000000..906e9027
--- /dev/null
+++ b/aimdb-cdr/src/error.rs
@@ -0,0 +1,79 @@
+use core::fmt;
+
+/// Result alias for this crate.
+pub type Result<T> = core::result::Result<T, Error>;
+
+/// Encode or decode failure.
+#[derive(Clone, Debug, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum Error {
+    /// The output slice is too small.
+    BufferTooSmall,
+    /// The input ended early, or a length prefix exceeds the input.
+    UnexpectedEof,
+    /// The representation identifier is not `CDR_LE` or `CDR_BE`.
+    InvalidHeader([u8; 2]),
+    /// A `bool` byte other than 0 or 1.
+    InvalidBool(u8),
+    /// A string is not UTF-8.
+    InvalidUtf8,
+    /// A string is not NUL-terminated.
+    MissingNul,
+    /// A length does not fit the `u32` prefix.
+    LengthOverflow,
+    /// A sequence was serialized without a known length.
+    UnknownLength,
+    /// A serde construct with no CDR mapping.
+    Unsupported(&'static str),
+    /// A serde impl reported an error (message dropped without `alloc`).
+    Custom,
+    /// A serde impl reported an error.
+    #[cfg(feature = "alloc")]
+    Message(alloc::string::String),
+}
+
+impl fmt::Display for Error {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::BufferTooSmall => f.write_str("output buffer too small"),
+            Self::UnexpectedEof => f.write_str("unexpected end of input"),
+            Self::InvalidHeader(id) => write!(f, "unsupported CDR representation {id:02x?}"),
+            Self::InvalidBool(b) => write!(f, "invalid bool byte {b}"),
+            Self::InvalidUtf8 => f.write_str("string is not UTF-8"),
+            Self::MissingNul => f.write_str("string is not NUL-terminated"),
+            Self::LengthOverflow => f.write_str("length exceeds u32"),
+            Self::UnknownLength => f.write_str("sequence length unknown"),
+            Self::Unsupported(what) => write!(f, "{what} has no CDR mapping"),
+            Self::Custom => f.write_str("serde error"),
+            #[cfg(feature = "alloc")]
+            Self::Message(msg) => f.write_str(msg),
+        }
+    }
+}
+
+impl core::error::Error for Error {}
+
+impl Error {
+    fn custom<T: fmt::Display>(_msg: T) -> Self {
+        #[cfg(feature = "alloc")]
+        {
+            Self::Message(alloc::string::ToString::to_string(&_msg))
+        }
+        #[cfg(not(feature = "alloc"))]
+        {
+            Self::Custom
+        }
+    }
+}
+
+impl serde::ser::Error for Error {
+    fn custom<T: fmt::Display>(msg: T) -> Self {
+        Error::custom(msg)
+    }
+}
+
+impl serde::de::Error for Error {
+    fn custom<T: fmt::Display>(msg: T) -> Self {
+        Error::custom(msg)
+    }
+}
diff --git a/aimdb-cdr/src/lib.rs b/aimdb-cdr/src/lib.rs
new file mode 100644
index 00000000..257efd5f
--- /dev/null
+++ b/aimdb-cdr/src/lib.rs
@@ -0,0 +1,68 @@
+#![doc = include_str!("../README.md")]
+#![cfg_attr(
+    not(test),
+    deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)
+)]
+#![no_std]
+
+#[cfg(feature = "alloc")]
+extern crate alloc;
+
+mod de;
+mod error;
+mod ser;
+
+pub use error::{Error, Result};
+
+/// Encapsulation header for little-endian XCDR1 (`CDR_LE`), the only one this
+/// crate writes.
+pub const HEADER_LE: [u8; 4] = [0x00, 0x01, 0x00, 0x00];
+
+const HEADER_LEN: usize = HEADER_LE.len();
+
+/// Encodes `value` with its header into `out`, returning the bytes written.
+///
+/// Fails with [`Error::BufferTooSmall`] if `out` cannot hold it; `out` is then
+/// partially written.
+pub fn to_slice<T>(value: &T, out: &mut [u8]) -> Result<usize>
+where
+    T: serde::Serialize + ?Sized,
+{
+    let (header, body) = out
+        .split_at_mut_checked(HEADER_LEN)
+        .ok_or(Error::BufferTooSmall)?;
+    header.copy_from_slice(&HEADER_LE);
+    let mut serializer = ser::Serializer::new(ser::SliceWriter::new(body));
+    value.serialize(&mut serializer)?;
+    Ok(HEADER_LEN + serializer.position())
+}
+
+/// Encodes `value` with its header into a new `Vec`.
+#[cfg(feature = "alloc")]
+pub fn to_vec<T>(value: &T) -> Result<alloc::vec::Vec<u8>>
+where
+    T: serde::Serialize + ?Sized,
+{
+    let mut out = alloc::vec::Vec::from(HEADER_LE);
+    value.serialize(&mut ser::Serializer::new(&mut out))?;
+    Ok(out)
+}
+
+/// Decodes a value from an encapsulated payload.
+///
+/// The byte order comes from the header (`CDR_LE` or `CDR_BE`); any other
+/// representation is [`Error::InvalidHeader`]. Trailing bytes are ignored.
+pub fn from_bytes<'de, T>(bytes: &'de [u8]) -> Result<T>
+where
+    T: serde::Deserialize<'de>,
+{
+    let (header, body) = bytes
+        .split_at_checked(HEADER_LEN)
+        .ok_or(Error::UnexpectedEof)?;
+    let big_endian = match [header[0], header[1]] {
+        [0x00, 0x01] => false,
+        [0x00, 0x00] => true,
+        other => return Err(Error::InvalidHeader(other)),
+    };
+    T::deserialize(&mut de::Deserializer::new(body, big_endian))
+}
diff --git a/aimdb-cdr/src/ser.rs b/aimdb-cdr/src/ser.rs
new file mode 100644
index 00000000..56f57851
--- /dev/null
+++ b/aimdb-cdr/src/ser.rs
@@ -0,0 +1,292 @@
+use serde::ser::{self, Serialize};
+
+use crate::{Error, Result};
+
+/// Byte sink behind the serializer.
+pub(crate) trait Write {
+    fn write_all(&mut self, bytes: &[u8]) -> Result<()>;
+}
+
+/// Writes into a fixed slice; overflow is [`Error::BufferTooSmall`].
+pub(crate) struct SliceWriter<'a> {
+    buf: &'a mut [u8],
+    len: usize,
+}
+
+impl<'a> SliceWriter<'a> {
+    pub(crate) fn new(buf: &'a mut [u8]) -> Self {
+        Self { buf, len: 0 }
+    }
+}
+
+impl Write for SliceWriter<'_> {
+    fn write_all(&mut self, bytes: &[u8]) -> Result<()> {
+        let end = self.len + bytes.len();
+        self.buf
+            .get_mut(self.len..end)
+            .ok_or(Error::BufferTooSmall)?
+            .copy_from_slice(bytes);
+        self.len = end;
+        Ok(())
+    }
+}
+
+#[cfg(feature = "alloc")]
+impl Write for &mut alloc::vec::Vec<u8> {
+    fn write_all(&mut self, bytes: &[u8]) -> Result<()> {
+        self.extend_from_slice(bytes);
+        Ok(())
+    }
+}
+
+/// Little-endian XCDR1 body serializer. `pos` counts from the end of the
+/// header, which is where CDR alignment is measured from.
+pub(crate) struct Serializer<W> {
+    out: W,
+    pos: usize,
+}
+
+impl<W: Write> Serializer<W> {
+    pub(crate) fn new(out: W) -> Self {
+        Self { out, pos: 0 }
+    }
+
+    pub(crate) fn position(&self) -> usize {
+        self.pos
+    }
+
+    fn write(&mut self, bytes: &[u8]) -> Result<()> {
+        self.out.write_all(bytes)?;
+        self.pos += bytes.len();
+        Ok(())
+    }
+
+    fn align(&mut self, alignment: usize) -> Result<()> {
+        let padding = (alignment - self.pos % alignment) % alignment;
+        self.write(&[0; 8][..padding])
+    }
+
+    fn primitive<const N: usize>(&mut self, bytes: [u8; N]) -> Result<()> {
+        self.align(N)?;
+        self.write(&bytes)
+    }
+
+    fn length(&mut self, len: usize) -> Result<()> {
+        let len = u32::try_from(len).map_err(|_| Error::LengthOverflow)?;
+        self.primitive(len.to_le_bytes())
+    }
+}
+
+impl<W: Write> ser::Serializer for &mut Serializer<W> {
+    type Ok = ();
+    type Error = Error;
+    type SerializeSeq = Self;
+    type SerializeTuple = Self;
+    type SerializeTupleStruct = Self;
+    type SerializeTupleVariant = ser::Impossible<(), Error>;
+    type SerializeMap = ser::Impossible<(), Error>;
+    type SerializeStruct = Self;
+    type SerializeStructVariant = ser::Impossible<(), Error>;
+
+    fn serialize_bool(self, v: bool) -> Result<()> {
+        self.write(&[u8::from(v)])
+    }
+
+    fn serialize_i8(self, v: i8) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_i16(self, v: i16) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_i32(self, v: i32) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_i64(self, v: i64) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_u8(self, v: u8) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_u16(self, v: u16) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_u32(self, v: u32) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_u64(self, v: u64) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_f32(self, v: f32) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_f64(self, v: f64) -> Result<()> {
+        self.primitive(v.to_le_bytes())
+    }
+
+    fn serialize_char(self, _v: char) -> Result<()> {
+        Err(Error::Unsupported("char"))
+    }
+
+    fn serialize_str(self, v: &str) -> Result<()> {
+        self.length(v.len() + 1)?;
+        self.write(v.as_bytes())?;
+        self.write(&[0])
+    }
+
+    fn serialize_bytes(self, v: &[u8]) -> Result<()> {
+        self.length(v.len())?;
+        self.write(v)
+    }
+
+    fn serialize_none(self) -> Result<()> {
+        Err(Error::Unsupported("Option"))
+    }
+
+    fn serialize_some<T: Serialize + ?Sized>(self, _value: &T) -> Result<()> {
+        Err(Error::Unsupported("Option"))
+    }
+
+    fn serialize_unit(self) -> Result<()> {
+        Ok(())
+    }
+
+    fn serialize_unit_struct(self, _name: &'static str) -> Result<()> {
+        Ok(())
+    }
+
+    fn serialize_unit_variant(self, _: &'static str, _: u32, _: &'static str) -> Result<()> {
+        Err(Error::Unsupported("enum"))
+    }
+
+    fn serialize_newtype_struct<T: Serialize + ?Sized>(
+        self,
+        _name: &'static str,
+        value: &T,
+    ) -> Result<()> {
+        value.serialize(self)
+    }
+
+    fn serialize_newtype_variant<T: Serialize + ?Sized>(
+        self,
+        _: &'static str,
+        _: u32,
+        _: &'static str,
+        _: &T,
+    ) -> Result<()> {
+        Err(Error::Unsupported("enum"))
+    }
+
+    fn serialize_seq(self, len: Option<usize>) -> Result<Self> {
+        self.length(len.ok_or(Error::UnknownLength)?)?;
+        Ok(self)
+    }
+
+    fn serialize_tuple(self, _len: usize) -> Result<Self> {
+        Ok(self)
+    }
+
+    fn serialize_tuple_struct(self, _name: &'static str, _len: usize) -> Result<Self> {
+        Ok(self)
+    }
+
+    fn serialize_tuple_variant(
+        self,
+        _: &'static str,
+        _: u32,
+        _: &'static str,
+        _: usize,
+    ) -> Result<Self::SerializeTupleVariant> {
+        Err(Error::Unsupported("enum"))
+    }
+
+    fn serialize_map(self, _len: Option<usize>) -> Result<Self::SerializeMap> {
+        Err(Error::Unsupported("map"))
+    }
+
+    fn serialize_struct(self, _name: &'static str, _len: usize) -> Result<Self> {
+        Ok(self)
+    }
+
+    fn serialize_struct_variant(
+        self,
+        _: &'static str,
+        _: u32,
+        _: &'static str,
+        _: usize,
+    ) -> Result<Self::SerializeStructVariant> {
+        Err(Error::Unsupported("enum"))
+    }
+
+    fn collect_str<T: core::fmt::Display + ?Sized>(self, _value: &T) -> Result<()> {
+        Err(Error::Unsupported("Display value"))
+    }
+
+    fn is_human_readable(&self) -> bool {
+        false
+    }
+}
+
+impl<W: Write> ser::SerializeSeq for &mut Serializer<W> {
+    type Ok = ();
+    type Error = Error;
+
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<()> {
+        value.serialize(&mut **self)
+    }
+
+    fn end(self) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl<W: Write> ser::SerializeTuple for &mut Serializer<W> {
+    type Ok = ();
+    type Error = Error;
+
+    fn serialize_element<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<()> {
+        value.serialize(&mut **self)
+    }
+
+    fn end(self) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl<W: Write> ser::SerializeTupleStruct for &mut Serializer<W> {
+    type Ok = ();
+    type Error = Error;
+
+    fn serialize_field<T: Serialize + ?Sized>(&mut self, value: &T) -> Result<()> {
+        value.serialize(&mut **self)
+    }
+
+    fn end(self) -> Result<()> {
+        Ok(())
+    }
+}
+
+impl<W: Write> ser::SerializeStruct for &mut Serializer<W> {
+    type Ok = ();
+    type Error = Error;
+
+    fn serialize_field<T: Serialize + ?Sized>(
+        &mut self,
+        _key: &'static str,
+        value: &T,
+    ) -> Result<()> {
+        value.serialize(&mut **self)
+    }
+
+    fn end(self) -> Result<()> {
+        Ok(())
+    }
+}
diff --git a/aimdb-cdr/tests/common/mod.rs b/aimdb-cdr/tests/common/mod.rs
new file mode 100644
index 00000000..c0864667
--- /dev/null
+++ b/aimdb-cdr/tests/common/mod.rs
@@ -0,0 +1,113 @@
+//! Shared fixtures. Golden bytes are laid out by hand from the XCDR1 rules.
+
+#![allow(dead_code)]
+
+use serde::{Deserialize, Serialize};
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Mixed {
+    pub a: u8,
+    pub b: u32,
+    pub c: u16,
+    pub d: f64,
+    pub s: String,
+    pub v: Vec<u16>,
+    pub arr: [u8; 3],
+    pub flag: bool,
+}
+
+pub fn mixed() -> Mixed {
+    Mixed {
+        a: 0x11,
+        b: 0x2233_4455,
+        c: 0x6677,
+        d: 1.0,
+        s: "hi".into(),
+        v: vec![1, 2],
+        arr: [7, 8, 9],
+        flag: true,
+    }
+}
+
+#[rustfmt::skip]
+pub const MIXED_LE: [u8; 48] = [
+    0x00, 0x01, 0x00, 0x00,                         // CDR_LE header
+    0x11, 0, 0, 0,                                  // a, pad to 4
+    0x55, 0x44, 0x33, 0x22,                         // b
+    0x77, 0x66, 0, 0, 0, 0, 0, 0,                   // c, pad to 8
+    0, 0, 0, 0, 0, 0, 0xf0, 0x3f,                   // d = 1.0
+    3, 0, 0, 0, b'h', b'i', 0, 0,                   // s: len incl. NUL, pad
+    2, 0, 0, 0, 1, 0, 2, 0,                         // v: count, elements
+    7, 8, 9,                                        // arr: no count
+    1,                                              // flag
+];
+
+#[rustfmt::skip]
+pub const MIXED_BE: [u8; 48] = [
+    0x00, 0x00, 0x00, 0x00,                         // CDR_BE header
+    0x11, 0, 0, 0,
+    0x22, 0x33, 0x44, 0x55,
+    0x66, 0x77, 0, 0, 0, 0, 0, 0,
+    0x3f, 0xf0, 0, 0, 0, 0, 0, 0,
+    0, 0, 0, 3, b'h', b'i', 0, 0,
+    0, 0, 0, 2, 0, 1, 0, 2,
+    7, 8, 9,
+    1,
+];
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Time {
+    pub sec: i32,
+    pub nanosec: u32,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Header {
+    pub stamp: Time,
+    pub frame_id: String,
+}
+
+/// `sensor_msgs/msg/Temperature`.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct Temperature {
+    pub header: Header,
+    pub temperature: f64,
+    pub variance: f64,
+}
+
+pub fn temperature() -> Temperature {
+    Temperature {
+        header: Header {
+            stamp: Time { sec: 1, nanosec: 2 },
+            frame_id: "a".into(),
+        },
+        temperature: 0.5,
+        variance: 0.0,
+    }
+}
+
+#[rustfmt::skip]
+pub const TEMPERATURE_LE: [u8; 36] = [
+    0x00, 0x01, 0x00, 0x00,
+    1, 0, 0, 0,                                     // stamp.sec
+    2, 0, 0, 0,                                     // stamp.nanosec
+    2, 0, 0, 0, b'a', 0, 0, 0,                      // frame_id, pad to 8
+    0, 0, 0, 0, 0, 0, 0xe0, 0x3f,                   // temperature = 0.5
+    0, 0, 0, 0, 0, 0, 0, 0,                         // variance
+];
+
+/// Tiny xorshift PRNG so the randomized tests need no extra dependency.
+pub struct Rng(pub u64);
+
+impl Rng {
+    pub fn next(&mut self) -> u64 {
+        self.0 ^= self.0 << 13;
+        self.0 ^= self.0 >> 7;
+        self.0 ^= self.0 << 17;
+        self.0
+    }
+
+    pub fn below(&mut self, n: u64) -> u64 {
+        self.next() % n
+    }
+}
diff --git a/aimdb-cdr/tests/golden.rs b/aimdb-cdr/tests/golden.rs
new file mode 100644
index 00000000..05a376f4
--- /dev/null
+++ b/aimdb-cdr/tests/golden.rs
@@ -0,0 +1,121 @@
+#![cfg(feature = "alloc")]
+
+mod common;
+
+use aimdb_cdr::{from_bytes, to_slice, to_vec, Error};
+use common::*;
+use serde::{Deserialize, Serialize};
+
+#[test]
+fn encodes_golden_little_endian() {
+    assert_eq!(to_vec(&mixed()).unwrap(), MIXED_LE);
+    assert_eq!(to_vec(&temperature()).unwrap(), TEMPERATURE_LE);
+}
+
+#[test]
+fn decodes_both_byte_orders() {
+    assert_eq!(from_bytes::<Mixed>(&MIXED_LE).unwrap(), mixed());
+    assert_eq!(from_bytes::<Mixed>(&MIXED_BE).unwrap(), mixed());
+    assert_eq!(
+        from_bytes::<Temperature>(&TEMPERATURE_LE).unwrap(),
+        temperature()
+    );
+}
+
+#[test]
+fn to_slice_matches_to_vec_and_reports_small_buffers() {
+    let mut out = [0u8; 48];
+    assert_eq!(to_slice(&mixed(), &mut out), Ok(48));
+    assert_eq!(out, MIXED_LE);
+
+    let mut short = [0u8; 47];
+    assert_eq!(to_slice(&mixed(), &mut short), Err(Error::BufferTooSmall));
+    assert_eq!(
+        to_slice(&mixed(), &mut [0u8; 3]),
+        Err(Error::BufferTooSmall)
+    );
+}
+
+#[test]
+fn empty_string_and_sequence() {
+    #[derive(Debug, PartialEq, Serialize, Deserialize)]
+    struct Empty {
+        s: String,
+        v: Vec<u32>,
+    }
+    let value = Empty {
+        s: String::new(),
+        v: Vec::new(),
+    };
+    let bytes = to_vec(&value).unwrap();
+    assert_eq!(bytes, [0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
+    assert_eq!(from_bytes::<Empty>(&bytes).unwrap(), value);
+}
+
+#[test]
+fn nested_sequences_of_structs() {
+    #[derive(Debug, PartialEq, Serialize, Deserialize)]
+    struct Path {
+        poses: Vec<Time>,
+        names: Vec<String>,
+    }
+    let value = Path {
+        poses: vec![
+            Time {
+                sec: -1,
+                nanosec: 9,
+            },
+            Time { sec: 3, nanosec: 4 },
+        ],
+        names: vec!["x".into(), "yz".into()],
+    };
+    assert_eq!(from_bytes::<Path>(&to_vec(&value).unwrap()).unwrap(), value);
+}
+
+#[test]
+fn rejects_malformed_input() {
+    assert_eq!(from_bytes::<u32>(&[0, 1, 0]), Err(Error::UnexpectedEof));
+    assert_eq!(
+        from_bytes::<u32>(&[0, 2, 0, 0, 1, 0, 0, 0]),
+        Err(Error::InvalidHeader([0, 2]))
+    );
+    assert_eq!(
+        from_bytes::<bool>(&[0, 1, 0, 0, 2]),
+        Err(Error::InvalidBool(2))
+    );
+    assert_eq!(
+        from_bytes::<String>(&[0, 1, 0, 0, 2, 0, 0, 0, b'a', b'b']),
+        Err(Error::MissingNul)
+    );
+    assert_eq!(
+        from_bytes::<String>(&[0, 1, 0, 0, 2, 0, 0, 0, 0xff, 0]),
+        Err(Error::InvalidUtf8)
+    );
+    // A huge count is refused before anything allocates.
+    assert_eq!(
+        from_bytes::<Vec<u64>>(&[0, 1, 0, 0, 0xff, 0xff, 0xff, 0xff]),
+        Err(Error::UnexpectedEof)
+    );
+    assert_eq!(
+        from_bytes::<Mixed>(&MIXED_LE[..40]),
+        Err(Error::UnexpectedEof)
+    );
+}
+
+#[test]
+fn rejects_constructs_without_a_cdr_mapping() {
+    assert_eq!(to_vec(&Some(1u8)), Err(Error::Unsupported("Option")));
+    assert_eq!(to_vec(&'x'), Err(Error::Unsupported("char")));
+    #[derive(Serialize)]
+    enum E {
+        A,
+    }
+    assert_eq!(to_vec(&E::A), Err(Error::Unsupported("enum")));
+}
+
+#[test]
+fn ignores_trailing_bytes() {
+    let mut padded = TEMPERATURE_LE.to_vec();
+    padded.extend_from_slice(&[0, 0, 0, 0]);
+    assert_eq!(from_bytes::<Temperature>(&padded).unwrap(), temperature());
+}
diff --git a/aimdb-cdr/tests/hiroz_oracle.rs b/aimdb-cdr/tests/hiroz_oracle.rs
new file mode 100644
index 00000000..8d47c252
--- /dev/null
+++ b/aimdb-cdr/tests/hiroz_oracle.rs
@@ -0,0 +1,51 @@
+//! Little-endian output must match hiroz-cdr, an independent ROS 2 encoder.
+
+#![cfg(feature = "alloc")]
+
+mod common;
+
+use aimdb_cdr::{from_bytes, to_vec, HEADER_LE};
+use common::*;
+use hiroz_cdr::LittleEndian;
+use serde::{de::DeserializeOwned, Serialize};
+
+fn assert_matches_hiroz<T: Serialize + DeserializeOwned + PartialEq + core::fmt::Debug>(value: &T) {
+    let ours = to_vec(value).unwrap();
+    let theirs = hiroz_cdr::to_vec::<T, LittleEndian>(value, 64).unwrap();
+    assert_eq!(&ours[..4], HEADER_LE);
+    assert_eq!(
+        &ours[4..],
+        theirs.as_slice(),
+        "encoding differs for {value:?}"
+    );
+
+    let mut framed = HEADER_LE.to_vec();
+    framed.extend_from_slice(&theirs);
+    assert_eq!(&from_bytes::<T>(&framed).unwrap(), value);
+}
+
+#[test]
+fn golden_fixtures_match_hiroz() {
+    assert_matches_hiroz(&mixed());
+    assert_matches_hiroz(&temperature());
+}
+
+#[test]
+fn random_values_match_hiroz() {
+    let mut rng = Rng(7);
+    for _ in 0..500 {
+        let mut value = temperature();
+        value.header.stamp.sec = rng.next() as i32;
+        value.header.frame_id = "f".repeat(rng.below(9) as usize);
+        value.temperature = rng.next() as i32 as f64 / 3.0;
+        assert_matches_hiroz(&value);
+
+        let mixed = Mixed {
+            s: "s".repeat(rng.below(9) as usize),
+            v: (0..rng.below(5)).map(|_| rng.next() as u16).collect(),
+            d: rng.next() as i32 as f64,
+            ..mixed()
+        };
+        assert_matches_hiroz(&mixed);
+    }
+}
diff --git a/aimdb-cdr/tests/no_alloc.rs b/aimdb-cdr/tests/no_alloc.rs
new file mode 100644
index 00000000..f21b9531
--- /dev/null
+++ b/aimdb-cdr/tests/no_alloc.rs
@@ -0,0 +1,32 @@
+//! Runs on every feature set: borrowed strings and fixed arrays only.
+
+use aimdb_cdr::{from_bytes, to_slice};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, PartialEq, Serialize, Deserialize)]
+struct Reading<'a> {
+    id: u16,
+    label: &'a str,
+    samples: [i32; 2],
+}
+
+#[test]
+fn round_trips_without_allocating() {
+    let value = Reading {
+        id: 7,
+        label: "t",
+        samples: [-1, 2],
+    };
+    let mut out = [0u8; 32];
+    let len = to_slice(&value, &mut out).unwrap();
+    #[rustfmt::skip]
+    let expected = [
+        0, 1, 0, 0,
+        7, 0, 0, 0,                 // id, pad to 4
+        2, 0, 0, 0, b't', 0, 0, 0,  // label, pad to 4
+        0xff, 0xff, 0xff, 0xff,     // samples[0]
+        2, 0, 0, 0,                 // samples[1]
+    ];
+    assert_eq!(&out[..len], expected);
+    assert_eq!(from_bytes::<Reading>(&out[..len]).unwrap(), value);
+}
diff --git a/aimdb-cdr/tests/robustness.rs b/aimdb-cdr/tests/robustness.rs
new file mode 100644
index 00000000..536b3be5
--- /dev/null
+++ b/aimdb-cdr/tests/robustness.rs
@@ -0,0 +1,61 @@
+//! Randomized checks: decoding arbitrary bytes never panics, and random
+//! values round-trip.
+
+#![cfg(feature = "alloc")]
+
+mod common;
+
+use aimdb_cdr::{from_bytes, to_vec};
+use common::*;
+
+#[test]
+fn decoding_random_and_mutated_input_never_panics() {
+    let mut rng = Rng(0x9e37_79b9_7f4a_7c15);
+    for _ in 0..20_000 {
+        let mut bytes: Vec<u8> = if rng.below(2) == 0 {
+            (0..rng.below(96)).map(|_| rng.next() as u8).collect()
+        } else {
+            let mut golden = MIXED_LE.to_vec();
+            for _ in 0..=rng.below(4) {
+                let at = rng.below(golden.len() as u64) as usize;
+                golden[at] = rng.next() as u8;
+            }
+            golden.truncate(rng.below(golden.len() as u64 + 1) as usize);
+            golden
+        };
+        if rng.below(2) == 0 && bytes.len() >= 2 {
+            bytes[0] = 0;
+            bytes[1] = rng.below(2) as u8;
+        }
+        let _ = from_bytes::<Mixed>(&bytes);
+        let _ = from_bytes::<Temperature>(&bytes);
+        let _ = from_bytes::<Vec<String>>(&bytes);
+    }
+}
+
+#[test]
+fn random_values_round_trip() {
+    let mut rng = Rng(42);
+    for _ in 0..2_000 {
+        let value = random_mixed(&mut rng);
+        assert_eq!(
+            from_bytes::<Mixed>(&to_vec(&value).unwrap()).unwrap(),
+            value
+        );
+    }
+}
+
+pub fn random_mixed(rng: &mut Rng) -> Mixed {
+    Mixed {
+        a: rng.next() as u8,
+        b: rng.next() as u32,
+        c: rng.next() as u16,
+        d: rng.next() as i32 as f64 / 7.0,
+        s: (0..rng.below(12))
+            .map(|_| char::from(b'a' + rng.below(26) as u8))
+            .collect(),
+        v: (0..rng.below(6)).map(|_| rng.next() as u16).collect(),
+        arr: [rng.next() as u8, rng.next() as u8, rng.next() as u8],
+        flag: rng.below(2) == 1,
+    }
+}
diff --git a/aimdb-core/CHANGELOG.md b/aimdb-core/CHANGELOG.md
index 133ef1e6..553f5e41 100644
--- a/aimdb-core/CHANGELOG.md
+++ b/aimdb-core/CHANGELOG.md
@@ -33,7 +33,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   to commit a message only once it has room) and receives an `OutboundMessage`
   borrowing the route's topic and payload buffers, so a message allocates
   nothing on a scratch serializer. `routes()` lists `RouteInfo` (default topic,
-  `ConnectorConfig` with `record_index`, topic and payload capacities);
+  the record's `type_id`, `ConnectorConfig` with `record_index`, topic and
+  payload capacities);
   `stats(id)` reports `RouteStats` (`sent`, `rejected`, `lagged`,
   `topic_overflow`, `serialize_failed`). Lag, serialize failures and a closed
   buffer are handled and counted inside; `next` ends when every route has
@@ -44,6 +45,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `dispatch(topic, payload)` deserializes and produces, logging failures, and
   `subscriptions()` lists the filters to subscribe. It is `Clone`, so the
   session task, the event loop and the inbound pumps share one.
+  `routes()` lists an `InboundRouteInfo` per link (resolved topic, the
+  record's `type_id`, `ConnectorConfig` with `record_index`), for parsing a
+  connector's per-link options once at build; a topic resolver runs once per
+  route.
+- **`connector::WIRE_FORMAT_KEY` (`aimdb.wire_format`)**, a reserved link
+  config key naming the codec's wire format. Codec verbs record it;
+  `with_serializer`, `with_serializer_into`, `with_deserializer` and
+  `with_match_deserializer` remove it, so a link carries a format exactly when
+  a known codec installed its current (de)serializer. Keys prefixed `aimdb.`
+  are reserved.
 - **`with_topic_writer(capacity, writer)` and `with_topic_fn(capacity, f)`**
   replace `with_topic_provider`. The writer receives the value and a
   `TopicBuf` (`push_str`, `write!`) of `capacity` bytes and returns
diff --git a/aimdb-core/src/builder.rs b/aimdb-core/src/builder.rs
index dcd2d7a7..77c017ce 100644
--- a/aimdb-core/src/builder.rs
+++ b/aimdb-core/src/builder.rs
@@ -1169,23 +1169,38 @@ impl AimDb {
     /// The inbound router for `scheme`: every link compiled against the
     /// connector's `grammar`, keyed links sharing their record's key table.
     ///
+    /// Also returns one [`InboundRouteInfo`](crate::InboundRouteInfo) per
+    /// route, in the router's order.
+    ///
     /// Rejects every link the grammar or its key cannot compile, naming the
     /// record and the resolved topic.
     pub(crate) fn inbound_router(
         &self,
         scheme: &str,
         grammar: &'static dyn crate::TopicGrammar,
-    ) -> DbResult<crate::router::Router> {
+    ) -> DbResult<(crate::router::Router, Vec<crate::InboundRouteInfo>)> {
         let mut routes = Vec::new();
+        let mut infos = Vec::new();
         let mut errors = Vec::new();
 
-        for entry in &self.inner.storages {
+        for (record_index, entry) in self.inner.storages.iter().enumerate() {
             for link in entry.record.inbound_connectors() {
                 if link.url.scheme() != scheme {
                     continue;
                 }
-                match self.inbound_route(entry, link, grammar) {
-                    Ok(route) => routes.push(route),
+                let topic = link.resolve_topic();
+                match self.inbound_route(entry, link, &topic, grammar) {
+                    Ok(route) => {
+                        routes.push(route);
+                        let mut config =
+                            crate::transport::ConnectorConfig::from_query(&link.config);
+                        config.record_index = Some(record_index);
+                        infos.push(crate::InboundRouteInfo {
+                            topic: Arc::from(topic),
+                            type_id: entry.type_id,
+                            config,
+                        });
+                    }
                     Err(message) => errors.push(crate::ConfigError::new(
                         entry.key.as_str(),
                         Some(link.url.to_string()),
@@ -1198,17 +1213,17 @@ impl AimDb {
         if !errors.is_empty() {
             return Err(DbError::InvalidConfiguration { errors });
         }
-        Ok(crate::router::Router::new(grammar, routes))
+        Ok((crate::router::Router::new(grammar, routes), infos))
     }
 
     fn inbound_route(
         &self,
         entry: &RecordEntry,
         link: &crate::connector::InboundConnectorLink,
+        topic: &str,
         grammar: &'static dyn crate::TopicGrammar,
     ) -> Result<crate::router::CompiledRoute, String> {
-        let topic = link.resolve_topic();
-        let pattern = crate::TopicPattern::parse(&topic).map_err(|e| e.to_string())?;
+        let pattern = crate::TopicPattern::parse(topic).map_err(|e| e.to_string())?;
         let filter = grammar.compile(&pattern)?;
         let names: Box<[Box<str>]> = pattern.capture_names().map(Box::from).collect();
 
@@ -1242,11 +1257,11 @@ impl AimDb {
             .name(key)
     }
 
-    /// Every outbound link of `scheme`, with its record's index.
+    /// Every outbound link of `scheme`, with its record's index and type.
     pub(crate) fn outbound_links<'a>(
         &'a self,
         scheme: &'a str,
-    ) -> impl Iterator<Item = (usize, &'a crate::connector::ConnectorLink)> + 'a {
+    ) -> impl Iterator<Item = (usize, TypeId, &'a crate::connector::ConnectorLink)> + 'a {
         self.inner
             .storages
             .iter()
@@ -1264,7 +1279,7 @@ impl AimDb {
                     .outbound_connectors()
                     .iter()
                     .filter(move |link| link.url.scheme() == scheme)
-                    .map(move |link| (i, link))
+                    .map(move |link| (i, entry.type_id, link))
             })
     }
 }
diff --git a/aimdb-core/src/connector.rs b/aimdb-core/src/connector.rs
index ba0ffecf..e7d08c6c 100644
--- a/aimdb-core/src/connector.rs
+++ b/aimdb-core/src/connector.rs
@@ -406,6 +406,13 @@ impl fmt::Display for ConnectorUrl {
     }
 }
 
+/// Link config key naming the wire format of the link's codec (e.g. `"cdr"`).
+///
+/// Recorded by codec verbs and removed by the serializer/deserializer setters,
+/// so it is present only when a known codec installed the current serializer.
+/// Keys prefixed `aimdb.` are reserved; connectors must not use them.
+pub const WIRE_FORMAT_KEY: &str = "aimdb.wire_format";
+
 /// Configuration for an outbound connector link
 ///
 /// Stores the parsed URL, configuration, and the route factory until the
diff --git a/aimdb-core/src/inbound_dispatch.rs b/aimdb-core/src/inbound_dispatch.rs
index 6fa6519a..6cc8437a 100644
--- a/aimdb-core/src/inbound_dispatch.rs
+++ b/aimdb-core/src/inbound_dispatch.rs
@@ -8,6 +8,7 @@ use alloc::sync::Arc;
 use alloc::vec::Vec;
 
 use crate::router::Router;
+use crate::transport::ConnectorConfig;
 use crate::{AimDb, DbResult, RuntimeContext, TopicGrammar};
 
 /// Every inbound link of one scheme, compiled against the connector's grammar.
@@ -17,17 +18,32 @@ use crate::{AimDb, DbResult, RuntimeContext, TopicGrammar};
 #[derive(Clone)]
 pub struct InboundDispatch {
     router: Arc<Router>,
+    routes: Arc<[InboundRouteInfo]>,
     ctx: RuntimeContext,
 }
 
+/// One inbound route, for parsing per-route configuration once at build.
+#[derive(Debug, Clone)]
+#[non_exhaustive]
+pub struct InboundRouteInfo {
+    /// The resolved topic or pattern, after any topic resolver.
+    pub topic: Arc<str>,
+    /// `TypeId` of the record the link belongs to.
+    pub type_id: core::any::TypeId,
+    /// The link's configuration, with `record_index` set.
+    pub config: ConnectorConfig,
+}
+
 impl InboundDispatch {
     /// Compiles every inbound link of `scheme` against `grammar`.
     ///
     /// Rejects every link the grammar or its key cannot compile, naming the
     /// record and the resolved topic.
     pub fn new(db: &AimDb, scheme: &str, grammar: &'static dyn TopicGrammar) -> DbResult<Self> {
+        let (router, routes) = db.inbound_router(scheme, grammar)?;
         Ok(Self {
-            router: Arc::new(db.inbound_router(scheme, grammar)?),
+            router: Arc::new(router),
+            routes: routes.into(),
             ctx: db.runtime_ctx(),
         })
     }
@@ -37,6 +53,7 @@ impl InboundDispatch {
     pub(crate) fn from_parts(router: Router, ctx: RuntimeContext) -> Self {
         Self {
             router: Arc::new(router),
+            routes: Arc::from([]),
             ctx,
         }
     }
@@ -57,6 +74,12 @@ impl InboundDispatch {
         self.router.subscriptions()
     }
 
+    /// Routes, one per inbound link, for parsing per-route configuration once
+    /// at build.
+    pub fn routes(&self) -> &[InboundRouteInfo] {
+        &self.routes
+    }
+
     /// Number of inbound routes.
     pub fn route_count(&self) -> usize {
         self.router.route_count()
diff --git a/aimdb-core/src/lib.rs b/aimdb-core/src/lib.rs
index b5ab18a2..acab7040 100644
--- a/aimdb-core/src/lib.rs
+++ b/aimdb-core/src/lib.rs
@@ -163,7 +163,7 @@ pub use connector::{IngestFactoryFn, IngestFn};
 pub use connector::{TopicBuf, TopicOverflow, TopicWriter};
 
 // Router exports for connector implementations
-pub use inbound_dispatch::InboundDispatch;
+pub use inbound_dispatch::{InboundDispatch, InboundRouteInfo};
 pub use outbound::{
     OutboundMessage, OutboundPayload, OutboundRoutes, RouteId, RouteInfo, RouteStats,
 };
diff --git a/aimdb-core/src/outbound/routes.rs b/aimdb-core/src/outbound/routes.rs
index 2d19a355..2d2644e3 100644
--- a/aimdb-core/src/outbound/routes.rs
+++ b/aimdb-core/src/outbound/routes.rs
@@ -18,6 +18,8 @@ use crate::{AimDb, DbError, DbResult, RuntimeContext};
 pub struct RouteInfo {
     /// Dense index, `0..routes().len()`.
     pub id: RouteId,
+    /// `TypeId` of the record the link belongs to.
+    pub type_id: core::any::TypeId,
     /// The topic from the link URL, used when no topic is written.
     pub default_topic: Arc<str>,
     /// The link's configuration, with `record_index` set.
@@ -201,12 +203,13 @@ impl OutboundRoutes {
         let mut routes = Vec::new();
         let mut states = Vec::new();
 
-        for (record_index, link) in db.outbound_links(scheme) {
+        for (record_index, type_id, link) in db.outbound_links(scheme) {
             let parts = (link.route_factory)(db);
             let mut config = ConnectorConfig::from_query(&link.config);
             config.record_index = Some(record_index);
             routes.push(RouteInfo {
                 id: routes.len(),
+                type_id,
                 default_topic: Arc::from(link.url.resource_id()),
                 config,
                 topic_capacity: parts.topic_capacity,
diff --git a/aimdb-core/src/typed_api.rs b/aimdb-core/src/typed_api.rs
index 4e93a5cd..7d099300 100644
--- a/aimdb-core/src/typed_api.rs
+++ b/aimdb-core/src/typed_api.rs
@@ -741,12 +741,22 @@ where
         self
     }
 
+    /// Drops any recorded [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY):
+    /// a newly installed codec closure has no known format until a codec verb
+    /// records one.
+    fn clear_wire_format(mut self) -> Self {
+        self.config
+            .retain(|(key, _)| key != crate::connector::WIRE_FORMAT_KEY);
+        self
+    }
+
     /// Sets the serialization callback
     ///
     /// The closure receives the [`RuntimeContext`](crate::RuntimeContext) for
     /// platform-independent timestamps and logging, plus the typed value being
     /// serialized. Ignore the context parameter (`|_ctx, value| …`) when it is
-    /// not needed.
+    /// not needed. Removes any recorded
+    /// [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY).
     pub fn with_serializer<F>(mut self, f: F) -> Self
     where
         F: Fn(crate::RuntimeContext, &T) -> Result<Vec<u8>, crate::connector::SerializeError>
@@ -755,7 +765,7 @@ where
             + 'static,
     {
         self.context_serializer = Some(Arc::new(f));
-        self
+        self.clear_wire_format()
     }
 
     /// Adds an into-slice fast path beside the required owned serializer.
@@ -769,6 +779,7 @@ where
     ///
     /// This method is an optimization only: callers must still install the
     /// owned serializer so oversized and legacy values retain their old behavior.
+    /// Removes any recorded [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY).
     pub fn with_serializer_into<F>(mut self, capacity: usize, f: F) -> Self
     where
         F: Fn(
@@ -781,7 +792,7 @@ where
             + 'static,
     {
         self.context_serializer_into = Some((capacity, Arc::new(f)));
-        self
+        self.clear_wire_format()
     }
 
     /// Removes a previously installed into-slice serializer.
@@ -1093,23 +1104,34 @@ where
         self
     }
 
+    /// Drops any recorded [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY):
+    /// a newly installed codec closure has no known format until a codec verb
+    /// records one.
+    fn clear_wire_format(mut self) -> Self {
+        self.config
+            .retain(|(key, _)| key != crate::connector::WIRE_FORMAT_KEY);
+        self
+    }
+
     /// Sets the deserialization callback
     ///
     /// The closure receives the [`RuntimeContext`](crate::RuntimeContext) for
     /// platform-independent timestamps and logging, plus the raw bytes from
     /// the external system. Ignore the context parameter (`|_ctx, data| …`)
-    /// when it is not needed.
+    /// when it is not needed. Removes any recorded
+    /// [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY).
     pub fn with_deserializer<F>(mut self, f: F) -> Self
     where
         F: Fn(crate::RuntimeContext, &[u8]) -> Result<T, String> + Send + Sync + 'static,
     {
         self.context_deserializer = Some(Arc::new(f));
-        self
+        self.clear_wire_format()
     }
 
     /// Like [`with_deserializer`](Self::with_deserializer), also receiving the
     /// topic the message arrived on, its captures and its key. The context is
-    /// borrowed, so no reference count changes per message.
+    /// borrowed, so no reference count changes per message. Removes any
+    /// recorded [`WIRE_FORMAT_KEY`](crate::connector::WIRE_FORMAT_KEY).
     pub fn with_match_deserializer<F>(mut self, f: F) -> Self
     where
         F: Fn(&crate::RuntimeContext, &crate::TopicMatch<'_>, &[u8]) -> Result<T, String>
@@ -1118,7 +1140,7 @@ where
             + 'static,
     {
         self.match_deserializer = Some(Arc::new(f));
-        self
+        self.clear_wire_format()
     }
 
     /// Assigns each value of capture `name` a [`KeyId`](crate::KeyId), up to
@@ -2479,4 +2501,115 @@ mod tests {
         assert_eq!(pull(&mut o).await, Some(("tele/out".into(), 5, false)));
         assert_eq!(pull(&mut o).await, None);
     }
+
+    #[test]
+    fn serializer_setters_clear_recorded_wire_format() {
+        use crate::connector::WIRE_FORMAT_KEY;
+
+        let mut rec = crate::typed_record::TypedRecord::<TestRecord>::new();
+        rec.set_buffer(Box::new(MockBuffer));
+        let builders: Vec<Box<dyn crate::connector::ConnectorBuilder>> =
+            vec![Box::new(MockConnectorBuilder {
+                scheme: "mqtt".to_string(),
+            })];
+        let extensions = crate::extensions::Extensions::new();
+        let mut reg = make_registrar(&mut rec, &builders, &extensions);
+
+        reg.link_to("mqtt://a")
+            .with_config(WIRE_FORMAT_KEY, "cdr")
+            .with_serializer(|_ctx, r: &TestRecord| Ok(r.value.to_le_bytes().to_vec()))
+            .finish();
+        reg.link_to("mqtt://b")
+            .with_serializer(|_ctx, r: &TestRecord| Ok(r.value.to_le_bytes().to_vec()))
+            .with_config(WIRE_FORMAT_KEY, "cdr")
+            .with_serializer_into(4, |_ctx, _r: &TestRecord, _out| Ok(0))
+            .finish();
+        reg.link_from("mqtt://c")
+            .with_config(WIRE_FORMAT_KEY, "cdr")
+            .with_deserializer(|_ctx, _bytes: &[u8]| Ok(TestRecord { value: 0 }))
+            .finish();
+        reg.link_from("mqtt://e")
+            .with_config(WIRE_FORMAT_KEY, "cdr")
+            .with_match_deserializer(|_ctx, _m, _bytes: &[u8]| Ok(TestRecord { value: 0 }))
+            .finish();
+        reg.link_to("mqtt://d")
+            .with_serializer(|_ctx, r: &TestRecord| Ok(r.value.to_le_bytes().to_vec()))
+            .with_config(WIRE_FORMAT_KEY, "cdr")
+            .finish();
+
+        let has_format =
+            |config: &[(String, String)]| config.iter().any(|(k, _)| k == WIRE_FORMAT_KEY);
+        let outbound = rec.outbound_connectors();
+        assert!(!has_format(&outbound[0].config));
+        assert!(!has_format(&outbound[1].config));
+        assert!(has_format(&outbound[2].config), "recorded after the setter");
+        let inbound = rec.inbound_connectors();
+        assert!(!has_format(&inbound[0].config));
+        assert!(!has_format(&inbound[1].config));
+    }
+
+    /// Connectors read each route's record type and options from its info;
+    /// a topic writer shows as a non-zero `topic_capacity`.
+    #[tokio::test]
+    async fn route_infos_carry_type_config_and_resolved_topic() {
+        use core::any::TypeId;
+
+        let (_db, outbound) = outbound(
+            || values(&[]),
+            |reg| {
+                reg.link_to("mqtt://tele/fixed")
+                    .with_serializer(le)
+                    .with_config("qos", "1")
+                    .finish();
+                reg.link_to("mqtt://tele/written")
+                    .with_topic_fn(16, |_v, _out| Ok(false))
+                    .with_serializer(le)
+                    .finish();
+            },
+        )
+        .await;
+        let routes = outbound.routes();
+        assert_eq!(routes.len(), 2);
+        assert!(routes
+            .iter()
+            .all(|r| r.type_id == TypeId::of::<TestRecord>()));
+        assert_eq!(
+            routes[0].config.protocol_options,
+            vec![("qos".to_string(), "1".to_string())]
+        );
+        assert_eq!(routes[0].topic_capacity, 0);
+        assert_eq!(routes[1].topic_capacity, 16);
+
+        let resolved = Arc::new(AtomicUsize::new(0));
+        let calls = resolved.clone();
+        let (db, _last, _count) = inbound_db(move |reg| {
+            reg.link_from("mqtt://cmd/in")
+                .with_topic_resolver(move || {
+                    calls.fetch_add(1, Ordering::SeqCst);
+                    Some("cmd/resolved".to_string())
+                })
+                .with_deserializer(|_ctx, _bytes: &[u8]| Ok(TestRecord { value: 0 }))
+                .with_config("qos", "2")
+                .finish();
+            reg.link_from("mqtt://dev/{id}")
+                .with_match_deserializer(key_deser)
+                .finish();
+        })
+        .await;
+        let inbound = crate::InboundDispatch::new(&db, "mqtt", &Plus).expect("routes compile");
+        assert_eq!(resolved.load(Ordering::SeqCst), 1, "resolved once");
+
+        let infos = inbound.routes();
+        assert_eq!(infos.len(), inbound.route_count());
+        let topics: Vec<&str> = infos.iter().map(|i| &*i.topic).collect();
+        assert_eq!(topics, ["cmd/resolved", "dev/{id}"]);
+        assert!(infos
+            .iter()
+            .all(|i| i.type_id == TypeId::of::<TestRecord>()));
+        assert!(infos.iter().all(|i| i.config.record_index == Some(0)));
+        assert_eq!(
+            infos[0].config.protocol_options,
+            vec![("qos".to_string(), "2".to_string())]
+        );
+    }
 }
diff --git a/aimdb-data-contracts/CHANGELOG.md b/aimdb-data-contracts/CHANGELOG.md
index a0f0432e..cb3ec376 100644
--- a/aimdb-data-contracts/CHANGELOG.md
+++ b/aimdb-data-contracts/CHANGELOG.md
@@ -7,6 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`WireFormat`** (`Unspecified`, `Json`, `Postcard`, `Cdr`) and the defaulted
+  constants `Linkable::WIRE_FORMAT` and `LinkCodec::WIRE_FORMAT`. The codec
+  verbs (`linked_to`, `linked_from`, `linked_*_with`, `with_link_codec`)
+  record the codec's format on the link under core's `WIRE_FORMAT_KEY`;
+  `WireFormat::recorded_in` reads it back. Existing impls compile unchanged.
+- **`ros2` feature: `RosMessage`**, a `Linkable` whose encoding is the type's
+  ROS 2 CDR form, with `ROS_TYPE_NAME` (DDS form, `pkg::msg::dds_::Name_`)
+  and `ROS_TYPE_HASH` (`RIHS01_…`). `ros2::dds_type_name`,
+  `ros2::validate_dds_type_name` and `ros2::validate_type_hash` check the
+  names (`RosNameError`); `#[derive(RosMessage)]` is re-exported. Implies
+  `linkable-cdr`.
+- **`linkable-cdr` feature: `link_codecs::Cdr<N>`**, CDR (XCDR1) through
+  `aimdb-cdr` on any link: a bounded encode into an `N`-byte scratch
+  (default 256), both byte orders on decode, `cdr` recorded on the link.
+
 ## [0.2.0] - 2026-09-18
 
 ### Changed (breaking) — Design 041: capability traits as first-class verbs
diff --git a/aimdb-data-contracts/Cargo.toml b/aimdb-data-contracts/Cargo.toml
index a80e4ba2..a2b3ace9 100644
--- a/aimdb-data-contracts/Cargo.toml
+++ b/aimdb-data-contracts/Cargo.toml
@@ -25,6 +25,10 @@ linkable-json = ["linkable", "serde_json", "dep:aimdb-derive"]
 # stays optional and no_std-compatible; `alloc` supplies the correctness
 # fallback for values larger than the preferred route buffer.
 linkable-postcard = ["linkable", "dep:postcard"]
+# OMG CDR (XCDR1), the ROS 2 wire format, with a bounded scratch capacity.
+linkable-cdr = ["linkable", "dep:aimdb-cdr"]
+# ROS 2 message identity (`RosMessage`) for `ros2://` links.
+ros2 = ["linkable-cdr", "dep:aimdb-derive"]
 # Dev-tier — never a default feature. The ext trait needs core's registrar,
 # same coupling `observable` has. `rand` is the tracer CI uses to prove a
 # production graph is sim-free (`make check-no-sim`).
@@ -41,6 +45,9 @@ serde_json = { workspace = true, optional = true }
 postcard = { version = "1.0", default-features = false, features = [
     "alloc",
 ], optional = true }
+aimdb-cdr = { version = "0.1.0", path = "../aimdb-cdr", optional = true, default-features = false, features = [
+    "alloc",
+] }
 
 # migration_chain! + #[derive(Linkable)] proc-macros (build-time only; no
 # target/runtime/no_std impact — see aimdb-derive). No cycle: aimdb-derive
diff --git a/aimdb-data-contracts/src/lib.rs b/aimdb-data-contracts/src/lib.rs
index 0139b474..60909185 100644
--- a/aimdb-data-contracts/src/lib.rs
+++ b/aimdb-data-contracts/src/lib.rs
@@ -62,6 +62,10 @@ extern crate self as aimdb_data_contracts;
 #[doc(hidden)]
 pub mod __private {
     pub extern crate alloc;
+    #[cfg(feature = "ros2")]
+    pub use aimdb_cdr;
+    #[cfg(feature = "ros2")]
+    pub use aimdb_core::connector::SerializeError;
     #[cfg(any(feature = "linkable-json", feature = "migratable"))]
     pub use serde_json;
 }
@@ -76,7 +80,7 @@ mod link_codec;
 mod linkable;
 
 #[cfg(feature = "linkable")]
-pub use link_codec::{link_codecs, LinkCodec, LinkCodecBuilderExt};
+pub use link_codec::{link_codecs, LinkCodec, LinkCodecBuilderExt, WireFormat};
 
 #[cfg(feature = "linkable")]
 pub use linkable::{LinkCodecRegistrarExt, LinkableRegistrarExt};
@@ -91,6 +95,15 @@ pub use linkable::{LinkCodecRegistrarExt, LinkableRegistrarExt};
 #[cfg(feature = "linkable-json")]
 pub use aimdb_derive::Linkable;
 
+#[cfg(feature = "ros2")]
+mod ros_message;
+
+#[cfg(feature = "ros2")]
+pub use ros_message::{ros2, RosMessage, RosNameError};
+
+#[cfg(feature = "ros2")]
+pub use aimdb_derive::RosMessage;
+
 #[cfg(feature = "observable")]
 mod observable;
 
@@ -270,6 +283,10 @@ pub trait Linkable: SchemaType + Sized {
     /// retries that value through [`to_bytes`](Self::to_bytes).
     const ENCODE_BUFFER_CAPACITY: Option<usize> = None;
 
+    /// What [`to_bytes`](Self::to_bytes) / [`from_bytes`](Self::from_bytes) speak.
+    /// Recorded on links that use this impl as their codec.
+    const WIRE_FORMAT: WireFormat = WireFormat::Unspecified;
+
     /// Deserialize from bytes (e.g., MQTT payload).
     ///
     /// Returns `Err` with error message on parse failure.
diff --git a/aimdb-data-contracts/src/link_codec.rs b/aimdb-data-contracts/src/link_codec.rs
index d49cbb54..b92d683c 100644
--- a/aimdb-data-contracts/src/link_codec.rs
+++ b/aimdb-data-contracts/src/link_codec.rs
@@ -6,12 +6,13 @@
 //!
 //! ```rust,ignore
 //! use aimdb_data_contracts::{
-//!     link_codecs::{Json, Postcard},
+//!     link_codecs::{Cdr, Json, Postcard},
 //!     LinkCodecBuilderExt, LinkCodecRegistrarExt,
 //! };
 //!
 //! registrar.linked_to_with("serial://mcu/reading", Postcard::<128>);
 //! registrar.linked_to_with("mqtt://cloud/reading", Json);
+//! registrar.linked_to_with("zenoh://cell/reading", Cdr::<128>);
 //! registrar
 //!     .link_to("mqtt://cloud/alerts")
 //!     .with_link_codec(Json)
@@ -20,14 +21,62 @@
 //! ```
 
 use alloc::string::String;
-#[cfg(any(feature = "linkable-json", feature = "linkable-postcard"))]
+#[cfg(any(
+    feature = "linkable-json",
+    feature = "linkable-postcard",
+    feature = "linkable-cdr"
+))]
 use alloc::string::ToString;
 use alloc::vec::Vec;
 use core::fmt::Debug;
 
-use aimdb_core::connector::SerializeError;
+use aimdb_core::connector::{SerializeError, WIRE_FORMAT_KEY};
 use aimdb_core::typed_api::{InboundConnectorBuilder, OutboundConnectorBuilder};
 
+/// The encoding a [`Linkable`](crate::Linkable) or [`LinkCodec`] speaks.
+///
+/// Codec verbs record it in the link config under
+/// [`WIRE_FORMAT_KEY`] so connectors can check it at build time.
+#[non_exhaustive]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum WireFormat {
+    /// Not declared; nothing is recorded.
+    Unspecified,
+    /// JSON.
+    Json,
+    /// Postcard.
+    Postcard,
+    /// OMG CDR (XCDR1) with encapsulation header, as used by ROS 2.
+    Cdr,
+}
+
+impl WireFormat {
+    /// The value recorded under [`WIRE_FORMAT_KEY`]; `None` for `Unspecified`.
+    pub const fn as_str(self) -> Option<&'static str> {
+        match self {
+            Self::Unspecified => None,
+            Self::Json => Some("json"),
+            Self::Postcard => Some("postcard"),
+            Self::Cdr => Some("cdr"),
+        }
+    }
+
+    /// Reads the format recorded in a link config; `Unspecified` if absent or
+    /// unknown.
+    pub fn recorded_in(config: &[(String, String)]) -> Self {
+        let value = config
+            .iter()
+            .find(|(key, _)| key == WIRE_FORMAT_KEY)
+            .map(|(_, value)| value.as_str());
+        match value {
+            Some("json") => Self::Json,
+            Some("postcard") => Self::Postcard,
+            Some("cdr") => Self::Cdr,
+            _ => Self::Unspecified,
+        }
+    }
+}
+
 /// A wire codec selected for one inbound or outbound record link.
 ///
 /// The owned [`encode`](Self::encode) operation is always required so an
@@ -47,6 +96,9 @@ pub trait LinkCodec<T>: Clone + Send + Sync + 'static {
     /// scratch serializer alongside the mandatory owned fallback.
     const ENCODE_BUFFER_CAPACITY: Option<usize> = None;
 
+    /// What this codec puts on the wire, recorded on each link it is installed on.
+    const WIRE_FORMAT: WireFormat = WireFormat::Unspecified;
+
     /// Decode one connector payload into a record.
     fn decode(&self, bytes: &[u8]) -> Result<T, String>;
 
@@ -84,6 +136,14 @@ pub mod link_codecs {
     #[cfg(feature = "linkable-postcard")]
     #[derive(Clone, Copy, Debug, Default)]
     pub struct Postcard<const N: usize = 256>;
+
+    /// Little-endian CDR (XCDR1) with its encapsulation header, as ROS 2
+    /// sends it, with a route-local reusable scratch capacity.
+    ///
+    /// Decoding accepts both byte orders.
+    #[cfg(feature = "linkable-cdr")]
+    #[derive(Clone, Copy, Debug, Default)]
+    pub struct Cdr<const N: usize = 256>;
 }
 
 impl<T> LinkCodec<T> for link_codecs::Default
@@ -91,6 +151,7 @@ where
     T: crate::Linkable,
 {
     const ENCODE_BUFFER_CAPACITY: Option<usize> = T::ENCODE_BUFFER_CAPACITY;
+    const WIRE_FORMAT: WireFormat = T::WIRE_FORMAT;
 
     fn decode(&self, bytes: &[u8]) -> Result<T, String> {
         T::from_bytes(bytes)
@@ -110,6 +171,8 @@ impl<T> LinkCodec<T> for link_codecs::Json
 where
     T: serde::Serialize + serde::de::DeserializeOwned,
 {
+    const WIRE_FORMAT: WireFormat = WireFormat::Json;
+
     fn decode(&self, bytes: &[u8]) -> Result<T, String> {
         serde_json::from_slice(bytes).map_err(|error| error.to_string())
     }
@@ -134,6 +197,7 @@ where
     T: serde::Serialize + serde::de::DeserializeOwned,
 {
     const ENCODE_BUFFER_CAPACITY: Option<usize> = Some(N);
+    const WIRE_FORMAT: WireFormat = WireFormat::Postcard;
 
     fn decode(&self, bytes: &[u8]) -> Result<T, String> {
         postcard::from_bytes(bytes).map_err(|error| error.to_string())
@@ -152,6 +216,31 @@ where
     }
 }
 
+#[cfg(feature = "linkable-cdr")]
+impl<T, const N: usize> LinkCodec<T> for link_codecs::Cdr<N>
+where
+    T: serde::Serialize + serde::de::DeserializeOwned,
+{
+    const ENCODE_BUFFER_CAPACITY: Option<usize> = Some(N);
+    const WIRE_FORMAT: WireFormat = WireFormat::Cdr;
+
+    fn decode(&self, bytes: &[u8]) -> Result<T, String> {
+        aimdb_cdr::from_bytes(bytes).map_err(|error| error.to_string())
+    }
+
+    fn encode(&self, value: &T) -> Result<Vec<u8>, SerializeError> {
+        aimdb_cdr::to_vec(value).map_err(|_| SerializeError::InvalidData)
+    }
+
+    fn encode_into(&self, value: &T, out: &mut [u8]) -> Result<usize, SerializeError> {
+        match aimdb_cdr::to_slice(value, out) {
+            Ok(used) => Ok(used),
+            Err(aimdb_cdr::Error::BufferTooSmall) => Err(SerializeError::BufferTooSmall),
+            Err(_) => Err(SerializeError::InvalidData),
+        }
+    }
+}
+
 /// Selects a codec on an individual typed connector builder.
 ///
 /// The builder type is preserved, so connector-specific extension methods can
@@ -164,7 +253,8 @@ where
     ///
     /// Calling this method again replaces the complete codec strategy. In
     /// particular, an owned-only codec clears any scratch serializer installed
-    /// by an earlier bounded codec.
+    /// by an earlier bounded codec. The codec's [`WireFormat`] is recorded
+    /// under [`WIRE_FORMAT_KEY`].
     fn with_link_codec<C>(self, codec: C) -> Self
     where
         C: LinkCodec<T>;
@@ -178,7 +268,7 @@ where
     where
         C: LinkCodec<T>,
     {
-        match C::ENCODE_BUFFER_CAPACITY {
+        let builder = match C::ENCODE_BUFFER_CAPACITY {
             Some(capacity) => {
                 let scratch_codec = codec.clone();
                 self.with_serializer(move |_ctx, value| codec.encode(value))
@@ -189,6 +279,11 @@ where
             None => self
                 .with_serializer(move |_ctx, value| codec.encode(value))
                 .clear_serializer_into(),
+        };
+        // After the setters, which clear any earlier record.
+        match C::WIRE_FORMAT.as_str() {
+            Some(format) => builder.with_config(WIRE_FORMAT_KEY, format),
+            None => builder,
         }
     }
 }
@@ -201,7 +296,11 @@ where
     where
         C: LinkCodec<T>,
     {
-        self.with_deserializer(move |_ctx, bytes| codec.decode(bytes))
+        let builder = self.with_deserializer(move |_ctx, bytes| codec.decode(bytes));
+        match C::WIRE_FORMAT.as_str() {
+            Some(format) => builder.with_config(WIRE_FORMAT_KEY, format),
+            None => builder,
+        }
     }
 }
 
@@ -388,6 +487,62 @@ mod tests {
         assert!(malformed.is_err());
     }
 
+    #[cfg(feature = "linkable-cdr")]
+    #[test]
+    fn cdr_codec_writes_header_and_handles_exact_and_undersized_buffers() {
+        let reading = Reading {
+            value: 1.5,
+            sequence: 0x0102_0304,
+        };
+        let codec = link_codecs::Cdr::<64>;
+        let owned = codec.encode(&reading).expect("CDR encode");
+        // Header, then `f32` and `u32` little-endian; both 4-aligned.
+        let mut expected = vec![0x00, 0x01, 0x00, 0x00];
+        expected.extend_from_slice(&1.5_f32.to_le_bytes());
+        expected.extend_from_slice(&0x0102_0304_u32.to_le_bytes());
+        assert_eq!(owned, expected);
+
+        let mut exact = vec![0_u8; owned.len()];
+        let written = codec
+            .encode_into(&reading, &mut exact)
+            .expect("exact CDR buffer");
+        assert_eq!(written, owned.len());
+        assert_eq!(exact, owned);
+        let decoded: Reading = codec.decode(&exact).expect("CDR decode");
+        assert_eq!(decoded, reading);
+
+        let mut small = vec![0_u8; owned.len() - 1];
+        assert_eq!(
+            codec.encode_into(&reading, &mut small),
+            Err(SerializeError::BufferTooSmall)
+        );
+        let bad_header: Result<Reading, _> = codec.decode(&[0x00, 0x07, 0x00, 0x00]);
+        assert!(bad_header.is_err());
+        assert_eq!(
+            <link_codecs::Cdr<64> as LinkCodec<Reading>>::ENCODE_BUFFER_CAPACITY,
+            Some(64)
+        );
+    }
+
+    #[cfg(feature = "linkable-cdr")]
+    #[test]
+    fn cdr_codec_decodes_big_endian() {
+        let mut big_endian = vec![0x00, 0x00, 0x00, 0x00];
+        big_endian.extend_from_slice(&1.5_f32.to_be_bytes());
+        big_endian.extend_from_slice(&7_u32.to_be_bytes());
+
+        let decoded: Reading = link_codecs::Cdr::<64>
+            .decode(&big_endian)
+            .expect("CDR_BE decode");
+        assert_eq!(
+            decoded,
+            Reading {
+                value: 1.5,
+                sequence: 7
+            }
+        );
+    }
+
     /// A fresh reader replays one value. Separate route subscriptions receive
     /// independent copies, matching a fan-out buffer's consumer semantics.
     #[cfg(all(feature = "linkable-json", feature = "linkable-postcard"))]
@@ -598,4 +753,136 @@ mod tests {
             );
         });
     }
+
+    #[test]
+    fn wire_format_round_trips_through_link_config() {
+        use super::WireFormat;
+        use aimdb_core::connector::WIRE_FORMAT_KEY;
+
+        for format in [WireFormat::Json, WireFormat::Postcard, WireFormat::Cdr] {
+            let config = vec![(
+                WIRE_FORMAT_KEY.to_string(),
+                format.as_str().expect("named format").to_string(),
+            )];
+            assert_eq!(WireFormat::recorded_in(&config), format);
+        }
+        assert_eq!(WireFormat::Unspecified.as_str(), None);
+        assert_eq!(WireFormat::recorded_in(&[]), WireFormat::Unspecified);
+        let unknown = vec![(WIRE_FORMAT_KEY.to_string(), "xml".to_string())];
+        assert_eq!(WireFormat::recorded_in(&unknown), WireFormat::Unspecified);
+    }
+
+    #[cfg(all(feature = "linkable-json", feature = "linkable-postcard"))]
+    #[test]
+    fn codec_verbs_record_the_last_codecs_wire_format() {
+        use super::WireFormat;
+        use crate::LinkableRegistrarExt;
+        use aimdb_core::connector::WIRE_FORMAT_KEY;
+
+        futures::executor::block_on(async {
+            let reading = Reading {
+                value: 1.0,
+                sequence: 1,
+            };
+            let mut builder = AimDbBuilder::new()
+                .runtime(Arc::new(NoopRuntimeOps))
+                .with_connector(NoopConnector);
+            builder.configure::<Reading>("reading.formats", |registrar| {
+                registrar.buffer_raw(Box::new(CannedBuffer { value: reading }));
+                registrar.linked_to_with("test://json", link_codecs::Json);
+                registrar.linked_to_with("test://postcard", link_codecs::Postcard::<64>);
+                // `Reading`'s own Linkable declares no format.
+                registrar.linked_to("test://default");
+                registrar
+                    .link_to("test://replaced")
+                    .with_link_codec(link_codecs::Postcard::<64>)
+                    .with_link_codec(link_codecs::Json)
+                    .finish();
+                registrar
+                    .link_to("test://custom-after-codec")
+                    .with_link_codec(link_codecs::Json)
+                    .with_serializer(|_ctx, _value| Ok(Vec::new()))
+                    .finish();
+            });
+            builder.configure::<Reading>("reading.formats.in", |registrar| {
+                registrar.buffer_raw(Box::new(CapturingBuffer {
+                    latest: Arc::new(std::sync::Mutex::new(None)),
+                }));
+                registrar.linked_from_with("test://json-in", link_codecs::Json);
+                registrar.linked_from("test://default-in");
+            });
+            let (db, _runner) = builder.build().await.expect("build");
+
+            let format_of = |topic: &str, config: &[(String, String)]| {
+                let records = config
+                    .iter()
+                    .filter(|(key, _)| key == WIRE_FORMAT_KEY)
+                    .count();
+                (topic.to_string(), WireFormat::recorded_in(config), records)
+            };
+            let outbound = OutboundRoutes::new(&db, "test").expect("outbound routes");
+            let inbound = InboundDispatch::new(&db, "test", &aimdb_core::ExactGrammar)
+                .expect("inbound routes");
+            let mut formats: Vec<(String, WireFormat, usize)> = outbound
+                .routes()
+                .iter()
+                .map(|route| format_of(&route.default_topic, &route.config.protocol_options))
+                .chain(
+                    inbound
+                        .routes()
+                        .iter()
+                        .map(|route| format_of(&route.topic, &route.config.protocol_options)),
+                )
+                .collect();
+            formats.sort_by(|a, b| a.0.cmp(&b.0));
+
+            let expected = [
+                ("custom-after-codec", WireFormat::Unspecified, 0),
+                ("default", WireFormat::Unspecified, 0),
+                ("default-in", WireFormat::Unspecified, 0),
+                ("json", WireFormat::Json, 1),
+                ("json-in", WireFormat::Json, 1),
+                ("postcard", WireFormat::Postcard, 1),
+                ("replaced", WireFormat::Json, 1),
+            ];
+            let actual: Vec<(&str, WireFormat, usize)> = formats
+                .iter()
+                .map(|(topic, format, n)| (topic.as_str(), *format, *n))
+                .collect();
+            assert_eq!(actual, expected);
+        });
+    }
+
+    #[cfg(all(
+        feature = "linkable-json",
+        feature = "linkable-postcard",
+        feature = "linkable-cdr"
+    ))]
+    #[test]
+    fn cdr_verb_records_cdr_and_takes_the_bounded_path() {
+        use super::WireFormat;
+
+        futures::executor::block_on(async {
+            let reading = Reading {
+                value: 1.0,
+                sequence: 1,
+            };
+            let mut builder = AimDbBuilder::new()
+                .runtime(Arc::new(NoopRuntimeOps))
+                .with_connector(NoopConnector);
+            builder.configure::<Reading>("reading.cdr", |registrar| {
+                registrar.buffer_raw(Box::new(CannedBuffer { value: reading }));
+                registrar.linked_to_with("test://cdr", link_codecs::Cdr::<64>);
+            });
+            let (db, _runner) = builder.build().await.expect("build");
+
+            let routes = OutboundRoutes::new(&db, "test").expect("outbound routes");
+            let route = &routes.routes()[0];
+            assert_eq!(
+                WireFormat::recorded_in(&route.config.protocol_options),
+                WireFormat::Cdr
+            );
+            assert_eq!(route.payload_capacity, 64);
+        });
+    }
 }
diff --git a/aimdb-data-contracts/src/linkable.rs b/aimdb-data-contracts/src/linkable.rs
index a7e4e450..13366854 100644
--- a/aimdb-data-contracts/src/linkable.rs
+++ b/aimdb-data-contracts/src/linkable.rs
@@ -7,10 +7,9 @@
 //! escape hatch for per-link options (QoS, topic providers/resolvers), while
 //! [`LinkCodecRegistrarExt`] selects a different codec for an individual link.
 
-use aimdb_core::connector::SerializeError;
 use aimdb_core::typed_api::RecordRegistrar;
 
-use crate::{LinkCodec, LinkCodecBuilderExt, Linkable};
+use crate::{link_codecs, LinkCodec, LinkCodecBuilderExt, Linkable};
 
 /// Adds `.linked_from(url)` and `.linked_to(url)` to [`RecordRegistrar`] for
 /// [`Linkable`] types.
@@ -36,21 +35,14 @@ where
 {
     fn linked_from(&mut self, url: &str) -> &mut RecordRegistrar<'a, T> {
         self.link_from(url)
-            .with_deserializer(|_ctx, bytes| T::from_bytes(bytes))
+            .with_link_codec(link_codecs::Default)
             .finish()
     }
 
     fn linked_to(&mut self, url: &str) -> &mut RecordRegistrar<'a, T> {
-        let builder = self.link_to(url).with_serializer(|_ctx, value: &T| {
-            value.to_bytes().map_err(|_| SerializeError::InvalidData)
-        });
-
-        match T::ENCODE_BUFFER_CAPACITY {
-            Some(capacity) => builder
-                .with_serializer_into(capacity, |_ctx, value: &T, out| value.encode_into(out))
-                .finish(),
-            None => builder.finish(),
-        }
+        self.link_to(url)
+            .with_link_codec(link_codecs::Default)
+            .finish()
     }
 }
 
diff --git a/aimdb-data-contracts/src/ros_message.rs b/aimdb-data-contracts/src/ros_message.rs
new file mode 100644
index 00000000..a6e776f2
--- /dev/null
+++ b/aimdb-data-contracts/src/ros_message.rs
@@ -0,0 +1,276 @@
+//! ROS 2 type identity for contracts carried on `ros2://` links.
+//!
+//! [`RosMessage`] names the ROS interface a contract mirrors. The functions in
+//! [`ros2`](crate::ros2) build and check the two names it carries, so a
+//! connector can reject a malformed hand-written impl at build time.
+
+use alloc::string::String;
+use core::fmt;
+
+use crate::Linkable;
+
+/// The type is a ROS 2 message: its [`Linkable`] encoding is the message's
+/// CDR form, and these two constants identify it on the wire.
+///
+/// A connector unlocks `ros2://` links for a type it registers with
+/// `.register::<T>()`; links then carry the data.
+///
+/// ```rust
+/// use aimdb_data_contracts::{Linkable, RosMessage, SchemaType, WireFormat};
+///
+/// #[derive(Clone, Debug)]
+/// pub struct Empty;
+///
+/// impl SchemaType for Empty {
+///     const NAME: &'static str = "std_msgs/msg/Empty";
+/// }
+///
+/// impl Linkable for Empty {
+///     const WIRE_FORMAT: WireFormat = WireFormat::Cdr;
+///     # fn from_bytes(_: &[u8]) -> Result<Self, String> { Ok(Empty) }
+///     # fn to_bytes(&self) -> Result<Vec<u8>, String> { Ok(Vec::new()) }
+///     // `from_bytes` / `to_bytes` speak CDR.
+/// }
+///
+/// impl RosMessage for Empty {
+///     const ROS_TYPE_NAME: &'static str = "std_msgs::msg::dds_::Empty_";
+///     // Copied from `ros2 topic info -v` on the robot.
+///     const ROS_TYPE_HASH: &'static str =
+///         "RIHS01_0000000000000000000000000000000000000000000000000000000000000000";
+/// }
+/// ```
+#[diagnostic::on_unimplemented(
+    message = "`{Self}` is not a ROS 2 message type",
+    label = "not a `RosMessage`",
+    note = "derive it: `#[derive(RosMessage)]` with `#[ros(type = \"pkg/msg/Name\", hash = \"RIHS01_…\")]`"
+)]
+pub trait RosMessage: Linkable {
+    /// The DDS type name rmw_zenoh puts in data keys and liveliness tokens,
+    /// e.g. `std_msgs::msg::dds_::String_`. See [`ros2::dds_type_name`](crate::ros2::dds_type_name).
+    const ROS_TYPE_NAME: &'static str;
+    /// The REP-2016 type hash: `RIHS01_` followed by 64 lowercase hex digits,
+    /// as `ros2 topic info -v` prints it.
+    const ROS_TYPE_HASH: &'static str;
+}
+
+/// Why a ROS type name or type hash was refused.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub enum RosNameError {
+    /// Not of the form `pkg/msg/Name` (or `pkg::msg::dds_::Name_`).
+    Shape,
+    /// The package breaks REP 144: lowercase letters, digits and single
+    /// underscores, starting with a letter and not ending with `_`.
+    Package,
+    /// The message name is not an uppercase letter followed by letters and
+    /// digits.
+    Message,
+    /// Not `RIHS01_` followed by 64 lowercase hex digits.
+    Hash,
+}
+
+impl fmt::Display for RosNameError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str(match self {
+            Self::Shape => "expected a ROS message type `pkg/msg/Name`",
+            Self::Package => {
+                "package must be lowercase letters, digits and single underscores, \
+                 starting with a letter and not ending with '_'"
+            }
+            Self::Message => {
+                "message name must start with an uppercase letter, then letters and digits"
+            }
+            Self::Hash => "type hash must be 'RIHS01_' followed by 64 lowercase hex digits",
+        })
+    }
+}
+
+#[cfg(feature = "std")]
+impl std::error::Error for RosNameError {}
+
+/// Name and hash checks for [`RosMessage`] implementations.
+pub mod ros2 {
+    use super::*;
+
+    const DDS_INFIX: &str = "::msg::dds_::";
+    const HASH_PREFIX: &str = "RIHS01_";
+
+    /// The DDS type name for a ROS message type:
+    /// `cell_msgs/msg/SpindleCommand` → `cell_msgs::msg::dds_::SpindleCommand_`.
+    pub fn dds_type_name(ros_type: &str) -> Result<String, RosNameError> {
+        let mut parts = ros_type.split('/');
+        let (Some(package), Some("msg"), Some(message), None) =
+            (parts.next(), parts.next(), parts.next(), parts.next())
+        else {
+            return Err(RosNameError::Shape);
+        };
+        check_package(package)?;
+        check_message(message)?;
+        Ok(alloc::format!("{package}{DDS_INFIX}{message}_"))
+    }
+
+    /// Checks a [`RosMessage::ROS_TYPE_NAME`], which is in DDS form.
+    pub fn validate_dds_type_name(name: &str) -> Result<(), RosNameError> {
+        let (package, rest) = name.split_once(DDS_INFIX).ok_or(RosNameError::Shape)?;
+        let message = rest.strip_suffix('_').ok_or(RosNameError::Shape)?;
+        check_package(package)?;
+        check_message(message)
+    }
+
+    /// Checks a [`RosMessage::ROS_TYPE_HASH`].
+    pub fn validate_type_hash(hash: &str) -> Result<(), RosNameError> {
+        let digits = hash.strip_prefix(HASH_PREFIX).ok_or(RosNameError::Hash)?;
+        if digits.len() == 64
+            && digits
+                .bytes()
+                .all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f'))
+        {
+            Ok(())
+        } else {
+            Err(RosNameError::Hash)
+        }
+    }
+
+    fn check_package(package: &str) -> Result<(), RosNameError> {
+        let bytes = package.as_bytes();
+        let valid = bytes.first().is_some_and(u8::is_ascii_lowercase)
+            && bytes.last() != Some(&b'_')
+            && !package.contains("__")
+            && bytes
+                .iter()
+                .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || *b == b'_');
+        if valid {
+            Ok(())
+        } else {
+            Err(RosNameError::Package)
+        }
+    }
+
+    fn check_message(message: &str) -> Result<(), RosNameError> {
+        let bytes = message.as_bytes();
+        if bytes.first().is_some_and(u8::is_ascii_uppercase)
+            && bytes.iter().all(u8::is_ascii_alphanumeric)
+        {
+            Ok(())
+        } else {
+            Err(RosNameError::Message)
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::ros2::*;
+    use super::RosNameError;
+
+    #[test]
+    fn dds_type_name_mangles_package_and_message() {
+        assert_eq!(
+            dds_type_name("std_msgs/msg/String").as_deref(),
+            Ok("std_msgs::msg::dds_::String_")
+        );
+        assert_eq!(
+            dds_type_name("cell_msgs/msg/SpindleCommand").as_deref(),
+            Ok("cell_msgs::msg::dds_::SpindleCommand_")
+        );
+        assert_eq!(
+            dds_type_name("sensor_msgs2/msg/Imu9").as_deref(),
+            Ok("sensor_msgs2::msg::dds_::Imu9_")
+        );
+    }
+
+    #[test]
+    fn dds_type_name_refuses_other_shapes() {
+        for bad in [
+            "",
+            "std_msgs",
+            "std_msgs/String",
+            "std_msgs/srv/String",
+            "std_msgs/action/Fibonacci",
+            "std_msgs/msg/String/Extra",
+            "/std_msgs/msg/String",
+        ] {
+            assert_eq!(dds_type_name(bad), Err(RosNameError::Shape), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn package_follows_rep_144() {
+        for bad in [
+            "Std_msgs",
+            "1msgs",
+            "_msgs",
+            "msgs_",
+            "std__msgs",
+            "std-msgs",
+            "",
+        ] {
+            let ty = alloc::format!("{bad}/msg/String");
+            assert_eq!(dds_type_name(&ty), Err(RosNameError::Package), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn message_is_upper_camel_alphanumeric() {
+        for bad in ["string", "9Lives", "Spindle_Command", "Spindle-Command", ""] {
+            let ty = alloc::format!("std_msgs/msg/{bad}");
+            assert_eq!(dds_type_name(&ty), Err(RosNameError::Message), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn dds_names_round_trip_through_validation() {
+        for ty in [
+            "std_msgs/msg/String",
+            "builtin_interfaces/msg/Time",
+            "a/msg/B",
+        ] {
+            let dds = dds_type_name(ty).expect("valid type");
+            assert_eq!(validate_dds_type_name(&dds), Ok(()), "{dds}");
+        }
+    }
+
+    #[test]
+    fn validate_dds_type_name_refuses_ros_form_and_damage() {
+        assert_eq!(
+            validate_dds_type_name("std_msgs/msg/String"),
+            Err(RosNameError::Shape)
+        );
+        assert_eq!(
+            validate_dds_type_name("std_msgs::msg::dds_::String"),
+            Err(RosNameError::Shape)
+        );
+        assert_eq!(
+            validate_dds_type_name("std_msgs::msg::String_"),
+            Err(RosNameError::Shape)
+        );
+        assert_eq!(
+            validate_dds_type_name("Std::msg::dds_::String_"),
+            Err(RosNameError::Package)
+        );
+        assert_eq!(
+            validate_dds_type_name("std_msgs::msg::dds_::string_"),
+            Err(RosNameError::Message)
+        );
+    }
+
+    #[test]
+    fn type_hash_is_rihs01_and_64_lowercase_hex() {
+        let good = alloc::format!("RIHS01_{}", "0123456789abcdef".repeat(4));
+        assert_eq!(validate_type_hash(&good), Ok(()));
+
+        let upper = good.to_uppercase();
+        for bad in [
+            "",
+            "RIHS01_",
+            &good[..good.len() - 1],
+            &alloc::format!("{good}0"),
+            &good.replace("RIHS01_", "RIHS02_"),
+            &good.replacen('a', "g", 1),
+            &upper,
+            "TypeHashNotSupported",
+        ] {
+            assert_eq!(validate_type_hash(bad), Err(RosNameError::Hash), "{bad:?}");
+        }
+    }
+}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.rs b/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.rs
new file mode 100644
index 00000000..35ee2edb
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/String", hash = "RIHS01_ABC")]
+struct ShortHash { data: String }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.stderr b/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.stderr
new file mode 100644
index 00000000..ee94c0ff
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_hash.stderr
@@ -0,0 +1,5 @@
+error: type hash must be 'RIHS01_' followed by 64 lowercase hex digits
+ --> tests/compile-fail-ros/bad_hash.rs:5:44
+  |
+5 | #[ros(type = "std_msgs/msg/String", hash = "RIHS01_ABC")]
+  |                                            ^^^^^^^^^^^^
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_package.rs b/aimdb-data-contracts/tests/compile-fail-ros/bad_package.rs
new file mode 100644
index 00000000..ab5c5eaf
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_package.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "Std_msgs/msg/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+struct Upper { data: String }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_package.stderr b/aimdb-data-contracts/tests/compile-fail-ros/bad_package.stderr
new file mode 100644
index 00000000..8222e7d8
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_package.stderr
@@ -0,0 +1,5 @@
+error: package must be lowercase letters, digits and single underscores, starting with a letter and not ending with '_'
+ --> tests/compile-fail-ros/bad_package.rs:5:14
+  |
+5 | #[ros(type = "Std_msgs/msg/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+  |              ^^^^^^^^^^^^^^^^^^^^^
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_type.rs b/aimdb-data-contracts/tests/compile-fail-ros/bad_type.rs
new file mode 100644
index 00000000..9f966280
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_type.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+struct Missing { data: String }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/bad_type.stderr b/aimdb-data-contracts/tests/compile-fail-ros/bad_type.stderr
new file mode 100644
index 00000000..f550337c
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/bad_type.stderr
@@ -0,0 +1,5 @@
+error: expected a ROS message type `pkg/msg/Name`
+ --> tests/compile-fail-ros/bad_type.rs:5:14
+  |
+5 | #[ros(type = "std_msgs/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+  |              ^^^^^^^^^^^^^^^^^
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/enum_type.rs b/aimdb-data-contracts/tests/compile-fail-ros/enum_type.rs
new file mode 100644
index 00000000..dae68475
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/enum_type.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+enum NotAStruct { A }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/enum_type.stderr b/aimdb-data-contracts/tests/compile-fail-ros/enum_type.stderr
new file mode 100644
index 00000000..990b26a9
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/enum_type.stderr
@@ -0,0 +1,5 @@
+error: RosMessage can only be derived for a struct
+ --> tests/compile-fail-ros/enum_type.rs:6:6
+  |
+6 | enum NotAStruct { A }
+  |      ^^^^^^^^^^
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.rs b/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.rs
new file mode 100644
index 00000000..d39ff244
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/String")]
+struct NoHash { data: String }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.stderr b/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.stderr
new file mode 100644
index 00000000..3358a6b9
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/missing_hash.stderr
@@ -0,0 +1,7 @@
+error: RosMessage needs #[ros(hash = "…")]
+ --> tests/compile-fail-ros/missing_hash.rs:4:34
+  |
+4 | #[derive(Serialize, Deserialize, RosMessage)]
+  |                                  ^^^^^^^^^^
+  |
+  = note: this error originates in the derive macro `RosMessage` (in Nightly builds, run with -Z macro-backtrace for more info)
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.rs b/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.rs
new file mode 100644
index 00000000..56421ede
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/Empty", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff")]
+struct Empty;
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.stderr b/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.stderr
new file mode 100644
index 00000000..f9caad97
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/unit_struct.stderr
@@ -0,0 +1,5 @@
+error: RosMessage needs a struct with named fields; for an empty message, add `structure_needs_at_least_one_member: u8` as ROS does
+ --> tests/compile-fail-ros/unit_struct.rs:6:8
+  |
+6 | struct Empty;
+  |        ^^^^^
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.rs b/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.rs
new file mode 100644
index 00000000..7c93dd86
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.rs
@@ -0,0 +1,8 @@
+use aimdb_data_contracts::RosMessage;
+use serde::{Deserialize, Serialize};
+
+#[derive(Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", depth = 10)]
+struct Unknown { data: String }
+
+fn main() {}
diff --git a/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.stderr b/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.stderr
new file mode 100644
index 00000000..8ab943aa
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile-fail-ros/unknown_key.stderr
@@ -0,0 +1,5 @@
+error: expected `type`, `hash` or `encode_capacity`
+ --> tests/compile-fail-ros/unknown_key.rs:5:119
+  |
+5 | #[ros(type = "std_msgs/msg/String", hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff", depth = 10)]
+  |                                                                                                                       ^^^^^
diff --git a/aimdb-data-contracts/tests/compile_fail_ros.rs b/aimdb-data-contracts/tests/compile_fail_ros.rs
new file mode 100644
index 00000000..287331e6
--- /dev/null
+++ b/aimdb-data-contracts/tests/compile_fail_ros.rs
@@ -0,0 +1,10 @@
+//! Compile-fail coverage for `#[derive(RosMessage)]`: malformed `#[ros(..)]`
+//! attributes and unsupported shapes fail at compile time.
+
+#![cfg(feature = "ros2")]
+
+#[test]
+fn compile_fail_ros_messages() {
+    let t = trybuild::TestCases::new();
+    t.compile_fail("tests/compile-fail-ros/*.rs");
+}
diff --git a/aimdb-data-contracts/tests/linkable_derive.rs b/aimdb-data-contracts/tests/linkable_derive.rs
index 2733e293..c195c538 100644
--- a/aimdb-data-contracts/tests/linkable_derive.rs
+++ b/aimdb-data-contracts/tests/linkable_derive.rs
@@ -7,7 +7,7 @@
 
 #![cfg(feature = "linkable-json")]
 
-use aimdb_data_contracts::{Linkable, SchemaType};
+use aimdb_data_contracts::{link_codecs, LinkCodec, Linkable, SchemaType, WireFormat};
 use serde::{Deserialize, Serialize};
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, Linkable)]
@@ -47,3 +47,12 @@ fn rejects_invalid_json() {
     let invalid = b"not valid json";
     assert!(DerivedTemperature::from_bytes(invalid).is_err());
 }
+
+#[test]
+fn declares_json_wire_format() {
+    assert_eq!(DerivedTemperature::WIRE_FORMAT, WireFormat::Json);
+    assert_eq!(
+        <link_codecs::Default as LinkCodec<DerivedTemperature>>::WIRE_FORMAT,
+        WireFormat::Json
+    );
+}
diff --git a/aimdb-data-contracts/tests/ros_message_derive.rs b/aimdb-data-contracts/tests/ros_message_derive.rs
new file mode 100644
index 00000000..c6918366
--- /dev/null
+++ b/aimdb-data-contracts/tests/ros_message_derive.rs
@@ -0,0 +1,313 @@
+//! Behavioral coverage for `#[derive(RosMessage)]`: one struct per row of the
+//! ROS-to-Rust type mapping, checked against golden CDR bytes.
+
+#![cfg(feature = "ros2")]
+
+use aimdb_core::connector::SerializeError;
+use aimdb_data_contracts::{ros2, Linkable, RosMessage, SchemaType, WireFormat};
+use serde::{Deserialize, Serialize};
+
+const HASH: &str = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
+const HEADER: [u8; 4] = [0x00, 0x01, 0x00, 0x00];
+
+fn golden(body: &[u8]) -> Vec<u8> {
+    let mut bytes = HEADER.to_vec();
+    bytes.extend_from_slice(body);
+    bytes
+}
+
+/// Encodes through both paths, checks them against `body`, and decodes back.
+fn assert_golden<T: Linkable + PartialEq + core::fmt::Debug>(value: &T, body: &[u8]) {
+    let expected = golden(body);
+    assert_eq!(value.to_bytes().expect("to_bytes"), expected, "owned path");
+
+    let mut buf = vec![0xA5; T::ENCODE_BUFFER_CAPACITY.expect("bounded")];
+    let written = value.encode_into(&mut buf).expect("encode_into");
+    assert_eq!(&buf[..written], expected.as_slice(), "bounded path");
+
+    assert_eq!(&T::from_bytes(&expected).expect("from_bytes"), value);
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Flag",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Flag {
+    flag: bool,
+}
+
+#[test]
+fn bool_is_one_byte() {
+    assert_golden(&Flag { flag: true }, &[0x01]);
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Bytes",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Bytes {
+    byte: u8,
+    int8: i8,
+}
+
+#[test]
+fn byte_char_uint8_int8_are_one_byte() {
+    assert_golden(
+        &Bytes {
+            byte: 0xFE,
+            int8: -2,
+        },
+        &[0xFE, 0xFE],
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Integers",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Integers {
+    lead: u8,
+    uint16: u16,
+    int32: i32,
+    uint64: u64,
+}
+
+#[test]
+fn integers_are_little_endian_and_aligned_from_the_header() {
+    let mut body = vec![0x01, 0x00]; // lead, pad to 2
+    body.extend_from_slice(&0x0203_u16.to_le_bytes()); // offset 2
+    body.extend_from_slice(&(-4_i32).to_le_bytes()); // offset 4
+    body.extend_from_slice(&0x0506_0708_090A_0B0C_u64.to_le_bytes()); // offset 8
+    assert_golden(
+        &Integers {
+            lead: 1,
+            uint16: 0x0203,
+            int32: -4,
+            uint64: 0x0506_0708_090A_0B0C,
+        },
+        &body,
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Floats",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Floats {
+    float32: f32,
+    float64: f64,
+}
+
+#[test]
+fn float64_aligns_to_eight() {
+    let mut body = 1.5_f32.to_le_bytes().to_vec();
+    body.extend_from_slice(&[0; 4]);
+    body.extend_from_slice(&(-2.25_f64).to_le_bytes());
+    assert_golden(
+        &Floats {
+            float32: 1.5,
+            float64: -2.25,
+        },
+        &body,
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Label",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Label {
+    lead: u8,
+    text: String,
+}
+
+#[test]
+fn string_is_a_u32_length_including_the_nul() {
+    let mut body = vec![0x07, 0, 0, 0]; // lead, pad to 4
+    body.extend_from_slice(&3_u32.to_le_bytes());
+    body.extend_from_slice(b"hi\0");
+    assert_golden(
+        &Label {
+            lead: 7,
+            text: "hi".into(),
+        },
+        &body,
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Fixed",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Fixed {
+    values: [u16; 3],
+}
+
+#[test]
+fn fixed_array_has_no_count() {
+    assert_golden(
+        &Fixed { values: [1, 2, 3] },
+        &[0x01, 0x00, 0x02, 0x00, 0x03, 0x00],
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Samples",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Samples {
+    values: Vec<u32>,
+}
+
+#[test]
+fn sequence_is_a_u32_count_then_elements() {
+    let mut body = 2_u32.to_le_bytes().to_vec();
+    body.extend_from_slice(&10_u32.to_le_bytes());
+    body.extend_from_slice(&20_u32.to_le_bytes());
+    assert_golden(
+        &Samples {
+            values: vec![10, 20],
+        },
+        &body,
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "builtin_interfaces/msg/Time",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Time {
+    sec: i32,
+    nanosec: u32,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Stamped",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Stamped {
+    lead: u8,
+    stamp: Time,
+}
+
+#[test]
+fn nested_message_is_inline() {
+    let mut body = vec![0x09, 0, 0, 0]; // lead, pad to 4
+    body.extend_from_slice(&5_i32.to_le_bytes());
+    body.extend_from_slice(&6_u32.to_le_bytes());
+    assert_golden(
+        &Stamped {
+            lead: 9,
+            stamp: Time { sec: 5, nanosec: 6 },
+        },
+        &body,
+    );
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Bounded",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Bounded {
+    #[ros(max_len = 4)]
+    name: String,
+    #[ros(max_len = 2)]
+    values: Vec<u8>,
+}
+
+#[test]
+fn bounded_string_and_sequence_fail_to_encode_past_their_bound() {
+    let at_bound = Bounded {
+        name: "abcd".into(),
+        values: vec![1, 2],
+    };
+    assert!(at_bound.to_bytes().is_ok());
+
+    let long_name = Bounded {
+        name: "abcde".into(),
+        ..at_bound.clone()
+    };
+    let err = long_name.to_bytes().expect_err("name past bound");
+    assert!(err.contains("`name`"), "{err}");
+    let mut buf = [0_u8; 256];
+    assert_eq!(
+        long_name.encode_into(&mut buf),
+        Err(SerializeError::InvalidData)
+    );
+
+    let long_values = Bounded {
+        values: vec![1, 2, 3],
+        ..at_bound
+    };
+    assert!(long_values
+        .to_bytes()
+        .expect_err("values past bound")
+        .contains("`values`"));
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "cell_msgs/msg/SpindleCommand",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff",
+    encode_capacity = 8
+)]
+struct SpindleCommand {
+    rpm: f64,
+    enabled: bool,
+}
+
+#[test]
+fn identity_constants_follow_the_attributes() {
+    assert_eq!(SpindleCommand::NAME, "cell_msgs/msg/SpindleCommand");
+    assert_eq!(
+        SpindleCommand::ROS_TYPE_NAME,
+        "cell_msgs::msg::dds_::SpindleCommand_"
+    );
+    assert_eq!(SpindleCommand::ROS_TYPE_HASH, HASH);
+    assert_eq!(SpindleCommand::WIRE_FORMAT, WireFormat::Cdr);
+    assert_eq!(SpindleCommand::ENCODE_BUFFER_CAPACITY, Some(8));
+    assert_eq!(Flag::ENCODE_BUFFER_CAPACITY, Some(256), "default capacity");
+}
+
+#[test]
+fn undersized_capacity_reports_buffer_too_small() {
+    // Header (4) + f64 at offset 0 (8) + bool = 13 bytes, more than 8.
+    let value = SpindleCommand {
+        rpm: 1200.0,
+        enabled: true,
+    };
+    let mut buf = [0_u8; 8];
+    assert_eq!(
+        value.encode_into(&mut buf),
+        Err(SerializeError::BufferTooSmall)
+    );
+    assert_eq!(value.to_bytes().expect("owned fallback").len(), 13);
+}
+
+#[test]
+fn derived_names_agree_with_the_runtime_rules() {
+    fn check<T: RosMessage>() {
+        assert_eq!(
+            ros2::dds_type_name(T::NAME).as_deref(),
+            Ok(T::ROS_TYPE_NAME),
+            "{}",
+            T::NAME
+        );
+        assert_eq!(ros2::validate_dds_type_name(T::ROS_TYPE_NAME), Ok(()));
+        assert_eq!(ros2::validate_type_hash(T::ROS_TYPE_HASH), Ok(()));
+    }
+    check::<Flag>();
+    check::<Integers>();
+    check::<Time>();
+    check::<SpindleCommand>();
+}
diff --git a/aimdb-derive/CHANGELOG.md b/aimdb-derive/CHANGELOG.md
index 03ae7e2c..2de705d9 100644
--- a/aimdb-derive/CHANGELOG.md
+++ b/aimdb-derive/CHANGELOG.md
@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`#[derive(RosMessage)]`** for a struct mirroring a ROS 2 message: emits
+  `SchemaType` (`NAME` = the ROS type), a CDR `Linkable` through `aimdb-cdr`
+  with a bounded `encode_into`, and `RosMessage`.
+  `#[ros(type = "pkg/msg/Name", hash = "RIHS01_…")]` is required and checked
+  at compile time; `#[ros(encode_capacity = N)]` sizes the scratch (default
+  256); `#[ros(max_len = N)]` bounds a `String` or `Vec` field, refused on
+  encode past it. Generic types, enums, and tuple or unit structs are refused.
+
+### Changed
+
+- **`#[derive(Linkable)]` sets `WIRE_FORMAT = Json`.**
+
 ## [0.2.0] - 2026-09-18
 
 ### Added
diff --git a/aimdb-derive/src/lib.rs b/aimdb-derive/src/lib.rs
index bd9f6f4a..b88bfd0f 100644
--- a/aimdb-derive/src/lib.rs
+++ b/aimdb-derive/src/lib.rs
@@ -30,6 +30,7 @@ use quote::quote;
 use syn::{parse_macro_input, Data, DeriveInput, Error, Fields, Lit, Meta};
 
 mod migration_chain;
+mod ros_message;
 
 /// Variable-arity replacement for `aimdb-data-contracts`'s old 3-arm
 /// `macro_rules! migration_chain`. Re-exported as
@@ -73,6 +74,9 @@ pub fn derive_linkable(input: TokenStream) -> TokenStream {
 
     let expanded = quote! {
         impl ::aimdb_data_contracts::Linkable for #name {
+            const WIRE_FORMAT: ::aimdb_data_contracts::WireFormat =
+                ::aimdb_data_contracts::WireFormat::Json;
+
             fn from_bytes(
                 data: &[u8],
             ) -> Result<Self, ::aimdb_data_contracts::__private::alloc::string::String> {
@@ -97,6 +101,53 @@ pub fn derive_linkable(input: TokenStream) -> TokenStream {
     expanded.into()
 }
 
+/// Derive `RosMessage` for a struct that mirrors a ROS 2 message.
+///
+/// Emits three impls:
+/// - `SchemaType`, with `NAME` set to the ROS type (`pkg/msg/Name`);
+/// - `Linkable` as CDR through `aimdb-cdr`, with a bounded `encode_into`;
+/// - `RosMessage`, with the DDS type name derived from the ROS type.
+///
+/// Requires `Serialize + Deserialize` and the `ros2` feature of
+/// `aimdb-data-contracts`. Fields must follow the `.msg` in order and type,
+/// since CDR is positional; an empty message carries
+/// `structure_needs_at_least_one_member: u8`, as ROS does.
+///
+/// Attributes:
+/// - `#[ros(type = "pkg/msg/Name", hash = "RIHS01_…")]`, both required and
+///   checked at compile time. Copy the hash from `ros2 topic info -v`.
+/// - `#[ros(encode_capacity = N)]`: the scratch buffer for the bounded encode
+///   path, 256 bytes by default.
+/// - `#[ros(max_len = N)]` on a `String` or `Vec` field, for a bounded
+///   `string<=N` or `T[<=N]`: encoding fails when the field is longer
+///   (bytes for a string, elements for a sequence).
+///
+/// # Example
+///
+/// Illustrative (not compiled: see the crate-level note — compiled
+/// integration tests live in `aimdb-data-contracts`).
+///
+/// ```rust,ignore
+/// use aimdb_data_contracts::RosMessage;
+/// use serde::{Deserialize, Serialize};
+///
+/// #[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+/// #[ros(type = "cell_msgs/msg/SpindleCommand", hash = "RIHS01_…")]
+/// pub struct SpindleCommand {
+///     pub rpm: f64,
+///     pub enabled: bool,
+///     #[ros(max_len = 32)]
+///     pub tool_id: String,
+/// }
+/// ```
+#[proc_macro_derive(RosMessage, attributes(ros))]
+pub fn derive_ros_message(input: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(input as DeriveInput);
+    ros_message::derive(input)
+        .unwrap_or_else(Error::into_compile_error)
+        .into()
+}
+
 /// Derive the `RecordKey` trait for an enum
 ///
 /// Each variant must have a `#[key = "..."]` attribute specifying its string key.
diff --git a/aimdb-derive/src/ros_message.rs b/aimdb-derive/src/ros_message.rs
new file mode 100644
index 00000000..7ff23e3e
--- /dev/null
+++ b/aimdb-derive/src/ros_message.rs
@@ -0,0 +1,231 @@
+//! `#[derive(RosMessage)]`: `SchemaType`, a CDR `Linkable` and `RosMessage`.
+
+use proc_macro2::{Span, TokenStream};
+use quote::quote;
+use syn::{Data, DeriveInput, Error, Fields, LitInt, LitStr, Result};
+
+const DEFAULT_ENCODE_CAPACITY: usize = 256;
+
+struct Container {
+    ros_type: LitStr,
+    dds_name: String,
+    hash: LitStr,
+    encode_capacity: usize,
+}
+
+pub fn derive(input: DeriveInput) -> Result<TokenStream> {
+    let name = &input.ident;
+    if !input.generics.params.is_empty() {
+        return Err(Error::new_spanned(
+            &input.generics,
+            "RosMessage cannot be derived for a generic type",
+        ));
+    }
+    let fields = match &input.data {
+        Data::Struct(data) => match &data.fields {
+            Fields::Named(fields) if !fields.named.is_empty() => &fields.named,
+            _ => {
+                return Err(Error::new_spanned(
+                    name,
+                    "RosMessage needs a struct with named fields; for an empty message, \
+                     add `structure_needs_at_least_one_member: u8` as ROS does",
+                ))
+            }
+        },
+        _ => {
+            return Err(Error::new_spanned(
+                name,
+                "RosMessage can only be derived for a struct",
+            ))
+        }
+    };
+
+    let container = parse_container(&input)?;
+    let mut bound_checks = Vec::new();
+    for field in fields {
+        let (Some(max_len), Some(ident)) = (parse_max_len(&field.attrs)?, &field.ident) else {
+            continue;
+        };
+        let field_name = ident.to_string();
+        bound_checks.push(quote! {
+            if self.#ident.len() > #max_len {
+                return ::core::result::Result::Err(#field_name);
+            }
+        });
+    }
+
+    let Container {
+        ros_type,
+        dds_name,
+        hash,
+        encode_capacity,
+    } = container;
+    let dc = quote!(::aimdb_data_contracts);
+    let p = quote!(::aimdb_data_contracts::__private);
+
+    Ok(quote! {
+        impl #dc::SchemaType for #name {
+            const NAME: &'static str = #ros_type;
+        }
+
+        impl #name {
+            /// The first field whose `#[ros(max_len)]` bound the value exceeds.
+            #[doc(hidden)]
+            fn __aimdb_ros_check_bounds(&self) -> ::core::result::Result<(), &'static str> {
+                #(#bound_checks)*
+                ::core::result::Result::Ok(())
+            }
+        }
+
+        impl #dc::Linkable for #name {
+            const ENCODE_BUFFER_CAPACITY: ::core::option::Option<usize> =
+                ::core::option::Option::Some(#encode_capacity);
+            const WIRE_FORMAT: #dc::WireFormat = #dc::WireFormat::Cdr;
+
+            fn from_bytes(data: &[u8]) -> ::core::result::Result<Self, #p::alloc::string::String> {
+                #p::aimdb_cdr::from_bytes(data)
+                    .map_err(|e| #p::alloc::string::ToString::to_string(&e))
+            }
+
+            fn to_bytes(
+                &self,
+            ) -> ::core::result::Result<#p::alloc::vec::Vec<u8>, #p::alloc::string::String> {
+                self.__aimdb_ros_check_bounds().map_err(|field| {
+                    #p::alloc::format!("field `{}` exceeds its #[ros(max_len)] bound", field)
+                })?;
+                #p::aimdb_cdr::to_vec(self).map_err(|e| #p::alloc::string::ToString::to_string(&e))
+            }
+
+            fn encode_into(
+                &self,
+                buf: &mut [u8],
+            ) -> ::core::result::Result<usize, #p::SerializeError> {
+                self.__aimdb_ros_check_bounds()
+                    .map_err(|_| #p::SerializeError::InvalidData)?;
+                match #p::aimdb_cdr::to_slice(self, buf) {
+                    ::core::result::Result::Ok(used) => ::core::result::Result::Ok(used),
+                    ::core::result::Result::Err(#p::aimdb_cdr::Error::BufferTooSmall) => {
+                        ::core::result::Result::Err(#p::SerializeError::BufferTooSmall)
+                    }
+                    ::core::result::Result::Err(_) => {
+                        ::core::result::Result::Err(#p::SerializeError::InvalidData)
+                    }
+                }
+            }
+        }
+
+        impl #dc::RosMessage for #name {
+            const ROS_TYPE_NAME: &'static str = #dds_name;
+            const ROS_TYPE_HASH: &'static str = #hash;
+        }
+    })
+}
+
+fn parse_container(input: &DeriveInput) -> Result<Container> {
+    let mut ros_type: Option<LitStr> = None;
+    let mut hash: Option<LitStr> = None;
+    let mut encode_capacity = DEFAULT_ENCODE_CAPACITY;
+
+    for attr in input.attrs.iter().filter(|a| a.path().is_ident("ros")) {
+        attr.parse_nested_meta(|meta| {
+            if meta.path.is_ident("type") {
+                ros_type = Some(meta.value()?.parse()?);
+            } else if meta.path.is_ident("hash") {
+                hash = Some(meta.value()?.parse()?);
+            } else if meta.path.is_ident("encode_capacity") {
+                let lit: LitInt = meta.value()?.parse()?;
+                encode_capacity = lit.base10_parse()?;
+                if encode_capacity == 0 {
+                    return Err(Error::new_spanned(
+                        lit,
+                        "encode_capacity must be at least 1",
+                    ));
+                }
+            } else {
+                return Err(meta.error("expected `type`, `hash` or `encode_capacity`"));
+            }
+            Ok(())
+        })?;
+    }
+
+    let missing = |what: &str| {
+        Error::new(
+            Span::call_site(),
+            format!("RosMessage needs #[ros({what} = \"…\")]"),
+        )
+    };
+    let ros_type = ros_type.ok_or_else(|| missing("type"))?;
+    let hash = hash.ok_or_else(|| missing("hash"))?;
+
+    let dds_name =
+        dds_type_name(&ros_type.value()).map_err(|why| Error::new_spanned(&ros_type, why))?;
+    check_hash(&hash.value()).map_err(|why| Error::new_spanned(&hash, why))?;
+
+    Ok(Container {
+        ros_type,
+        dds_name,
+        hash,
+        encode_capacity,
+    })
+}
+
+fn parse_max_len(attrs: &[syn::Attribute]) -> Result<Option<usize>> {
+    let mut max_len = None;
+    for attr in attrs.iter().filter(|a| a.path().is_ident("ros")) {
+        attr.parse_nested_meta(|meta| {
+            if meta.path.is_ident("max_len") {
+                let lit: LitInt = meta.value()?.parse()?;
+                max_len = Some(lit.base10_parse()?);
+                Ok(())
+            } else {
+                Err(meta.error("expected `max_len` on a field"))
+            }
+        })?;
+    }
+    Ok(max_len)
+}
+
+// The rules match `aimdb_data_contracts::ros2`, which this crate cannot
+// depend on; the data-contracts tests check that both agree.
+
+fn dds_type_name(ros_type: &str) -> core::result::Result<String, &'static str> {
+    let mut parts = ros_type.split('/');
+    let (Some(package), Some("msg"), Some(message), None) =
+        (parts.next(), parts.next(), parts.next(), parts.next())
+    else {
+        return Err("expected a ROS message type `pkg/msg/Name`");
+    };
+    let pb = package.as_bytes();
+    let package_ok = pb.first().is_some_and(u8::is_ascii_lowercase)
+        && pb.last() != Some(&b'_')
+        && !package.contains("__")
+        && pb
+            .iter()
+            .all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || *b == b'_');
+    if !package_ok {
+        return Err(
+            "package must be lowercase letters, digits and single underscores, \
+                    starting with a letter and not ending with '_'",
+        );
+    }
+    let mb = message.as_bytes();
+    if !(mb.first().is_some_and(u8::is_ascii_uppercase) && mb.iter().all(u8::is_ascii_alphanumeric))
+    {
+        return Err("message name must start with an uppercase letter, then letters and digits");
+    }
+    Ok(format!("{package}::msg::dds_::{message}_"))
+}
+
+fn check_hash(hash: &str) -> core::result::Result<(), &'static str> {
+    match hash.strip_prefix("RIHS01_") {
+        Some(digits)
+            if digits.len() == 64
+                && digits
+                    .bytes()
+                    .all(|b| matches!(b, b'0'..=b'9' | b'a'..=b'f')) =>
+        {
+            Ok(())
+        }
+        _ => Err("type hash must be 'RIHS01_' followed by 64 lowercase hex digits"),
+    }
+}
diff --git a/aimdb-mqtt-connector/src/publish_opts.rs b/aimdb-mqtt-connector/src/publish_opts.rs
index 4c992c04..e081c6f9 100644
--- a/aimdb-mqtt-connector/src/publish_opts.rs
+++ b/aimdb-mqtt-connector/src/publish_opts.rs
@@ -67,6 +67,7 @@ mod tests {
             .collect();
         RouteInfo {
             id: 0,
+            type_id: core::any::TypeId::of::<()>(),
             default_topic: Arc::from("sensors/t"),
             config: ConnectorConfig::from_query(&query),
             topic_capacity: 0,
diff --git a/aimdb-zenoh-connector/CHANGELOG.md b/aimdb-zenoh-connector/CHANGELOG.md
new file mode 100644
index 00000000..f0abd026
--- /dev/null
+++ b/aimdb-zenoh-connector/CHANGELOG.md
@@ -0,0 +1,50 @@
+# Changelog - aimdb-zenoh-connector
+
+All notable changes to the `aimdb-zenoh-connector` crate will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+
+- **First release: Zenoh links, and AimDB records as ROS 2 topics** through
+  rmw_zenoh, on the `zenoh` crate (`std` feature). The `zenoh-nostd` backend
+  for microcontrollers follows once zenoh-nostd is on crates.io.
+- **`ZenohConnector`** for `zenoh://` links.
+  - Outbound: one publisher per fixed key; a topic writer's keys are checked
+    per message. A key with a wildcard fails the build.
+  - Inbound: `ZenohGrammar` (`*`, `**` anywhere, `$*` within a chunk,
+    verbatim `@` chunks, `{name}`/`{name..}` captures and keys) and one
+    subscriber per filter of the covering set. A sample that several
+    subscribers receive is ingested once per route.
+  - Remote-only: the connector never receives its own publications. Deletes
+    and samples on wildcard keys are dropped.
+  - `with_zenoh_config` for peer mode, TLS, QUIC and the rest
+    (`transport-tls`, `transport-quic`, `transport-ws`) and authentication
+    (`auth-usrpwd`). Transport compression stays off; see the
+    crate docs.
+  - Opening the session never stalls the database: each attempt runs on a
+    task of its own. Needs Tokio's multi-thread scheduler.
+  - A deserializer that panics drops its sample; keys longer than the wire
+    format's 65,535 bytes are refused.
+- **`Ros2Connector`** for `ros2://` links, as a ROS 2 node (`Ros2Node`, with
+  a namespace) in a domain (`domain_id`, else `ROS_DOMAIN_ID` read as `rcl`
+  reads it, else 0; above 232 warns). Types are registered with
+  `.register::<T: RosMessage>()`.
+  - Outbound links are publishers: rmw_zenoh data keys, node and publisher
+    liveliness tokens, and the attachment (sequence, timestamp, GID).
+  - Inbound links are subscriptions: one subscriber per topic, dispatched to
+    every record linked to it.
+  - `Ros2LinkExt::with_depth` and `with_reliability` set the advertised QoS
+    (default `KEEP_LAST` 10, `RELIABLE`, `VOLATILE`); reliability is not yet
+    applied on the wire.
+  - `build()` refuses an unregistered type, a non-CDR codec, a topic writer,
+    a pattern, two ROS types on one topic, invalid ROS names and a bad
+    `ROS_DOMAIN_ID`; a custom (de)serializer warns.
+- **`zenoh.ros2(node)`**: a `Ros2Connector` on the `ZenohConnector`'s session,
+  so a gateway (`zenoh://` from devices, `ros2://` to robots) keeps one
+  router connection.
+- Tested against an in-process router, and against Jazzy's and Lyrical's
+  `rmw_zenohd` with the ROS 2 CLI in CI (`make ros2-interop`).
diff --git a/aimdb-zenoh-connector/Cargo.toml b/aimdb-zenoh-connector/Cargo.toml
new file mode 100644
index 00000000..fbe8091d
--- /dev/null
+++ b/aimdb-zenoh-connector/Cargo.toml
@@ -0,0 +1,72 @@
+[package]
+name = "aimdb-zenoh-connector"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+authors.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "Zenoh connector for AimDB, with an rmw_zenoh-compatible ROS 2 profile"
+keywords = ["zenoh", "ros2", "connector", "embedded", "aimdb"]
+categories = ["network-programming", "embedded", "asynchronous"]
+
+[features]
+default = ["aimdb-core/alloc"]
+# The `zenoh` crate backend: `zenoh://` and `ros2://`, over TCP and UDP.
+std = [
+    "aimdb-core/std",
+    "aimdb-core/alloc",
+    "dep:zenoh",
+    "dep:tokio",
+    "dep:aimdb-data-contracts",
+]
+# Further Zenoh transports for the `std` backend, for `with_zenoh_config`.
+transport-tls = ["std", "zenoh/transport_tls"]
+transport-quic = ["std", "zenoh/transport_quic"]
+transport-ws = ["std", "zenoh/transport_ws"]
+# User/password authentication for the `std` backend. Without it,
+# `transport/auth/usrpwd` in a config is ignored. Pubkey auth pulls in `rsa`
+# (RUSTSEC-2023-0071) and is left out.
+auth-usrpwd = ["std", "zenoh/auth_usrpwd"]
+# Log through aimdb-core's facade.
+tracing = ["aimdb-core/tracing"]
+log = ["aimdb-core/log"]
+# Reserved for the `zenoh-nostd` backend (`zenoh://` only), once zenoh-nostd is
+# on crates.io; today the `no_std` parts such as `ZenohGrammar`.
+embedded = ["aimdb-core/alloc"]
+
+[dependencies]
+aimdb-core = { version = "2.0.0", path = "../aimdb-core", default-features = false }
+zenoh = { version = "1.10.1", default-features = false, features = [
+    "transport_tcp",
+    "transport_udp",
+], optional = true }
+# The session task's retry wait; zenoh itself runs on tokio.
+tokio = { workspace = true, features = ["time"], optional = true }
+# `RosMessage` and the recorded wire format, for `ros2://` links.
+aimdb-data-contracts = { version = "0.2.0", path = "../aimdb-data-contracts", default-features = false, features = [
+    "ros2",
+], optional = true }
+# XXH3-128 for rmw_zenoh GIDs; no_std.
+twox-hash = { version = "2", default-features = false, features = ["xxhash3_128"] }
+
+[dev-dependencies]
+# Reference matcher: oracle for `ZenohGrammar`'s matching and covering.
+zenoh-keyexpr = "1.10.1"
+# `tests/inbound_routes.rs`: links through core's router on a real runtime.
+aimdb-tokio-adapter = { path = "../aimdb-tokio-adapter", features = ["tokio-runtime"] }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+# `tests/ros2_outbound.rs`: derived ROS types and a non-CDR codec.
+aimdb-data-contracts = { path = "../aimdb-data-contracts", features = ["ros2", "linkable-json"] }
+serde = { version = "1", features = ["derive"] }
+# The `register` bound, as a compile error.
+trybuild = "1.0"
+
+[[example]]
+name = "ros2_talker"
+required-features = ["std"]
+
+[[example]]
+name = "ros2_listener"
+required-features = ["std"]
diff --git a/aimdb-zenoh-connector/README.md b/aimdb-zenoh-connector/README.md
new file mode 100644
index 00000000..1f4c2950
--- /dev/null
+++ b/aimdb-zenoh-connector/README.md
@@ -0,0 +1,162 @@
+# aimdb-zenoh-connector
+
+Zenoh connector for AimDB, with an rmw_zenoh-compatible ROS 2 profile:
+`zenoh://` links for plain Zenoh, and `ros2://` links that make AimDB records
+ROS 2 topics. No ROS installation is needed on the AimDB side, only a Zenoh
+router such as `rmw_zenohd`.
+
+## Installation
+
+```toml
+[dependencies]
+aimdb-zenoh-connector = { version = "0.1", features = ["std"] }
+# ROS 2 message types: #[derive(RosMessage)]
+aimdb-data-contracts = { version = "0.2", features = ["ros2"] }
+```
+
+| Feature | What it adds |
+|---|---|
+| `std` | The `zenoh` crate backend: `zenoh://` and `ros2://`, over TCP and UDP |
+| `transport-tls`, `transport-quic`, `transport-ws` | Further Zenoh transports for `with_zenoh_config` |
+| `auth-usrpwd` | Zenoh user/password authentication; without it `transport/auth/usrpwd` in a config is ignored. Pubkey auth is left out: it pulls in `rsa` (RUSTSEC-2023-0071); use mutual TLS instead |
+| `tracing`, `log` | Logging through aimdb-core's facade |
+| `embedded` | Reserved for the `zenoh-nostd` backend, which follows once zenoh-nostd is on crates.io |
+
+The `std` backend needs Tokio's multi-thread scheduler (one worker thread is
+enough); `build()` fails on the current-thread scheduler.
+
+## ROS 2 topics
+
+A ROS message is a struct with the `.msg`'s fields, in order, and one derive.
+Copy the type hash from `ros2 topic info -v` on the robot.
+
+```rust,ignore
+use aimdb_data_contracts::{LinkableRegistrarExt, RosMessage};
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+
+#[derive(Clone, Debug, serde::Serialize, serde::Deserialize, RosMessage)]
+#[ros(type = "cell_msgs/msg/SpindleCommand", hash = "RIHS01_<64 hex>")]
+pub struct SpindleCommand {
+    pub rpm: f64,
+    pub enabled: bool,
+}
+
+let ros2 = Ros2Connector::new("tcp/192.168.10.5:7447",
+        Ros2Node::new("cell4_gateway").namespace("/cell4"))
+    .domain_id(7)                              // else ROS_DOMAIN_ID, else 0
+    .register::<Temperature>()
+    .register::<SpindleCommand>();
+
+let mut builder = AimDbBuilder::new().runtime(runtime).with_connector(ros2);
+builder.configure::<Temperature>("cell4.temperature", |reg| {
+    reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+        .linked_to("ros2://cell4/temperature");     // a ROS publisher
+});
+builder.configure::<SpindleCommand>("cell4.spindle.cmd", |reg| {
+    reg.buffer(BufferCfg::Mailbox)
+        .linked_from("ros2://cell4/spindle_cmd");   // a ROS subscription
+});
+```
+
+- A `ros2://` URL names a fully qualified topic: `ros2://cell4/temperature` is
+  `/cell4/temperature`. The node's namespace sets its identity, not its topics.
+- Each link advertises `KEEP_LAST` 10, `RELIABLE`, `VOLATILE`. Override per link
+  with `Ros2LinkExt`:
+
+  ```rust,ignore
+  reg.link_to("ros2://cell4/temperature")
+      .with_link_codec(link_codecs::Default)
+      .with_depth(1)
+      .with_reliability(Reliability::BestEffort)
+      .finish();
+  ```
+
+- `build()` fails for a type that is not registered, a codec other than CDR,
+  a topic writer, a `{…}` pattern, two ROS types on one topic, and an invalid
+  ROS name or `ROS_DOMAIN_ID`. A domain above 232 warns.
+
+See [AimDB and ROS 2](https://github.com/aimdb-dev/aimdb/blob/main/docs/aimdb-and-ros2.md) for the type mapping, the
+gateway pattern and how to check the result with the ROS 2 CLI.
+
+## Plain Zenoh
+
+```rust,ignore
+use aimdb_zenoh_connector::ZenohConnector;
+
+let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+builder.with_connector(zenoh);
+
+builder.configure::<MachineState>("cell4.state", |reg| {
+    reg.buffer(BufferCfg::SingleLatest)
+        .linked_to_with("zenoh://aimdb/cell4/state", Postcard::<128>);
+});
+builder.configure::<MachineState>("cells.state", |reg| {
+    reg.buffer(BufferCfg::SpmcRing { capacity: 64 })
+        .link_from("zenoh://aimdb/{cell}/state")      // every cell
+        .key("cell", 64)                              // a KeyId per cell
+        .with_match_deserializer(|_ctx, m, bytes| decode(m.get("cell"), bytes))
+        .finish();
+});
+```
+
+- Inbound keys follow Zenoh's rules: `*` one chunk, `**` any number, `$*` within
+  a chunk; `{name}` and `{name..}` capture whole chunks. A sample is ingested
+  once per route, even when several subscriptions receive it.
+- Subscriptions and publications are remote-only: the connector never receives
+  its own puts. Deletes and samples on wildcard keys are dropped.
+- `with_zenoh_config(zenoh::Config)` starts from your own Zenoh configuration:
+  peer mode, TLS, QUIC, access control.
+
+## Both on one session
+
+A gateway bridges devices on plain Zenoh to ROS 2. Derive the ROS view from
+the Zenoh connector so both share one router connection, and register both
+on the same `AimDbBuilder`:
+
+```rust,ignore
+let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+let ros2 = zenoh.ros2(Ros2Node::new("cell4_gateway")).register::<Temperature>();
+let mut builder = AimDbBuilder::new().runtime(runtime)
+    .with_connector(zenoh)
+    .with_connector(ros2);
+
+builder.configure::<Temperature>("cell4.temperature", |reg| {
+    reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+        .linked_from("zenoh://cell4/probe/temperature")
+        .linked_to("ros2://cell4/temperature");
+});
+```
+
+## Limits
+
+- **Reliability is advertised, not applied.** A `BEST_EFFORT` link says so in
+  its token but is sent on Zenoh's default reliable path, because zenoh 1.10's
+  publisher reliability is still an unstable API.
+- **No services, actions or `TRANSIENT_LOCAL`** yet.
+- **Deserializers run on Zenoh's receive thread.** A slow one delays every
+  subscription on the session; one that panics drops its sample, logged.
+- **Keys are at most 65,535 bytes**, the Zenoh wire format's limit: a longer
+  fixed key fails the build, a longer written key is skipped.
+- **An inner `**` is exposed to
+  [zenoh#2836](https://github.com/eclipse-zenoh/zenoh/issues/2836).** Zenoh
+  checks each delivered sample against every subscription with `intersects`,
+  which recurses once per chunk under a `**` that more chunks follow. On an
+  inbound link such as `zenoh://site/{path..}/state`, one sample with a long
+  matching key (about 64 KB) overflows a stack and aborts the process. A `**`
+  or `{name..}` at the end of a link is not affected.
+- **Transport compression stays off.** zenoh 1.10.1 decompresses through
+  `lz4_flex` 0.10.0, which has RUSTSEC-2026-0041; this crate never enables it.
+  An application whose own dependencies enable `zenoh`'s compression, for
+  example `zenoh` with default features, compiles that path in.
+
+## Testing
+
+```text
+cargo test -p aimdb-zenoh-connector --features std   # includes an in-process router
+make ros2-interop DISTRO=lyrical                      # against real ROS 2, in Docker
+```
+
+The examples `ros2_talker` and `ros2_listener` are a publisher and a
+subscription for trying the connector against a ROS 2 host.
+
+Design: [053 — Zenoh connector](https://github.com/aimdb-dev/aimdb/blob/main/docs/design/053-zenoh-connector.md).
diff --git a/aimdb-zenoh-connector/examples/ros2_listener.rs b/aimdb-zenoh-connector/examples/ros2_listener.rs
new file mode 100644
index 00000000..6f859ab0
--- /dev/null
+++ b/aimdb-zenoh-connector/examples/ros2_listener.rs
@@ -0,0 +1,49 @@
+//! Prints every `std_msgs/msg/String` published on `/aimdb_cmd`, as node
+//! `/aimdb/listener`, through the Zenoh router at `ZENOH_ENDPOINT`
+//! (default `tcp/127.0.0.1:7447`).
+//!
+//! ```text
+//! cargo run -p aimdb-zenoh-connector --features std --example ros2_listener
+//! ros2 topic pub /aimdb_cmd std_msgs/msg/String "{data: hello}"
+//! ```
+
+use std::sync::Arc;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::AimDbBuilder;
+use aimdb_data_contracts::{LinkableRegistrarExt, RosMessage};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+use serde::{Deserialize, Serialize};
+
+/// `std_msgs/msg/String`, with the hash Jazzy and Lyrical publish.
+#[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "std_msgs/msg/String",
+    hash = "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"
+)]
+struct StringMsg {
+    data: String,
+}
+
+#[tokio::main]
+async fn main() {
+    let endpoint = std::env::var("ZENOH_ENDPOINT").unwrap_or_else(|_| "tcp/127.0.0.1:7447".into());
+    let ros2 = Ros2Connector::new(endpoint, Ros2Node::new("listener").namespace("/aimdb"))
+        .register::<StringMsg>();
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ros2);
+    builder.configure::<StringMsg>("command", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+        reg.linked_from("ros2://aimdb_cmd");
+    });
+    let (db, runner) = builder.build().await.expect("build");
+    let mut reader = db.subscribe::<StringMsg>("command").expect("reader");
+    tokio::spawn(runner.run());
+
+    while let Ok(msg) = reader.recv().await {
+        println!("received: {}", msg.data);
+    }
+}
diff --git a/aimdb-zenoh-connector/examples/ros2_talker.rs b/aimdb-zenoh-connector/examples/ros2_talker.rs
new file mode 100644
index 00000000..3e532942
--- /dev/null
+++ b/aimdb-zenoh-connector/examples/ros2_talker.rs
@@ -0,0 +1,58 @@
+//! Publishes `std_msgs/msg/String` on `/aimdb_chatter`, as node
+//! `/aimdb/talker`, through the Zenoh router at `ZENOH_ENDPOINT`
+//! (default `tcp/127.0.0.1:7447`).
+//!
+//! ```text
+//! cargo run -p aimdb-zenoh-connector --features std --example ros2_talker
+//! ros2 topic echo /aimdb_chatter        # on a ROS 2 host with rmw_zenoh
+//! ```
+
+use std::sync::Arc;
+use std::time::Duration;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::AimDbBuilder;
+use aimdb_data_contracts::{LinkableRegistrarExt, RosMessage};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+use serde::{Deserialize, Serialize};
+
+/// `std_msgs/msg/String`, with the hash Jazzy and Lyrical publish.
+#[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "std_msgs/msg/String",
+    hash = "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"
+)]
+struct StringMsg {
+    data: String,
+}
+
+#[tokio::main]
+async fn main() {
+    let endpoint = std::env::var("ZENOH_ENDPOINT").unwrap_or_else(|_| "tcp/127.0.0.1:7447".into());
+    let ros2 = Ros2Connector::new(endpoint, Ros2Node::new("talker").namespace("/aimdb"))
+        .register::<StringMsg>();
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ros2);
+    builder.configure::<StringMsg>("chatter", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+        reg.linked_to("ros2://aimdb_chatter");
+    });
+    let (db, runner) = builder.build().await.expect("build");
+    tokio::spawn(runner.run());
+
+    let mut n: u64 = 0;
+    loop {
+        n += 1;
+        db.produce(
+            "chatter",
+            StringMsg {
+                data: format!("aimdb {n}"),
+            },
+        )
+        .unwrap();
+        tokio::time::sleep(Duration::from_millis(500)).await;
+    }
+}
diff --git a/aimdb-zenoh-connector/src/connector.rs b/aimdb-zenoh-connector/src/connector.rs
new file mode 100644
index 00000000..9dcfa63f
--- /dev/null
+++ b/aimdb-zenoh-connector/src/connector.rs
@@ -0,0 +1,121 @@
+//! `ZenohConnector` over a protocol backend.
+
+use alloc::boxed::Box;
+use alloc::string::String;
+use alloc::vec::Vec;
+use core::future::Future;
+use core::pin::Pin;
+
+use aimdb_core::connector::ConnectorBuilder;
+use aimdb_core::{AimDb, DbResult};
+
+/// The runner's collected future type.
+pub(crate) type BoxFuture = Pin<Box<dyn Future<Output = ()> + Send + 'static>>;
+/// What [`ConnectorBuilder::build`] returns.
+pub(crate) type BuildFuture<'a> =
+    Pin<Box<dyn Future<Output = DbResult<Vec<BoxFuture>>> + Send + 'a>>;
+
+/// The `zenoh` crate backend. Selected by supplying no transport.
+#[derive(Clone)]
+pub struct Native {
+    #[cfg(feature = "std")]
+    pub(crate) shared: alloc::sync::Arc<crate::shared::Shared>,
+}
+
+impl Native {
+    #[cfg_attr(not(feature = "std"), allow(unused_variables))]
+    fn new(endpoint: &str) -> Self {
+        Self {
+            #[cfg(feature = "std")]
+            shared: crate::shared::Shared::new(String::from(endpoint)),
+        }
+    }
+}
+
+/// A connector for `zenoh://` links over the backend `B`.
+///
+/// ```rust,ignore
+/// let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+/// builder.with_connector(zenoh);
+/// ```
+pub struct ZenohConnector<B = Native> {
+    pub(crate) endpoint: String,
+    pub(crate) backend: B,
+}
+
+impl ZenohConnector<Native> {
+    /// Connect to a Zenoh router at `endpoint`, in Zenoh's locator syntax
+    /// (`tcp/host:port`). An empty endpoint adds none: the session then
+    /// follows its config, whose defaults scout the LAN by multicast and
+    /// connect to whatever answers. Pair it with `with_zenoh_config` (with
+    /// `std`).
+    pub fn new(endpoint: impl Into<String>) -> Self {
+        let endpoint = endpoint.into();
+        Self {
+            backend: Native::new(&endpoint),
+            endpoint,
+        }
+    }
+
+    /// Start from `config` instead of Zenoh's defaults in client mode: peer
+    /// mode, TLS, QUIC, access control. The endpoint passed to
+    /// [`new`](Self::new), if not empty, replaces `connect/endpoints`.
+    #[cfg(feature = "std")]
+    pub fn with_zenoh_config(self, config: zenoh::Config) -> Self {
+        self.backend.shared.set_config(config);
+        self
+    }
+
+    /// `ros2://` links on this connector's session: one router connection for
+    /// both schemes. Register both connectors on the same `AimDbBuilder`:
+    /// the session belongs to the first of them to build.
+    ///
+    /// ```rust,ignore
+    /// let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+    /// let ros2 = zenoh.ros2(Ros2Node::new("cell4_gateway")).register::<Temperature>();
+    /// builder.with_connector(zenoh).with_connector(ros2);
+    /// ```
+    #[cfg(feature = "std")]
+    pub fn ros2(&self, node: crate::Ros2Node) -> crate::Ros2Connector {
+        crate::Ros2Connector::on(self.backend.shared.clone(), node)
+    }
+}
+
+mod sealed {
+    pub trait Sealed {}
+    impl Sealed for super::Native {}
+}
+
+/// A backend with a build path compiled in.
+///
+/// Implemented for [`Native`] only under `std`.
+#[diagnostic::on_unimplemented(
+    message = "`ZenohConnector<{Self}>` has no Zenoh backend compiled in",
+    label = "no backend for this configuration",
+    note = "enable this crate's `std` feature for the `zenoh` crate backend"
+)]
+pub trait Backend: sealed::Sealed + Send + Sync {
+    /// Build this backend's session task.
+    fn build<'a>(&'a self, db: &'a AimDb, endpoint: &'a str) -> BuildFuture<'a>;
+}
+
+#[cfg(feature = "std")]
+impl Backend for Native {
+    fn build<'a>(&'a self, db: &'a AimDb, _endpoint: &'a str) -> BuildFuture<'a> {
+        crate::native::build(db, &self.shared)
+    }
+}
+
+impl<B: Backend> ConnectorBuilder for ZenohConnector<B> {
+    fn build<'a>(&'a self, db: &'a AimDb) -> BuildFuture<'a> {
+        self.backend.build(db, &self.endpoint)
+    }
+
+    fn scheme(&self) -> &str {
+        crate::SCHEME
+    }
+
+    fn owns_scheme(&self) -> bool {
+        true
+    }
+}
diff --git a/aimdb-zenoh-connector/src/grammar.rs b/aimdb-zenoh-connector/src/grammar.rs
new file mode 100644
index 00000000..6256fb5f
--- /dev/null
+++ b/aimdb-zenoh-connector/src/grammar.rs
@@ -0,0 +1,511 @@
+//! Zenoh key expressions as a [`TopicGrammar`].
+
+use aimdb_core::{PatternPart, Spans, TopicFilter, TopicGrammar, TopicPattern};
+use alloc::{boxed::Box, format, string::String, vec::Vec};
+
+/// Zenoh key expressions: `/` separates chunks, `*` matches one chunk, `**`
+/// any number of chunks (anywhere, including none), and `$*` inside a chunk
+/// any run of characters. A chunk starting with `@` is verbatim: only the
+/// same chunk matches it, never a wildcard.
+///
+/// `{name}` matches one chunk and `{name..}` any number; a capture is a whole
+/// chunk. Where a pattern is ambiguous, a `{name..}` capture takes as few
+/// chunks as it can. [`TopicFilter::filter`] is the canonical key expression
+/// Zenoh accepts for a subscriber (`{a..}/{b}` subscribes `*/**`).
+///
+/// A key that is itself a wildcard matches no pattern. Zenoh delivers a `put`
+/// on `a/*` to every intersecting subscriber with `a/*` as the key, and no
+/// record stands for it: `{cell}` would capture `*`.
+#[derive(Debug, Clone, Copy, Default)]
+pub struct ZenohGrammar;
+
+#[derive(Debug, PartialEq)]
+enum Chunk {
+    /// A plain or verbatim (`@…`) chunk.
+    Literal(String),
+    /// `*` or `{name}`, with the capture number.
+    Single(Option<usize>),
+    /// `**` or `{name..}`, with the capture number.
+    Multi(Option<usize>),
+    /// A chunk with `$*`: the text around each `$*`, in order. The first and
+    /// last piece may be empty, the others are not.
+    Glob(Vec<String>),
+}
+
+struct ZenohFilter {
+    filter: String,
+    chunks: Vec<Chunk>,
+}
+
+/// A chunk as written: its text and, for `{…}`, the capture number and
+/// whether it is `{name..}`.
+#[derive(Default)]
+struct RawChunk {
+    text: String,
+    capture: Option<(usize, bool)>,
+}
+
+impl TopicGrammar for ZenohGrammar {
+    fn compile(&self, pattern: &TopicPattern<'_>) -> Result<Box<dyn TopicFilter>, String> {
+        let topic = pattern.as_str();
+
+        let mut raw = Vec::from([RawChunk::default()]);
+        let mut captures = 0;
+        for part in pattern.parts() {
+            match part {
+                PatternPart::Text(text) => {
+                    for (i, segment) in text.split('/').enumerate() {
+                        if i > 0 {
+                            raw.push(RawChunk::default());
+                        }
+                        if let Some(chunk) = raw.last_mut() {
+                            chunk.text.push_str(segment);
+                        }
+                    }
+                }
+                PatternPart::Capture { multi, .. } => {
+                    if let Some(chunk) = raw.last_mut() {
+                        if chunk.capture.is_some() {
+                            return Err(whole_chunk(topic));
+                        }
+                        chunk.capture = Some((captures, *multi));
+                    }
+                    captures += 1;
+                }
+            }
+        }
+
+        let mut chunks = Vec::with_capacity(raw.len());
+        for RawChunk { text, capture } in raw {
+            chunks.push(match capture {
+                Some(_) if !text.is_empty() => return Err(whole_chunk(topic)),
+                Some((n, false)) => Chunk::Single(Some(n)),
+                Some((n, true)) => Chunk::Multi(Some(n)),
+                None => classify(&text).map_err(|why| format!("'{topic}': {why}"))?,
+            });
+        }
+
+        Ok(Box::new(ZenohFilter {
+            filter: canonical(&chunks),
+            chunks,
+        }))
+    }
+
+    fn covers(&self, a: &str, b: &str) -> bool {
+        match (parse(a), parse(b)) {
+            (Some(a), Some(b)) => includes(&a, &b),
+            _ => false,
+        }
+    }
+}
+
+fn whole_chunk(topic: &str) -> String {
+    format!("'{topic}': a capture must be a whole chunk, not part of one")
+}
+
+/// One chunk without captures.
+fn classify(text: &str) -> Result<Chunk, &'static str> {
+    match text {
+        "" => return Err("a key expression has no empty chunks"),
+        "*" => return Ok(Chunk::Single(None)),
+        "**" => return Ok(Chunk::Multi(None)),
+        _ => {}
+    }
+    if text.contains(['#', '?']) {
+        return Err("'#' and '?' are not allowed in a key expression");
+    }
+    if !text.contains(['*', '$']) {
+        return Ok(Chunk::Literal(text.into()));
+    }
+    if text.starts_with('@') {
+        return Err("a verbatim '@' chunk cannot hold a wildcard");
+    }
+    let mut pieces: Vec<String> = text.split("$*").map(String::from).collect();
+    if pieces.iter().any(|p| p.contains('$')) {
+        return Err("'$' must be followed by '*'");
+    }
+    if pieces.iter().any(|p| p.contains('*')) {
+        return Err("'*' and '**' must be whole chunks; inside a chunk use '$*'");
+    }
+    // `$*$*` is `$*`: drop the empty pieces between them.
+    let last = pieces.len() - 1;
+    let mut i = 0;
+    pieces.retain(|p| {
+        let keep = i == 0 || i == last || !p.is_empty();
+        i += 1;
+        keep
+    });
+    if pieces.iter().all(String::is_empty) {
+        Ok(Chunk::Single(None))
+    } else {
+        Ok(Chunk::Glob(pieces))
+    }
+}
+
+/// The canonical key expression: within each run of `*` and `**` chunks, the
+/// `*`s come first and one `**` ends it.
+fn canonical(chunks: &[Chunk]) -> String {
+    let mut out: Vec<String> = Vec::with_capacity(chunks.len());
+    let (mut singles, mut multi) = (0, false);
+    let flush = |out: &mut Vec<String>, singles: &mut usize, multi: &mut bool| {
+        out.extend(core::iter::repeat_n(String::from("*"), *singles));
+        if *multi {
+            out.push(String::from("**"));
+        }
+        (*singles, *multi) = (0, false);
+    };
+    for chunk in chunks {
+        match chunk {
+            Chunk::Single(_) => singles += 1,
+            Chunk::Multi(_) => multi = true,
+            Chunk::Literal(text) => {
+                flush(&mut out, &mut singles, &mut multi);
+                out.push(text.clone());
+            }
+            Chunk::Glob(pieces) => {
+                flush(&mut out, &mut singles, &mut multi);
+                out.push(pieces.join("$*"));
+            }
+        }
+    }
+    flush(&mut out, &mut singles, &mut multi);
+    out.join("/")
+}
+
+/// A canonical filter's chunks, or `None` if it is not one.
+fn parse(filter: &str) -> Option<Vec<Chunk>> {
+    filter.split('/').map(|c| classify(c).ok()).collect()
+}
+
+fn is_verbatim(chunk: &Chunk) -> bool {
+    matches!(chunk, Chunk::Literal(text) if text.starts_with('@'))
+}
+
+/// Whether `a` matches every key `b` matches.
+fn includes(a: &[Chunk], b: &[Chunk]) -> bool {
+    match (a.split_first(), b.split_first()) {
+        (None, None) => true,
+        (Some((Chunk::Multi(_), a_rest)), _) => {
+            includes(a_rest, b)
+                || matches!(b.split_first(), Some((first, b_rest))
+                    if !is_verbatim(first) && includes(a, b_rest))
+        }
+        (None, Some(_)) | (Some(_), None) | (Some(_), Some((Chunk::Multi(_), _))) => false,
+        (Some((x, a_rest)), Some((y, b_rest))) => chunk_includes(x, y) && includes(a_rest, b_rest),
+    }
+}
+
+/// Whether chunk `a` matches every chunk `b` matches; neither is `**`.
+fn chunk_includes(a: &Chunk, b: &Chunk) -> bool {
+    if is_verbatim(b) {
+        return a == b;
+    }
+    match (a, b) {
+        (Chunk::Literal(x), Chunk::Literal(y)) => x == y,
+        (Chunk::Single(_), _) => true,
+        (Chunk::Glob(pieces), Chunk::Literal(text)) => glob_matches(pieces, text),
+        // `a`'s pieces hold no `$` or `*`, so they can only land in `b`'s
+        // text between its `$*`s, and each `$*` of `b` falls in one of `a`'s.
+        (Chunk::Glob(x), Chunk::Glob(y)) => glob_matches(x, &y.join("$*")),
+        _ => false,
+    }
+}
+
+/// Whether `text` fits `pieces` joined by `$*`, each `$*` matching any run of
+/// characters, including none.
+fn glob_matches(pieces: &[String], text: &str) -> bool {
+    let (Some((first, rest)), Some(last)) = (pieces.split_first(), pieces.last()) else {
+        return false;
+    };
+    let Some(body) = text.strip_prefix(first.as_str()) else {
+        return false;
+    };
+    let Some(mut body) = body.strip_suffix(last.as_str()) else {
+        return false;
+    };
+    for middle in &rest[..rest.len().saturating_sub(1)] {
+        match body.find(middle.as_str()) {
+            Some(at) => body = &body[at + middle.len()..],
+            None => return false,
+        }
+    }
+    true
+}
+
+/// The chunk starting at byte `at`, and where the next one starts.
+fn chunk_at(topic: &str, at: usize) -> (&str, Option<usize>) {
+    match topic[at..].find('/') {
+        Some(len) => (&topic[at..at + len], Some(at + len + 1)),
+        None => (&topic[at..], None),
+    }
+}
+
+impl ZenohFilter {
+    /// Matches `segment`, which holds no `**`, chunk by chunk from byte `at`
+    /// (`None`: the topic is used up). Returns where the topic continues, or
+    /// `None` if the segment does not fit there.
+    fn segment_at(
+        segment: &[Chunk],
+        topic: &str,
+        mut at: Option<usize>,
+        spans: &mut Spans,
+    ) -> Option<Option<usize>> {
+        for chunk in segment {
+            let here = at?;
+            let (text, after) = chunk_at(topic, here);
+            let fits = match chunk {
+                Chunk::Literal(literal) => literal == text,
+                Chunk::Single(capture) => {
+                    if let Some(n) = capture {
+                        spans[*n] = span(here, here + text.len());
+                    }
+                    !text.starts_with('@')
+                }
+                Chunk::Glob(pieces) => !text.starts_with('@') && glob_matches(pieces, text),
+                Chunk::Multi(_) => false,
+            };
+            if !fits {
+                return None;
+            }
+            at = after;
+        }
+        Some(at)
+    }
+}
+
+/// The router never passes more than `u16::MAX` bytes.
+fn span(start: usize, end: usize) -> (u16, u16) {
+    (start as u16, end as u16)
+}
+
+impl TopicFilter for ZenohFilter {
+    fn filter(&self) -> &str {
+        &self.filter
+    }
+
+    fn is_literal(&self) -> bool {
+        self.chunks.iter().all(|c| matches!(c, Chunk::Literal(_)))
+    }
+
+    fn matches(&self, topic: &str, spans: &mut Spans) -> bool {
+        // A wildcard key (`*`, `**` or `$*`): see `ZenohGrammar`.
+        if topic.contains('*') {
+            return false;
+        }
+        // The pattern is segments separated by `**`. Each `**` takes chunks
+        // until the next segment fits, so segments land as early as they can:
+        // linear in the topic, and the fewest chunks for each `{name..}` in
+        // order. A `**` cannot take a verbatim chunk.
+        let is_multi = |c: &Chunk| matches!(c, Chunk::Multi(_));
+        let mut segments = self.chunks.split(is_multi).peekable();
+        let mut multis = self.chunks.iter().filter_map(|c| match c {
+            Chunk::Multi(capture) => Some(*capture),
+            _ => None,
+        });
+
+        let start = (!topic.is_empty()).then_some(0);
+        let first = segments.next().unwrap_or(&[]);
+        let Some(mut at) = Self::segment_at(first, topic, start, spans) else {
+            return false;
+        };
+        while let Some(segment) = segments.next() {
+            let capture = multis.next().flatten();
+            let last = segments.peek().is_none();
+            let gap_start = at.unwrap_or(topic.len());
+            let (mut gap_end, mut here) = (gap_start, at);
+            loop {
+                if let Some(n) = capture {
+                    spans[n] = span(gap_start, gap_end);
+                }
+                match Self::segment_at(segment, topic, here, spans) {
+                    // The last segment must also use up the topic.
+                    Some(after) if !last || after.is_none() => {
+                        at = after;
+                        break;
+                    }
+                    _ => {}
+                }
+                let Some(p) = here else { return false };
+                let (text, next) = chunk_at(topic, p);
+                if text.starts_with('@') {
+                    return false;
+                }
+                (gap_end, here) = (p + text.len(), next);
+            }
+        }
+        at.is_none()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use aimdb_core::MAX_CAPTURES;
+    use alloc::string::ToString;
+    use alloc::vec;
+
+    fn compile(topic: &str) -> Result<Box<dyn TopicFilter>, String> {
+        ZenohGrammar.compile(&TopicPattern::parse(topic).map_err(|e| e.to_string())?)
+    }
+
+    /// The captured text of each capture, or `None` if `topic` does not match.
+    fn captures(pattern: &str, topic: &str) -> Option<Vec<String>> {
+        let filter = compile(pattern).expect("compiles");
+        let mut spans = [(0, 0); MAX_CAPTURES];
+        let count = TopicPattern::parse(pattern)
+            .ok()?
+            .parts()
+            .iter()
+            .filter(|p| matches!(p, PatternPart::Capture { .. }))
+            .count();
+        filter.matches(topic, &mut spans).then(|| {
+            spans[..count]
+                .iter()
+                .map(|&(s, e)| topic[usize::from(s)..usize::from(e)].into())
+                .collect()
+        })
+    }
+
+    #[test]
+    fn rejects_what_zenoh_rejects() {
+        for bad in ["a*", "a/**b", "a/#", "a/?", "a/$x", "a//b", "a/", "@*"] {
+            assert!(compile(bad).is_err(), "{bad} should be refused");
+        }
+        let dollar = compile("a/$x").err().expect("refused");
+        assert!(dollar.contains("'$' must be followed by '*'"), "{dollar}");
+    }
+
+    #[test]
+    fn captures_must_be_whole_chunks() {
+        for bad in [
+            "dev-{id}",
+            "a/{x}b",
+            "a/{x}{y}",
+            "a/{x}{y..}",
+            "{x}$*",
+            "@{x}",
+        ] {
+            assert!(compile(bad).is_err(), "{bad} should be refused");
+        }
+    }
+
+    /// Zenoh accepts `@v$*`, but in a verbatim chunk `$*` is literal: it
+    /// matches only the key `@v$*`. Refused as a likely mistake.
+    #[test]
+    fn rejects_wildcards_in_verbatim_chunks() {
+        assert!(compile("@v$*").is_err());
+    }
+
+    #[test]
+    fn filter_is_canonical() {
+        for (pattern, filter) in [
+            ("aimdb/{cell}/state", "aimdb/*/state"),
+            ("{rest..}/{last}", "*/**"),
+            ("a/**/**/b", "a/**/b"),
+            ("a/**/*/*/b", "a/*/*/**/b"),
+            ("a/$*/b", "a/*/b"),
+            ("a/x$*$*y", "a/x$*y"),
+            ("@ros2_lv/**", "@ros2_lv/**"),
+        ] {
+            assert_eq!(
+                compile(pattern).expect(pattern).filter(),
+                filter,
+                "{pattern}"
+            );
+        }
+    }
+
+    #[test]
+    fn literal_patterns_are_exact_routes() {
+        assert!(compile("a/@v/b").expect("literal").is_literal());
+        assert!(!compile("a/*").expect("wildcard").is_literal());
+        assert!(!compile("a/x$*").expect("glob").is_literal());
+    }
+
+    #[test]
+    fn captures_land_on_their_chunks() {
+        assert_eq!(
+            captures("aimdb/{cell}/state", "aimdb/cell4/state"),
+            Some(vec!["cell4".into()])
+        );
+        assert_eq!(
+            captures("{site}/{rest..}", "plant/hall/cell4"),
+            Some(vec!["plant".into(), "hall/cell4".into()])
+        );
+        assert_eq!(captures("a/{x..}/b", "a/b"), Some(vec!["".into()]));
+        assert_eq!(captures("a/{x..}", "a"), Some(vec!["".into()]));
+        assert_eq!(
+            captures("{x..}/c/{y..}", "c/c/c"),
+            Some(vec!["".into(), "c/c".into()]),
+            "a multi-chunk capture takes as few chunks as it can"
+        );
+        assert_eq!(captures("aimdb/{cell}/state", "aimdb/cell4"), None);
+    }
+
+    #[test]
+    fn wildcards_skip_verbatim_chunks() {
+        assert_eq!(captures("**", "@ros2_lv/0"), None);
+        assert_eq!(captures("*/0", "@ros2_lv/0"), None);
+        assert_eq!(captures("a/**", "a/@v"), None);
+        assert_eq!(captures("@ros2_lv/**", "@ros2_lv/0/x"), Some(vec![]));
+        assert_eq!(captures("a/@v", "a/@v"), Some(vec![]));
+    }
+
+    #[test]
+    fn wildcard_keys_match_nothing() {
+        for (pattern, key) in [
+            ("aimdb/{cell}/state", "aimdb/*/state"),
+            ("aimdb/{rest..}", "aimdb/**"),
+            ("{x}", "c$*"),
+            ("**", "a/*"),
+        ] {
+            assert_eq!(captures(pattern, key), None, "{pattern} on {key}");
+        }
+    }
+
+    /// Keys come from remote publishers: a near-miss on a 64 KB key with
+    /// several `**` must cost linear time, not one pass per way to split it.
+    #[test]
+    fn long_keys_match_in_linear_time() {
+        let key = (0..32_000)
+            .map(|i| if i % 2 == 0 { "x" } else { "y" })
+            .collect::<Vec<_>>()
+            .join("/");
+        assert_eq!(captures("{a..}/x/{b..}/y/{c..}/z", &key), None);
+        assert_eq!(captures("**/x/**/y/**/x/**/y/**/z", &key), None);
+        assert_eq!(captures("{a..}/{b..}/{c..}/z", &key), None);
+        assert_eq!(captures("**/x/**/z", &key), None);
+        let last = captures("{a..}/x/{b..}", &key).expect("matches");
+        assert_eq!((last[0].as_str(), last[1].len()), ("", key.len() - 2));
+    }
+
+    #[test]
+    fn sub_chunk_wildcard_matches_any_run() {
+        assert!(captures("a/x$*", "a/x").is_some());
+        assert!(captures("a/x$*", "a/xyz").is_some());
+        assert!(captures("a/$*z", "a/xyz").is_some());
+        assert!(captures("a/x$*y$*z", "a/xyz").is_some());
+        assert!(captures("a/x$*z", "a/xy").is_none());
+        assert!(captures("a/x$*x", "a/x").is_none());
+    }
+
+    #[test]
+    fn covers_follows_key_expression_inclusion() {
+        let g = ZenohGrammar;
+        assert!(g.covers("aimdb/*/state", "aimdb/cell4/state"));
+        assert!(g.covers("a/**", "a"));
+        assert!(g.covers("a/**", "a/*/b"));
+        assert!(g.covers("**", "a/**/b"));
+        assert!(g.covers("a/x$*", "a/xyz"));
+        assert!(g.covers("*", "x$*"));
+        assert!(!g.covers("a/*", "a/**"));
+        assert!(!g.covers("a/*/c", "a/b/*"));
+        assert!(!g.covers("**", "@ros2_lv/0"));
+        assert!(!g.covers("*", "@v"));
+        assert!(g.covers("@ros2_lv/**", "@ros2_lv/0/x"));
+        assert!(g.covers("x$*", "x$*y"));
+        assert!(g.covers("$*a$*", "a$*b"));
+        assert!(!g.covers("x$*y", "x$*"));
+        assert!(!g.covers("$*ab$*", "$*a$*b$*"), "`b` also matches `axb`");
+    }
+}
diff --git a/aimdb-zenoh-connector/src/lib.rs b/aimdb-zenoh-connector/src/lib.rs
new file mode 100644
index 00000000..8cb409ae
--- /dev/null
+++ b/aimdb-zenoh-connector/src/lib.rs
@@ -0,0 +1,64 @@
+//! Zenoh connector for AimDB.
+//!
+//! Serves `zenoh://` links, and with `std` also `ros2://` links that follow
+//! rmw_zenoh's conventions.
+//!
+//! ## Features
+//!
+//! - `std`: the `zenoh` crate backend, both schemes
+//! - `embedded`: reserved for the `zenoh-nostd` backend (`zenoh://` only),
+//!   which follows once zenoh-nostd is on crates.io; today it builds the
+//!   `no_std` parts, such as `ZenohGrammar`
+//! - `transport-tls`, `transport-quic`, `transport-ws`: further Zenoh
+//!   transports for the `std` backend
+//! - `auth-usrpwd`: Zenoh user/password authentication for the `std` backend
+//!
+//! The `std` backend needs Tokio's multi-thread scheduler; one worker thread
+//! is enough. `build()` fails on the current-thread scheduler.
+//!
+//! ## Zenoh transport compression
+//!
+//! This crate never enables `zenoh`'s `transport_compression`. With it,
+//! zenoh 1.10.1 decompresses through `lz4_flex` 0.10.0, which has
+//! RUSTSEC-2026-0041 (eclipse-zenoh/zenoh#2589). An application whose own
+//! dependencies enable it, for example `zenoh` with default features,
+//! compiles that path in.
+
+#![cfg_attr(not(feature = "std"), no_std)]
+
+extern crate alloc;
+
+/// The URL scheme of plain Zenoh links.
+pub(crate) const SCHEME: &str = "zenoh";
+
+// One `ZenohConnector` over its protocol backends.
+pub mod connector;
+pub use connector::{Native, ZenohConnector};
+
+// The `zenoh` crate backend.
+#[cfg(feature = "std")]
+mod native;
+
+// The session a `ZenohConnector` and its `Ros2Connector` share.
+#[cfg(feature = "std")]
+mod shared;
+
+// `ros2://` links, on the `zenoh` crate backend.
+#[cfg(feature = "std")]
+mod ros2;
+#[cfg(feature = "std")]
+pub use ros2::{Ros2Connector, Ros2Node};
+
+// ROS 2 QoS overrides over core's link builders.
+#[cfg(feature = "std")]
+mod link_ext;
+#[cfg(feature = "std")]
+pub use link_ext::Ros2LinkExt;
+
+// Zenoh key expressions for inbound links (works on every feature leg).
+pub mod grammar;
+pub use grammar::ZenohGrammar;
+
+// rmw_zenoh's wire conventions for `ros2://` links.
+mod profile;
+pub use profile::Reliability;
diff --git a/aimdb-zenoh-connector/src/link_ext.rs b/aimdb-zenoh-connector/src/link_ext.rs
new file mode 100644
index 00000000..dd5101f7
--- /dev/null
+++ b/aimdb-zenoh-connector/src/link_ext.rs
@@ -0,0 +1,54 @@
+//! ROS 2 QoS overrides over core's generic link builders.
+//!
+//! ```rust,ignore
+//! reg.link_to("ros2://cell4/temperature")
+//!     .with_link_codec(link_codecs::Default)
+//!     .with_depth(1)
+//!     .with_reliability(Reliability::BestEffort)
+//!     .finish();
+//! ```
+
+use std::string::ToString;
+
+use aimdb_core::{InboundConnectorBuilder, OutboundConnectorBuilder};
+use core::fmt::Debug;
+
+use crate::ros2::{DEPTH_KEY, RELIABILITY_KEY};
+use crate::Reliability;
+
+/// The QoS a `ros2://` link advertises, beyond the rmw default profile
+/// (`KEEP_LAST` 10, `RELIABLE`, `VOLATILE`).
+pub trait Ros2LinkExt: Sized {
+    /// `KEEP_LAST` with this depth (at least 1).
+    fn with_depth(self, depth: u32) -> Self;
+
+    /// The advertised reliability. The token carries it; this connector
+    /// sends over Zenoh's default reliable path either way.
+    fn with_reliability(self, reliability: Reliability) -> Self;
+}
+
+impl<'r, 'a, T> Ros2LinkExt for OutboundConnectorBuilder<'r, 'a, T>
+where
+    T: Send + Sync + 'static + Debug + Clone,
+{
+    fn with_depth(self, depth: u32) -> Self {
+        self.with_config(DEPTH_KEY, &depth.to_string())
+    }
+
+    fn with_reliability(self, reliability: Reliability) -> Self {
+        self.with_config(RELIABILITY_KEY, reliability.as_str())
+    }
+}
+
+impl<'r, 'a, T> Ros2LinkExt for InboundConnectorBuilder<'r, 'a, T>
+where
+    T: Send + Sync + 'static + Debug + Clone,
+{
+    fn with_depth(self, depth: u32) -> Self {
+        self.with_config(DEPTH_KEY, &depth.to_string())
+    }
+
+    fn with_reliability(self, reliability: Reliability) -> Self {
+        self.with_config(RELIABILITY_KEY, reliability.as_str())
+    }
+}
diff --git a/aimdb-zenoh-connector/src/native.rs b/aimdb-zenoh-connector/src/native.rs
new file mode 100644
index 00000000..982604b1
--- /dev/null
+++ b/aimdb-zenoh-connector/src/native.rs
@@ -0,0 +1,330 @@
+//! The `zenoh` crate backend: one session task that subscribes, dispatches
+//! inbound samples from the subscriber callbacks, and pulls outbound
+//! messages.
+
+use std::boxed::Box;
+use std::format;
+use std::string::{String, ToString};
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+use std::vec::Vec;
+
+use aimdb_core::{
+    log_debug, log_error, log_info, log_warn, AimDb, DbError, DbResult, InboundDispatch,
+    OutboundRoutes, RouteInfo, TopicFilter, TopicGrammar, TopicPattern, MAX_CAPTURES,
+};
+use zenoh::key_expr::{keyexpr, KeyExpr};
+use zenoh::pubsub::Publisher;
+use zenoh::sample::{Locality, SampleKind};
+use zenoh::Session;
+
+use crate::connector::BuildFuture;
+use crate::shared::Shared;
+use crate::{ZenohGrammar, SCHEME};
+
+/// The first wait before retrying to open the session; it doubles up to
+/// [`OPEN_RETRY_MAX`] while no router answers.
+const OPEN_RETRY: Duration = Duration::from_secs(1);
+const OPEN_RETRY_MAX: Duration = Duration::from_secs(30);
+
+/// Validate every route and return the session task.
+pub(crate) fn build<'a>(db: &'a AimDb, shared: &'a Arc<Shared>) -> BuildFuture<'a> {
+    Box::pin(async move {
+        let inbound = InboundDispatch::new(db, SCHEME, &ZenohGrammar)?;
+        // Subscribed now, so values produced before the session opens are kept.
+        let outbound = OutboundRoutes::new(db, SCHEME)?;
+        let keys = outbound
+            .routes()
+            .iter()
+            .map(route_key)
+            .collect::<Result<Vec<_>, _>>()?;
+        let filters = subscriptions(&inbound)?;
+
+        log_info!(
+            "Zenoh: {} subscriptions, {} outbound routes",
+            filters.len(),
+            keys.len()
+        );
+        shared.deposit_zenoh(ZenohParts {
+            inbound,
+            filters,
+            outbound,
+            keys,
+        })
+    })
+}
+
+/// What `build()` prepares for the session task.
+pub(crate) struct ZenohParts {
+    inbound: InboundDispatch,
+    filters: Vec<(KeyExpr<'static>, Box<dyn TopicFilter>)>,
+    outbound: OutboundRoutes,
+    keys: Vec<KeyExpr<'static>>,
+}
+
+/// The longest key the Zenoh wire format carries: its length is a `u16`. A
+/// longer key panics zenoh-transport while it holds its pipeline lock, which
+/// aborts the process.
+pub(crate) const KEY_MAX: usize = u16::MAX as usize;
+
+pub(crate) fn config_error(message: String) -> DbError {
+    DbError::runtime_error(format!("Failed to build Zenoh connector: {message}"))
+}
+
+/// The key of a route's link URL. Outbound keys hold no wildcards: a `put` on
+/// `a/*` would reach every intersecting subscriber, and AimDB peers drop such
+/// samples.
+fn route_key(route: &RouteInfo) -> DbResult<KeyExpr<'static>> {
+    let topic = &*route.default_topic;
+    if topic.len() > KEY_MAX {
+        return Err(config_error(format!(
+            "outbound key of {} bytes is longer than {KEY_MAX}",
+            topic.len()
+        )));
+    }
+    let key = KeyExpr::try_from(topic.to_string())
+        .map_err(|e| config_error(format!("'{topic}' is not a key expression: {e}")))?;
+    if topic.contains('*') {
+        return Err(config_error(format!(
+            "outbound key '{topic}' must not hold a wildcard"
+        )));
+    }
+    Ok(key)
+}
+
+/// Zenoh's defaults in client mode, or the caller's configuration, with
+/// `endpoint` as the router to connect to.
+pub(crate) fn session_config(
+    endpoint: &str,
+    config: Option<zenoh::Config>,
+) -> DbResult<zenoh::Config> {
+    let mut config = match config {
+        Some(config) => config,
+        None => {
+            let mut config = zenoh::Config::default();
+            config
+                .insert_json5("mode", r#""client""#)
+                .map_err(|e| config_error(format!("mode: {e}")))?;
+            config
+        }
+    };
+    if !endpoint.is_empty() {
+        if endpoint.contains(['"', '\\']) {
+            return Err(config_error(format!("invalid endpoint '{endpoint}'")));
+        }
+        config
+            .insert_json5("connect/endpoints", &format!(r#"["{endpoint}"]"#))
+            .map_err(|e| config_error(format!("endpoint '{endpoint}': {e}")))?;
+    }
+    Ok(config)
+}
+
+/// The filters to subscribe, each compiled to tell which earlier subscriber
+/// also delivers a sample.
+fn subscriptions(
+    inbound: &InboundDispatch,
+) -> DbResult<Vec<(KeyExpr<'static>, Box<dyn TopicFilter>)>> {
+    inbound
+        .subscriptions()
+        .iter()
+        .map(|filter| {
+            if filter.len() > KEY_MAX {
+                return Err(config_error(format!(
+                    "filter of {} bytes is longer than {KEY_MAX}",
+                    filter.len()
+                )));
+            }
+            let key = KeyExpr::try_from(filter.to_string())
+                .map_err(|e| config_error(format!("filter '{filter}': {e}")))?;
+            let compiled = TopicPattern::parse(filter)
+                .map_err(|e| e.to_string())
+                .and_then(|pattern| ZenohGrammar.compile(&pattern))
+                .map_err(|e| config_error(format!("filter '{filter}': {e}")))?;
+            Ok((key, compiled))
+        })
+        .collect()
+}
+
+/// Subscribe, then publish until every outbound route has closed. Zenoh
+/// reconnects and re-declares on its own once the session is open.
+///
+/// Subscribers and publishers are remote-only: a `put` never reaches this
+/// session's own subscribers. Otherwise a record linked to and from one key
+/// would ingest its own publications in a loop, and an inbound link would see
+/// the database's own writes.
+impl ZenohParts {
+    pub(crate) async fn serve(self, session: &Session) {
+        let ZenohParts {
+            inbound,
+            filters,
+            mut outbound,
+            keys,
+        } = self;
+        let _subscribers = subscribe(session, &inbound, filters).await;
+        let mut publishers: Vec<Option<Publisher<'static>>> = Vec::with_capacity(keys.len());
+        for key in keys {
+            match session
+                .declare_publisher(key)
+                .allowed_destination(Locality::Remote)
+                .await
+            {
+                Ok(publisher) => publishers.push(Some(publisher)),
+                Err(_e) => {
+                    log_error!("Zenoh: cannot declare a publisher: {}", _e);
+                    publishers.push(None);
+                }
+            }
+        }
+
+        while let Some(msg) = outbound.next().await {
+            let id = msg.route.id;
+            let written = msg.topic != &*msg.route.default_topic;
+            let result = match (&publishers[id], written) {
+                (Some(publisher), false) => publisher.put(msg.payload.into_vec()).await,
+                _ => match written_key(msg.topic) {
+                    Some(key) => {
+                        session
+                            .put(key, msg.payload.into_vec())
+                            .allowed_destination(Locality::Remote)
+                            .await
+                    }
+                    None => {
+                        log_error!("Zenoh: '{}' is not a key without wildcards", msg.topic);
+                        outbound.reject(id);
+                        continue;
+                    }
+                },
+            };
+            if let Err(_e) = result {
+                log_error!(
+                    "Zenoh: put on route '{}' failed: {}",
+                    outbound.routes()[id].default_topic,
+                    _e
+                );
+                outbound.reject(id);
+            }
+        }
+
+        log_info!("Zenoh: every outbound route has closed");
+        // The subscribers keep delivering for the life of the database.
+        core::future::pending::<()>().await;
+    }
+}
+
+/// Open a session, retrying with a back-off while no router answers.
+///
+/// Each attempt runs on a task of its own: zenoh's `open` blocks its thread
+/// until it connects or times out (up to `open_timeout`, 10 s by default),
+/// which would stall every other future of the database.
+pub(crate) async fn open(config: zenoh::Config) -> Session {
+    let mut wait = OPEN_RETRY;
+    let session = loop {
+        let attempt = config.clone();
+        let opened = tokio::spawn(async move { zenoh::open(attempt).await })
+            .await
+            .map_err(|e| e.to_string())
+            .and_then(|opened| opened.map_err(|e| e.to_string()));
+        match opened {
+            Ok(session) => break session,
+            Err(_e) => {
+                log_warn!(
+                    "Zenoh: cannot open the session, retrying in {:?}: {}",
+                    wait,
+                    _e
+                );
+                tokio::time::sleep(wait).await;
+                wait = (wait * 2).min(OPEN_RETRY_MAX);
+            }
+        }
+    };
+    log_info!("Zenoh: session {} open", session.zid());
+    session
+}
+
+/// A key written by a topic writer, if it is a valid key without wildcards
+/// that the wire format can carry.
+fn written_key(topic: &str) -> Option<&keyexpr> {
+    if topic.len() > KEY_MAX || topic.contains('*') {
+        return None;
+    }
+    keyexpr::new(topic).ok()
+}
+
+/// The zenoh runtime refuses Tokio's current-thread scheduler: every open
+/// would panic. One worker thread is enough.
+pub(crate) fn check_runtime() -> DbResult<()> {
+    match tokio::runtime::Handle::try_current() {
+        Ok(handle) if handle.runtime_flavor() == tokio::runtime::RuntimeFlavor::CurrentThread => {
+            Err(config_error(String::from(
+                "zenoh needs Tokio's multi-thread scheduler; one worker thread is enough \
+                 (`#[tokio::main(flavor = \"multi_thread\", worker_threads = 1)]`)",
+            )))
+        }
+        _ => Ok(()),
+    }
+}
+
+/// Dispatches a sample, so that a panicking deserializer drops the sample
+/// instead of unwinding out of zenoh's receive task, which would end every
+/// subscription on the session for good.
+pub(crate) fn dispatch_guarded(inbound: &InboundDispatch, topic: &str, payload: &[u8]) {
+    let dispatched = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+        inbound.dispatch(topic, payload)
+    }));
+    if dispatched.is_err() {
+        log_error!("Zenoh: ingest panicked on '{}'; sample dropped", topic);
+    }
+}
+
+/// One subscriber per filter. A sample matching several filters reaches
+/// each subscriber; only the first one dispatches it, so every route sees it
+/// once. A sample on a wildcard key is dropped (`ZenohGrammar`), and so is a
+/// delete: a record has no value to remove.
+async fn subscribe(
+    session: &Session,
+    inbound: &InboundDispatch,
+    filters: Vec<(KeyExpr<'static>, Box<dyn TopicFilter>)>,
+) -> Vec<zenoh::pubsub::Subscriber<()>> {
+    let warned = Arc::new(AtomicBool::new(false));
+    // The filters of the subscribers declared so far: a later subscriber
+    // defers to these only, so a failed declaration suppresses nothing.
+    let mut earlier: Vec<Arc<dyn TopicFilter>> = Vec::with_capacity(filters.len());
+    let mut subscribers = Vec::with_capacity(filters.len());
+    for (key, compiled) in filters {
+        let inbound = inbound.clone();
+        let shadows: Arc<[Arc<dyn TopicFilter>]> = earlier.clone().into();
+        let warned = warned.clone();
+        let declared = session
+            .declare_subscriber(key)
+            .allowed_origin(Locality::Remote)
+            .callback(move |sample| {
+                let key = sample.key_expr().as_str();
+                if sample.kind() == SampleKind::Delete {
+                    log_debug!("Zenoh: ignored a delete on '{}'", key);
+                    return;
+                }
+                if key.contains('*') {
+                    if !warned.swap(true, Ordering::Relaxed) {
+                        log_warn!("Zenoh: dropping samples on wildcard keys, first '{}'", key);
+                    }
+                    log_debug!("Zenoh: dropped a sample on wildcard key '{}'", key);
+                    return;
+                }
+                let mut spans = [(0, 0); MAX_CAPTURES];
+                if shadows.iter().any(|f| f.matches(key, &mut spans)) {
+                    return;
+                }
+                dispatch_guarded(&inbound, key, &sample.payload().to_bytes());
+            })
+            .await;
+        match declared {
+            Ok(subscriber) => {
+                subscribers.push(subscriber);
+                earlier.push(Arc::from(compiled));
+            }
+            Err(_e) => log_error!("Zenoh: cannot declare a subscriber: {}", _e),
+        }
+    }
+    subscribers
+}
diff --git a/aimdb-zenoh-connector/src/profile/attachment.rs b/aimdb-zenoh-connector/src/profile/attachment.rs
new file mode 100644
index 00000000..8642a708
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/attachment.rs
@@ -0,0 +1,39 @@
+//! The attachment every rmw_zenoh publication carries.
+
+/// Its length: sequence number, source timestamp, the `0x10` length of the
+/// GID array, and the GID.
+pub(crate) const ATTACHMENT_LEN: usize = 8 + 8 + 1 + 16;
+
+/// A publication's attachment, as zenoh-cpp's `ext::Serializer` writes it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Attachment {
+    /// Per publisher, starting at 1.
+    pub sequence: i64,
+    /// Nanoseconds since the Unix epoch; 0 without a wall clock.
+    pub timestamp_ns: i64,
+    pub gid: [u8; 16],
+}
+
+impl Attachment {
+    pub(crate) fn encode(&self) -> [u8; ATTACHMENT_LEN] {
+        let mut out = [0; ATTACHMENT_LEN];
+        out[..8].copy_from_slice(&self.sequence.to_le_bytes());
+        out[8..16].copy_from_slice(&self.timestamp_ns.to_le_bytes());
+        out[16] = 16;
+        out[17..].copy_from_slice(&self.gid);
+        out
+    }
+
+    /// `None` unless `bytes` has exactly this layout.
+    pub(crate) fn decode(bytes: &[u8]) -> Option<Self> {
+        let bytes: &[u8; ATTACHMENT_LEN] = bytes.try_into().ok()?;
+        if bytes[16] != 16 {
+            return None;
+        }
+        Some(Self {
+            sequence: i64::from_le_bytes(bytes[..8].try_into().ok()?),
+            timestamp_ns: i64::from_le_bytes(bytes[8..16].try_into().ok()?),
+            gid: bytes[17..].try_into().ok()?,
+        })
+    }
+}
diff --git a/aimdb-zenoh-connector/src/profile/gid.rs b/aimdb-zenoh-connector/src/profile/gid.rs
new file mode 100644
index 00000000..2e5ef356
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/gid.rs
@@ -0,0 +1,11 @@
+//! Entity GIDs.
+
+/// The GID rmw_zenoh derives from an entity's liveliness token: XXH3-128 of
+/// the token, the low 64 bits then the high 64 bits, each little-endian.
+pub(crate) fn gid(token: &str) -> [u8; 16] {
+    let hash = twox_hash::XxHash3_128::oneshot(token.as_bytes());
+    let mut out = [0; 16];
+    out[..8].copy_from_slice(&(hash as u64).to_le_bytes());
+    out[8..].copy_from_slice(&((hash >> 64) as u64).to_le_bytes());
+    out
+}
diff --git a/aimdb-zenoh-connector/src/profile/golden.rs b/aimdb-zenoh-connector/src/profile/golden.rs
new file mode 100644
index 00000000..2e42a426
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/golden.rs
@@ -0,0 +1,298 @@
+//! The profile against values captured from real rmw_zenoh nodes: Jazzy
+//! (rmw_zenoh 0.2.11) and Lyrical (0.10.6), both with zenoh-c 1.8.0.
+//!
+//! Captured with a `zenoh` client on the router: `demo_nodes_cpp` talkers,
+//! one in domain 7 under `/cell4`, and `ros2 topic pub` with depth 42, depth
+//! 10, best-effort, transient-local and keep-all. Each attachment comes from
+//! a sample of the publisher on the line above it.
+
+use alloc::vec::Vec;
+
+use super::*;
+
+fn bytes(hex: &str) -> Vec<u8> {
+    (0..hex.len())
+        .step_by(2)
+        .map(|i| u8::from_str_radix(&hex[i..i + 2], 16).expect("hex"))
+        .collect()
+}
+
+/// The attachment decodes, carries the GID of `token`, and re-encodes to the
+/// same bytes.
+fn check_attachment(hex: &str, token: &str) {
+    let captured = bytes(hex);
+    let attachment = Attachment::decode(&captured).expect("rmw_zenoh layout");
+    assert_eq!(attachment.gid, gid(token), "GID of {token}");
+    assert!(attachment.sequence >= 1);
+    assert_eq!(attachment.encode().as_slice(), captured.as_slice());
+}
+
+#[test]
+fn tokens_keys_and_gids_match_rmw_zenoh() {
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "45000cc3452ec777e9664270c90b5af",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_be"
+        }),
+        "@ros2_lv/0/45000cc3452ec777e9664270c90b5af/0/0/NN/%/%/p_be"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "45000cc3452ec777e9664270c90b5af", id: 0, enclave: "/", namespace: "/", name: "p_be" }, 4, EntityKind::Publisher, "/q_best_effort", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::BestEffort, durability: Durability::Volatile, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/45000cc3452ec777e9664270c90b5af/0/4/MP/%/%/p_be/%q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/2::,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_best_effort", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("150000000000000058d1b24cf9a2dc1810a4461b1ae3b3b1de4a54c9c5e9e88fd0", "@ros2_lv/0/45000cc3452ec777e9664270c90b5af/0/4/MP/%/%/p_be/%q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/2::,10:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "4d5b53bcdd3d15e71bef6b55f1997400",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_depth42"
+        }),
+        "@ros2_lv/0/4d5b53bcdd3d15e71bef6b55f1997400/0/0/NN/%/%/p_depth42"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "4d5b53bcdd3d15e71bef6b55f1997400", id: 0, enclave: "/", namespace: "/", name: "p_depth42" }, 4, EntityKind::Publisher, "/q_depth42", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 42 }),
+        "@ros2_lv/0/4d5b53bcdd3d15e71bef6b55f1997400/0/4/MP/%/%/p_depth42/%q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_depth42", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1500000000000000c2bec64cf9a2dc1810c4fac2c77aa599d761ccd1c0dd836e24", "@ros2_lv/0/4d5b53bcdd3d15e71bef6b55f1997400/0/4/MP/%/%/p_depth42/%q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "914ec2c920f5151f26394cf0ba959999",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_tl"
+        }),
+        "@ros2_lv/0/914ec2c920f5151f26394cf0ba959999/0/0/NN/%/%/p_tl"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "914ec2c920f5151f26394cf0ba959999", id: 0, enclave: "/", namespace: "/", name: "p_tl" }, 4, EntityKind::Publisher, "/q_transient", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::TransientLocal, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/914ec2c920f5151f26394cf0ba959999/0/4/MP/%/%/p_tl/%q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/:1:,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_transient", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("15000000000000008903674cf9a2dc1810b9249d3fec6b1be4c0c8a0e3eb3550bb", "@ros2_lv/0/914ec2c920f5151f26394cf0ba959999/0/4/MP/%/%/p_tl/%q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/:1:,10:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "a52f44b281e33efee354a095ad96d9e9",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "talker"
+        }),
+        "@ros2_lv/0/a52f44b281e33efee354a095ad96d9e9/0/0/NN/%/%/talker"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "a52f44b281e33efee354a095ad96d9e9", id: 0, enclave: "/", namespace: "/", name: "talker" }, 11, EntityKind::Publisher, "/chatter", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 7 }),
+        "@ros2_lv/0/a52f44b281e33efee354a095ad96d9e9/0/11/MP/%/%/talker/%chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,7:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/chatter", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1a0000000000000005301f32f9a2dc18103e1e8c9234b1602a9dba5860eed86e33", "@ros2_lv/0/a52f44b281e33efee354a095ad96d9e9/0/11/MP/%/%/talker/%chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,7:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "b2936fe8c98a79b9e28da840b609862b",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_ka"
+        }),
+        "@ros2_lv/0/b2936fe8c98a79b9e28da840b609862b/0/0/NN/%/%/p_ka"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "b2936fe8c98a79b9e28da840b609862b", id: 0, enclave: "/", namespace: "/", name: "p_ka" }, 4, EntityKind::Publisher, "/q_keep_all", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepAll, depth: 10 }),
+        "@ros2_lv/0/b2936fe8c98a79b9e28da840b609862b/0/4/MP/%/%/p_ka/%q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::2,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_keep_all", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("15000000000000001cfe3a4cf9a2dc1810e6d945421b873f8046a960ce657b3641", "@ros2_lv/0/b2936fe8c98a79b9e28da840b609862b/0/4/MP/%/%/p_ka/%q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::2,10:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "ecb5f8e5211f6643577812e1e59f4666",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_depth10"
+        }),
+        "@ros2_lv/0/ecb5f8e5211f6643577812e1e59f4666/0/0/NN/%/%/p_depth10"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "ecb5f8e5211f6643577812e1e59f4666", id: 0, enclave: "/", namespace: "/", name: "p_depth10" }, 4, EntityKind::Publisher, "/q_depth10", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/ecb5f8e5211f6643577812e1e59f4666/0/4/MP/%/%/p_depth10/%q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_depth10", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1500000000000000edb12d4df9a2dc18103b5f5f1e26e9b9c14d8b73120159f4d6", "@ros2_lv/0/ecb5f8e5211f6643577812e1e59f4666/0/4/MP/%/%/p_depth10/%q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,10:,:,:,,");
+    // jazzy
+    assert_eq!(
+        node_token(&Node {
+            domain: 7,
+            zid: "6977b59f87229328a8d406ad77b301a6",
+            id: 0,
+            enclave: "/",
+            namespace: "/cell4",
+            name: "gw"
+        }),
+        "@ros2_lv/7/6977b59f87229328a8d406ad77b301a6/0/0/NN/%/%cell4/gw"
+    );
+    // jazzy
+    assert_eq!(
+        entity_token(&Node { domain: 7, zid: "6977b59f87229328a8d406ad77b301a6", id: 0, enclave: "/", namespace: "/cell4", name: "gw" }, 11, EntityKind::Publisher, "/cell4/chatter", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 7 }),
+        "@ros2_lv/7/6977b59f87229328a8d406ad77b301a6/0/11/MP/%/%cell4/gw/%cell4%chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,7:,:,:,,"
+    );
+    assert_eq!(data_key(7, "/cell4/chatter", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "7/cell4/chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1a00000000000000699e1332f9a2dc1810b7aef695b2cd04ba45f9eed0c4a6c584", "@ros2_lv/7/6977b59f87229328a8d406ad77b301a6/0/11/MP/%/%cell4/gw/%cell4%chatter/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,7:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "1cdcdbd45bbff59f7a7a50283650fb64",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "talker"
+        }),
+        "@ros2_lv/0/1cdcdbd45bbff59f7a7a50283650fb64/0/0/NN/%/%/talker"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "1cdcdbd45bbff59f7a7a50283650fb64", id: 0, enclave: "/", namespace: "/", name: "talker" }, 10, EntityKind::Publisher, "/chatter", "example_interfaces::msg::dds_::String_", "RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 7 }),
+        "@ros2_lv/0/1cdcdbd45bbff59f7a7a50283650fb64/0/10/MP/%/%/talker/%chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b/::,7:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/chatter", "example_interfaces::msg::dds_::String_", "RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b"), "0/chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b");
+    check_attachment("170000000000000007565979dda2dc181043fbe3d3dcfb9659b7a82d4478c8eca0", "@ros2_lv/0/1cdcdbd45bbff59f7a7a50283650fb64/0/10/MP/%/%/talker/%chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b/::,7:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "441ed9dd3a332261e0c9d6e43d8cad1d",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_tl"
+        }),
+        "@ros2_lv/0/441ed9dd3a332261e0c9d6e43d8cad1d/0/0/NN/%/%/p_tl"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "441ed9dd3a332261e0c9d6e43d8cad1d", id: 0, enclave: "/", namespace: "/", name: "p_tl" }, 4, EntityKind::Publisher, "/q_transient", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::TransientLocal, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/441ed9dd3a332261e0c9d6e43d8cad1d/0/4/MP/%/%/p_tl/%q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/:1:,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_transient", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("150000000000000052e623a3dda2dc18100860bd607ea991ace37183d2b2a112ff", "@ros2_lv/0/441ed9dd3a332261e0c9d6e43d8cad1d/0/4/MP/%/%/p_tl/%q_transient/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/:1:,10:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "5466af59ede35c5be9cb5513adf36541",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_be"
+        }),
+        "@ros2_lv/0/5466af59ede35c5be9cb5513adf36541/0/0/NN/%/%/p_be"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "5466af59ede35c5be9cb5513adf36541", id: 0, enclave: "/", namespace: "/", name: "p_be" }, 4, EntityKind::Publisher, "/q_best_effort", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::BestEffort, durability: Durability::Volatile, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/5466af59ede35c5be9cb5513adf36541/0/4/MP/%/%/p_be/%q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/2::,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_best_effort", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("15000000000000007bca51a3dda2dc1810e67cc94b80d75ed5aa2880df74ac0bc4", "@ros2_lv/0/5466af59ede35c5be9cb5513adf36541/0/4/MP/%/%/p_be/%q_best_effort/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/2::,10:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "93feaf5f1a1e1d73349ed78c24d233ee",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_depth42"
+        }),
+        "@ros2_lv/0/93feaf5f1a1e1d73349ed78c24d233ee/0/0/NN/%/%/p_depth42"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "93feaf5f1a1e1d73349ed78c24d233ee", id: 0, enclave: "/", namespace: "/", name: "p_depth42" }, 4, EntityKind::Publisher, "/q_depth42", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 42 }),
+        "@ros2_lv/0/93feaf5f1a1e1d73349ed78c24d233ee/0/4/MP/%/%/p_depth42/%q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_depth42", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1500000000000000240db5a3dda2dc181024185e5248c67368fab11b9817dd22b9", "@ros2_lv/0/93feaf5f1a1e1d73349ed78c24d233ee/0/4/MP/%/%/p_depth42/%q_depth42/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "96030c84a104a478c5e739aacc9dc763",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_ka"
+        }),
+        "@ros2_lv/0/96030c84a104a478c5e739aacc9dc763/0/0/NN/%/%/p_ka"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "96030c84a104a478c5e739aacc9dc763", id: 0, enclave: "/", namespace: "/", name: "p_ka" }, 4, EntityKind::Publisher, "/q_keep_all", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepAll, depth: 10 }),
+        "@ros2_lv/0/96030c84a104a478c5e739aacc9dc763/0/4/MP/%/%/p_ka/%q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::2,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_keep_all", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("15000000000000007d5de6a3dda2dc181089ee3c7c4ca1012497819746e530a097", "@ros2_lv/0/96030c84a104a478c5e739aacc9dc763/0/4/MP/%/%/p_ka/%q_keep_all/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::2,10:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 0,
+            zid: "ff6c41dd9c6b1963c056554e51113e2b",
+            id: 0,
+            enclave: "/",
+            namespace: "/",
+            name: "p_depth10"
+        }),
+        "@ros2_lv/0/ff6c41dd9c6b1963c056554e51113e2b/0/0/NN/%/%/p_depth10"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 0, zid: "ff6c41dd9c6b1963c056554e51113e2b", id: 0, enclave: "/", namespace: "/", name: "p_depth10" }, 4, EntityKind::Publisher, "/q_depth10", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 10 }),
+        "@ros2_lv/0/ff6c41dd9c6b1963c056554e51113e2b/0/4/MP/%/%/p_depth10/%q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,10:,:,:,,"
+    );
+    assert_eq!(data_key(0, "/q_depth10", "std_msgs::msg::dds_::String_", "RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18"), "0/q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18");
+    check_attachment("1500000000000000da84fda2dda2dc1810be2dbfb962d6c6fb80e105afbb1ab12a", "@ros2_lv/0/ff6c41dd9c6b1963c056554e51113e2b/0/4/MP/%/%/p_depth10/%q_depth10/std_msgs::msg::dds_::String_/RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18/::,10:,:,:,,");
+    // lyrical
+    assert_eq!(
+        node_token(&Node {
+            domain: 7,
+            zid: "304b88ed8d0d24d941ca41005d509970",
+            id: 0,
+            enclave: "/",
+            namespace: "/cell4",
+            name: "gw"
+        }),
+        "@ros2_lv/7/304b88ed8d0d24d941ca41005d509970/0/0/NN/%/%cell4/gw"
+    );
+    // lyrical
+    assert_eq!(
+        entity_token(&Node { domain: 7, zid: "304b88ed8d0d24d941ca41005d509970", id: 0, enclave: "/", namespace: "/cell4", name: "gw" }, 10, EntityKind::Publisher, "/cell4/chatter", "example_interfaces::msg::dds_::String_", "RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b", &Qos { reliability: Reliability::Reliable, durability: Durability::Volatile, history: History::KeepLast, depth: 7 }),
+        "@ros2_lv/7/304b88ed8d0d24d941ca41005d509970/0/10/MP/%/%cell4/gw/%cell4%chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b/::,7:,:,:,,"
+    );
+    assert_eq!(data_key(7, "/cell4/chatter", "example_interfaces::msg::dds_::String_", "RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b"), "7/cell4/chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b");
+    check_attachment("17000000000000000d83fc79dda2dc181066aaa0f0bdc395448269a8214ca82fea", "@ros2_lv/7/304b88ed8d0d24d941ca41005d509970/0/10/MP/%/%cell4/gw/%cell4%chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b/::,7:,:,:,,");
+}
diff --git a/aimdb-zenoh-connector/src/profile/keys.rs b/aimdb-zenoh-connector/src/profile/keys.rs
new file mode 100644
index 00000000..6acd1e7f
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/keys.rs
@@ -0,0 +1,98 @@
+//! Data keys and liveliness tokens.
+
+use alloc::string::String;
+use core::fmt;
+
+use super::Qos;
+
+/// A ROS 2 node's identity in liveliness tokens.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct Node<'a> {
+    pub domain: u32,
+    /// The Zenoh session id, as Zenoh prints it.
+    pub zid: &'a str,
+    pub id: u32,
+    /// `/` is the default enclave.
+    pub enclave: &'a str,
+    /// `/` or `/cell4`.
+    pub namespace: &'a str,
+    pub name: &'a str,
+}
+
+/// Whether an entity publishes or subscribes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum EntityKind {
+    Publisher,
+    Subscription,
+}
+
+/// A name as a single token chunk: every `/` becomes `%`, and an empty name
+/// is `%`. Written straight into the token, with no string of its own.
+pub(crate) fn mangle(name: &str) -> Mangled<'_> {
+    Mangled(name)
+}
+
+pub(crate) struct Mangled<'a>(&'a str);
+
+impl fmt::Display for Mangled<'_> {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.0.is_empty() {
+            return f.write_str("%");
+        }
+        for (i, part) in self.0.split('/').enumerate() {
+            if i > 0 {
+                f.write_str("%")?;
+            }
+            f.write_str(part)?;
+        }
+        Ok(())
+    }
+}
+
+/// `<domain>/<topic>/<type>/<hash>`, the topic without its slashes at either
+/// end: `0/cell4/temperature/sensor_msgs::msg::dds_::Temperature_/RIHS01_…`.
+pub(crate) fn data_key(domain: u32, topic: &str, type_name: &str, type_hash: &str) -> String {
+    let topic = topic.trim_matches('/');
+    alloc::format!("{domain}/{topic}/{type_name}/{type_hash}")
+}
+
+/// `@ros2_lv/<domain>/<zid>/<node id>/<node id>/NN/<enclave>/<namespace>/<name>`.
+pub(crate) fn node_token(node: &Node<'_>) -> String {
+    alloc::format!(
+        "@ros2_lv/{}/{}/{}/{}/NN/{}/{}/{}",
+        node.domain,
+        node.zid,
+        node.id,
+        node.id,
+        mangle(node.enclave),
+        mangle(node.namespace),
+        node.name
+    )
+}
+
+/// `@ros2_lv/<domain>/<zid>/<node id>/<entity id>/MP|MS/<enclave>/<namespace>/<name>/<topic>/<type>/<hash>/<qos>`.
+pub(crate) fn entity_token(
+    node: &Node<'_>,
+    entity_id: u32,
+    kind: EntityKind,
+    topic: &str,
+    type_name: &str,
+    type_hash: &str,
+    qos: &Qos,
+) -> String {
+    let kind = match kind {
+        EntityKind::Publisher => "MP",
+        EntityKind::Subscription => "MS",
+    };
+    alloc::format!(
+        "@ros2_lv/{}/{}/{}/{entity_id}/{kind}/{}/{}/{}/{}/{type_name}/{type_hash}/{}",
+        node.domain,
+        node.zid,
+        node.id,
+        mangle(node.enclave),
+        mangle(node.namespace),
+        node.name,
+        mangle(topic),
+        qos
+    )
+}
diff --git a/aimdb-zenoh-connector/src/profile/mod.rs b/aimdb-zenoh-connector/src/profile/mod.rs
new file mode 100644
index 00000000..baf43297
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/mod.rs
@@ -0,0 +1,74 @@
+//! rmw_zenoh's wire conventions: names, data keys, liveliness tokens, the
+//! QoS field, GIDs and the publication attachment.
+//!
+//! Pure functions over strings and bytes, `no_std + alloc`, so a ROS node on
+//! an MCU can reuse them unchanged.
+
+// Used by the ROS 2 connector, which builds on this module.
+#![allow(dead_code, unused_imports)]
+
+mod attachment;
+mod gid;
+mod keys;
+mod names;
+mod qos;
+
+pub(crate) use attachment::{Attachment, ATTACHMENT_LEN};
+pub(crate) use gid::gid;
+pub(crate) use keys::{data_key, entity_token, mangle, node_token, EntityKind, Node};
+pub(crate) use names::{validate_namespace, validate_node_name, validate_topic, NameError};
+pub use qos::Reliability;
+pub(crate) use qos::{Durability, History, Qos};
+
+#[cfg(test)]
+mod golden;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn default_qos_is_depth_10_reliable_volatile() {
+        assert_eq!(Qos::default().encode(), "::,10:,:,:,,");
+        let depth_42 = Qos {
+            depth: 42,
+            ..Qos::default()
+        };
+        assert_eq!(depth_42.encode(), "::,:,:,:,,", "rmw_zenoh's default depth");
+    }
+
+    #[test]
+    fn mangling_turns_slashes_into_percent() {
+        let m = |name: &str| alloc::format!("{}", mangle(name));
+        assert_eq!(m(""), "%");
+        assert_eq!(m("/"), "%");
+        assert_eq!(m("/cell4"), "%cell4");
+        assert_eq!(m("/cell4/temperature"), "%cell4%temperature");
+    }
+
+    #[test]
+    fn data_keys_drop_the_outer_slashes() {
+        assert_eq!(data_key(3, "/a/b", "T_", "H"), "3/a/b/T_/H");
+        assert_eq!(data_key(0, "a/b", "T_", "H"), "0/a/b/T_/H");
+    }
+
+    #[test]
+    fn attachments_round_trip_and_reject_other_layouts() {
+        let a = Attachment {
+            sequence: 1,
+            timestamp_ns: 0,
+            gid: [7; 16],
+        };
+        let bytes = a.encode();
+        assert_eq!(bytes.len(), ATTACHMENT_LEN);
+        assert_eq!(
+            &bytes[..17],
+            &[1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 16]
+        );
+        assert_eq!(Attachment::decode(&bytes), Some(a));
+        assert_eq!(Attachment::decode(&bytes[..32]), None);
+        let mut wrong_length_byte = bytes;
+        wrong_length_byte[16] = 15;
+        assert_eq!(Attachment::decode(&wrong_length_byte), None);
+    }
+}
diff --git a/aimdb-zenoh-connector/src/profile/names.rs b/aimdb-zenoh-connector/src/profile/names.rs
new file mode 100644
index 00000000..86f5f1c9
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/names.rs
@@ -0,0 +1,153 @@
+//! ROS 2 name rules, as `rmw`'s validators state them.
+
+use core::fmt;
+
+/// The longest fully qualified topic name (`RMW_TOPIC_MAX_NAME_LENGTH`).
+const TOPIC_MAX: usize = 255 - 8;
+/// The longest namespace (`RMW_NAMESPACE_MAX_LENGTH`).
+const NAMESPACE_MAX: usize = TOPIC_MAX - 2;
+/// The longest node name (`RMW_NODE_NAME_MAX_NAME_LENGTH`).
+const NODE_NAME_MAX: usize = 255;
+
+/// Why a topic, namespace or node name breaks the ROS rules.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum NameError {
+    Empty,
+    NotAbsolute,
+    EndsWithSlash,
+    Characters,
+    RepeatedSlash,
+    StartsWithDigit,
+    TooLong { max: usize },
+}
+
+impl fmt::Display for NameError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::Empty => f.write_str("is empty"),
+            Self::NotAbsolute => f.write_str("must start with '/'"),
+            Self::EndsWithSlash => f.write_str("must not end with '/'"),
+            Self::Characters => f.write_str("may only hold letters, digits, '_' and '/'"),
+            Self::RepeatedSlash => f.write_str("must not hold '//'"),
+            Self::StartsWithDigit => f.write_str("has a name part starting with a digit"),
+            Self::TooLong { max } => write!(f, "is longer than {max} bytes"),
+        }
+    }
+}
+
+/// A fully qualified topic name: `/cell4/temperature`.
+pub(crate) fn validate_topic(name: &str) -> Result<(), NameError> {
+    absolute(name, TOPIC_MAX)
+}
+
+/// A namespace: `/` or `/cell4`.
+pub(crate) fn validate_namespace(name: &str) -> Result<(), NameError> {
+    if name == "/" {
+        return Ok(());
+    }
+    absolute(name, NAMESPACE_MAX)
+}
+
+/// A node name: `cell4_gateway`.
+pub(crate) fn validate_node_name(name: &str) -> Result<(), NameError> {
+    let Some(first) = name.bytes().next() else {
+        return Err(NameError::Empty);
+    };
+    if !name.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'_') {
+        return Err(NameError::Characters);
+    }
+    if first.is_ascii_digit() {
+        return Err(NameError::StartsWithDigit);
+    }
+    if name.len() > NODE_NAME_MAX {
+        return Err(NameError::TooLong { max: NODE_NAME_MAX });
+    }
+    Ok(())
+}
+
+fn absolute(name: &str, max: usize) -> Result<(), NameError> {
+    if name.is_empty() {
+        return Err(NameError::Empty);
+    }
+    if !name.starts_with('/') {
+        return Err(NameError::NotAbsolute);
+    }
+    if name.ends_with('/') {
+        return Err(NameError::EndsWithSlash);
+    }
+    if !name
+        .bytes()
+        .all(|b| b.is_ascii_alphanumeric() || b == b'_' || b == b'/')
+    {
+        return Err(NameError::Characters);
+    }
+    if name.contains("//") {
+        return Err(NameError::RepeatedSlash);
+    }
+    if name[1..]
+        .split('/')
+        .any(|part| part.bytes().next().is_some_and(|b| b.is_ascii_digit()))
+    {
+        return Err(NameError::StartsWithDigit);
+    }
+    if name.len() > max {
+        return Err(NameError::TooLong { max });
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn topics_follow_rmw() {
+        for good in ["/chatter", "/cell4/temperature", "/_private", "/a1/b_2"] {
+            assert_eq!(validate_topic(good), Ok(()), "{good}");
+        }
+        for (bad, why) in [
+            ("", NameError::Empty),
+            ("chatter", NameError::NotAbsolute),
+            ("/chatter/", NameError::EndsWithSlash),
+            ("/", NameError::EndsWithSlash),
+            ("/cell-4", NameError::Characters),
+            ("/~/x", NameError::Characters),
+            ("/{node}/x", NameError::Characters),
+            ("/a//b", NameError::RepeatedSlash),
+            ("/4cell/x", NameError::StartsWithDigit),
+            ("/cell/4x", NameError::StartsWithDigit),
+        ] {
+            assert_eq!(validate_topic(bad), Err(why), "{bad}");
+        }
+        let long = alloc::format!("/{}", "a".repeat(TOPIC_MAX));
+        assert_eq!(validate_topic(&long[..TOPIC_MAX]), Ok(()));
+        assert_eq!(validate_topic(&long), Err(NameError::TooLong { max: 247 }));
+    }
+
+    #[test]
+    fn namespaces_allow_the_root() {
+        assert_eq!(validate_namespace("/"), Ok(()));
+        assert_eq!(validate_namespace("/cell4"), Ok(()));
+        assert_eq!(validate_namespace("/cell4/"), Err(NameError::EndsWithSlash));
+        assert_eq!(validate_namespace("cell4"), Err(NameError::NotAbsolute));
+        let long = alloc::format!("/{}", "a".repeat(NAMESPACE_MAX));
+        assert_eq!(
+            validate_namespace(&long),
+            Err(NameError::TooLong { max: 245 })
+        );
+    }
+
+    #[test]
+    fn node_names_are_one_token() {
+        assert_eq!(validate_node_name("cell4_gateway"), Ok(()));
+        assert_eq!(validate_node_name(""), Err(NameError::Empty));
+        assert_eq!(validate_node_name("cell/4"), Err(NameError::Characters));
+        assert_eq!(validate_node_name("cell-4"), Err(NameError::Characters));
+        assert_eq!(validate_node_name("4cell"), Err(NameError::StartsWithDigit));
+        let long = "a".repeat(NODE_NAME_MAX + 1);
+        assert_eq!(
+            validate_node_name(&long),
+            Err(NameError::TooLong { max: 255 })
+        );
+    }
+}
diff --git a/aimdb-zenoh-connector/src/profile/qos.rs b/aimdb-zenoh-connector/src/profile/qos.rs
new file mode 100644
index 00000000..d8aae66e
--- /dev/null
+++ b/aimdb-zenoh-connector/src/profile/qos.rs
@@ -0,0 +1,101 @@
+//! The QoS field of a liveliness token.
+
+use alloc::string::String;
+use core::fmt;
+
+/// rmw_zenoh's own default depth: a token leaves the depth empty for it.
+const RMW_ZENOH_DEFAULT_DEPTH: u32 = 42;
+
+/// The QoS a `ros2://` link advertises. Deadline, lifespan and liveliness
+/// always take the ROS defaults.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct Qos {
+    pub reliability: Reliability,
+    pub durability: Durability,
+    pub history: History,
+    pub depth: u32,
+}
+
+/// A `ros2://` link's advertised reliability.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Reliability {
+    /// `RELIABLE`, the default.
+    Reliable,
+    /// `BEST_EFFORT`.
+    BestEffort,
+}
+
+impl Reliability {
+    /// The link config value.
+    pub(crate) fn as_str(self) -> &'static str {
+        match self {
+            Self::Reliable => "reliable",
+            Self::BestEffort => "best_effort",
+        }
+    }
+
+    /// The inverse of [`as_str`](Self::as_str).
+    pub(crate) fn parse(value: &str) -> Option<Self> {
+        match value {
+            "reliable" => Some(Self::Reliable),
+            "best_effort" => Some(Self::BestEffort),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Durability {
+    Volatile,
+    TransientLocal,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum History {
+    KeepLast,
+    KeepAll,
+}
+
+impl Default for Qos {
+    /// The rmw default profile, as a default-constructed `rclcpp` publisher
+    /// has it: `KEEP_LAST` 10, `RELIABLE`, `VOLATILE`.
+    fn default() -> Self {
+        Self {
+            reliability: Reliability::Reliable,
+            durability: Durability::Volatile,
+            history: History::KeepLast,
+            depth: 10,
+        }
+    }
+}
+
+impl Qos {
+    /// The token's QoS field; see the [`Display`](fmt::Display) impl.
+    pub(crate) fn encode(&self) -> String {
+        alloc::format!("{self}")
+    }
+}
+
+impl fmt::Display for Qos {
+    /// `<reliability>:<durability>:<history>,<depth>:<deadline>:<lifespan>:<liveliness>`,
+    /// each component empty when it equals rmw_zenoh's default.
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let reliability = match self.reliability {
+            Reliability::Reliable => "",
+            Reliability::BestEffort => "2",
+        };
+        let durability = match self.durability {
+            Durability::Volatile => "",
+            Durability::TransientLocal => "1",
+        };
+        let history = match self.history {
+            History::KeepLast => "",
+            History::KeepAll => "2",
+        };
+        write!(f, "{reliability}:{durability}:{history},")?;
+        if self.depth != RMW_ZENOH_DEFAULT_DEPTH {
+            write!(f, "{}", self.depth)?;
+        }
+        f.write_str(":,:,:,,")
+    }
+}
diff --git a/aimdb-zenoh-connector/src/ros2.rs b/aimdb-zenoh-connector/src/ros2.rs
new file mode 100644
index 00000000..9ad4c187
--- /dev/null
+++ b/aimdb-zenoh-connector/src/ros2.rs
@@ -0,0 +1,640 @@
+//! `Ros2Connector`: `ros2://` links following rmw_zenoh's conventions.
+
+use std::any::{type_name, TypeId};
+use std::boxed::Box;
+use std::format;
+use std::string::String;
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+use std::vec::Vec;
+
+use aimdb_core::connector::ConnectorBuilder;
+use aimdb_core::{
+    log_error, log_warn, AimDb, ExactGrammar, InboundDispatch, OutboundRoutes, RouteInfo,
+};
+use aimdb_data_contracts::{ros2, RosMessage, WireFormat};
+use zenoh::key_expr::KeyExpr;
+use zenoh::qos::CongestionControl;
+use zenoh::sample::{Locality, SampleKind};
+use zenoh::Session;
+
+use crate::connector::BuildFuture;
+use crate::native::{config_error, dispatch_guarded};
+use crate::profile::{self, Attachment, Durability, EntityKind, History, Node, Qos, Reliability};
+use crate::shared::Shared;
+
+/// The URL scheme of ROS 2 topic links.
+pub(crate) const SCHEME: &str = "ros2";
+
+/// The environment variable ROS reads the domain from.
+const DOMAIN_ENV: &str = "ROS_DOMAIN_ID";
+
+/// Link config key for [`Ros2LinkExt::with_depth`](crate::Ros2LinkExt::with_depth).
+pub(crate) const DEPTH_KEY: &str = "ros2.depth";
+/// Link config key for [`Ros2LinkExt::with_reliability`](crate::Ros2LinkExt::with_reliability).
+pub(crate) const RELIABILITY_KEY: &str = "ros2.reliability";
+
+/// The highest domain id ROS 2 documents.
+const DOMAIN_MAX: u32 = 232;
+
+/// The ROS 2 node AimDB appears as.
+#[derive(Debug, Clone)]
+pub struct Ros2Node {
+    name: String,
+    namespace: String,
+}
+
+impl Ros2Node {
+    /// A node in the root namespace.
+    pub fn new(name: impl Into<String>) -> Self {
+        Self {
+            name: name.into(),
+            namespace: String::from("/"),
+        }
+    }
+
+    /// The node's namespace, e.g. `/cell4`. It sets the node's identity, not
+    /// its topics: a `ros2://` link always names a fully qualified topic.
+    pub fn namespace(mut self, namespace: impl Into<String>) -> Self {
+        self.namespace = namespace.into();
+        self
+    }
+}
+
+/// A type registered with [`Ros2Connector::register`].
+#[derive(Debug, Clone)]
+struct RosType {
+    type_id: TypeId,
+    rust_name: &'static str,
+    dds_name: &'static str,
+    hash: &'static str,
+    wire_format: WireFormat,
+}
+
+/// A connector for `ros2://` links: AimDB records as ROS 2 topics, as
+/// rmw_zenoh puts them on the wire.
+///
+/// ```rust,ignore
+/// let ros2 = Ros2Connector::new("tcp/192.168.10.5:7447", Ros2Node::new("cell4_gateway"))
+///     .register::<Temperature>();
+/// builder.with_connector(ros2);
+/// ```
+///
+/// Next to `zenoh://` links, derive it from the [`ZenohConnector`](crate::ZenohConnector)
+/// with `.ros2(node)` instead, so both ride one session.
+pub struct Ros2Connector {
+    shared: Arc<Shared>,
+    node: Ros2Node,
+    domain: Option<u32>,
+    types: Vec<RosType>,
+}
+
+impl Ros2Connector {
+    /// Connect to the Zenoh router at `endpoint` (`tcp/host:port`) as `node`.
+    pub fn new(endpoint: impl Into<String>, node: Ros2Node) -> Self {
+        Self::on(Shared::new(endpoint.into()), node)
+    }
+
+    /// The view of an existing session.
+    pub(crate) fn on(shared: Arc<Shared>, node: Ros2Node) -> Self {
+        shared.ros2_view_created();
+        Self {
+            shared,
+            node,
+            domain: None,
+            types: Vec::new(),
+        }
+    }
+
+    /// The ROS domain. Without it the connector reads `ROS_DOMAIN_ID`, as
+    /// `rcl` does, and falls back to 0.
+    pub fn domain_id(mut self, domain: u32) -> Self {
+        self.domain = Some(domain);
+        self
+    }
+
+    /// Allow `ros2://` links on records of type `T`.
+    pub fn register<T: RosMessage + 'static>(mut self) -> Self {
+        self.types.push(RosType {
+            type_id: TypeId::of::<T>(),
+            rust_name: type_name::<T>(),
+            dds_name: T::ROS_TYPE_NAME,
+            hash: T::ROS_TYPE_HASH,
+            wire_format: T::WIRE_FORMAT,
+        });
+        self
+    }
+
+    /// Start from `config` instead of Zenoh's defaults in client mode; see
+    /// [`ZenohConnector::with_zenoh_config`](crate::ZenohConnector::with_zenoh_config).
+    /// On a shared session it configures that session.
+    pub fn with_zenoh_config(self, config: zenoh::Config) -> Self {
+        self.shared.set_config(config);
+        self
+    }
+}
+
+impl ConnectorBuilder for Ros2Connector {
+    fn build<'a>(&'a self, db: &'a AimDb) -> BuildFuture<'a> {
+        Box::pin(async move {
+            let domain = resolve_domain(self.domain, std::env::var(DOMAIN_ENV).ok().as_deref())
+                .map_err(config_error)?;
+            if let Some(warning) = domain_warning(domain) {
+                log_warn!("{}", warning);
+            }
+            let node = &self.node;
+            profile::validate_node_name(&node.name)
+                .map_err(|e| config_error(format!("node name '{}' {e}", node.name)))?;
+            profile::validate_namespace(&node.namespace)
+                .map_err(|e| config_error(format!("namespace '{}' {e}", node.namespace)))?;
+            for ty in &self.types {
+                check_type(ty).map_err(config_error)?;
+            }
+
+            let outbound = OutboundRoutes::new(db, SCHEME)?;
+            let publishers = outbound
+                .routes()
+                .iter()
+                .enumerate()
+                .map(|(i, route)| publisher(route, &self.types, domain, i as u32 + 1))
+                .collect::<Result<Vec<_>, _>>()
+                .map_err(config_error)?;
+
+            let inbound = InboundDispatch::new(db, SCHEME, &ExactGrammar)?;
+            let first_id = publishers.len() as u32 + 1;
+            let subscriptions =
+                subscriptions(&inbound, &self.types, domain, first_id).map_err(config_error)?;
+
+            one_type_per_topic(
+                publishers
+                    .iter()
+                    .map(|p| &p.link)
+                    .chain(subscriptions.links.iter()),
+            )
+            .map_err(config_error)?;
+
+            for warning in publishers
+                .iter()
+                .map(|p| &p.link)
+                .chain(subscriptions.links.iter())
+                .filter_map(|link| link.warning.as_deref())
+            {
+                log_warn!("{}", warning);
+            }
+
+            self.shared.deposit_ros2(Ros2Parts {
+                domain,
+                node: self.node.clone(),
+                outbound,
+                publishers,
+                inbound,
+                subscriptions,
+            })
+        })
+    }
+
+    fn scheme(&self) -> &str {
+        SCHEME
+    }
+
+    fn owns_scheme(&self) -> bool {
+        true
+    }
+}
+
+/// The domain `rcl` would use: the explicit one, else `ROS_DOMAIN_ID` unless
+/// it is empty, else 0. `ROS_DOMAIN_ID` is read as `strtoul(.., 0)` reads it:
+/// `0x` is hex and a leading `0` octal, so `010` is domain 8.
+fn resolve_domain(explicit: Option<u32>, env: Option<&str>) -> Result<u32, String> {
+    let env = env.map(str::trim).filter(|v| !v.is_empty());
+    match (explicit, env) {
+        (Some(domain), _) => Ok(domain),
+        (None, Some(value)) => {
+            parse_domain(value).ok_or_else(|| format!("{DOMAIN_ENV}='{value}' is not a domain id"))
+        }
+        (None, None) => Ok(0),
+    }
+}
+
+/// An unsigned integer in C's base-0 notation: decimal, `0x…` hex, `0…` octal.
+fn parse_domain(value: &str) -> Option<u32> {
+    let (digits, radix) = match value.as_bytes() {
+        [b'0', b'x' | b'X', rest @ ..] if !rest.is_empty() => (&value[2..], 16),
+        [b'0', rest @ ..] if !rest.is_empty() => (&value[1..], 8),
+        _ => (value, 10),
+    };
+    if !digits.bytes().all(|b| b.is_ascii_hexdigit()) {
+        return None;
+    }
+    u32::from_str_radix(digits, radix).ok()
+}
+
+/// ROS 2 documents domains 0 to 232, the range DDS can map to ports. rmw_zenoh
+/// accepts any, but a node there is out of reach of DDS-based ROS 2.
+fn domain_warning(domain: u32) -> Option<String> {
+    (domain > DOMAIN_MAX).then(|| {
+        format!(
+            "ROS 2 domain {domain} is above {DOMAIN_MAX}, the highest ROS 2 documents; \
+             rmw_zenoh accepts it, DDS-based ROS 2 does not"
+        )
+    })
+}
+
+/// A registered type's own claims: it is CDR, and its names are well formed.
+/// The derive guarantees all three; a hand-written impl may not.
+fn check_type(ty: &RosType) -> Result<(), String> {
+    if ty.wire_format != WireFormat::Cdr {
+        return Err(format!(
+            "{} is registered for ROS 2, but its Linkable encoding is not CDR",
+            ty.rust_name
+        ));
+    }
+    ros2::validate_dds_type_name(ty.dds_name)
+        .map_err(|e| format!("{}: ROS type name '{}': {e}", ty.rust_name, ty.dds_name))?;
+    ros2::validate_type_hash(ty.hash)
+        .map_err(|e| format!("{}: type hash '{}': {e}", ty.rust_name, ty.hash))?;
+    Ok(())
+}
+
+/// What one `ros2://` link of either direction needs on the wire, fixed at
+/// build.
+struct Link {
+    /// The fully qualified topic, `/cell4/temperature`.
+    topic: String,
+    ty: RosType,
+    qos: Qos,
+    entity_id: u32,
+    /// The rmw_zenoh data key.
+    key: KeyExpr<'static>,
+    /// Logged once the whole configuration is known to be valid.
+    warning: Option<String>,
+}
+
+/// The checks both directions share: a ROS topic name, a registered type,
+/// CDR on the wire, and the QoS overrides.
+fn link(
+    resource: &str,
+    type_id: TypeId,
+    options: &[(String, String)],
+    types: &[RosType],
+    domain: u32,
+    entity_id: u32,
+) -> Result<Link, String> {
+    let topic = format!("/{resource}");
+    profile::validate_topic(&topic).map_err(|e| format!("ROS topic '{topic}' {e}"))?;
+    let ty = types
+        .iter()
+        .find(|t| t.type_id == type_id)
+        .cloned()
+        .ok_or_else(|| {
+            format!("ros2://{resource}: the record's type is not registered with Ros2Connector")
+        })?;
+    let warning = codec_warning(resource, options)?;
+    let qos = qos(options).map_err(|e| format!("ros2://{resource}: {e}"))?;
+    let key = KeyExpr::try_from(profile::data_key(domain, &topic, ty.dds_name, ty.hash))
+        .map_err(|e| format!("ros2://{resource}: {e}"))?;
+    Ok(Link {
+        topic,
+        ty,
+        qos,
+        entity_id,
+        key,
+        warning,
+    })
+}
+
+/// A codec verb records CDR; any other recorded format is refused. A custom
+/// serializer or deserializer records none: that is the documented escape
+/// hatch, so it warns instead.
+fn codec_warning(resource: &str, options: &[(String, String)]) -> Result<Option<String>, String> {
+    match WireFormat::recorded_in(options) {
+        WireFormat::Cdr => Ok(None),
+        WireFormat::Unspecified => Ok(Some(format!(
+            "ros2://{resource}: a custom serializer or deserializer is installed; \
+             nothing checks that it speaks CDR"
+        ))),
+        other => Err(format!(
+            "ros2://{resource} encodes as {other:?}; a ROS topic needs CDR"
+        )),
+    }
+}
+
+/// A ROS topic has one type: every link on a topic, publisher or
+/// subscription, names the same ROS type and hash. Two Rust types that mirror
+/// one ROS type may share a topic.
+fn one_type_per_topic<'a>(links: impl Iterator<Item = &'a Link>) -> Result<(), String> {
+    let mut seen: Vec<&Link> = Vec::new();
+    for link in links {
+        match seen.iter().find(|l| l.topic == link.topic) {
+            Some(other)
+                if (other.ty.dds_name, other.ty.hash) != (link.ty.dds_name, link.ty.hash) =>
+            {
+                return Err(format!(
+                    "ros2:/{} is linked as {} ({}) and as {} ({}); a ROS topic has one type",
+                    link.topic, other.ty.dds_name, other.ty.hash, link.ty.dds_name, link.ty.hash
+                ));
+            }
+            Some(_) => {}
+            None => seen.push(link),
+        }
+    }
+    Ok(())
+}
+
+/// An outbound link: a ROS publisher.
+struct Publisher {
+    link: Link,
+}
+
+fn publisher(
+    route: &RouteInfo,
+    types: &[RosType],
+    domain: u32,
+    entity_id: u32,
+) -> Result<Publisher, String> {
+    let resource = &*route.default_topic;
+    if route.topic_capacity > 0 {
+        return Err(format!(
+            "ros2://{resource} has a topic writer; a ROS topic is fixed by its link"
+        ));
+    }
+    let link = link(
+        resource,
+        route.type_id,
+        &route.config.protocol_options,
+        types,
+        domain,
+        entity_id,
+    )?;
+    Ok(Publisher { link })
+}
+
+/// The inbound links: one subscription token per link, and one Zenoh
+/// subscriber per distinct topic.
+struct Subscriptions {
+    links: Vec<Link>,
+    /// Per distinct topic: its data key, and the link topic its samples are
+    /// dispatched under.
+    subscribers: Vec<(KeyExpr<'static>, Arc<str>)>,
+}
+
+fn subscriptions(
+    inbound: &InboundDispatch,
+    types: &[RosType],
+    domain: u32,
+    first_id: u32,
+) -> Result<Subscriptions, String> {
+    let mut links: Vec<Link> = Vec::with_capacity(inbound.routes().len());
+    let mut subscribers: Vec<(KeyExpr<'static>, Arc<str>)> = Vec::new();
+    for (i, route) in inbound.routes().iter().enumerate() {
+        let resource = &*route.topic;
+        let link = link(
+            resource,
+            route.type_id,
+            &route.config.protocol_options,
+            types,
+            domain,
+            first_id + i as u32,
+        )?;
+        if !links.iter().any(|l| l.topic == link.topic) {
+            subscribers.push((link.key.clone(), route.topic.clone()));
+        }
+        links.push(link);
+    }
+    Ok(Subscriptions { links, subscribers })
+}
+
+/// The link's QoS overrides on top of the rmw default profile.
+fn qos(options: &[(String, String)]) -> Result<Qos, String> {
+    let mut qos = Qos::default();
+    for (key, value) in options {
+        match key.as_str() {
+            DEPTH_KEY => {
+                qos.depth =
+                    value.parse().ok().filter(|d| *d > 0).ok_or_else(|| {
+                        format!("depth must be a positive integer, got '{value}'")
+                    })?;
+            }
+            RELIABILITY_KEY => {
+                qos.reliability = Reliability::parse(value).ok_or_else(|| {
+                    format!("reliability must be reliable or best_effort, got '{value}'")
+                })?;
+            }
+            _ => {}
+        }
+    }
+    debug_assert!(qos.durability == Durability::Volatile && qos.history == History::KeepLast);
+    Ok(qos)
+}
+
+/// What `build()` prepares for the session task.
+pub(crate) struct Ros2Parts {
+    domain: u32,
+    node: Ros2Node,
+    outbound: OutboundRoutes,
+    publishers: Vec<Publisher>,
+    inbound: InboundDispatch,
+    subscriptions: Subscriptions,
+}
+
+impl Ros2Parts {
+    /// Declare the node's, every publisher's and every subscription's
+    /// liveliness token; subscribe; then publish each value with its
+    /// attachment.
+    pub(crate) async fn serve(self, session: &Session) {
+        let Ros2Parts {
+            domain,
+            node,
+            mut outbound,
+            publishers,
+            inbound,
+            subscriptions,
+        } = self;
+        let zid = session.zid().to_string();
+        let identity = Node {
+            domain,
+            zid: &zid,
+            id: 0,
+            enclave: "/",
+            namespace: &node.namespace,
+            name: &node.name,
+        };
+        let token = |link: &Link, kind| {
+            profile::entity_token(
+                &identity,
+                link.entity_id,
+                kind,
+                &link.topic,
+                link.ty.dds_name,
+                link.ty.hash,
+                &link.qos,
+            )
+        };
+
+        let mut tokens = Vec::with_capacity(1 + publishers.len() + subscriptions.links.len());
+        tokens.push(profile::node_token(&identity));
+        let mut gids = Vec::with_capacity(publishers.len());
+        for publisher in &publishers {
+            let token = token(&publisher.link, EntityKind::Publisher);
+            gids.push(profile::gid(&token));
+            tokens.push(token);
+        }
+        for link in &subscriptions.links {
+            tokens.push(token(link, EntityKind::Subscription));
+        }
+        // Declared before the first publish, as rmw_zenoh does.
+        let mut live = Vec::with_capacity(tokens.len());
+        for token in tokens {
+            match session.liveliness().declare_token(token).await {
+                Ok(token) => live.push(token),
+                Err(_e) => log_error!("ROS 2: cannot declare a liveliness token: {}", _e),
+            }
+        }
+
+        let mut subscribers = Vec::with_capacity(subscriptions.subscribers.len());
+        for (key, topic) in subscriptions.subscribers {
+            let inbound = inbound.clone();
+            let declared = session
+                .declare_subscriber(key)
+                .allowed_origin(Locality::Remote)
+                .callback(move |sample| {
+                    // A delete has no value; the attachment is not needed.
+                    if sample.kind() == SampleKind::Put {
+                        dispatch_guarded(&inbound, &topic, &sample.payload().to_bytes());
+                    }
+                })
+                .await;
+            match declared {
+                Ok(subscriber) => subscribers.push(subscriber),
+                Err(_e) => log_error!("ROS 2: cannot declare a subscriber: {}", _e),
+            }
+        }
+
+        let mut senders = Vec::with_capacity(publishers.len());
+        for publisher in &publishers {
+            let declared = session
+                .declare_publisher(publisher.link.key.clone())
+                .congestion_control(CongestionControl::Drop)
+                .allowed_destination(Locality::Remote)
+                .await;
+            match declared {
+                Ok(sender) => senders.push(Some(sender)),
+                Err(_e) => {
+                    log_error!(
+                        "ROS 2: cannot declare a publisher on '{}': {}",
+                        publisher.link.topic,
+                        _e
+                    );
+                    senders.push(None);
+                }
+            }
+        }
+
+        let mut sequence = std::vec![0i64; publishers.len()];
+        while let Some(msg) = outbound.next().await {
+            let id = msg.route.id;
+            let Some(sender) = &senders[id] else {
+                outbound.reject(id);
+                continue;
+            };
+            sequence[id] += 1;
+            let attachment = Attachment {
+                sequence: sequence[id],
+                timestamp_ns: now_ns(),
+                gid: gids[id],
+            };
+            let result = sender
+                .put(msg.payload.into_vec())
+                .attachment(attachment.encode())
+                .await;
+            if let Err(_e) = result {
+                log_error!(
+                    "ROS 2: put on '{}' failed: {}",
+                    publishers[id].link.topic,
+                    _e
+                );
+                outbound.reject(id);
+            }
+        }
+        // The tokens keep the node in the ROS graph, and the subscribers deliver,
+        // for the life of the database.
+        let _alive = (live, subscribers);
+        core::future::pending::<()>().await;
+    }
+}
+
+fn now_ns() -> i64 {
+    SystemTime::now()
+        .duration_since(UNIX_EPOCH)
+        .map(|d| d.as_nanos() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_domain_resolves_as_rcl_resolves_it() {
+        assert_eq!(resolve_domain(Some(7), Some("3")), Ok(7), "explicit wins");
+        assert_eq!(
+            resolve_domain(None, Some("3")),
+            Ok(3),
+            "then the environment"
+        );
+        assert_eq!(resolve_domain(None, Some(" 12 ")), Ok(12));
+        assert_eq!(resolve_domain(None, None), Ok(0), "then 0");
+        assert_eq!(resolve_domain(None, Some("")), Ok(0), "empty is unset");
+        assert_eq!(resolve_domain(None, Some("  ")), Ok(0), "blank is unset");
+        // As `strtoul(.., 0)`: octal and hex.
+        assert_eq!(resolve_domain(None, Some("010")), Ok(8));
+        assert_eq!(resolve_domain(None, Some("0xA")), Ok(10));
+        assert_eq!(resolve_domain(None, Some("0X1f")), Ok(31));
+        assert_eq!(resolve_domain(None, Some("0")), Ok(0));
+        assert!(resolve_domain(None, Some("08")).is_err(), "not octal");
+        assert!(resolve_domain(None, Some("0x")).is_err());
+        assert!(resolve_domain(None, Some("1a")).is_err());
+        // Above 232 warns: rmw_zenoh accepts it.
+        assert_eq!(resolve_domain(Some(233), None), Ok(233));
+        assert_eq!(resolve_domain(None, Some("233")), Ok(233));
+        assert_eq!(domain_warning(232), None);
+        let warning = domain_warning(233).expect("a warning");
+        assert!(
+            warning.contains("233") && warning.contains("rmw_zenoh"),
+            "{warning}"
+        );
+        assert!(
+            resolve_domain(None, Some("4294967296")).is_err(),
+            "beyond u32"
+        );
+        let bad = resolve_domain(None, Some("seven")).unwrap_err();
+        assert!(bad.contains("ROS_DOMAIN_ID='seven'"), "{bad}");
+        assert!(resolve_domain(None, Some("-1")).is_err());
+    }
+
+    #[test]
+    fn a_custom_serializer_warns_and_a_foreign_codec_fails() {
+        use aimdb_core::connector::WIRE_FORMAT_KEY;
+        let format = |f: &str| [(WIRE_FORMAT_KEY.to_string(), f.to_string())];
+        assert_eq!(codec_warning("t", &format("cdr")), Ok(None));
+        // `with_serializer` alone, or after a codec verb, which it clears.
+        let warning = codec_warning("t", &[]).unwrap().expect("a warning");
+        assert!(
+            warning.contains("ros2://t") && warning.contains("CDR"),
+            "{warning}"
+        );
+        let error = codec_warning("t", &format("json")).unwrap_err();
+        assert!(error.contains("Json"), "{error}");
+    }
+
+    #[test]
+    fn link_options_override_the_default_qos() {
+        let opt = |k: &str, v: &str| (k.to_string(), v.to_string());
+        assert_eq!(qos(&[]).unwrap(), Qos::default());
+        let q = qos(&[opt(DEPTH_KEY, "1"), opt(RELIABILITY_KEY, "best_effort")]).unwrap();
+        assert_eq!((q.depth, q.reliability), (1, Reliability::BestEffort));
+        assert!(qos(&[opt(DEPTH_KEY, "0")]).is_err());
+        assert!(qos(&[opt(DEPTH_KEY, "ten")]).is_err());
+        assert!(qos(&[opt(RELIABILITY_KEY, "maybe")]).is_err());
+    }
+}
diff --git a/aimdb-zenoh-connector/src/shared.rs b/aimdb-zenoh-connector/src/shared.rs
new file mode 100644
index 00000000..2ad4f1e4
--- /dev/null
+++ b/aimdb-zenoh-connector/src/shared.rs
@@ -0,0 +1,110 @@
+//! One Zenoh session behind a `ZenohConnector` and the `Ros2Connector`
+//! derived from it.
+//!
+//! Each connector's `build()` validates its links and leaves its parts here.
+//! The first `build()` to run returns the session task; the other returns
+//! none. `AimDbBuilder` runs every `build()` before it polls any future, so
+//! the task finds every part when it first runs.
+
+use std::boxed::Box;
+use std::string::String;
+use std::sync::atomic::{AtomicBool, Ordering};
+use std::sync::{Arc, Mutex, PoisonError};
+use std::vec::Vec;
+
+use aimdb_core::{log_warn, DbResult};
+
+use crate::connector::BoxFuture;
+use crate::native::{check_runtime, open, session_config, ZenohParts};
+use crate::ros2::Ros2Parts;
+
+/// The session the views share, and what each view left for it.
+pub(crate) struct Shared {
+    endpoint: String,
+    config: Mutex<Option<zenoh::Config>>,
+    zenoh: Mutex<Option<ZenohParts>>,
+    ros2: Mutex<Option<Ros2Parts>>,
+    /// A `build()` has returned the session task.
+    task_taken: AtomicBool,
+    /// A `Ros2Connector` exists on this session.
+    ros2_view: AtomicBool,
+}
+
+impl Shared {
+    pub(crate) fn new(endpoint: String) -> Arc<Self> {
+        Arc::new(Self {
+            endpoint,
+            config: Mutex::new(None),
+            zenoh: Mutex::new(None),
+            ros2: Mutex::new(None),
+            task_taken: AtomicBool::new(false),
+            ros2_view: AtomicBool::new(false),
+        })
+    }
+
+    pub(crate) fn set_config(&self, config: zenoh::Config) {
+        *self.config.lock().unwrap_or_else(PoisonError::into_inner) = Some(config);
+    }
+
+    pub(crate) fn ros2_view_created(&self) {
+        self.ros2_view.store(true, Ordering::Relaxed);
+    }
+
+    pub(crate) fn deposit_zenoh(self: &Arc<Self>, parts: ZenohParts) -> DbResult<Vec<BoxFuture>> {
+        *self.zenoh.lock().unwrap_or_else(PoisonError::into_inner) = Some(parts);
+        self.task()
+    }
+
+    pub(crate) fn deposit_ros2(self: &Arc<Self>, parts: Ros2Parts) -> DbResult<Vec<BoxFuture>> {
+        *self.ros2.lock().unwrap_or_else(PoisonError::into_inner) = Some(parts);
+        self.task()
+    }
+
+    /// The session task for the first caller; nothing for the next.
+    fn task(self: &Arc<Self>) -> DbResult<Vec<BoxFuture>> {
+        let config = self
+            .config
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .clone();
+        // Validated by every view, so a bad endpoint fails whichever builds.
+        let config = session_config(&self.endpoint, config)?;
+        check_runtime()?;
+        if self.task_taken.swap(true, Ordering::AcqRel) {
+            return Ok(Vec::new());
+        }
+        let shared = self.clone();
+        let task: BoxFuture = Box::pin(async move { shared.run(config).await });
+        Ok(Vec::from([task]))
+    }
+
+    async fn run(self: Arc<Self>, config: zenoh::Config) {
+        let zenoh = self
+            .zenoh
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .take();
+        let ros2 = self
+            .ros2
+            .lock()
+            .unwrap_or_else(PoisonError::into_inner)
+            .take();
+        if ros2.is_none() && self.ros2_view.load(Ordering::Relaxed) {
+            log_warn!("Zenoh: a Ros2Connector on this session was never registered");
+        }
+        let session = open(config).await;
+        let zenoh = async {
+            match zenoh {
+                Some(parts) => parts.serve(&session).await,
+                None => core::future::pending().await,
+            }
+        };
+        let ros2 = async {
+            match ros2 {
+                Some(parts) => parts.serve(&session).await,
+                None => core::future::pending().await,
+            }
+        };
+        tokio::join!(zenoh, ros2);
+    }
+}
diff --git a/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.rs b/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.rs
new file mode 100644
index 00000000..c7a537ef
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.rs
@@ -0,0 +1,7 @@
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+
+struct NotRos;
+
+fn main() {
+    let _ = Ros2Connector::new("tcp/127.0.0.1:7447", Ros2Node::new("n")).register::<NotRos>();
+}
diff --git a/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.stderr b/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.stderr
new file mode 100644
index 00000000..5267d22b
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/compile-fail/register_not_ros.stderr
@@ -0,0 +1,19 @@
+error[E0277]: `NotRos` is not a ROS 2 message type
+ --> tests/compile-fail/register_not_ros.rs:6:85
+  |
+6 |     let _ = Ros2Connector::new("tcp/127.0.0.1:7447", Ros2Node::new("n")).register::<NotRos>();
+  |                                                                          --------   ^^^^^^ not a `RosMessage`
+  |                                                                          |
+  |                                                                          required by a bound introduced by this call
+  |
+help: the trait `aimdb_data_contracts::ros_message::RosMessage` is not implemented for `NotRos`
+ --> tests/compile-fail/register_not_ros.rs:3:1
+  |
+3 | struct NotRos;
+  | ^^^^^^^^^^^^^
+  = note: derive it: `#[derive(RosMessage)]` with `#[ros(type = "pkg/msg/Name", hash = "RIHS01_…")]`
+note: required by a bound in `Ros2Connector::register`
+ --> src/ros2.rs
+  |
+  |     pub fn register<T: RosMessage + 'static>(mut self) -> Self {
+  |                        ^^^^^^^^^^ required by this bound in `Ros2Connector::register`
diff --git a/aimdb-zenoh-connector/tests/compile_fail.rs b/aimdb-zenoh-connector/tests/compile_fail.rs
new file mode 100644
index 00000000..dfa36654
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/compile_fail.rs
@@ -0,0 +1,8 @@
+//! `Ros2Connector::register` accepts only `RosMessage` types.
+
+#![cfg(feature = "std")]
+
+#[test]
+fn register_needs_a_ros_message() {
+    trybuild::TestCases::new().compile_fail("tests/compile-fail/*.rs");
+}
diff --git a/aimdb-zenoh-connector/tests/grammar_oracle.rs b/aimdb-zenoh-connector/tests/grammar_oracle.rs
new file mode 100644
index 00000000..af29cbfa
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/grammar_oracle.rs
@@ -0,0 +1,308 @@
+//! `ZenohGrammar` against `zenoh-keyexpr` on a generated corpus: validation,
+//! canonical filters, matching and covering agree with Zenoh's own rules.
+//! Capture values, which Zenoh has no notion of, are checked against a
+//! brute-force model.
+
+use aimdb_core::{PatternPart, Spans, TopicFilter, TopicGrammar, TopicPattern, MAX_CAPTURES};
+use aimdb_zenoh_connector::ZenohGrammar;
+use zenoh_keyexpr::{keyexpr, OwnedKeyExpr};
+
+const PATTERN_CHUNKS: [&str; 8] = ["a", "b", "@v", "*", "**", "a$*", "$*b", "a$*b"];
+const KEY_CHUNKS: [&str; 4] = ["a", "b", "ab", "@v"];
+const CAPTURE_PATTERNS: [&str; 12] = [
+    "{x}",
+    "{x..}",
+    "a/{x..}/b",
+    "{x}/{y..}",
+    "{x..}/{y}",
+    "@v/{x..}",
+    "{x..}/a/{y..}",
+    "{x..}/{y..}",
+    "{x}/**/{y}",
+    "**/{x}/*",
+    "a$*/{x..}/b",
+    "{x..}/@v/{y}",
+];
+
+/// Every `/`-joined sequence of 1 to `max` `chunks`.
+fn sequences(chunks: &[&str], max: usize) -> Vec<String> {
+    let mut out: Vec<String> = chunks.iter().map(|c| c.to_string()).collect();
+    let mut previous = out.clone();
+    for _ in 1..max {
+        previous = previous
+            .iter()
+            .flat_map(|p| chunks.iter().map(move |c| format!("{p}/{c}")))
+            .collect();
+        out.extend(previous.iter().cloned());
+    }
+    out
+}
+
+fn compile(pattern: &str) -> Box<dyn TopicFilter> {
+    let parsed = TopicPattern::parse(pattern).expect("valid `{…}` syntax");
+    ZenohGrammar.compile(&parsed).expect(pattern)
+}
+
+fn patterns() -> Vec<String> {
+    let mut all = sequences(&PATTERN_CHUNKS, 3);
+    all.extend(CAPTURE_PATTERNS.iter().map(|p| p.to_string()));
+    all
+}
+
+/// Every string over `a@$*/#` up to 6 bytes: `compile` accepts what Zenoh
+/// accepts, except `$*` in an `@` chunk, and its filter is Zenoh's canon.
+///
+/// `zenoh-keyexpr` 1.10.1's canonizer panics on a run of `$*` ending the key
+/// (`a$*$*`) and leaves `$*$*` from `$*$*$*`, so for those inputs only the
+/// validity of our filter is checked.
+#[test]
+fn compile_agrees_with_zenoh_validation() {
+    let mut all: Vec<String> = vec![String::new()];
+    let mut checked = 0;
+    for _ in 0..6 {
+        all = all
+            .iter()
+            .flat_map(|s| "a@$*/#".chars().map(move |c| format!("{s}{c}")))
+            .collect();
+        for s in &all {
+            let ours = ZenohGrammar.compile(&TopicPattern::parse(s).expect("no braces"));
+            if s.contains("$*$*") {
+                if let Ok(f) = &ours {
+                    assert!(keyexpr::new(f.filter()).is_ok(), "{s}");
+                }
+                continue;
+            }
+            checked += 1;
+            match (ours, OwnedKeyExpr::autocanonize(s.clone())) {
+                (Ok(f), Ok(zenoh)) => assert_eq!(f.filter(), zenoh.as_str(), "{s}"),
+                (Ok(f), Err(e)) => panic!("{s}: we accept ({}), Zenoh refuses: {e}", f.filter()),
+                (Err(e), Ok(_)) => assert!(
+                    s.split('/').any(|c| c.starts_with('@') && c.contains("$*")),
+                    "{s}: Zenoh accepts, we refuse: {e}"
+                ),
+                (Err(_), Err(_)) => {}
+            }
+        }
+    }
+    assert!(checked > 50_000, "{checked} strings checked");
+}
+
+#[test]
+fn filters_are_what_zenoh_canonizes_to() {
+    for pattern in sequences(&PATTERN_CHUNKS, 3) {
+        let filter = compile(&pattern);
+        let zenoh = OwnedKeyExpr::autocanonize(pattern.clone()).expect("zenoh accepts it");
+        assert_eq!(filter.filter(), zenoh.as_str(), "{pattern}");
+        assert!(keyexpr::new(filter.filter()).is_ok(), "{pattern}");
+    }
+    for pattern in CAPTURE_PATTERNS {
+        let filter = compile(pattern);
+        assert!(keyexpr::new(filter.filter()).is_ok(), "{pattern}");
+    }
+}
+
+#[test]
+fn matching_agrees_with_zenoh() {
+    let keys = sequences(&KEY_CHUNKS, 3);
+    let mut spans: Spans = [(0, 0); MAX_CAPTURES];
+    let (mut matched, mut missed) = (0, 0);
+    for pattern in patterns() {
+        let filter = compile(&pattern);
+        let zenoh = keyexpr::new(filter.filter()).expect("canonical");
+        for key in &keys {
+            let expected = zenoh.intersects(keyexpr::new(key.as_str()).expect("key"));
+            if expected {
+                matched += 1;
+            } else {
+                missed += 1;
+            }
+            assert_eq!(
+                filter.matches(key, &mut spans),
+                expected,
+                "pattern {pattern} ({}) on key {key}",
+                filter.filter()
+            );
+        }
+    }
+    assert!(
+        matched > 1_000 && missed > 1_000,
+        "{matched} matched, {missed} missed"
+    );
+}
+
+/// A `put` on a wildcard key expression arrives with the wildcard as its
+/// key. Zenoh intersects it with subscribers; the grammar matches it with
+/// nothing (see `ZenohGrammar`).
+#[test]
+fn wildcard_keys_match_no_pattern() {
+    let keys: Vec<String> = sequences(&["a", "@v", "*", "**", "a$*"], 3)
+        .into_iter()
+        .filter(|k| k.contains('*') && keyexpr::new(k.as_str()).is_ok())
+        .collect();
+    let mut spans: Spans = [(0, 0); MAX_CAPTURES];
+    let mut intersecting = 0;
+    for pattern in patterns() {
+        let filter = compile(&pattern);
+        let zenoh = keyexpr::new(filter.filter()).expect("canonical");
+        for key in &keys {
+            intersecting += usize::from(zenoh.intersects(keyexpr::new(key.as_str()).unwrap()));
+            assert!(!filter.matches(key, &mut spans), "{pattern} on {key}");
+        }
+    }
+    assert!(intersecting > 1_000, "Zenoh would deliver {intersecting}");
+}
+
+#[test]
+fn covering_equals_zenoh_includes() {
+    let filters: Vec<String> = patterns()
+        .iter()
+        .map(|p| compile(p).filter().to_string())
+        .collect();
+    let (mut pairs, mut covered, mut globs) = (0, 0, 0);
+    for a in &filters {
+        let za = keyexpr::new(a.as_str()).expect("canonical");
+        for b in &filters {
+            let zb = keyexpr::new(b.as_str()).expect("canonical");
+            let ours = ZenohGrammar.covers(a, b);
+            assert_eq!(ours, za.includes(zb), "{a} covers {b}");
+            pairs += 1;
+            covered += usize::from(ours);
+            globs += usize::from(ours && a != b && a.contains('$') && b.contains('$'));
+        }
+    }
+    assert!(pairs > 100_000, "{pairs} pairs");
+    assert!(
+        covered > 1_000 && globs > 100,
+        "{covered} covered, {globs} by a `$*` chunk"
+    );
+}
+
+// ------------------------------------------------------- capture values
+
+/// One chunk of a pattern as written, read without `ZenohGrammar`.
+enum Model {
+    Literal(String),
+    One(Option<usize>),
+    Many(Option<usize>),
+    Glob(String),
+}
+
+fn model(pattern: &str) -> Vec<Model> {
+    let mut captures = 0;
+    pattern
+        .split('/')
+        .map(|chunk| {
+            if chunk.starts_with('{') {
+                captures += 1;
+                if chunk.ends_with("..}") {
+                    Model::Many(Some(captures - 1))
+                } else {
+                    Model::One(Some(captures - 1))
+                }
+            } else if chunk == "**" {
+                Model::Many(None)
+            } else if chunk == "*" {
+                Model::One(None)
+            } else if chunk.contains("$*") {
+                Model::Glob(chunk.to_string())
+            } else {
+                Model::Literal(chunk.to_string())
+            }
+        })
+        .collect()
+}
+
+/// Byte by byte: `$*` is any run, everything else itself.
+fn glob(pattern: &[u8], text: &[u8]) -> bool {
+    match pattern {
+        [] => text.is_empty(),
+        [b'$', b'*', rest @ ..] => (0..=text.len()).any(|i| glob(rest, &text[i..])),
+        [c, rest @ ..] => text.first() == Some(c) && glob(rest, &text[1..]),
+    }
+}
+
+/// Every way `pattern` matches `key`: per pattern chunk, the chunks it took.
+fn assignments(pattern: &[Model], key: &[&str], taken: &mut Vec<usize>, out: &mut Vec<Vec<usize>>) {
+    let Some((first, rest)) = pattern.split_first() else {
+        if key.is_empty() {
+            out.push(taken.clone());
+        }
+        return;
+    };
+    let verbatim = |c: &&str| c.starts_with('@');
+    if let Model::Many(_) = first {
+        for n in 0..=key.len() {
+            if key[..n].iter().any(verbatim) {
+                break;
+            }
+            taken.push(n);
+            assignments(rest, &key[n..], taken, out);
+            taken.pop();
+        }
+        return;
+    }
+    let Some((chunk, key_rest)) = key.split_first() else {
+        return;
+    };
+    let fits = match first {
+        Model::Literal(text) => text == chunk,
+        Model::One(_) => !verbatim(chunk),
+        Model::Glob(g) => !verbatim(chunk) && glob(g.as_bytes(), chunk.as_bytes()),
+        Model::Many(_) => unreachable!(),
+    };
+    if fits {
+        taken.push(1);
+        assignments(rest, key_rest, taken, out);
+        taken.pop();
+    }
+}
+
+/// The capture values when the leftmost capture takes the fewest chunks.
+fn expected(pattern: &str, key: &str) -> Option<Vec<String>> {
+    let model = model(pattern);
+    let chunks: Vec<&str> = key.split('/').collect();
+    let mut all = Vec::new();
+    assignments(&model, &chunks, &mut Vec::new(), &mut all);
+    let best = all.into_iter().min()?;
+    let mut values = Vec::new();
+    let mut at = 0;
+    for (chunk, &n) in model.iter().zip(&best) {
+        if let Model::One(Some(_)) | Model::Many(Some(_)) = chunk {
+            values.push(chunks[at..at + n].join("/"));
+        }
+        at += n;
+    }
+    Some(values)
+}
+
+#[test]
+fn captures_take_the_fewest_chunks_leftmost_first() {
+    let keys = sequences(&["a", "b", "ab", "@v"], 4);
+    let mut matched = 0;
+    for pattern in CAPTURE_PATTERNS {
+        let filter = compile(pattern);
+        let count = TopicPattern::parse(pattern)
+            .unwrap()
+            .parts()
+            .iter()
+            .filter(|p| matches!(p, PatternPart::Capture { .. }))
+            .count();
+        for key in &keys {
+            // Unwritten spans would read as `<unwritten>`.
+            let mut spans: Spans = [(u16::MAX, u16::MAX); MAX_CAPTURES];
+            let ours = filter.matches(key, &mut spans).then(|| {
+                spans[..count]
+                    .iter()
+                    .map(|&(s, e)| {
+                        key.get(usize::from(s)..usize::from(e))
+                            .unwrap_or("<unwritten>")
+                            .to_string()
+                    })
+                    .collect::<Vec<_>>()
+            });
+            matched += usize::from(ours.is_some());
+            assert_eq!(ours, expected(pattern, key), "{pattern} on {key}");
+        }
+    }
+    assert!(matched > 500, "{matched} matched");
+}
diff --git a/aimdb-zenoh-connector/tests/inbound_routes.rs b/aimdb-zenoh-connector/tests/inbound_routes.rs
new file mode 100644
index 00000000..42cea91e
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/inbound_routes.rs
@@ -0,0 +1,183 @@
+//! `ZenohGrammar` through core's router (`InboundDispatch`), with Zenoh's
+//! delivery emulated: a sample reaches every declared subscriber whose key
+//! expression intersects its key, and each delivery is one `dispatch` call
+//! (053 §4.3, inbound).
+
+#![cfg(feature = "std")]
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::{AimDb, AimDbBuilder, ConnectorBuilder, DbResult, InboundDispatch, KeyId};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::ZenohGrammar;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use zenoh_keyexpr::keyexpr;
+
+#[derive(Clone, Debug)]
+struct Sample;
+
+/// Registers the `zenoh` scheme so `build()` accepts the links.
+struct NoopZenoh;
+
+impl ConnectorBuilder for NoopZenoh {
+    #[allow(clippy::type_complexity)]
+    fn build<'a>(
+        &'a self,
+        _db: &'a AimDb,
+    ) -> Pin<
+        Box<
+            dyn Future<Output = DbResult<Vec<Pin<Box<dyn Future<Output = ()> + Send + 'static>>>>>
+                + Send
+                + 'a,
+        >,
+    > {
+        Box::pin(async { Ok(Vec::new()) })
+    }
+
+    fn scheme(&self) -> &str {
+        "zenoh"
+    }
+}
+
+/// What one link's deserializer saw: its key capture's value and key.
+#[derive(Default)]
+struct Probe {
+    calls: AtomicUsize,
+    seen: Mutex<Vec<(String, Option<KeyId>)>>,
+}
+
+/// One record with an inbound link per pattern, keyed by `(capture, capacity)`.
+async fn record(links: &[(&'static str, Option<(&'static str, u16)>)]) -> (AimDb, Vec<Arc<Probe>>) {
+    let runtime = Arc::new(TokioAdapter::new().unwrap());
+    let mut builder = AimDbBuilder::new()
+        .runtime(runtime)
+        .with_connector(NoopZenoh);
+    let probes: Vec<Arc<Probe>> = links.iter().map(|_| Arc::default()).collect();
+    let config: Vec<_> = links.iter().copied().zip(probes.clone()).collect();
+    builder.configure::<Sample>("rec", move |reg| {
+        reg.buffer(BufferCfg::SingleLatest);
+        for ((pattern, key), probe) in config {
+            let mut link = reg.link_from(&format!("zenoh://{pattern}"));
+            if let Some((capture, capacity)) = key {
+                link = link.key(capture, capacity);
+            }
+            link.with_match_deserializer(move |_ctx, m, _bytes| {
+                probe.calls.fetch_add(1, Ordering::SeqCst);
+                let value = key.and_then(|(c, _)| m.get(c)).unwrap_or_default();
+                probe.seen.lock().unwrap().push((value.into(), m.key()));
+                Ok(Sample)
+            })
+            .finish();
+        }
+    });
+    let (db, _runner) = builder.build().await.expect("build");
+    (db, probes)
+}
+
+/// Delivers `key` once per intersecting subscriber, as Zenoh does; returns
+/// the number of deliveries.
+fn publish(inbound: &InboundDispatch, key: &str) -> usize {
+    let key_expr = keyexpr::new(key).expect("valid key expression");
+    let mut deliveries = 0;
+    for subscription in inbound.subscriptions() {
+        if keyexpr::new(&*subscription).unwrap().intersects(key_expr) {
+            inbound.dispatch(key, b"");
+            deliveries += 1;
+        }
+    }
+    deliveries
+}
+
+fn calls(probes: &[Arc<Probe>]) -> Vec<usize> {
+    probes
+        .iter()
+        .map(|p| p.calls.load(Ordering::SeqCst))
+        .collect()
+}
+
+fn subscriptions(inbound: &InboundDispatch) -> Vec<String> {
+    inbound
+        .subscriptions()
+        .iter()
+        .map(|s| s.to_string())
+        .collect()
+}
+
+#[tokio::test]
+async fn covered_filters_deliver_once_per_route() {
+    let (db, probes) = record(&[
+        ("aimdb/*/state", None),
+        ("aimdb/cell4/state", None),
+        ("aimdb/{cell}/state", None),
+    ])
+    .await;
+    let inbound = InboundDispatch::new(&db, "zenoh", &ZenohGrammar).unwrap();
+    assert_eq!(subscriptions(&inbound), ["aimdb/*/state"]);
+    assert_eq!(publish(&inbound, "aimdb/cell4/state"), 1);
+    assert_eq!(calls(&probes), [1, 1, 1]);
+}
+
+/// `**` and `*/**` match the same keys; `**` covers `*/**`, so only it is
+/// declared.
+#[tokio::test]
+async fn an_equivalent_filter_is_not_declared_twice() {
+    let (db, probes) = record(&[("{all..}", None), ("{path..}/{leaf}", None)]).await;
+    let inbound = InboundDispatch::new(&db, "zenoh", &ZenohGrammar).unwrap();
+    assert_eq!(subscriptions(&inbound), ["**"]);
+    assert_eq!(publish(&inbound, "plant/cell4/temp"), 1);
+    assert_eq!(calls(&probes), [1, 1]);
+}
+
+/// `x$*` covers `x$*y`; were both declared, each route would ingest a
+/// sample matching both twice.
+#[tokio::test]
+async fn sub_chunk_filters_deliver_once_per_route() {
+    let (db, probes) = record(&[("dev/x$*", None), ("dev/x$*y", None)]).await;
+    let inbound = InboundDispatch::new(&db, "zenoh", &ZenohGrammar).unwrap();
+    assert_eq!(subscriptions(&inbound), ["dev/x$*"]);
+    assert_eq!(publish(&inbound, "dev/xzy"), 1);
+    assert_eq!(calls(&probes), [1, 1]);
+}
+
+/// 055 §5.7's known difference: Zenoh delivers a sample matching two partly
+/// overlapping filters to both subscribers, so each route sees it twice.
+#[tokio::test]
+async fn partly_overlapping_filters_deliver_per_subscriber() {
+    let (db, probes) = record(&[("a/*/c", None), ("a/b/*", None)]).await;
+    let inbound = InboundDispatch::new(&db, "zenoh", &ZenohGrammar).unwrap();
+    assert_eq!(subscriptions(&inbound), ["a/*/c", "a/b/*"]);
+    assert_eq!(publish(&inbound, "a/b/c"), 2);
+    assert_eq!(calls(&probes), [2, 2]);
+}
+
+/// One `KeyId` per publisher, and a `put` on a wildcard key expression,
+/// which Zenoh delivers with the wildcard as its key, takes none.
+#[tokio::test]
+async fn keyed_pattern_assigns_one_key_per_publisher() {
+    let (db, probes) = record(&[("aimdb/{cell}/state", Some(("cell", 2)))]).await;
+    let inbound = InboundDispatch::new(&db, "zenoh", &ZenohGrammar).unwrap();
+
+    assert_eq!(publish(&inbound, "aimdb/*/state"), 1);
+    assert_eq!(publish(&inbound, "aimdb/c$*/state"), 1);
+    assert_eq!(calls(&probes), [0], "wildcard keys reach no route");
+
+    for key in [
+        "aimdb/cell4/state",
+        "aimdb/cell5/state",
+        "aimdb/cell4/state",
+    ] {
+        publish(&inbound, key);
+    }
+    let seen = probes[0].seen.lock().unwrap();
+    let values: Vec<&str> = seen.iter().map(|(v, _)| v.as_str()).collect();
+    assert_eq!(values, ["cell4", "cell5", "cell4"]);
+    assert!(seen.iter().all(|(_, k)| k.is_some()));
+    assert_ne!(seen[0].1, seen[1].1);
+    assert_eq!(seen[0].1, seen[2].1);
+    assert_eq!(
+        db.inbound_key_name("rec", seen[1].1.unwrap()).as_deref(),
+        Some("cell5")
+    );
+}
diff --git a/aimdb-zenoh-connector/tests/interop/Dockerfile b/aimdb-zenoh-connector/tests/interop/Dockerfile
new file mode 100644
index 00000000..6c1081a7
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/interop/Dockerfile
@@ -0,0 +1,8 @@
+# A ROS 2 distribution with rmw_zenoh, for tests/interop/ros2_interop.sh.
+ARG DISTRO=lyrical
+FROM ros:${DISTRO}
+ARG DISTRO
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ros-${DISTRO}-rmw-zenoh-cpp \
+ && rm -rf /var/lib/apt/lists/*
+ENV RMW_IMPLEMENTATION=rmw_zenoh_cpp
diff --git a/aimdb-zenoh-connector/tests/interop/ros2_interop.sh b/aimdb-zenoh-connector/tests/interop/ros2_interop.sh
new file mode 100755
index 00000000..281636e5
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/interop/ros2_interop.sh
@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+# ros2:// against a real ROS 2 distribution: rmw_zenohd as the router, the
+# ros2 CLI as the other side, the ros2_talker and ros2_listener examples as
+# AimDB.
+#
+#   ros2_interop.sh <distro>
+#
+# Needs Docker with host networking and the examples built:
+#   cargo build -p aimdb-zenoh-connector --features std --examples
+# IMAGE overrides the image (built from this directory's Dockerfile
+# otherwise); EXAMPLES overrides the directory of the example binaries.
+set -euo pipefail
+
+DISTRO=${1:?usage: ros2_interop.sh <distro>}
+HERE=$(cd "$(dirname "$0")" && pwd)
+EXAMPLES=${EXAMPLES:-target/debug/examples}
+IMAGE=${IMAGE:-aimdb-ros2-interop:$DISTRO}
+PREFIX=aimdb-interop-$DISTRO-$$
+PIDS=()
+
+cleanup() {
+    for pid in "${PIDS[@]}"; do kill "$pid" 2>/dev/null || true; done
+    for c in $(docker ps -aq --filter "name=$PREFIX"); do
+        docker stop "$c" >/dev/null 2>&1 || true
+        docker container rm "$c" >/dev/null 2>&1 || true
+    done
+}
+trap cleanup EXIT
+
+fail() {
+    echo "FAIL ($DISTRO): $*" >&2
+    exit 1
+}
+
+# Runs a ros2 CLI command in a container and prints its output. Detached
+# and read back with `docker logs`, which works on every Docker setup.
+ros() {
+    local name=$PREFIX-cli-$RANDOM
+    docker run -d --name "$name" --network host "$IMAGE" "$@" >/dev/null
+    docker wait "$name" >/dev/null
+    docker logs "$name" 2>&1
+    docker container rm "$name" >/dev/null
+}
+
+# Retries `ros ...` until its output matches the pattern: ROS discovery
+# takes a few seconds after a node appears.
+ros_until() {
+    local pattern=$1 out
+    shift
+    for _ in $(seq 1 10); do
+        out=$(ros "$@") || true
+        if grep -qE "$pattern" <<<"$out"; then
+            printf '%s\n' "$out"
+            return 0
+        fi
+        sleep 2
+    done
+    printf '%s\n' "$out" >&2
+    return 1
+}
+
+if ! docker image inspect "$IMAGE" >/dev/null 2>&1; then
+    echo "Building $IMAGE"
+    docker build -q --build-arg DISTRO="$DISTRO" -t "$IMAGE" "$HERE" >/dev/null
+fi
+
+echo "Starting rmw_zenohd ($DISTRO)"
+docker run -d --name "$PREFIX-router" --network host "$IMAGE" \
+    ros2 run rmw_zenoh_cpp rmw_zenohd >/dev/null
+for _ in $(seq 1 30); do
+    (exec 3<>/dev/tcp/127.0.0.1/7447) 2>/dev/null && break
+    sleep 1
+done
+(exec 3<>/dev/tcp/127.0.0.1/7447) 2>/dev/null || fail "rmw_zenohd did not listen on 7447"
+
+# --- AimDB publishes; ROS sees the node, the topic and the values.
+"$EXAMPLES/ros2_talker" >/dev/null 2>&1 &
+PIDS+=($!)
+
+ros_until '^/aimdb/talker$' ros2 node list >/dev/null \
+    || fail "ros2 node list does not show /aimdb/talker"
+info=$(ros_until 'Publisher count: 1' ros2 topic info -v /aimdb_chatter) \
+    || fail "ros2 topic info -v does not show the publisher"
+for expected in \
+    'Type: std_msgs/msg/String' \
+    'Node name: talker' \
+    'Node namespace: /aimdb' \
+    'Topic type hash: RIHS01_df668c740482bbd48fb39d76a70dfd4bd59db1288021743503259e948f6b1a18' \
+    'Endpoint type: PUBLISHER' \
+    'GID: [0-9a-f.]{47}' \
+    'Reliability: RELIABLE' \
+    'History \(Depth\): KEEP_LAST \(10\)' \
+    'Durability: VOLATILE'; do
+    grep -qE "$expected" <<<"$info" || fail "ros2 topic info -v lacks '$expected':
+$info"
+done
+ros_until '^data: aimdb [0-9]+' timeout 20 ros2 topic echo --once /aimdb_chatter >/dev/null \
+    || fail "ros2 topic echo received nothing from /aimdb_chatter"
+echo "ok: publisher (node list, topic info -v, topic echo)"
+
+# --- ROS publishes; AimDB receives every message.
+listener_log=$(mktemp)
+"$EXAMPLES/ros2_listener" >"$listener_log" 2>&1 &
+PIDS+=($!)
+ros_until 'Subscription count: 1' ros2 topic info -v /aimdb_cmd >/dev/null \
+    || fail "ros2 topic info -v does not show the subscription"
+ros timeout 30 ros2 topic pub --times 3 -r 2 /aimdb_cmd std_msgs/msg/String \
+    "{data: hello from $DISTRO}" >/dev/null
+for _ in $(seq 1 10); do
+    [[ $(grep -c "received: hello from $DISTRO" "$listener_log") -ge 3 ]] && break
+    sleep 1
+done
+received=$(grep -c "received: hello from $DISTRO" "$listener_log" || true)
+rm -f "$listener_log"
+[[ $received -eq 3 ]] || fail "the listener received $received of 3 messages"
+echo "ok: subscription (topic info -v, topic pub, 3 of 3 received)"
+
+echo "PASS ($DISTRO)"
diff --git a/aimdb-zenoh-connector/tests/native_session.rs b/aimdb-zenoh-connector/tests/native_session.rs
new file mode 100644
index 00000000..af559019
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/native_session.rs
@@ -0,0 +1,603 @@
+//! The `zenoh` crate backend against a real Zenoh router, in-process: the
+//! connector is a client of the router, and a plain `zenoh` session is the
+//! remote side.
+
+#![cfg(feature = "std")]
+
+use std::net::TcpListener;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::builder::AimDbRunner;
+use aimdb_core::{AimDb, AimDbBuilder, KeyId};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::ZenohConnector;
+use zenoh::Session;
+
+const WAIT: Duration = Duration::from_secs(20);
+
+fn free_port() -> u16 {
+    TcpListener::bind("127.0.0.1:0")
+        .unwrap()
+        .local_addr()
+        .unwrap()
+        .port()
+}
+
+/// A session config that only talks to `endpoint`: no scouting, so tests
+/// running side by side cannot find each other's routers.
+fn config(mode: &str, endpoint: &str, listen: bool) -> zenoh::Config {
+    let mut config = zenoh::Config::default();
+    config
+        .insert_json5("mode", &format!(r#""{mode}""#))
+        .unwrap();
+    config
+        .insert_json5("scouting/multicast/enabled", "false")
+        .unwrap();
+    let field = if listen {
+        "listen/endpoints"
+    } else {
+        "connect/endpoints"
+    };
+    config
+        .insert_json5(field, &format!(r#"["{endpoint}"]"#))
+        .unwrap();
+    config
+}
+
+async fn router(endpoint: &str) -> Session {
+    zenoh::open(config("router", endpoint, true)).await.unwrap()
+}
+
+async fn client(endpoint: &str) -> Session {
+    zenoh::open(config("client", endpoint, false))
+        .await
+        .unwrap()
+}
+
+/// The connector under test, as a client of `endpoint` without scouting.
+fn connector(endpoint: &str) -> ZenohConnector {
+    ZenohConnector::new(endpoint).with_zenoh_config(config("client", endpoint, false))
+}
+
+async fn build(
+    endpoint: &str,
+    configure: impl FnOnce(&mut AimDbBuilder) + Send,
+) -> (AimDb, AimDbRunner) {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(connector(endpoint));
+    configure(&mut builder);
+    builder.build().await.expect("build")
+}
+
+/// Polls `done` until it holds or `WAIT` passes.
+async fn eventually(what: &str, mut done: impl FnMut() -> bool) {
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while !done() {
+        assert!(tokio::time::Instant::now() < deadline, "timed out: {what}");
+        tokio::time::sleep(Duration::from_millis(20)).await;
+    }
+}
+
+fn le(
+    _ctx: aimdb_core::RuntimeContext,
+    v: &u32,
+) -> Result<Vec<u8>, aimdb_core::connector::SerializeError> {
+    Ok(v.to_le_bytes().to_vec())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn outbound_values_reach_a_zenoh_subscriber() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let fixed = remote.declare_subscriber("aimdb/test/out").await.unwrap();
+    let written = remote.declare_subscriber("aimdb/test/dyn/*").await.unwrap();
+
+    let (db, runner) = build(&endpoint, |b| {
+        b.configure::<u32>("out", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_to("zenoh://aimdb/test/out")
+                .with_serializer(le)
+                .finish();
+        });
+        b.configure::<u32>("dyn", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_to("zenoh://aimdb/test/dyn/default")
+                .with_topic_fn(32, |v: &u32, out| {
+                    use core::fmt::Write;
+                    write!(out, "aimdb/test/dyn/{v}")?;
+                    Ok(true)
+                })
+                .with_serializer(le)
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    let deadline = tokio::time::Instant::now() + WAIT;
+    let mut value = 0u32;
+    let sample = loop {
+        db.produce("out", value).unwrap();
+        value += 1;
+        if let Ok(Ok(sample)) =
+            tokio::time::timeout(Duration::from_millis(200), fixed.recv_async()).await
+        {
+            break sample;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "no fixed-key sample"
+        );
+    };
+    assert_eq!(sample.key_expr().as_str(), "aimdb/test/out");
+    assert_eq!(sample.payload().to_bytes().len(), 4);
+
+    db.produce("dyn", 7u32).unwrap();
+    let sample = tokio::time::timeout(WAIT, written.recv_async())
+        .await
+        .expect("written-key sample")
+        .unwrap();
+    assert_eq!(sample.key_expr().as_str(), "aimdb/test/dyn/7");
+    assert_eq!(&*sample.payload().to_bytes(), &7u32.to_le_bytes());
+}
+
+/// What one inbound link's deserializer saw: capture value and key.
+#[derive(Default)]
+struct Probe {
+    seen: Mutex<Vec<(String, Option<KeyId>)>>,
+    calls: AtomicUsize,
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn inbound_patterns_capture_and_key_each_publisher() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let probe = Arc::new(Probe::default());
+
+    let p = probe.clone();
+    let (_db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("cells", move |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_from("zenoh://aimdb/{cell}/state")
+                .key("cell", 8)
+                .with_match_deserializer(move |_ctx, m, _bytes| {
+                    p.calls.fetch_add(1, Ordering::SeqCst);
+                    let cell = m.get("cell").unwrap_or_default().to_string();
+                    p.seen.lock().unwrap().push((cell, m.key()));
+                    Ok(0)
+                })
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    // Repeat until the connector's subscriber is in place.
+    let seen = |cell: &str| probe.seen.lock().unwrap().iter().any(|(c, _)| c == cell);
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while !seen("cell4") {
+        remote.put("aimdb/cell4/state", "x").await.unwrap();
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        assert!(tokio::time::Instant::now() < deadline, "no cell4 sample");
+    }
+    remote.put("aimdb/*/state", "wildcard").await.unwrap();
+    remote.put("aimdb/cell5/state", "x").await.unwrap();
+    eventually("cell5", || seen("cell5")).await;
+
+    let seen = probe.seen.lock().unwrap();
+    let key = |cell: &str| seen.iter().find(|(c, _)| c == cell).and_then(|(_, k)| *k);
+    assert!(key("cell4").is_some() && key("cell5").is_some());
+    assert_ne!(key("cell4"), key("cell5"), "one KeyId per publisher");
+    assert!(
+        seen.iter().all(|(c, _)| c != "*"),
+        "a wildcard key is not a publisher"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn every_route_ingests_a_sample_once() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    // One counter per link: covered (`aimdb/cell4/x` under `aimdb/*/x`) and
+    // partly overlapping (`a/*/c` and `a/b/*`) filters.
+    let counters: Vec<Arc<AtomicUsize>> = (0..4).map(|_| Arc::default()).collect();
+    let c = counters.clone();
+    let (_db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("covered", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+            for (url, counter) in [
+                ("zenoh://aimdb/cell4/x", &c[0]),
+                ("zenoh://aimdb/*/x", &c[1]),
+            ] {
+                let counter = counter.clone();
+                reg.link_from(url)
+                    .with_deserializer(move |_ctx, _bytes: &[u8]| {
+                        counter.fetch_add(1, Ordering::SeqCst);
+                        Ok(0)
+                    })
+                    .finish();
+            }
+        });
+        b.configure::<u32>("overlap", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+            for (url, counter) in [("zenoh://a/*/c", &c[2]), ("zenoh://a/b/*", &c[3])] {
+                let counter = counter.clone();
+                reg.link_from(url)
+                    .with_deserializer(move |_ctx, _bytes: &[u8]| {
+                        counter.fetch_add(1, Ordering::SeqCst);
+                        Ok(0)
+                    })
+                    .finish();
+            }
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    // Wait for the subscribers with a probe key only `aimdb/*/x` matches.
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while counters[1].load(Ordering::SeqCst) == 0 {
+        remote.put("aimdb/probe/x", "x").await.unwrap();
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        assert!(tokio::time::Instant::now() < deadline, "no probe sample");
+    }
+    let before: Vec<usize> = counters.iter().map(|c| c.load(Ordering::SeqCst)).collect();
+    remote.put("aimdb/cell4/x", "x").await.unwrap();
+    remote.put("a/b/c", "x").await.unwrap();
+    eventually("both samples", || {
+        counters[0].load(Ordering::SeqCst) > before[0]
+            && counters[2].load(Ordering::SeqCst) > before[2]
+    })
+    .await;
+    // Let any duplicate arrive before counting.
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    let delta: Vec<usize> = counters
+        .iter()
+        .zip(&before)
+        .map(|(c, b)| c.load(Ordering::SeqCst) - b)
+        .collect();
+    assert_eq!(delta, [1, 1, 1, 1], "once per route");
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn an_outbound_wildcard_key_fails_the_build() {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(connector("tcp/127.0.0.1:1"));
+    builder.configure::<u32>("out", |reg| {
+        reg.buffer(BufferCfg::SingleLatest)
+            .link_to("zenoh://aimdb/*/out")
+            .with_serializer(le)
+            .finish();
+    });
+    let error = builder.build().await.err().expect("refused");
+    assert!(error.to_string().contains("wildcard"), "{error}");
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn the_connector_waits_for_a_router_that_starts_later() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let probe = Arc::new(Probe::default());
+    let p = probe.clone();
+    let (_db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("late", move |reg| {
+            reg.buffer(BufferCfg::SingleLatest)
+                .link_from("zenoh://aimdb/late")
+                .with_deserializer(move |_ctx, _bytes: &[u8]| {
+                    p.calls.fetch_add(1, Ordering::SeqCst);
+                    Ok(0)
+                })
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    tokio::time::sleep(Duration::from_secs(1)).await;
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while probe.calls.load(Ordering::SeqCst) == 0 {
+        remote.put("aimdb/late", "x").await.unwrap();
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "no sample after the router started"
+        );
+    }
+}
+
+/// A record linked to and from one key ingests no publication of its own:
+/// without remote-only locality, one value looped through the session
+/// hundreds of thousands of times a second.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_record_linked_both_ways_does_not_ingest_its_own_puts() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let echoes = remote.declare_subscriber("aimdb/mirror").await.unwrap();
+    let ingested = Arc::new(AtomicUsize::new(0));
+    let i = ingested.clone();
+    let (db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("mirror", move |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_to("zenoh://aimdb/mirror")
+                .with_serializer(le)
+                .finish()
+                .link_from("zenoh://aimdb/mirror")
+                .with_deserializer(move |_ctx, bytes: &[u8]| {
+                    i.fetch_add(1, Ordering::SeqCst);
+                    Ok(u32::from_le_bytes(bytes.try_into().map_err(|_| "4 bytes")?))
+                })
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    // Local values reach the remote side and never come back in.
+    let deadline = tokio::time::Instant::now() + WAIT;
+    let mut produced = 0u32;
+    loop {
+        db.produce("mirror", produced).unwrap();
+        produced += 1;
+        if let Ok(Ok(_)) =
+            tokio::time::timeout(Duration::from_millis(200), echoes.recv_async()).await
+        {
+            break;
+        }
+        assert!(tokio::time::Instant::now() < deadline, "no outbound sample");
+    }
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    assert_eq!(ingested.load(Ordering::SeqCst), 0, "own puts ingested");
+    while echoes.try_recv().ok().flatten().is_some() {}
+
+    // A remote value is ingested once, published back out once, and stops.
+    remote
+        .put("aimdb/mirror", 42u32.to_le_bytes().to_vec())
+        .await
+        .unwrap();
+    eventually("remote value ingested", || {
+        ingested.load(Ordering::SeqCst) == 1
+    })
+    .await;
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    assert_eq!(
+        ingested.load(Ordering::SeqCst),
+        1,
+        "re-ingested its own echo"
+    );
+    let mut echoed = 0;
+    while echoes.try_recv().ok().flatten().is_some() {
+        echoed += 1;
+    }
+    // The remote put itself, plus the record's one echo of it.
+    assert!(echoed <= 2, "{echoed} samples after one remote put");
+}
+
+/// A remote `delete()` is not a value: it never reaches the deserializer.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_remote_delete_is_not_ingested() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let calls = Arc::new(AtomicUsize::new(0));
+    let c = calls.clone();
+    let (_db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("deleted", move |reg| {
+            reg.buffer(BufferCfg::SingleLatest)
+                .link_from("zenoh://aimdb/deleted")
+                .with_deserializer(move |_ctx, _bytes: &[u8]| {
+                    c.fetch_add(1, Ordering::SeqCst);
+                    Ok(0)
+                })
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while calls.load(Ordering::SeqCst) == 0 {
+        remote.put("aimdb/deleted", "x").await.unwrap();
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "subscriber never ready"
+        );
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    let before = calls.load(Ordering::SeqCst);
+    remote.delete("aimdb/deleted").await.unwrap();
+    remote.put("aimdb/deleted", "after").await.unwrap();
+    eventually("the put after the delete", || {
+        calls.load(Ordering::SeqCst) > before
+    })
+    .await;
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(
+        calls.load(Ordering::SeqCst),
+        before + 1,
+        "the delete reached the deserializer"
+    );
+}
+
+/// zenoh's `open` blocks its thread while it waits for a router. On a task of
+/// its own it does not stall the rest of the database: here a router that
+/// accepts TCP but never answers held every other future for 10 s at a time.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn opening_the_session_does_not_stall_the_database() {
+    let silent = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let endpoint = format!("tcp/127.0.0.1:{}", silent.local_addr().unwrap().port());
+    tokio::spawn(async move {
+        let mut held = Vec::new();
+        while let Ok((socket, _)) = silent.accept().await {
+            held.push(socket);
+        }
+    });
+
+    let (db, runner) = build(&endpoint, |b| {
+        b.configure::<u32>("ticks", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 1024 })
+                .source(|ctx, producer| async move {
+                    let mut n = 0u32;
+                    loop {
+                        producer.produce(n);
+                        n += 1;
+                        ctx.time().sleep_millis(10).await;
+                    }
+                });
+        });
+        b.configure::<u32>("out", |reg| {
+            reg.buffer(BufferCfg::SingleLatest)
+                .link_to("zenoh://aimdb/stall")
+                .with_serializer(le)
+                .finish();
+        });
+    })
+    .await;
+    let mut ticks = db.subscribe::<u32>("ticks").unwrap();
+    tokio::spawn(runner.run());
+
+    let mut seen = 0;
+    let deadline = tokio::time::Instant::now() + Duration::from_secs(3);
+    while tokio::time::Instant::now() < deadline {
+        if let Ok(Ok(_)) = tokio::time::timeout(Duration::from_millis(500), ticks.recv()).await {
+            seen += 1;
+        }
+    }
+    // A 10 ms source runs about 300 times in 3 s; a stalled runner, never.
+    assert!(
+        seen > 100,
+        "{seen} ticks in 3 s while the session was opening"
+    );
+}
+
+/// A deserializer that panics drops its own sample; zenoh keeps delivering.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_panicking_deserializer_drops_only_its_sample() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let good = Arc::new(AtomicUsize::new(0));
+    let g = good.clone();
+    let (_db, runner) = build(&endpoint, move |b| {
+        b.configure::<u32>("decoded", move |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_from("zenoh://aimdb/decode")
+                .with_deserializer(move |_ctx, bytes: &[u8]| {
+                    let value = u32::from_le_bytes(bytes.try_into().unwrap());
+                    g.fetch_add(1, Ordering::SeqCst);
+                    Ok(value)
+                })
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while good.load(Ordering::SeqCst) == 0 {
+        remote
+            .put("aimdb/decode", 1u32.to_le_bytes().to_vec())
+            .await
+            .unwrap();
+        tokio::time::sleep(Duration::from_millis(50)).await;
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "subscriber never ready"
+        );
+    }
+    remote.put("aimdb/decode", vec![0u8; 2]).await.unwrap();
+    let before = good.load(Ordering::SeqCst);
+    for n in 0..20u32 {
+        remote
+            .put("aimdb/decode", n.to_le_bytes().to_vec())
+            .await
+            .unwrap();
+    }
+    eventually("valid samples after the panic", || {
+        good.load(Ordering::SeqCst) >= before + 20
+    })
+    .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn keys_longer_than_the_wire_format_are_refused() {
+    // A fixed key fails the build.
+    let long = "k".repeat(65_536);
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(connector("tcp/127.0.0.1:1"));
+    let url = format!("zenoh://{long}");
+    builder.configure::<u32>("out", move |reg| {
+        reg.buffer(BufferCfg::SingleLatest)
+            .link_to(&url)
+            .with_serializer(le)
+            .finish();
+    });
+    let error = builder.build().await.err().expect("refused").to_string();
+    assert!(error.contains("longer than 65535"), "{error}");
+
+    // A written key is skipped; the next value still goes out.
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = router(&endpoint).await;
+    let remote = client(&endpoint).await;
+    let ok = remote.declare_subscriber("aimdb/long/ok").await.unwrap();
+    let (db, runner) = build(&endpoint, |b| {
+        b.configure::<u32>("long", |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+                .link_to("zenoh://aimdb/long/ok")
+                .with_topic_fn(70_000, |v: &u32, out| {
+                    use core::fmt::Write;
+                    if *v == 0 {
+                        out.push_str("aimdb/long/")?;
+                        out.push_str(&"k".repeat(66_000))?;
+                        Ok(true)
+                    } else {
+                        write!(out, "aimdb/long/ok")?;
+                        Ok(true)
+                    }
+                })
+                .with_serializer(le)
+                .finish();
+        });
+    })
+    .await;
+    tokio::spawn(runner.run());
+    let deadline = tokio::time::Instant::now() + WAIT;
+    loop {
+        db.produce("long", 0u32).unwrap();
+        db.produce("long", 1u32).unwrap();
+        if let Ok(Ok(_)) = tokio::time::timeout(Duration::from_millis(200), ok.recv_async()).await {
+            break;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "the valid key never arrived"
+        );
+    }
+}
+
+/// zenoh refuses Tokio's current-thread scheduler; `build()` says so.
+#[tokio::test]
+async fn a_current_thread_runtime_fails_the_build() {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(connector("tcp/127.0.0.1:1"));
+    builder.configure::<u32>("out", |reg| {
+        reg.buffer(BufferCfg::SingleLatest)
+            .link_to("zenoh://aimdb/out")
+            .with_serializer(le)
+            .finish();
+    });
+    let error = builder.build().await.err().expect("refused").to_string();
+    assert!(error.contains("multi-thread"), "{error}");
+}
diff --git a/aimdb-zenoh-connector/tests/ros2_inbound.rs b/aimdb-zenoh-connector/tests/ros2_inbound.rs
new file mode 100644
index 00000000..e4238e7e
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/ros2_inbound.rs
@@ -0,0 +1,289 @@
+//! Inbound `ros2://` links against a real Zenoh router, in-process, and
+//! their build-time refusals.
+
+#![cfg(feature = "std")]
+
+use std::net::TcpListener;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::{AimDbBuilder, RecordRegistrar};
+use aimdb_data_contracts::link_codecs::Json;
+use aimdb_data_contracts::{LinkCodecRegistrarExt, Linkable, LinkableRegistrarExt, RosMessage};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+use serde::{Deserialize, Serialize};
+
+const HASH: &str = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
+const DDS: &str = "test_msgs::msg::dds_::Command_";
+const WAIT: Duration = Duration::from_secs(20);
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Command",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Command {
+    rpm: f64,
+    enabled: bool,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Other",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Other {
+    value: u32,
+}
+
+fn free_port() -> u16 {
+    TcpListener::bind("127.0.0.1:0")
+        .unwrap()
+        .local_addr()
+        .unwrap()
+        .port()
+}
+
+fn config(mode: &str, endpoint: &str, listen: bool) -> zenoh::Config {
+    let mut config = zenoh::Config::default();
+    config
+        .insert_json5("mode", &format!(r#""{mode}""#))
+        .unwrap();
+    config
+        .insert_json5("scouting/multicast/enabled", "false")
+        .unwrap();
+    let field = if listen {
+        "listen/endpoints"
+    } else {
+        "connect/endpoints"
+    };
+    config
+        .insert_json5(field, &format!(r#"["{endpoint}"]"#))
+        .unwrap();
+    config
+}
+
+fn ros2(endpoint: &str) -> Ros2Connector {
+    let connector = Ros2Connector::new(endpoint, Ros2Node::new("aimdb_test").namespace("/cell4"))
+        .domain_id(7)
+        .register::<Command>()
+        .register::<Other>();
+    // Build-only tests pass no endpoint and never connect.
+    if endpoint.is_empty() {
+        connector
+    } else {
+        connector.with_zenoh_config(config("client", endpoint, false))
+    }
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_ros_publisher_reaches_every_record_linked_to_its_topic() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = zenoh::open(config("router", &endpoint, true))
+        .await
+        .unwrap();
+    let remote = zenoh::open(config("client", &endpoint, false))
+        .await
+        .unwrap();
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ros2(&endpoint));
+    for record in ["spindle.a", "spindle.b"] {
+        builder.configure::<Command>(record, |reg| {
+            reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+            reg.linked_from("ros2://cell4/spindle_cmd");
+        });
+    }
+    let (db, runner) = builder.build().await.expect("build");
+    let mut a = db.subscribe::<Command>("spindle.a").unwrap();
+    let mut b = db.subscribe::<Command>("spindle.b").unwrap();
+    tokio::spawn(runner.run());
+
+    // One subscription token per link, after the (absent) publishers.
+    let mut tokens = Vec::new();
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while tokens.len() < 2 {
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "tokens: {tokens:#?}"
+        );
+        tokio::time::sleep(Duration::from_millis(100)).await;
+        tokens.clear();
+        let replies = remote.liveliness().get("@ros2_lv/7/**").await.unwrap();
+        while let Ok(reply) = replies.recv_async().await {
+            if let Ok(sample) = reply.result() {
+                let token = sample.key_expr().as_str().to_string();
+                if token.contains("/MS/") {
+                    tokens.push(token);
+                }
+            }
+        }
+    }
+    tokens.sort();
+    for (token, id) in tokens.iter().zip(["1", "2"]) {
+        let tail =
+            format!("/0/{id}/MS/%/%cell4/aimdb_test/%cell4%spindle_cmd/{DDS}/{HASH}/::,10:,:,:,,");
+        assert!(token.ends_with(&tail), "{token}");
+    }
+
+    let command = Command {
+        rpm: 1200.0,
+        enabled: true,
+    };
+    let key = format!("7/cell4/spindle_cmd/{DDS}/{HASH}");
+    remote.delete(key.as_str()).await.unwrap();
+    remote
+        .put(key.as_str(), command.to_bytes().unwrap())
+        .await
+        .unwrap();
+    for reader in [&mut a, &mut b] {
+        let value = tokio::time::timeout(WAIT, reader.recv())
+            .await
+            .expect("a value")
+            .unwrap();
+        assert_eq!(value, command, "the delete was not ingested first");
+    }
+}
+
+/// Builds a database with one inbound `ros2://` link set up by `link`, and
+/// returns the build error, if any.
+async fn build_with(
+    link: impl FnOnce(&mut RecordRegistrar<'_, Command>) + Send + 'static,
+    other: bool,
+) -> Result<(), String> {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ros2(""));
+    builder.configure::<Command>("command", move |reg| {
+        reg.buffer(BufferCfg::SingleLatest);
+        link(reg);
+    });
+    if other {
+        builder.configure::<Other>("other", |reg| {
+            reg.buffer(BufferCfg::SingleLatest);
+            reg.linked_from("ros2://cell4/spindle_cmd");
+        });
+    }
+    builder.build().await.map(|_| ()).map_err(|e| e.to_string())
+}
+
+#[tokio::test]
+async fn build_refuses_inbound_links_ros_could_not_serve() {
+    let e = build_with(
+        |reg| {
+            reg.linked_from("ros2://cell4/{cell}/cmd");
+        },
+        false,
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        e.contains("does not support topic patterns"),
+        "pattern: {e}"
+    );
+
+    let e = build_with(
+        |reg| {
+            reg.linked_from("ros2://cell4/spindle_cmd");
+        },
+        true,
+    )
+    .await
+    .unwrap_err();
+    assert!(e.contains("one type"), "two types: {e}");
+
+    let e = build_with(
+        |reg| {
+            reg.linked_from_with("ros2://cell4/spindle_cmd", Json);
+        },
+        false,
+    )
+    .await
+    .unwrap_err();
+    assert!(
+        e.contains("Json") && e.contains("CDR"),
+        "non-CDR codec: {e}"
+    );
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(Ros2Connector::new("", Ros2Node::new("n")).domain_id(0));
+    builder.configure::<Command>("command", |reg| {
+        reg.buffer(BufferCfg::SingleLatest);
+        reg.linked_from("ros2://cell4/spindle_cmd");
+    });
+    let e = builder.build().await.err().expect("refused").to_string();
+    assert!(e.contains("not registered"), "unregistered: {e}");
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+async fn a_custom_deserializer_builds() {
+    let calls = Arc::new(AtomicUsize::new(0));
+    let c = calls.clone();
+    let built = build_with(
+        move |reg| {
+            reg.link_from("ros2://cell4/spindle_cmd")
+                .with_deserializer(move |_ctx, bytes: &[u8]| {
+                    c.fetch_add(1, Ordering::SeqCst);
+                    Command::from_bytes(bytes)
+                })
+                .finish();
+        },
+        false,
+    )
+    .await;
+    assert_eq!(built, Ok(()), "the escape hatch warns, it does not refuse");
+    assert_eq!(calls.load(Ordering::SeqCst), 0);
+}
+
+/// A second Rust mirror of `test_msgs/msg/Command`.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Command",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct CommandMirror {
+    rpm: f64,
+    enabled: bool,
+}
+
+/// One ROS type per topic, across publishers and subscriptions, compared by
+/// ROS type and hash rather than by Rust type.
+#[tokio::test(flavor = "multi_thread", worker_threads = 1)]
+async fn one_ros_type_per_topic_across_both_directions() {
+    let build = |mirror: bool| async move {
+        let mut builder = AimDbBuilder::new()
+            .runtime(Arc::new(TokioAdapter::new().unwrap()))
+            .with_connector(ros2("").register::<CommandMirror>());
+        builder.configure::<Command>("out", |reg| {
+            reg.buffer(BufferCfg::SingleLatest);
+            reg.linked_to("ros2://cell4/spindle_cmd");
+        });
+        if mirror {
+            builder.configure::<CommandMirror>("in", |reg| {
+                reg.buffer(BufferCfg::SingleLatest);
+                reg.linked_from("ros2://cell4/spindle_cmd");
+            });
+        } else {
+            builder.configure::<Other>("in", |reg| {
+                reg.buffer(BufferCfg::SingleLatest);
+                reg.linked_from("ros2://cell4/spindle_cmd");
+            });
+        }
+        builder.build().await.map(|_| ()).map_err(|e| e.to_string())
+    };
+    let e = build(false).await.unwrap_err();
+    assert!(
+        e.contains("one type") && e.contains("Other_"),
+        "publisher vs subscription: {e}"
+    );
+    assert_eq!(
+        build(true).await,
+        Ok(()),
+        "two Rust mirrors of one ROS type"
+    );
+}
diff --git a/aimdb-zenoh-connector/tests/ros2_outbound.rs b/aimdb-zenoh-connector/tests/ros2_outbound.rs
new file mode 100644
index 00000000..ed8d32f1
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/ros2_outbound.rs
@@ -0,0 +1,350 @@
+//! Outbound `ros2://` links against a real Zenoh router, in-process, and the
+//! build-time refusals of 053 §4.3.
+
+#![cfg(feature = "std")]
+
+use std::net::TcpListener;
+use std::sync::Arc;
+use std::time::Duration;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::{AimDbBuilder, DbError};
+use aimdb_data_contracts::link_codecs::{self, Json};
+use aimdb_data_contracts::{
+    LinkCodecBuilderExt, LinkCodecRegistrarExt, Linkable, LinkableRegistrarExt, RosMessage,
+    SchemaType, WireFormat,
+};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::{Ros2Connector, Ros2LinkExt, Ros2Node, ZenohConnector};
+use serde::{Deserialize, Serialize};
+
+const HASH: &str = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
+const DDS: &str = "test_msgs::msg::dds_::Reading_";
+const WAIT: Duration = Duration::from_secs(20);
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Reading",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Reading {
+    celsius: f64,
+    sensor: String,
+}
+
+fn free_port() -> u16 {
+    TcpListener::bind("127.0.0.1:0")
+        .unwrap()
+        .local_addr()
+        .unwrap()
+        .port()
+}
+
+fn config(mode: &str, endpoint: &str, listen: bool) -> zenoh::Config {
+    let mut config = zenoh::Config::default();
+    config
+        .insert_json5("mode", &format!(r#""{mode}""#))
+        .unwrap();
+    config
+        .insert_json5("scouting/multicast/enabled", "false")
+        .unwrap();
+    let field = if listen {
+        "listen/endpoints"
+    } else {
+        "connect/endpoints"
+    };
+    config
+        .insert_json5(field, &format!(r#"["{endpoint}"]"#))
+        .unwrap();
+    config
+}
+
+fn node() -> Ros2Node {
+    Ros2Node::new("aimdb_test").namespace("/cell4")
+}
+
+fn ros2(endpoint: &str) -> Ros2Connector {
+    Ros2Connector::new(endpoint, node())
+        .domain_id(7)
+        .register::<Reading>()
+        .with_zenoh_config(config("client", endpoint, false))
+}
+
+fn hex(bytes: &[u8]) -> String {
+    bytes.iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// XXH3-128 of `token`, low half first: rmw_zenoh's GID.
+fn gid(token: &str) -> [u8; 16] {
+    let h = twox_hash::XxHash3_128::oneshot(token.as_bytes());
+    let mut out = [0; 16];
+    out[..8].copy_from_slice(&(h as u64).to_le_bytes());
+    out[8..].copy_from_slice(&((h >> 64) as u64).to_le_bytes());
+    out
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_record_appears_as_a_ros_publisher() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = zenoh::open(config("router", &endpoint, true))
+        .await
+        .unwrap();
+    let remote = zenoh::open(config("client", &endpoint, false))
+        .await
+        .unwrap();
+    let data = remote
+        .declare_subscriber(format!("7/cell4/reading/{DDS}/{HASH}"))
+        .await
+        .unwrap();
+
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ros2(&endpoint));
+    builder.configure::<Reading>("reading", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 });
+        reg.linked_to("ros2://cell4/reading");
+        reg.link_to("ros2://cell4/reading_fast")
+            .with_link_codec(link_codecs::Default)
+            .with_depth(1)
+            .finish();
+    });
+    let (db, runner) = builder.build().await.expect("build");
+    tokio::spawn(runner.run());
+
+    let value = Reading {
+        celsius: 23.5,
+        sensor: "probe".into(),
+    };
+    let deadline = tokio::time::Instant::now() + WAIT;
+    let first = loop {
+        db.produce("reading", value.clone()).unwrap();
+        if let Ok(Ok(sample)) =
+            tokio::time::timeout(Duration::from_millis(200), data.recv_async()).await
+        {
+            break sample;
+        }
+        assert!(tokio::time::Instant::now() < deadline, "no ROS sample");
+    };
+    db.produce("reading", value.clone()).unwrap();
+    let second = tokio::time::timeout(WAIT, data.recv_async())
+        .await
+        .unwrap()
+        .unwrap();
+
+    // The payload is the type's CDR.
+    let payload = first.payload().to_bytes();
+    assert_eq!(Reading::from_bytes(&payload).unwrap(), value);
+    assert_eq!(&payload[..4], &[0x00, 0x01, 0x00, 0x00]);
+
+    // The tokens: the node, and one publisher per link, with its QoS.
+    let mut tokens = Vec::new();
+    let replies = remote.liveliness().get("@ros2_lv/7/**").await.unwrap();
+    while let Ok(reply) = replies.recv_async().await {
+        if let Ok(sample) = reply.result() {
+            tokens.push(sample.key_expr().as_str().to_string());
+        }
+    }
+    let find = |suffix: &str| {
+        tokens
+            .iter()
+            .find(|t| t.ends_with(suffix))
+            .unwrap_or_else(|| panic!("no token ending {suffix} in {tokens:#?}"))
+            .clone()
+    };
+    let node_token = find("/0/0/NN/%/%cell4/aimdb_test");
+    let zid = node_token.split('/').nth(2).unwrap().to_string();
+    let publisher = find(&format!(
+        "/MP/%/%cell4/aimdb_test/%cell4%reading/{DDS}/{HASH}/::,10:,:,:,,"
+    ));
+    let fast = find(&format!(
+        "/MP/%/%cell4/aimdb_test/%cell4%reading_fast/{DDS}/{HASH}/::,1:,:,:,,"
+    ));
+    assert_eq!(
+        publisher,
+        format!(
+            "@ros2_lv/7/{zid}/0/1/MP/%/%cell4/aimdb_test/%cell4%reading/{DDS}/{HASH}/::,10:,:,:,,"
+        )
+    );
+    assert!(
+        fast.starts_with(&format!("@ros2_lv/7/{zid}/0/2/MP/")),
+        "{fast}"
+    );
+
+    // The attachment: sequence from 1, a timestamp, and the publisher's GID.
+    let attachment =
+        |s: &zenoh::sample::Sample| s.attachment().expect("attachment").to_bytes().to_vec();
+    let (a, b) = (attachment(&first), attachment(&second));
+    assert_eq!(a.len(), 33);
+    let seq = |a: &[u8]| i64::from_le_bytes(a[..8].try_into().unwrap());
+    assert_eq!(seq(&b), seq(&a) + 1);
+    assert!(i64::from_le_bytes(a[8..16].try_into().unwrap()) > 1_700_000_000_000_000_000);
+    assert_eq!(a[16], 0x10);
+    assert_eq!(hex(&a[17..]), hex(&gid(&publisher)), "GID of {publisher}");
+}
+
+/// Builds a database whose only `ros2://` link is set up by `link`, and
+/// returns the build error.
+async fn refused(
+    connector: Ros2Connector,
+    link: impl FnOnce(&mut aimdb_core::RecordRegistrar<'_, Reading>) + Send + 'static,
+) -> String {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(connector);
+    builder.configure::<Reading>("reading", move |reg| {
+        reg.buffer(BufferCfg::SingleLatest);
+        link(reg);
+    });
+    let error: DbError = builder.build().await.err().expect("refused");
+    error.to_string()
+}
+
+fn plain(endpoint: &str) -> Ros2Connector {
+    Ros2Connector::new(endpoint, node())
+        .domain_id(0)
+        .register::<Reading>()
+}
+
+#[tokio::test]
+async fn build_refuses_what_ros_would_not_see() {
+    let e = refused(Ros2Connector::new("", node()).domain_id(0), |reg| {
+        reg.linked_to("ros2://cell4/reading");
+    })
+    .await;
+    assert!(e.contains("not registered"), "unregistered type: {e}");
+
+    let e = refused(plain(""), |reg| {
+        reg.linked_to_with("ros2://cell4/reading", Json);
+    })
+    .await;
+    assert!(
+        e.contains("Json") && e.contains("CDR"),
+        "non-CDR codec: {e}"
+    );
+
+    let e = refused(plain(""), |reg| {
+        reg.link_to("ros2://cell4/reading")
+            .with_link_codec(link_codecs::Default)
+            .with_topic_fn(16, |_v, _out| Ok(false))
+            .finish();
+    })
+    .await;
+    assert!(e.contains("topic writer"), "topic writer: {e}");
+
+    let e = refused(plain(""), |reg| {
+        reg.linked_to("ros2://cell-4/reading");
+    })
+    .await;
+    assert!(e.contains("'/cell-4/reading'"), "topic name: {e}");
+
+    let e = refused(
+        Ros2Connector::new("", Ros2Node::new("aimdb-test"))
+            .domain_id(0)
+            .register::<Reading>(),
+        |reg| {
+            reg.linked_to("ros2://reading");
+        },
+    )
+    .await;
+    assert!(e.contains("node name 'aimdb-test'"), "node name: {e}");
+
+    let e = refused(
+        Ros2Connector::new("", Ros2Node::new("n").namespace("cell4"))
+            .domain_id(0)
+            .register::<Reading>(),
+        |reg| {
+            reg.linked_to("ros2://reading");
+        },
+    )
+    .await;
+    assert!(e.contains("namespace 'cell4'"), "namespace: {e}");
+}
+
+/// A hand-written `RosMessage` the derive would never produce.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct HandWritten;
+
+impl SchemaType for HandWritten {
+    const NAME: &'static str = "hand_written";
+}
+
+impl Linkable for HandWritten {
+    const WIRE_FORMAT: WireFormat = WireFormat::Json;
+    fn from_bytes(_: &[u8]) -> Result<Self, String> {
+        Ok(HandWritten)
+    }
+    fn to_bytes(&self) -> Result<Vec<u8>, String> {
+        Ok(Vec::new())
+    }
+}
+
+impl RosMessage for HandWritten {
+    const ROS_TYPE_NAME: &'static str = "test_msgs::msg::dds_::HandWritten_";
+    const ROS_TYPE_HASH: &'static str = "RIHS01_short";
+}
+
+#[tokio::test]
+async fn build_refuses_a_hand_written_type_that_lies() {
+    let connector = Ros2Connector::new("", node())
+        .domain_id(0)
+        .register::<HandWritten>();
+    let e = refused(connector, |reg| {
+        reg.linked_to("ros2://reading");
+    })
+    .await;
+    assert!(e.contains("HandWritten") && e.contains("not CDR"), "{e}");
+}
+
+#[tokio::test]
+async fn without_a_ros2_connector_the_scheme_is_unregistered() {
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(ZenohConnector::new(""));
+    builder.configure::<Reading>("reading", |reg| {
+        reg.buffer(BufferCfg::SingleLatest);
+        reg.linked_to("ros2://cell4/reading");
+    });
+    let e = builder.build().await.err().expect("refused").to_string();
+    assert!(
+        e.contains("No connector registered for scheme 'ros2'"),
+        "{e}"
+    );
+}
+
+/// Claims CDR, but its hash is malformed.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+struct BadHash;
+
+impl SchemaType for BadHash {
+    const NAME: &'static str = "bad_hash";
+}
+
+impl Linkable for BadHash {
+    const WIRE_FORMAT: WireFormat = WireFormat::Cdr;
+    fn from_bytes(_: &[u8]) -> Result<Self, String> {
+        Ok(BadHash)
+    }
+    fn to_bytes(&self) -> Result<Vec<u8>, String> {
+        Ok(Vec::new())
+    }
+}
+
+impl RosMessage for BadHash {
+    const ROS_TYPE_NAME: &'static str = "test_msgs::msg::dds_::BadHash_";
+    const ROS_TYPE_HASH: &'static str = "RIHS01_short";
+}
+
+#[tokio::test]
+async fn build_refuses_a_malformed_hand_written_hash() {
+    let connector = Ros2Connector::new("", node())
+        .domain_id(0)
+        .register::<BadHash>();
+    let e = refused(connector, |reg| {
+        reg.linked_to("ros2://reading");
+    })
+    .await;
+    assert!(
+        e.contains("BadHash") && e.contains("type hash 'RIHS01_short'"),
+        "{e}"
+    );
+}
diff --git a/aimdb-zenoh-connector/tests/shared_session.rs b/aimdb-zenoh-connector/tests/shared_session.rs
new file mode 100644
index 00000000..581e5a2f
--- /dev/null
+++ b/aimdb-zenoh-connector/tests/shared_session.rs
@@ -0,0 +1,254 @@
+//! A `ZenohConnector` and the `Ros2Connector` derived from it share one
+//! session: one TCP connection to the router, whichever is registered first.
+
+#![cfg(feature = "std")]
+
+use std::net::TcpListener as StdListener;
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
+
+use aimdb_core::buffer::BufferCfg;
+use aimdb_core::AimDbBuilder;
+use aimdb_data_contracts::{Linkable, LinkableRegistrarExt, RosMessage};
+use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
+use aimdb_zenoh_connector::{Ros2Node, ZenohConnector};
+use serde::{Deserialize, Serialize};
+use tokio::net::{TcpListener, TcpStream};
+
+const HASH: &str = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff";
+const DDS: &str = "test_msgs::msg::dds_::Temperature_";
+const WAIT: Duration = Duration::from_secs(20);
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, RosMessage)]
+#[ros(
+    type = "test_msgs/msg/Temperature",
+    hash = "RIHS01_00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
+)]
+struct Temperature {
+    celsius: f64,
+}
+
+fn free_port() -> u16 {
+    StdListener::bind("127.0.0.1:0")
+        .unwrap()
+        .local_addr()
+        .unwrap()
+        .port()
+}
+
+fn config(mode: &str, endpoint: &str, listen: bool) -> zenoh::Config {
+    let mut config = zenoh::Config::default();
+    config
+        .insert_json5("mode", &format!(r#""{mode}""#))
+        .unwrap();
+    config
+        .insert_json5("scouting/multicast/enabled", "false")
+        .unwrap();
+    let field = if listen {
+        "listen/endpoints"
+    } else {
+        "connect/endpoints"
+    };
+    config
+        .insert_json5(field, &format!(r#"["{endpoint}"]"#))
+        .unwrap();
+    config
+}
+
+/// Forwards `127.0.0.1:<returned port>` to `router_port`, counting the
+/// connections made through it.
+async fn counting_proxy(router_port: u16) -> (u16, Arc<AtomicUsize>) {
+    let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
+    let port = listener.local_addr().unwrap().port();
+    let count = Arc::new(AtomicUsize::new(0));
+    let c = count.clone();
+    tokio::spawn(async move {
+        while let Ok((mut inbound, _)) = listener.accept().await {
+            c.fetch_add(1, Ordering::SeqCst);
+            tokio::spawn(async move {
+                if let Ok(mut outbound) = TcpStream::connect(("127.0.0.1", router_port)).await {
+                    let _ = tokio::io::copy_bidirectional(&mut inbound, &mut outbound).await;
+                }
+            });
+        }
+    });
+    (port, count)
+}
+
+/// The gateway (053 §4.8): `zenoh://` in, `ros2://` out, on one session.
+async fn gateway(zenoh_first: bool) {
+    let router_port = free_port();
+    let router = format!("tcp/127.0.0.1:{router_port}");
+    let _router = zenoh::open(config("router", &router, true)).await.unwrap();
+    let remote = zenoh::open(config("client", &router, false)).await.unwrap();
+    let ros = remote
+        .declare_subscriber(format!("7/cell4/temperature/{DDS}/{HASH}"))
+        .await
+        .unwrap();
+
+    let (proxy_port, connections) = counting_proxy(router_port).await;
+    let through_proxy = format!("tcp/127.0.0.1:{proxy_port}");
+    let zenoh = ZenohConnector::new(through_proxy.as_str()).with_zenoh_config(config(
+        "client",
+        &through_proxy,
+        false,
+    ));
+    let ros2 = zenoh
+        .ros2(Ros2Node::new("cell4_gateway"))
+        .domain_id(7)
+        .register::<Temperature>();
+
+    let builder = AimDbBuilder::new().runtime(Arc::new(TokioAdapter::new().unwrap()));
+    let mut builder = if zenoh_first {
+        builder.with_connector(zenoh).with_connector(ros2)
+    } else {
+        builder.with_connector(ros2).with_connector(zenoh)
+    };
+    builder.configure::<Temperature>("cell4.temperature", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+            .linked_from("zenoh://cell4/probe/temperature")
+            .linked_to("ros2://cell4/temperature");
+    });
+    let (_db, runner) = builder.build().await.expect("build");
+    tokio::spawn(runner.run());
+
+    // An MCU's plain Zenoh publish comes out as a ROS sample.
+    let reading = Temperature { celsius: 23.5 };
+    let deadline = tokio::time::Instant::now() + WAIT;
+    let sample = loop {
+        remote
+            .put("cell4/probe/temperature", reading.to_bytes().unwrap())
+            .await
+            .unwrap();
+        if let Ok(Ok(sample)) =
+            tokio::time::timeout(Duration::from_millis(200), ros.recv_async()).await
+        {
+            break sample;
+        }
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "nothing reached ROS"
+        );
+    };
+    assert_eq!(
+        Temperature::from_bytes(&sample.payload().to_bytes()).unwrap(),
+        reading
+    );
+    assert_eq!(sample.attachment().expect("attachment").len(), 33);
+
+    tokio::time::sleep(Duration::from_millis(500)).await;
+    assert_eq!(
+        connections.load(Ordering::SeqCst),
+        1,
+        "one router connection"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn the_gateway_opens_one_connection_with_zenoh_registered_first() {
+    gateway(true).await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn the_gateway_opens_one_connection_with_ros2_registered_first() {
+    gateway(false).await;
+}
+
+/// A `.ros2(..)` view that is never registered leaves the Zenoh side alone.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn an_unregistered_ros2_view_does_not_stop_the_zenoh_connector() {
+    let endpoint = format!("tcp/127.0.0.1:{}", free_port());
+    let _router = zenoh::open(config("router", &endpoint, true))
+        .await
+        .unwrap();
+    let remote = zenoh::open(config("client", &endpoint, false))
+        .await
+        .unwrap();
+    let out = remote.declare_subscriber("cell4/state").await.unwrap();
+
+    let zenoh = ZenohConnector::new(endpoint.as_str())
+        .with_zenoh_config(config("client", &endpoint, false));
+    let _unused = zenoh.ros2(Ros2Node::new("never_registered"));
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(zenoh);
+    builder.configure::<Temperature>("state", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+            .linked_to("zenoh://cell4/state");
+    });
+    let (db, runner) = builder.build().await.expect("build");
+    tokio::spawn(runner.run());
+
+    let deadline = tokio::time::Instant::now() + WAIT;
+    loop {
+        db.produce("state", Temperature { celsius: 1.0 }).unwrap();
+        if let Ok(Ok(_)) = tokio::time::timeout(Duration::from_millis(200), out.recv_async()).await
+        {
+            break;
+        }
+        assert!(tokio::time::Instant::now() < deadline, "no zenoh sample");
+    }
+}
+
+/// One ROS node per session: two views both claim `ros2://`.
+#[tokio::test]
+async fn two_ros2_views_on_one_session_are_refused() {
+    let zenoh = ZenohConnector::new("");
+    let a = zenoh.ros2(Ros2Node::new("a")).domain_id(0);
+    let b = zenoh.ros2(Ros2Node::new("b")).domain_id(0);
+    let builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(zenoh)
+        .with_connector(a)
+        .with_connector(b);
+    let error = builder.build().await.err().expect("refused").to_string();
+    assert!(error.contains("ros2"), "{error}");
+}
+
+/// The control: two connectors that do not share a session open two
+/// connections through the same proxy.
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn separate_connectors_open_two_connections() {
+    let router_port = free_port();
+    let router = format!("tcp/127.0.0.1:{router_port}");
+    let _router = zenoh::open(config("router", &router, true)).await.unwrap();
+    let (proxy_port, connections) = counting_proxy(router_port).await;
+    let through_proxy = format!("tcp/127.0.0.1:{proxy_port}");
+
+    let zenoh = ZenohConnector::new(through_proxy.as_str()).with_zenoh_config(config(
+        "client",
+        &through_proxy,
+        false,
+    ));
+    let ros2 = aimdb_zenoh_connector::Ros2Connector::new(
+        through_proxy.as_str(),
+        Ros2Node::new("separate"),
+    )
+    .domain_id(7)
+    .register::<Temperature>()
+    .with_zenoh_config(config("client", &through_proxy, false));
+    let mut builder = AimDbBuilder::new()
+        .runtime(Arc::new(TokioAdapter::new().unwrap()))
+        .with_connector(zenoh)
+        .with_connector(ros2);
+    builder.configure::<Temperature>("t", |reg| {
+        reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+            .linked_from("zenoh://cell4/probe/temperature")
+            .linked_to("ros2://cell4/temperature");
+    });
+    let (_db, runner) = builder.build().await.expect("build");
+    tokio::spawn(runner.run());
+
+    let deadline = tokio::time::Instant::now() + WAIT;
+    while connections.load(Ordering::SeqCst) < 2 {
+        assert!(
+            tokio::time::Instant::now() < deadline,
+            "connections: {}",
+            connections.load(Ordering::SeqCst)
+        );
+        tokio::time::sleep(Duration::from_millis(50)).await;
+    }
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(connections.load(Ordering::SeqCst), 2);
+}
diff --git a/deny.toml b/deny.toml
index 2ea3316a..078a31e6 100644
--- a/deny.toml
+++ b/deny.toml
@@ -11,6 +11,7 @@ allow = [
     "MPL-2.0",      # Mozilla Public License 2.0 - used by colored crate (CLI only)
     "OpenSSL",      # OpenSSL License - used by aws-lc-sys (transitive via rumqttc/rustls)
     "Zlib",         # Zlib License - used by foldhash (hashbrown default hasher)
+    "CDLA-Permissive-2.0", # Community Data License (permissive) - Mozilla's CA data in webpki-roots/webpki-root-certs (via zenoh-link-commons)
 ]
 
 confidence-threshold = 0.8
@@ -27,6 +28,10 @@ yanked = "warn"
 ignore = [
     "RUSTSEC-2026-0110", # bare-metal deprecated via cortex-m (embedded-only transitive)
     "RUSTSEC-2026-0173", # TEMP: proc-macro-error2 unmaintained (transitive via defmt-macros/tabled_derive)
+    "RUSTSEC-2024-0436", # paste unmaintained: proc-macro only, via zenoh-keyexpr/token-cell (zenoh connector)
+    "RUSTSEC-2025-0134", # rustls-pemfile unmaintained (transitive via rumqttc and zenoh-link-commons)
+    "RUSTSEC-2024-0449", # unsafe-libyaml unmaintained, via serde_yaml from zenoh-config (zenoh connector never parses YAML config) and aimdb-cli's optional yaml feature
+    "RUSTSEC-2026-0041", # lz4_flex decompression, via zenoh-transport: compiled only with transport_compression, which the zenoh connector never enables (see .cargo/audit.toml)
 ]
 
 [sources]
diff --git a/docs/aimdb-and-ros2.md b/docs/aimdb-and-ros2.md
new file mode 100644
index 00000000..8f08f891
--- /dev/null
+++ b/docs/aimdb-and-ros2.md
@@ -0,0 +1,135 @@
+# AimDB and ROS 2
+
+AimDB records can be ROS 2 topics. `aimdb-zenoh-connector` speaks what
+`rmw_zenoh` puts on the wire, so a ROS 2 system that uses rmw_zenoh sees an
+AimDB process as an ordinary node: `ros2 node list` lists it, `ros2 topic echo`
+reads its records, and `ros2 topic pub` writes into them. AimDB needs no ROS
+installation, only a Zenoh router both sides reach.
+
+Tested with Jazzy and Lyrical. A robot on a DDS middleware needs
+`zenoh-bridge-ros2dds`; Humble has no type hashes and is not supported.
+
+## The ROS side
+
+Every ROS node and AimDB connect to one Zenoh router:
+
+```text
+export RMW_IMPLEMENTATION=rmw_zenoh_cpp
+ros2 run rmw_zenoh_cpp rmw_zenohd          # the router, on tcp/…:7447
+```
+
+## Message types
+
+A ROS message is a Rust struct with the `.msg`'s fields **in order**, since
+CDR is positional, and one derive:
+
+```rust,ignore
+use aimdb_data_contracts::RosMessage;
+
+/// cell_msgs/msg/SpindleCommand.msg: float64 rpm, bool enabled, string<=32 tool
+#[derive(Clone, Debug, serde::Serialize, serde::Deserialize, RosMessage)]
+#[ros(type = "cell_msgs/msg/SpindleCommand", hash = "RIHS01_<64 hex>")]
+pub struct SpindleCommand {
+    pub rpm: f64,
+    pub enabled: bool,
+    #[ros(max_len = 32)]
+    pub tool: String,
+}
+```
+
+**The hash** identifies the type on the wire. A wrong one fails silently, as
+the two sides never meet, so copy it from the robot:
+
+```text
+$ ros2 topic info -v /cell4/spindle_cmd | grep hash
+Topic type hash: RIHS01_…
+```
+
+| `.msg` | Rust |
+|---|---|
+| `bool` | `bool` |
+| `byte`, `char`, `uint8`, `int8` | `u8`, `i8` |
+| `uint16` … `int64` | `u16` … `i64` |
+| `float32`, `float64` | `f32`, `f64` |
+| `string`; `string<=N` | `String`; add `#[ros(max_len = N)]` |
+| `T[N]` | `[T; N]` |
+| `T[]`; `T[<=N]` | `Vec<T>`; add `#[ros(max_len = N)]` |
+| `pkg/Type` | another `RosMessage` struct |
+| `wstring` | not supported |
+
+Constants in a `.msg` are not on the wire and are left out. An empty message
+carries `structure_needs_at_least_one_member: u8`, as ROS does. Standard types
+such as `std_msgs/Header` and `builtin_interfaces/Time` are written the same
+way, once per project.
+
+## The connector
+
+```rust,ignore
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
+
+let ros2 = Ros2Connector::new("tcp/192.168.10.5:7447",
+        Ros2Node::new("cell4_gateway").namespace("/cell4"))
+    .domain_id(7)
+    .register::<SpindleCommand>();
+```
+
+- **Domain:** `domain_id(n)`; without it `ROS_DOMAIN_ID`, read as `rcl`
+  reads it (`010` is 8, `0xA` is 10); without that 0. Above 232, the highest
+  ROS 2 documents, it warns. Like a wrong hash, a wrong domain fails silently.
+- **Namespace:** the node's identity in `ros2 node list`. It does not prefix
+  topics: `ros2://cell4/spindle_cmd` is always `/cell4/spindle_cmd`.
+- **Links:** `linked_to("ros2://…")` makes a record a ROS publisher,
+  `linked_from("ros2://…")` a subscription. Each advertises `KEEP_LAST` 10,
+  `RELIABLE`, `VOLATILE`; `Ros2LinkExt::with_depth` and `with_reliability`
+  override it. Reliability is advertised only: the data travels on Zenoh's
+  reliable default.
+- **Mistakes fail `build()`:** an unregistered type, a codec other than CDR, a
+  topic writer, a `{…}` pattern, two ROS types on one topic (publisher or
+  subscription), an invalid ROS name or `ROS_DOMAIN_ID`. A custom serializer is allowed and logs a warning, since nothing can
+  check that it writes CDR.
+
+## Microcontrollers: the gateway
+
+A microcontroller publishes plain `zenoh://` to the same router, and a gateway
+re-publishes the same contract as a ROS topic. The gateway derives its ROS
+connector from its Zenoh connector, so it keeps one router connection:
+
+```rust,ignore
+let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+let ros2 = zenoh.ros2(Ros2Node::new("cell4_gateway")).register::<Temperature>();
+builder.with_connector(zenoh).with_connector(ros2);
+
+builder.configure::<Temperature>("cell4.temperature", |reg| {
+    reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+        .linked_from("zenoh://cell4/probe/temperature")
+        .linked_to("ros2://cell4/temperature");
+});
+```
+
+ROS sees `/cell4/temperature` published by `/cell4_gateway`. A type that is a
+`RosMessage` encodes as CDR by default, so both links need no codec. The
+attachment's timestamp comes from the gateway; a microcontroller without a
+clock leaves `header.stamp` to a transform on the gateway record. The
+microcontroller side, on `zenoh-nostd`, follows once zenoh-nostd is published
+on crates.io.
+
+## Checking it from ROS
+
+```text
+$ ros2 node list
+/cell4/cell4_gateway
+$ ros2 topic info -v /cell4/temperature     # type, hash, QoS, GID
+$ ros2 topic echo /cell4/temperature
+$ ros2 topic pub --once /cell4/spindle_cmd cell_msgs/msg/SpindleCommand "{rpm: 1200.0, enabled: true, tool: t1}"
+```
+
+`make ros2-interop DISTRO=lyrical` runs these checks against a ROS 2
+distribution in Docker, with the connector's `ros2_talker` and `ros2_listener`
+examples.
+
+## Not yet
+
+Services, actions, `TRANSIENT_LOCAL` (latched topics), Humble, and a
+microcontroller that joins the ROS graph itself rather than through a gateway.
+
+Design: [053 — Zenoh connector](design/053-zenoh-connector.md).
diff --git a/docs/aimdb-usage-guide.md b/docs/aimdb-usage-guide.md
index 9cdfdb0e..5a894265 100644
--- a/docs/aimdb-usage-guide.md
+++ b/docs/aimdb-usage-guide.md
@@ -282,13 +282,13 @@ async fn main(_spawner: Spawner) {
 
 ## Using Connectors
 
-AimDB connectors enable integration with external protocols and systems. All connectors support both Tokio and Embassy runtimes.
+AimDB connectors enable integration with external protocols and systems. KNX and MQTT run on both Tokio and Embassy; the Zenoh connector is `std` only for now.
 
 ---
 
 ## Using Connectors
 
-AimDB connectors enable integration with external protocols and systems. All connectors support both Tokio and Embassy runtimes.
+AimDB connectors enable integration with external protocols and systems. KNX and MQTT run on both Tokio and Embassy; the Zenoh connector is `std` only for now.
 
 ### KNX Connector
 
@@ -428,6 +428,42 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 - [tokio-mqtt-connector-demo](../examples/tokio-mqtt-connector-demo) - Full Tokio example
 - [embassy-mqtt-connector-demo](../examples/embassy-mqtt-connector-demo) - Full Embassy example
 
+### Zenoh Connector and ROS 2
+
+The Zenoh connector serves `zenoh://` links, and `ros2://` links that make
+records ROS 2 topics through rmw_zenoh, with no ROS installation on the AimDB
+side.
+
+**Add to Cargo.toml:**
+```toml
+aimdb-zenoh-connector = { version = "0.1", features = ["std"] }
+aimdb-data-contracts = { version = "0.2", features = ["ros2"] }   # #[derive(RosMessage)]
+```
+
+```rust
+use aimdb_zenoh_connector::{Ros2Connector, Ros2Node, ZenohConnector};
+
+// Plain Zenoh, and ROS 2 on the same session: register both
+let zenoh = ZenohConnector::new("tcp/192.168.10.5:7447");
+let ros2 = zenoh.ros2(Ros2Node::new("cell4_gateway")).register::<Temperature>();
+let mut builder = AimDbBuilder::new()
+    .runtime(runtime)
+    .with_connector(zenoh)
+    .with_connector(ros2);
+
+builder.configure::<MachineState>("cell4.state", |reg| {
+    reg.buffer(BufferCfg::SingleLatest)
+        .linked_to_with("zenoh://aimdb/cell4/state", Postcard::<128>);
+});
+builder.configure::<Temperature>("cell4.temperature", |reg| {
+    reg.buffer(BufferCfg::SpmcRing { capacity: 16 })
+        .linked_to("ros2://cell4/temperature");
+});
+```
+
+See [AimDB and ROS 2](aimdb-and-ros2.md) for message types, domains, QoS and
+the gateway pattern.
+
 ---
 
 ## Current Status & Limitations
@@ -438,6 +474,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 - **aimdb-embassy-adapter**: Embassy runtime support (embedded)
 - **aimdb-knx-connector**: KNX/IP tunneling (both runtimes)
 - **aimdb-mqtt-connector**: MQTT (both runtimes)
+- **aimdb-zenoh-connector**: Zenoh, and ROS 2 topics through rmw_zenoh (std)
 - **aimdb-sync**: Synchronous API wrapper
 - **aimdb-client**: Remote database access (AimX protocol)
 
diff --git a/docs/design/052-verification.md b/docs/design/052-verification.md
deleted file mode 100644
index e671fe30..00000000
--- a/docs/design/052-verification.md
+++ /dev/null
@@ -1,325 +0,0 @@
-# 052 — Verification against the codebase, and effort assessment
-
-**Status:** review + prototype, 2026-09-02. Verifies
-[052 — Runtime-neutral connectors](052-runtime-neutral-connectors.md) against
-the tree at `58c1951`, on the pinned toolchain (rustc 1.98.0, `88d9e12ae`).
-**Verdict:** the architecture is sound and the core mechanism is real — it
-compile-checks exactly as claimed. Four factual errors and four open design
-gaps were found; **all four gaps are now closed with working code** (§3), not
-with argument, and every correction has been folded back into design 052
-itself. Effort, recalibrated against the prototype: **4–6 weeks** for one
-engineer already fluent in the crates.
-
-Every claim below that says "verified" or "answered" was executed. The
-prototype lives on `claude/design-doc-52-verify-1lsexa` and is **not** on
-`main`: this document and the revised design are merged ahead of it, so the
-findings are not stranded behind an unmerged change. It is ~2 300 lines across
-seven crates — core's neutral I/O layer, both adapters, a unified KNX
-connection task, the serial connector reduced to framing, and the tests that
-settle each question. §7 lists what landed where.
-
----
-
-## 1. What checks out
-
-Every load-bearing claim in §2, §5 and §6 was checked against the source.
-Line references are to `main` at `58c1951`; where the prototype later
-changes a cited item, the change is called out in §3.
-
-| Claim | Verified |
-|---|---|
-| §5.1 return-type notation is experimental on 1.98 | Yes — `error[E0658]: return type notation is experimental`, issue #109417 |
-| §5.1 the trait-declared `+ Send` shape works instead | Yes — a standalone crate with a `!Send` socket, a `SendFutureWrapper` newtype impl, a plain `async fn` impl, a generic `FramedConnection`, and a generic task boxed as `Send + 'static` compiles clean under `rustup run 1.98.0` |
-| §5.2 `embassy-sync` pulls in no executor | Yes — `_external/embassy/embassy-sync/Cargo.toml` deps are exactly `critical-section`, `heapless`, `futures-core`, `futures-sink`, `embedded-io-async`, `cfg-if` (+ optional `defmt`/`log`) |
-| §5.2 KNX Embassy already uses `StaticCell<Channel<CriticalSectionRawMutex, …, N>>` | Yes — [`embassy_client.rs:76-107`](../../aimdb-knx-connector/src/embassy_client.rs) |
-| §5.2 Tokio's `with_command_queue_size` becomes a const generic | Yes — it exists at [`tokio_client.rs:64`](../../aimdb-knx-connector/src/tokio_client.rs); the Embassy side already notes the size must be a constant |
-| §5.5 `spin::Mutex` needs no new dependency | Yes — `aimdb-core/Cargo.toml:120` already declares `spin` with `mutex`/`spin_mutex` |
-| §4 `RuntimeOps::sleep` boxes | Yes — `fn sleep(&self, d) -> BoxFuture` at [`executor.rs:50`](../../aimdb-core/src/executor.rs); `now_nanos` is a plain call |
-| §2 KNX is ~90 % shared behind a three-method `TunnelIo` | Yes — `send`/`forward`/`warn_ack_timeout` at [`tunnel.rs:536`](../../aimdb-knx-connector/src/tunnel.rs); `drain_actions` is the shared driver |
-| §2 both KNX halves bypass `RuntimeOps` for the clock | Yes — `embassy_time::Instant::now()` at `embassy_client.rs:281`, `tokio::time::Instant` at `tokio_client.rs:221` |
-| §2 the serial Embassy half is already the target shape | Yes — it contributes only `CobsFramer` and rides `EmbassyConnection<Rd, Wr, F, RC, WC>`; the file carries **zero** `unsafe` |
-| §5.4 `embassy-futures` is dependency-free | Yes — its `[dependencies]` is empty bar optional `defmt`/`log`, and `select_array` exists for the pooled case |
-| §6 `embassy_tls.rs` already bypasses `run_with_subscriptions` | Yes — `handle_messages` at [`embassy_tls.rs:372`](../../aimdb-mqtt-connector/src/embassy_tls.rs); the plain path still uses `run_with_subscriptions` at `embassy_client.rs:575` |
-| §6 `set_unix_time` has no neutral home | Yes — it is an inherent `EmbassyAdapter` method ([`runtime.rs:48`](../../aimdb-embassy-adapter/src/runtime.rs)), not on `RuntimeOps` |
-| §7.2 hostname resolution is a genuine gain | Yes — the plain Embassy path rejects non-IPv4-literal hosts today ("plain mqtt:// needs an IPv4 literal") |
-| §8 design 012 exists and needs a rewrite | Yes — `012-M5-connector-development-guide.md`, marked "✅ Implemented (Reference Documentation)" |
-| Acceptance 1 baseline | Yes — `cargo check -p aimdb-core --no-default-features --features alloc,connector-session,remote --target thumbv7em-none-eabihf` passes today, and core's only `unsafe` is a word inside a doc comment (`transport.rs:165`) |
-
-One structural point the design gets right without saying so: the Embassy TCP
-half documents that "`connector-io` cannot be reused directly because
-`TcpSocket::split()` only yields borrowed halves, while AimDB's `Connection`
-must own the socket". An unsplit `ByteStream` with `&mut self` on both
-directions dissolves that blocker, and it costs nothing, because
-`Connection::recv`/`send` already take `&mut self` and so already serialize.
-
-## 2. Factual errors
-
-1. **§8: "No tool or library crate constructs these connectors."** False.
-   [`aimdb-codegen/src/rust.rs`](../../aimdb-codegen/src/rust.rs) emits
-   `MqttConnector::new(&mqtt_url)` (lines 268, 1421) and
-   `KnxConnector::new(&knx_gateway)` (lines 269, 1424) into generated user
-   code. MQTT is unaffected (the `Native` backend keeps that signature), but
-   **KNX is not**: once `KnxConnector` is generic over `Datagram + Delay`, the
-   generated line must carry a transport, so `aimdb-codegen` changes and
-   `make codegen-drift` has to be re-baselined.
-2. **§8's call-site list is incomplete.** It omits
-   [`aimdb-tcp-connector/examples/tcp_demo.rs`](../../aimdb-tcp-connector/examples/tcp_demo.rs)
-   and
-   [`aimdb-serial-connector/examples/serial_demo.rs`](../../aimdb-serial-connector/examples/serial_demo.rs)
-   — precisely the two crates whose sugar §8 says will change. It also lists
-   all four `weather-mesh-demo` binaries when only `weather-station-gamma`
-   (Embassy MQTT) is affected; hub/alpha/beta use the unchanged Tokio path.
-3. **§2 cites `tokio_client.rs:691`.** That file is 632 lines. The clock is at
-   `tokio_client.rs:221-222`. (`embassy_client.rs:283` is off by two — the fn
-   is at 281.) `connectors.rs:75` in §5.1 should be `:74`.
-4. **Acceptance 2: "Every `unsafe impl Send`/`Sync` in the workspace remains
-   inside `aimdb-embassy-adapter`."** False today and after the change:
-   `aimdb-wasm-adapter` carries 16 (`buffer.rs` 9, `ws_bridge.rs` 4,
-   `time.rs` 3) and `aimdb-bench/src/alloc.rs` one. The criterion needs
-   scoping to the connector crates, which is what it evidently means.
-
-## 3. The four gaps, closed
-
-Each was flagged as needing design work before step 1. Each is now answered by
-code on the prototype branch, with a test that fails if the answer is wrong.
-
-### 3.1 `StreamListener` **can** back the Embassy N-socket accept pool
-
-The concern was that `accept(&mut self)` is single-shot while the pool exists
-to keep `N` sockets in `accept()` at once, so routing it through core's serial
-`serve` loop would drop concurrency to one — and that §6's "moves into the
-adapter unchanged" therefore could not hold.
-
-Reading `embassy-net` settles the mechanism. `TcpSocket::accept` is a
-*synchronous* `s.listen(endpoint)` followed by a bare `poll_fn` that waits for
-the state to leave `Listen`/`SynSent`/`SynReceived`. So **dropping the future
-does not un-listen the socket** — but *re-entering* `accept()` on a listening
-socket is `InvalidState`, and the `abort()` that makes it re-enterable is what
-drops the `LISTEN`.
-
-`EmbassyNet::listen::<N>` therefore stores one accept future per slot and
-consumes only the one that completes; the other `N-1` stay pending, untouched,
-still listening. Nothing is ever cancelled and no socket leaves `LISTEN`
-between calls.
-
-`aimdb-tcp-connector/tests/accept_pool.rs` proves it over the same two
-crossover-wired `embassy-net` stacks the existing loopback smoke uses, driven
-in exactly the shape `serve` accepts in:
-
-- `pool_keeps_every_slot_listening_between_accepts` — client A connects and
-  round-trips bytes; **then**, while the server sits between accepts, client B
-  dials and also connects and round-trips. A pool holding only one socket in
-  `LISTEN` would have had B's SYN refused.
-- `naive_pool_loses_the_syn_that_arrives_between_accepts` — the same scenario
-  against a pool that re-creates its accepts each call. B's dial fails with
-  `TransportError::Io`, asserted. This is what makes the first test a finding
-  rather than a coincidence, and it is a regression guard: if embassy-net's
-  cancellation semantics ever change, it tells you the stored-accept design
-  can be simplified.
-
-So §6's wording needs one correction — the pool moves *reshaped*, not
-unchanged — but the trait set is sufficient, and the result is strictly better
-than today's: no `abort()`/`LISTEN` window at all.
-
-### 3.2 `Datagram` needed `local_addr` and a binder — both added, both work
-
-Confirmed as a real gap and closed by widening the trait, not by dropping
-behaviour. `Datagram::local_addr` is now part of the contract and
-`DatagramBinder` supplies sockets, so the engine's `Action::ResetSocket` can
-rebind.
-
-Both are implementable on both runtimes. Tokio reads `UdpSocket::local_addr`;
-Embassy assembles the address from the socket's bound port and the stack's
-IPv4 config, and rebinds by `close()` + `bind()` on the same socket rather
-than recreating it (which would strand its buffers).
-
-`client::tests::unified_task_advertises_the_real_local_endpoint` drives the
-unified task against a real UDP gateway socket and asserts the bytes: the
-CONNECT_REQUEST's control HPAI carries `127.0.0.1` and the socket's actual
-bound port, not `0.0.0.0:0`. Worth noting the Embassy half never set the
-explicit endpoint *at all* today, so unification fixes it rather than
-regressing it.
-
-### 3.3 `TunnelIo::send` did block generic code — fixed, and it cost one line
-
-Reproduced exactly. A probe asserting `Send` on `drain_actions`' future in
-generic code gave `E0277: future cannot be sent between threads safely`, with
-rustc prescribing the fix verbatim:
-
-```
-help: `Send` can be made part of the associated future's guarantees for all
-      implementations of `tunnel::TunnelIo::send`
--     async fn send(&mut self, frame: &[u8]) -> bool;
-+     fn send(&mut self, frame: &[u8]) -> impl Future<Output = bool> + Send;
-```
-
-Applied, with `tunnel::tests::drain_actions_future_is_send_in_generic_code` as
-the guard. The two existing impls then split exactly along §5.1's predicted
-line: the Tokio one stays a plain `async fn`, and the Embassy one — whose
-`embassy_net::udp::UdpSocket` future is `!Send` — returns the adapter's
-transparent `SendFutureWrapper`. That is §5.1's mechanism exercised on a real
-trait in a real connector rather than on a standalone sketch.
-
-### 3.4 §6 and acceptance 2 really did conflict — the signature is what gives
-
-A type assertion on the real struct confirmed it: `TlsOptions` is `!Send`
-because its RNG is a bare `&'static mut dyn CryptoRngCore`, so §5.5's
-`spin::Mutex<Option<T>>` cannot hold it and the `unsafe impl`s cannot go.
-
-The resolution is one `+ Send` on the trait object — a signature change §6
-says will not happen, and the cheapest of the available options, since every
-concrete CSPRNG a caller passes already satisfies it. With that:
-
-- core gains `session::OneShot<T>`, §5.5's cell: `Send + Sync` for any
-  `T: Send`, no `unsafe`, with a compile-time assertion of that property so a
-  regression surfaces in core rather than in a connector;
-- `TlsSlot` becomes an alias for it, and **`aimdb-mqtt-connector` now carries
-  zero `unsafe impl`s** (was two);
-- the whole `embassy-tls` path still cross-compiles to thumbv7em, so
-  `embedded-tls` accepts the bound.
-
-§6 should be amended to say `TlsOptions` keeps its *shape* but gains a `Send`
-bound on its RNG.
-
-## 4. The two understated consequences, measured
-
-### 4.1 `CriticalSectionRawMutex` on std is a link-time obligation
-
-§5.2 mentions `critical-section/std` only as a host-test detail. A standalone
-std binary using `Channel<CriticalSectionRawMutex, _, N>` fails to link:
-
-```
-rust-lld: error: undefined symbol: _critical_section_1_0_acquire
-rust-lld: error: undefined symbol: _critical_section_1_0_release
-```
-
-`NoopRawMutex` cannot substitute — it is `!Sync`, so it cannot back a shared
-channel at all (`*mut () cannot be shared between threads safely`).
-`CriticalSectionRawMutex` is therefore forced on std, and the obligation with
-it.
-
-It is also fully mitigable in one line, which the branch does: the KNX
-connector's `tokio-runtime` feature now enables `critical-section/std` itself,
-so no downstream std user ever sees the error.
-`client::tests::shared_embassy_channels_carry_telegrams_on_tokio` then runs
-§5.2's claim rather than asserting it — the unified task on Tokio, against a
-real UDP gateway, carrying a full handshake, an inbound telegram with its ACK,
-and an outbound command, all through the same `embassy_sync` channel types the
-MCU uses.
-
-### 4.2 The `embassy-sync` patch, and one feature-unification trap
-
-§5.4's "dependency-free" claim is exact: `embassy-futures` 0.1.2 has an empty
-`[dependencies]` bar optional `defmt`/`log`, and its `select3` drives the
-unified KNX loop on both runtimes. It is now an unconditional dependency of
-the KNX connector, and the std build is unaffected.
-
-One trap found by building rather than reading: making the adapter's `net`
-feature imply `embassy-time` turns on the workspace's
-`defmt-timestamp-uptime`, which defines `_defmt_timestamp` and collides with
-the `defmt::timestamp!` every host test binary must supply. Sockets and clock
-have to stay separable features — `net` does not imply `embassy-time`, and
-`EmbassyDelay` is gated separately.
-
-## 5. Acceptance criteria, re-reviewed against the prototype
-
-| # | Assessment |
-|---|---|
-| 1 | **Met.** Core carries the new traits, `FramedConnection`, `FramingDialer`/`FramingListener` and `OneShot`, and still cross-compiles to `thumbv7em-none-eabihf` with zero `unsafe`. |
-| 2 | Needs rewording (it overlooks `aimdb-wasm-adapter`'s 16 `unsafe impl`s and `aimdb-bench`'s one), but now reachable: MQTT is at zero, serial was already at zero, and the TCP connector's remaining three live in the module this design deletes — the adapter's `net` module already replaces them. |
-| 3 | **Met for serial**, and the doubt was unfounded: `tokio` for `io-util` alone suffices, with no `aimdb-tokio-adapter` dependency. See §3 of `framed.rs`. |
-| 4 | Still the sharpest criterion. `two_concurrent_sessions` and the three other loopback tests pass unchanged, and `accept_pool.rs` adds the pooled-`StreamListener` equivalent. Note MQTT's `build_internal` tests are Tokio-only unit tests; there is still **no** host test for either Embassy MQTT path. |
-| 5 | **Near-vacuous, unchanged.** `examples/embassy-bench-stm32h5` depends only on `aimdb-core`, `aimdb-embassy-adapter` and `aimdb-bench` — no connector — so it will show no change whatever the refactor does. Replace it with an allocation-counting test on a connector path. |
-| 6 | Still the most valuable, and still unbuilt. Build it first, not last (§6.3). |
-
-## 6. Effort assessment, recalibrated
-
-### 6.1 Code in scope
-
-Runtime-specific connector code the design deletes or restructures:
-
-| Crate | Files | Lines |
-|---|---|---|
-| `aimdb-tcp-connector` | `embassy_transport.rs` 591 + `tokio_transport.rs` 302 | 893 |
-| `aimdb-serial-connector` | `embassy_transport.rs` 237 + most of `tokio_transport.rs` 312 | 549 |
-| `aimdb-knx-connector` | `embassy_client.rs` 468 + `tokio_client.rs` 632 | 1 100 |
-| `aimdb-mqtt-connector` | `embassy_client.rs` 712 + `embassy_tls.rs` 415 + `tokio_client.rs` 457 | 1 584 |
-| **Total** | | **~4 130** |
-
-Untouched and load-bearing: `tunnel.rs` (1 400), the two `framing.rs`
-(93 + 139), `sntp*.rs` (281), `link_ext.rs` (68).
-
-The prototype is 2 324 lines added across 22 files, which is
-the first hard data point on the "new code" estimate. It covers step 1 in
-full, both halves of step 2, the load-bearing parts of steps 4a and 4b, and
-none of steps 3, 5 or 6.
-
-### 6.2 Stage estimates
-
-| Step | Work | Days | Status |
-|---|---|---|---|
-| 1 | Core traits, `FramedConnection`, framing adapters, `OneShot` | 2–3 | **done on the prototype branch** |
-| 2a | `aimdb-tokio-adapter` `net` feature | 1–2 | **done** |
-| 2b | `EmbassyNet`/`EmbassyUart`/`Delay` + slot-pool move | 3–5 | **done**; §3.1 resolved, so the risk that inflated this is gone |
-| 3 | TCP pilot: port the connector onto the traits, migrate `embassy_loopback` | 3–4 | not started; the adapter side it depends on is done |
-| 4a | Serial | 1–2 | framing + streams **done**; connector sugar and test migration remain |
-| 4b | KNX | 3–5 | unified task **done**; builder/channel wiring and deleting the two clients remain |
-| 5 | MQTT `Native`/`Embedded` split | 5–8 | not started |
-| 6 | Examples, codegen + drift re-baseline, design 012, CHANGELOGs, major bumps | 2–3 | not started |
-| | **Total** | **20–32 days ≈ 4–6 weeks** | |
-
-The estimate holds. What changed is its shape: the week of contingency I
-attached to §3.1 is no longer needed, and the four gaps that could each have
-forced a rethink are closed. The remaining risk is concentrated almost
-entirely in step 5.
-
-### 6.3 Where the risk actually sits
-
-- **MQTT is the long pole and the thinnest-covered.** 1 584 lines restructured
-  with no host integration test for either Embassy path. Moving the plain path
-  from `run_with_subscriptions` to `handle_messages` means re-implementing the
-  reconnect-and-resubscribe loop mountain-mqtt-embassy currently owns
-  (`embassy_client.rs:562-577` — "the manager re-subscribes these topics on
-  every connection, so inbound routing survives reconnects"). That is
-  behaviour, not plumbing. Acceptance 6 is the mitigation and should be built
-  **first**.
-- **Everything else is now de-risked by running code.** The traits, both
-  adapters, the accept pool, the unified KNX task and the framed
-  connection all exist and are tested.
-- **What is well covered:** CI cross-compiles every Embassy connector to
-  `thumbv7em-none-eabihf` (`make test-embedded`, 8 connector configurations),
-  and the TCP and serial halves have real host smokes.
-
-## 7. What is on the prototype branch
-
-New:
-
-- `aimdb-core/src/session/io.rs` — `ByteStream`, `StreamDialer`,
-  `StreamListener`, `Datagram`, `DatagramBinder`, `Delay`, `Framer`,
-  `FramerFactory`, `FramedConnection`, `FramingDialer`, `FramingListener`,
-  `OneShot`. Additive; core still has zero `unsafe`.
-- `aimdb-embassy-adapter/src/net.rs` (feature `net`) — `EmbassyNet::tcp` /
-  `listen::<N>` / `udp`, `EmbassyTcpStream`, the stored-accept pool,
-  `EmbassyUdpSocket`/`EmbassyUdpBinder`, `EmbassyDelay`. All the force-`Send`
-  for the TCP and UDP paths lives here.
-- `aimdb-tokio-adapter/src/net.rs` (feature `net`) — the std duals, every
-  future a plain `async fn`, no `unsafe`.
-- `aimdb-knx-connector/src/client.rs` — one `connection_task` generic over
-  `DatagramBinder + Delay`, plus the `embassy_sync` channel bridges.
-- `aimdb-serial-connector/src/framing.rs` — the COBS framer against core's
-  trait, and one `ByteStream` per byte source.
-- Tests: `aimdb-tcp-connector/tests/accept_pool.rs`,
-  `aimdb-serial-connector/tests/framed.rs`, and unit tests in
-  `client.rs` and `tunnel.rs`.
-
-Changed: `TunnelIo::send` gains `+ Send`; `TlsOptions`'s RNG gains `+ Send`
-and `TlsSlot` becomes `OneShot`; the KNX `tokio-runtime` feature adopts
-`embassy-sync` + `critical-section/std`; `embassy-futures` becomes
-unconditional.
-
-Verification run: `make test-embedded` passes (all 8 Embassy connector
-configurations), every connector test suite passes, and clippy is clean on
-the changed crates. Two pre-existing failures are unrelated to this work and
-reproduce on `main`: `aimdb-data-contracts`' `compile_fail` trybuild suite,
-and `cargo clippy --target thumbv7em-none-eabihf`, which fails in this
-environment for untouched crates too.
diff --git a/docs/design/053-zenoh-connector.md b/docs/design/053-zenoh-connector.md
index 0cba55bb..07c74ad5 100644
--- a/docs/design/053-zenoh-connector.md
+++ b/docs/design/053-zenoh-connector.md
@@ -52,30 +52,87 @@
     section yet (§1).
   - Humble keys carry a placeholder hash, not none (§2).
   - The native publisher mirrors rmw_zenoh's congestion control (§5.1).
-
-Nothing is implemented. **[checked]** marks a claim read from upstream source at
+- **rev 7, 2026-09-26.** The domain ID and node namespace get an API, following
+  ROS's layering: the domain is set per session on `Ros2Connector`, and the
+  namespace per node on `Ros2Node` (§4.2). Q6 is answered: topics stay fully
+  qualified (§4.3, §10). Review findings are folded in too:
+  - Core's serializer setters clear the recorded wire format, so a custom
+    serializer after a codec verb now warns (§4.3, §4.4, §4.6).
+  - The `WIRE_FORMAT` const-assert becomes a `build()` check (§4.3, §9).
+  - `aimdb-cdr` decodes both byte orders (§4.4).
+  - The wildcard, `SchemaType::NAME` and `RouteMeta` duplication consequences
+    are written down (§4.3, §4.4, §4.6).
+
+  - `aimdb-ros2-msgs` is postponed to a later phase. In v1 every ROS type,
+    standard or custom, is hand-written with the derive (§4.5).
+
+  The changes are in the scope list, §2, §4.2–4.6, §4.10, §8, §9, §10, §11 and
+  §12.
+- **rev 8, 2026-09-26.** hiroz, a native Rust ROS 2 stack on Zenoh, is
+  assessed. Our traits stay independent of it. Its crates serve as test oracles
+  for CDR bytes and rmw_zenoh keys, and its prebuilt messages are a follow-up
+  (§4.4, §4.5, §8, §9, §13).
+- **rev 9, 2026-10-07.** Rebased on the connector structure of
+  [054](054-zero-alloc-connector-boundary.md) and
+  [055](055-wildcard-inbound-links.md), checked against AimDB @ `eefe2c2`:
+  - Inbound `zenoh://` gets a `ZenohGrammar`. Records see the concrete key
+    and its captures, and the connector subscribes `subscriptions()`, the
+    covering set (§4.3).
+  - The connector pulls from `OutboundRoutes` and pushes into
+    `InboundDispatch`; it drives no pumps and holds no action channel
+    (§4.7, §5.2, §7).
+  - Core's additions shrink to `RouteInfo::type_id` and
+    `InboundDispatch::routes()`. `RouteMeta`, its accessors and the
+    topic-provider key are gone: the route lists they extended no longer
+    exist, and `RouteInfo::topic_capacity` already says whether a link has
+    a topic writer (§4.6).
+  - The "nothing breaks" constraint is dropped. 054 and 055 already break
+    the connector interface for the next major release, and nothing has
+    shipped since 2.0.0 (§12).
+  - A consistency pass (2026-10-08) refreshes the citations into AimDB to
+    `eefe2c2`, requires a capture to be a whole Zenoh chunk (§4.3), and adds
+    S6 to the spike: whether zenoh-nostd lets `put` run beside
+    `session.run()` (§5.2, §10).
+
+  The changes are in the scope list, §2, §4.1, §4.3, §4.4, §4.6, §4.7,
+  §4.9, §5.1, §5.2, §6, §7, §8, §9, §10, §11, §12 and §13.
+- **rev 10, 2026-10-08.** The spike (§11 step 1) ran against live routers and
+  ROS 2 nodes, and answered S2 and S6: yes to both (§10). It also found that
+  released Rolling binaries still vendor zenoh-c 1.8.0, so 1.10.1 was tested
+  with Eclipse's own `zenohd` (§3). The live captures are in §3. The changes
+  are in §3, §5.1, §5.2, §10 and §11.
+
+**Implemented** (on `feat/aimdb-zenoh-connector`): `aimdb-cdr`,
+`WireFormat` on `Linkable` and `LinkCodec`, and the recorded
+`aimdb.wire_format` key with the setters that clear it. Nothing else is.
+
+**[checked]** marks a claim read from upstream source at
 the commits listed in §13; **[verified]** marks one confirmed by reading or
 running code at those commits. **[spike]** marks a question only a running system can
 answer; §10 collects them.
 **Predecessors:** [052 — Runtime-neutral connectors](052-runtime-neutral-connectors.md)
 (this connector is written in 052's shape from the start),
+[054 — Zero-allocation connector boundary](054-zero-alloc-connector-boundary.md)
+(`OutboundRoutes`, `InboundDispatch`, `TopicWriter`),
+[055 — Wildcard inbound links](055-wildcard-inbound-links.md) (`TopicGrammar`,
+captures and keys),
 [045 — Per-link codec selection](045-per-link-codec-selection.md),
 [041 — Data contracts as first-class capabilities](041-data-contracts-integration.md)
 (`RosMessage` follows the one-verb-per-contract rule; its connector-side
 registration follows `Streamable`'s precedent).
 **Scope:**
-- New crates `aimdb-zenoh-connector`, `aimdb-cdr` and `aimdb-ros2-msgs`.
+- New crates `aimdb-zenoh-connector` and `aimdb-cdr`. A prebuilt
+  `aimdb-ros2-msgs` is a later phase (§4.5).
 - Additive changes to `aimdb-data-contracts`: `RosMessage`, `Linkable::WIRE_FORMAT`,
   `LinkCodec::WIRE_FORMAT` (recorded on each link), and `link_codecs::Cdr`.
 - A new `#[derive(RosMessage)]` in `aimdb-derive`.
-- Additive changes to `aimdb-core`: two new route accessors that return
-  a new `#[non_exhaustive]` `RouteMeta` (the record's `TypeId` and the link
-  config), plus a reserved `aimdb.topic_provider` config key. The existing
-  `OutboundRoute`, `ConnectorLink` and `collect_*_routes` are left alone (§4.6).
+- Changes to `aimdb-core`'s connector interface: `RouteInfo` gains the
+  record's `TypeId`, `InboundDispatch` gains a per-route view, and the
+  serializer setters clear the reserved `aimdb.wire_format` key (§4.6).
+  These ride the break 054 and 055 already make; the user-facing link API
+  does not change.
 - `aimdb-codegen` is not touched.
 
-Nothing breaks. No existing public struct gains a field.
-
 ---
 
 ## 1. The question
@@ -118,7 +175,7 @@ serves two schemes, which can share **one** Zenoh session:
   rmw_zenoh-compatible key expressions, CDR payloads, the publication attachment,
   and liveliness tokens, so AimDB entities appear in `ros2 node list` and
   `ros2 topic info -v`. It targets Jazzy, Kilted, Lyrical and Rolling.
-- **G3.** Two backends in 052's shape:
+- **G3.** Two backends in 052's shape, on 054's connector interface:
   - `Native` uses the `zenoh` crate on std and serves both schemes.
   - `Embedded` uses `zenoh-nostd` on `no_std + alloc`, over any `StreamDialer`,
     and serves `zenoh://` only.
@@ -142,7 +199,9 @@ serves two schemes, which can share **one** Zenoh session:
 - Consuming the ROS graph. We announce our own entities and never build a graph
   cache.
 - A `.msg` importer or any other code generation. ROS types are written by hand
-  with a derive, or taken from `aimdb-ros2-msgs` (§4.5).
+  with a derive (§4.5).
+- A prebuilt message crate (`aimdb-ros2-msgs`). It is postponed to a later phase
+  (§4.5).
 - Auto-exposing every record of a type. Topics belong to instances, not types, and
   writes into the plant stay explicit (§8).
 - DDS robots. A robot on the default `rmw_fastrtps_cpp` needs
@@ -173,8 +232,12 @@ Differences between distros and dependencies:
   **[verified]**: Jazzy and Kilted have no backends code, and the Jazzy→Lyrical
   diff of `liveliness_utils.cpp` is otherwise only the backend escaping.
 - Jazzy, Kilted and Lyrical vendor zenoh-c 1.8.0 plus fixes (commit `05bd370`,
-  zenoh `2687c51`). **Rolling has moved to zenoh-c 1.10.1** plus fixes
-  (`07b0d43`), so S2 has to cover both. All four build the router with
+  zenoh `2687c51`). Rolling's source branch has moved to zenoh-c 1.10.1 plus
+  fixes (`07b0d43`), so S2 has to cover both. **[verified]** that the
+  *released* binaries lag: the apt packages `ros-lyrical-rmw-zenoh-cpp`
+  0.10.6 and `ros-rolling-rmw-zenoh-cpp` 0.13.0 (both built 2026-09-15) ship
+  `libzenohc` v1.8.0-2687c51. The spike therefore tested 1.10.1 with
+  Eclipse's `zenohd` 1.10.1 image as the router (§10, S2). All four build the router with
   `zenoh/transport_serial`, which matters once zenoh-nostd gains serial (§5.2).
 - **Subscribers are zenoh-ext `AdvancedSubscriber`s** (`rmw_subscription_data.cpp:434`).
   For a `VOLATILE` subscriber they use default options and receive a plain
@@ -183,6 +246,23 @@ Differences between distros and dependencies:
   have no cache and are not detectable, so such a subscriber, rviz on `/map`
   for example, gets live samples but no history until v1.1 (§6).
 
+**Captured live (rev 10)** from Lyrical's `demo_nodes_cpp` talker through
+`rmw_zenohd`. Every element matches the table above:
+
+- Data key: `0/chatter/example_interfaces::msg::dds_::String_/RIHS01_5509d866a579951f2fc6c19577c32605ba16f308cae7b498341d79536d4eb06b`.
+  Lyrical's talker publishes `example_interfaces/msg/String`, not `std_msgs`.
+- Payload `000100001100000048656c6c6f20576f726c643a2034363200`: the header,
+  then `u32` 17 and `Hello World: 462` with its NUL.
+- Attachment, 33 bytes: `ce01000000000000` (sequence number 462),
+  `3f629a2ea5a1dc18` (timestamp), `10`, then the GID
+  `0a93e656da27421a4169e87cbacda088`.
+- Node token: `@ros2_lv/0/8a6f0f1ec9ba74b35b16caa1d9043206/0/0/NN/%/%/talker`.
+- Publisher token: `@ros2_lv/0/8a6f0f1ec9ba74b35b16caa1d9043206/0/10/MP/%/%/talker/%chatter/example_interfaces::msg::dds_::String_/RIHS01_5509…06b/::,7:,:,:,,`
+  (depth 7). XXH3-128 of this token, low half first, gives exactly the GID in
+  the attachment, which confirms S3 live.
+- `/rosout`'s token carries a non-default QoS: `:1:,1000:,:10,0:,,`
+  (`TRANSIENT_LOCAL`, depth 1000, lifespan 10 s).
+
 Two consequences shape the design.
 
 1. **Every publish carries a wall-clock timestamp.** `RuntimeOps::unix_time()`
@@ -204,13 +284,14 @@ Two consequences shape the design.
 ```text
 aimdb-zenoh-connector
 ├── connector.rs    ZenohConnector<B> (scheme `zenoh`), sealed Backend trait
+├── grammar.rs      ZenohGrammar: key-expression matching and covering (§4.3)
 ├── shared.rs       the session state connectors on one session hold (§4.7)
 ├── ros2.rs         `std`: Ros2Connector (scheme `ros2`)
 ├── registry.rs     `std`: TypeId → ROS type name + hash, filled by `.register::<T>()`
 ├── link_ext.rs     `std`: Ros2LinkExt, QoS overrides for the long form (§4.3)
 ├── profile/        the rmw_zenoh profile: pure, alloc-only, host-tested once
 │   ├── keys.rs         data keys, liveliness tokens, name mangling, QoS strings
-│   ├── gid.rs          XXH3-128 over the token (xxhash-rust, no_std)
+│   ├── gid.rs          XXH3-128 over the token (twox-hash, no_std)
 │   └── attachment.rs   the 33-byte attachment, encoded into a stack array
 ├── native.rs       `std`: the zenoh crate, both schemes
 └── embedded/       `embedded`: zenoh-nostd, no_std + alloc, `zenoh://` only
@@ -224,14 +305,9 @@ split is the precedent (`aimdb-mqtt-connector/src/connector.rs`).
 
 ### 4.2 User-facing API
 
-Common ROS types come ready-made from `aimdb-ros2-msgs` (§4.5):
-
-```rust
-use aimdb_ros2_msgs::sensor_msgs::Temperature;
-```
-
-A custom type from the robot team's package is a hand-written struct with one
-derive:
+In v1 every ROS type is a hand-written struct with one derive. That covers
+standard interfaces such as `sensor_msgs/Temperature` and custom types from the
+robot team's package alike (§4.5):
 
 ```rust
 #[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
@@ -297,6 +373,36 @@ let mut builder = AimDbBuilder::new()
     .with_connector(ros2);
 ```
 
+**Domain ID and namespace.** These follow ROS's own layering. The domain belongs to
+the context, which is one session here. The namespace belongs to the node.
+
+```rust
+let ros2 = Ros2Connector::new("tcp/192.168.10.5:7447",
+        Ros2Node::new("cell4_gateway").namespace("/cell4"))
+    .domain_id(7)
+    .register::<Temperature>();
+
+// Shared session: the domain goes on the ROS view, since `zenoh://` has none.
+let ros2 = zenoh.ros2(Ros2Node::new("cell4_gateway").namespace("/cell4")).domain_id(7);
+```
+
+- **The domain resolves the way rcl resolves it.** An explicit `.domain_id(n)` wins.
+  Without one, the connector reads `ROS_DOMAIN_ID`, and falls back to `0` when that
+  is unset. **[checked]**: rcl reads the variable only when no domain was set
+  (`rcl/src/rcl/init.c:152`, `domain_id.c:25`), and rmw_zenoh stores one domain per
+  context (`rmw_init.cpp:66`). Reading the environment matters because the domain is
+  the first segment of every key and token. A gateway pinned to `0` while the robot
+  runs on `7` fails silently, like a wrong type hash (§3). A `ROS_DOMAIN_ID` that is
+  not an integer fails `build()`, as it fails `rcl_init`.
+- **The domain is on the connector, not on `Ros2Node`.** If several nodes per
+  session arrive later (§4.7), they cannot disagree on a domain that rmw_zenoh keeps
+  per context anyway.
+- **The namespace is set in code** or from the application's config. AimDB is not
+  started by `ros2 launch`, so `--ros-args -r __ns:=…` is not parsed. The default
+  is the root namespace. The namespace changes the node's identity (its tokens and
+  `ros2 node list`), not its topics (§4.3).
+- **The enclave** is always the default (`%` in tokens) in v1.
+
 `Ros2Connector` and `.ros2(..)` exist only with the `std` feature. On an embedded
 build, a `ros2://` link fails `build()` with core's unregistered-scheme error, and
 the connector docs point to §4.8.
@@ -311,17 +417,63 @@ from a Zenoh or rmw_zenoh config work unchanged. The native backend also accepts
 
 - The resource is the Zenoh key expression verbatim. AimDB 2.0 keeps `/` inside
   external addresses, so `zenoh://a/b/c` is `a/b/c`.
-- Outbound: one `put` per value, with whatever codec the link carries.
-- Inbound: one declared subscriber per **distinct** route topic, not per link.
-  Wildcards (`*`, `**`) are allowed. The connector's `Source` yields the
-  *subscriber's* key expression as the route topic, not the sample's key, so
-  `pump_source`'s exact-match router still works. **[verified]**: the router
-  compares by string equality, and it already fans one topic out to every
-  route that shares it (`router.rs:104`). With one subscriber per link, N
-  records sharing a key would each receive every sample N times. MQTT dedupes the same way through
-  `RouterBuilder::resource_ids()`. The route topic is the one
-  `collect_inbound_routes` resolves, so an inbound `with_topic_resolver` is
-  honoured.
+- Outbound: one `put` per value, with whatever codec the link carries. A
+  `.with_topic_writer(..)` / `.with_topic_fn(..)` link puts each value on
+  the key its writer produces (054 §4.3). The key must be a
+  valid key expression without wildcards; one that is not is skipped and
+  counted as rejected in the route's `RouteStats`.
+- Inbound: the connector builds
+  `InboundDispatch::new(db, "zenoh", &ZenohGrammar)` and declares one
+  subscriber per filter in its `subscriptions()`, then calls
+  `dispatch(sample_key, payload)` with the **sample's** key. The router
+  matches it against every route, so:
+  - Zenoh wildcards (`*` one chunk, `**` any number of chunks, anywhere)
+    work as written, and 055's captures work too:
+    `linked_from("zenoh://aimdb/{cell}/state")` with
+    `.with_match_deserializer(..)` sees `cell` and, with `.key("cell", N)`,
+    a `KeyId` per cell. rev 8's cost, that a wildcard record cannot tell
+    `cell4` from `cell5`, is gone.
+  - `subscriptions()` drops every filter another one covers (055 §5.7), so
+    `aimdb/cell4/state` beside `aimdb/*/state` declares one subscriber, and
+    a record linked to both receives each sample once per route, not once
+    per subscriber. Filters that overlap only partly (`a/*/c` and `a/b/*`)
+    both stay, and Zenoh delivers a sample matching both to each
+    subscriber. Subscriber `i`'s callback therefore dispatches only if no
+    earlier subscription matches the key, so each route still sees it once
+    (s08, tested). 055 §5.7's MQTT 5 duplicate does not occur on Zenoh.
+  - zenoh's `Session` still checks each delivered sample against every
+    subscriber's key with `intersects`, which recurses once per chunk of the
+    sample's key under a `**` that chunks follow (zenoh#2836). A filter
+    such as `aimdb/{path..}/state` is therefore exposed: one long matching
+    key aborts the process. **[verified]** on zenoh 1.10.1 with a
+    64,001-byte key and a client subscribed to `a/**/b` through a router.
+    A trailing `**` is not affected.
+  - An inbound `with_topic_resolver` is honoured: its result goes through
+    the same grammar.
+- **`ZenohGrammar`** implements `TopicGrammar` (055 §5.1). `{name}` compiles
+  to `*` and `{name..}` to `**`, at any position, since Zenoh allows `**`
+  mid-expression. A capture must be a whole chunk (`dev-{id}` is refused),
+  as MQTT's grammar requires a whole level, so a capture's value is never
+  part of a chunk; a hand-written `$*` inside a chunk is accepted as an
+  unnamed wildcard. Verbatim `@` chunks follow the Zenoh key-expression
+  rules. The subscribed filter is the canonical key expression
+  (`{a..}/{b}` subscribes `*/**`), and where a pattern is ambiguous a
+  `{name..}` capture takes as few chunks as it can. A sample whose key is
+  itself a wildcard matches no route: Zenoh delivers a `put` on `a/*` to
+  every intersecting subscriber with `a/*` as its key, and `{cell}` would
+  capture `*` and spend a key on it. The connector logs the first such
+  sample at `warn` and every one at `debug`; a count can join inbound route
+  statistics once core has them. **[verified]** on zenoh 1.10.1. Matching and `covers` are the connector's own
+  code, `no_std + alloc`, so both backends share them. Matching is linear in
+  the key and allocation-free, since keys come from remote publishers: each
+  `**` takes chunks only until the next segment fits. `zenoh-keyexpr`'s
+  `includes` and `intersects` are the test oracle (§9), and `covers` equals
+  `includes` on its corpus. **[checked]**: `zenoh-keyexpr` 1.10.1 is
+  `no_std + alloc` without its default `std` feature, but it should not
+  become the implementation: it has no captures, its `intersects` recurses
+  once per chunk under `**` (a 32,000-chunk key overflows a 2 MiB stack),
+  and its `autocanonize` panics on `a$*$*`. The backends hand Zenoh the
+  grammar's canonical `filter()`, never a pattern through `autocanonize`.
 - No tokens, no attachment, no type in the key. CDR over `zenoh://` is allowed
   (`linked_to_with(url, Cdr::<256>)`) for non-ROS consumers that want it. It will
   not reach ROS, and the docs say so.
@@ -329,32 +481,46 @@ from a Zenoh or rmw_zenoh config work unchanged. The native backend also accepts
 **`ros2://<topic>`: a ROS topic**
 
 - The resource is the fully qualified topic name without its leading slash, so
-  `ros2://cell4/temperature` is `/cell4/temperature`. v1 does not resolve relative
-  names against the node namespace. **[verified]**: `LinkAddress::parse` keeps
-  `/` and strips leading slashes, so `ros2:///cell4/temperature` is the same
-  topic.
+  `ros2://cell4/temperature` is `/cell4/temperature`. Topics are never resolved
+  against the node namespace: a node in `/cell4` linked to `ros2://temperature`
+  publishes `/temperature`. The URL could not express the difference anyway.
+  **[verified]**: `LinkAddress::parse` keeps `/` and strips leading slashes, so
+  `ros2:///cell4/temperature` is the same topic, and an absolute name cannot be
+  told from a relative one. The connector docs say this, since ROS users will
+  expect a namespace to prefix topics.
 - Direction comes from the link. `linked_to` makes AimDB a ROS publisher (`MP`
   token); `linked_from` makes it a subscriber (`MS` token). No method names the
   role. The scheme names the protocol, as `mqtt://` and `knx://` already do.
 - The payload is the type's `Linkable` encoding, which must be CDR (see the
   guarantees below).
-- At build, the connector looks up each route's `TypeId` in its registry to get
-  the ROS type name and hash. It then derives the data key, token and GID once and
-  holds them for the life of the session.
+- At build, the connector looks up each route's `TypeId` (outbound:
+  `RouteInfo::type_id`; inbound: `InboundDispatch::routes()`, §4.6) in its
+  registry to get the ROS type name and hash. It then derives the data key,
+  token and GID once per route and holds them, indexed by `RouteId`, for the
+  life of the session.
+- Inbound routes use core's `ExactGrammar`: ROS topic names have no
+  wildcards, and a `{…}` on a `ros2://` link fails the build (055 §5.3).
+  The connector subscribes the ROS data key of each distinct topic and
+  dispatches a sample under its **link** topic (`cell4/spindle_cmd`), not
+  the data key, so the router matches it. Two links on one topic with
+  different ROS types fail the build, since a ROS topic has one type.
 
 **Guarantees: every mismatch fails before the wire**
 
 | Mistake | Caught | How |
 |---|---|---|
 | `.register::<T>()` on a type that isn't a `RosMessage` | compile time | `register` is bounded on `T: RosMessage` |
-| `.register::<T>()` on a hand-implemented `RosMessage` whose `Linkable` is not CDR | `cargo build` (not `cargo check`) | `register` contains `const { assert!(matches!(T::WIRE_FORMAT, WireFormat::Cdr)) }` (§4.4). `matches!` rather than `==`, because `PartialEq` is not usable in const context. The derive always emits CDR, so derived types cannot hit this. **[verified on 1.98.0]**: a const in a generic function is evaluated at monomorphization, so the check fails `cargo build`, while `cargo check` and rust-analyzer stay silent. The binary still cannot ship with the mistake, and the docs say where it surfaces |
+| `.register::<T>()` on a hand-implemented `RosMessage` whose `Linkable` is not CDR | `build()` | `register` checks `T::WIRE_FORMAT` (§4.4), and `build()` reports the mismatch with the type's name. The derive always emits CDR, so only hand-written impls can hit this. rev 5's inline-const assert was dropped in rev 7. It fired on `cargo build` but not on `cargo check` or in rust-analyzer, and it needed a special trybuild setup, all for a rare mistake |
 | A malformed `type` or `hash` in `#[ros(..)]` | compile time | The derive validates `pkg/msg/Name` and `RIHS01_` + 64 hex |
 | A malformed type name or hash in a hand-written impl | `build()` | Checked at registration, so the error names the type |
-| A `ros2://` link on a type that was never registered | `build()` | The route's `TypeId` (from `RouteMeta`, §4.6) is missing from the registry |
-| A `ros2://` link with a non-CDR codec: `linked_to_with(url, Json)`, or `.with_link_codec(Postcard::<N>)` on the long form | `build()` | Every codec verb records its `LinkCodec::WIRE_FORMAT` in the link config (§4.4), and the connector refuses anything other than `cdr`, read from `RouteMeta::config` |
-| A `ros2://` outbound link with `.with_topic_provider(..)` | `build()` | A provider can send a value to a topic that has no precomputed key, token or GID. `finish()` records `aimdb.topic_provider` in the link config (§4.6), so the connector refuses it |
-| A topic that breaks ROS name rules | `build()` | The profile's name validator |
-| `ros2://` links with no `Ros2Connector` registered | `build()` | Core's existing refusal for a scheme no connector claims. **[verified]**: it is recorded when the link is finished (`typed_api.rs:930`) and reported by `build()`, so `with_connector` must come before `configure`, as every example here does |
+| A `ros2://` link on a type that was never registered | `build()` | The route's `TypeId` (§4.6) is missing from the registry |
+| A `ros2://` link with a non-CDR codec: `linked_to_with(url, Json)`, or `.with_link_codec(Postcard::<N>)` on the long form | `build()` | Every codec verb records its `LinkCodec::WIRE_FORMAT` in the link config (§4.4), and the connector refuses anything other than `cdr`, read from the route's `config.protocol_options` |
+| A `ros2://` outbound link with `.with_topic_writer(..)` or `.with_topic_fn(..)` | `build()` | A writer can send a value to a topic that has no precomputed key, token or GID. The connector refuses a route whose `RouteInfo::topic_capacity` is non-zero (§4.6) |
+| A `ros2://` inbound link with a `{…}` capture | `build()` | `ExactGrammar` rejects it in `InboundDispatch::new` (055 §5.3). A `*` or `**` is not a wildcard there; the name validator below refuses it |
+| Two `ros2://` links on one topic with different ROS types | `build()` | Per distinct topic, the registry lookups must agree |
+| A topic, node name or namespace that breaks ROS name rules | `build()` | The profile's name validator |
+| A `ROS_DOMAIN_ID` that is not an integer | `build()` | Parsed once at build, as `rcl_init` does (§4.2) |
+| `ros2://` links with no `Ros2Connector` registered | `build()` | Core's existing refusal for a scheme no connector claims. **[verified]**: it is recorded when the link is finished (`typed_api.rs:933` outbound, `:1288` inbound, at `eefe2c2`) and reported by `build()`, so `with_connector` must come before `configure`, as every example here does |
 
 Two gaps remain that the design cannot close.
 
@@ -363,8 +529,8 @@ Two gaps remain that the design cannot close.
    serializer, and a connector cannot inspect a closure. Such a link carries no
    recorded wire format, so the connector **warns** at `build()` rather than
    refusing it. That keeps it the documented escape hatch that voids the
-   guarantee. A `with_serializer` placed *after* a codec verb overrides the
-   serializer but keeps the recorded format, so the warning cannot see that case.
+   guarantee. The warning also covers a `with_serializer` placed *after* a codec
+   verb, because the serializer setters clear the recorded format (§4.4).
 2. **Hand-written field layout.** CDR is positional. A struct whose fields are out
    of order or wrongly typed relative to the `.msg` (`f32` for `float64`) decodes
    garbage or fails to decode at runtime. Nothing catches that at compile time in
@@ -387,8 +553,9 @@ reg.link_to("ros2://cell4/temperature")
 
 `Ros2LinkExt` pushes `ros2.depth` / `ros2.reliability` through `with_config`, the
 same way `MqttLinkExt` pushes `qos` **[verified]** (`link_ext.rs`). The same
-extension exists on inbound builders, and the connector reads it through
-`RouteMeta::config` (§4.6).
+extension exists on inbound builders. The connector parses both once per
+route at build from `config.protocol_options`, as MQTT's `PublishOpts`
+does (054 §4.4), so a malformed override fails the build.
 
 ### 4.4 Contracts: `RosMessage`, `WIRE_FORMAT` and CDR
 
@@ -426,7 +593,13 @@ pub enum WireFormat { Unspecified, Json, Postcard, Cdr }
 **`#[derive(RosMessage)]`**, in `aimdb-derive` and re-exported by
 `aimdb-data-contracts` under `ros2`, takes `#[ros(type = "pkg/msg/Name", hash = "RIHS01_…")]`
 and emits three impls, so the user writes none by hand:
-- `SchemaType`, with `NAME` set to the ROS type (`cell_msgs/msg/SpindleCommand`);
+- `SchemaType`, with `NAME` set to the ROS type (`cell_msgs/msg/SpindleCommand`).
+  Existing `NAME`s are plain identifiers such as `"temperature"`. **[verified]**
+  that its consumers treat it as an opaque string, so the slashes are harmless:
+  the WebSocket `StreamableRegistry` and the WASM schema registry key on it
+  (`registry.rs:35`, `schema_registry.rs:114`), and it is `Observable::SIGNAL`'s
+  default (`lib.rs:218`). ROS type names are globally unique, which suits the
+  WebSocket registry's refusal of two types under one name;
 - `Linkable` as CDR through `aimdb-cdr`, with `WIRE_FORMAT = Cdr`, a bounded
   `encode_into`, and `ENCODE_BUFFER_CAPACITY` (overridable with
   `#[ros(encode_capacity = N)]`);
@@ -457,6 +630,16 @@ the blessed design-045 path, not an escape hatch. Without this record,
 and no connector in the tree rejects unknown keys, so the extra entry is inert
 everywhere else.
 
+**The record follows the serializer.** Core's `with_serializer`,
+`with_serializer_into`, `with_deserializer` and `with_match_deserializer`
+remove any recorded
+`aimdb.wire_format`. The codec verbs install their serializer through those same
+setters (**[verified]** at `eefe2c2`: `linkable.rs:36`, `link_codec.rs:236`), then record the
+format. So a link carries a format exactly when a codec verb was the last to set
+its serializer. A custom serializer anywhere after it leaves no format, and the
+connector warns (§4.3). Removing the entry, rather than appending a second one,
+means no reader has to know which duplicate wins.
+
 **CDR becomes the type's default format everywhere.** An MQTT link on a
 `RosMessage` type also sends CDR unless it names another codec
 (`linked_to_with(url, Json)`, design 045). For a type that exists to mirror a ROS
@@ -470,42 +653,33 @@ opposite case: CDR on a link whose type's default is something else. It advertis
 crate behind RustDDS and `ros2-client`, is std-only **[checked]**: it imports
 `std::io` and `std::marker`. The new `aimdb-cdr` crate provides serde for XCDR1:
 - `no_std`, with `alloc` optional;
-- little-endian;
+- encodes little-endian, as rmw_zenoh does on every target AimDB ships (§3);
+- decodes both byte orders, taken from the encapsulation header (`CDR_LE` or
+  `CDR_BE`), since a big-endian ROS host sends big-endian CDR under the same
+  type. Any other representation ID is a decode error;
 - the encapsulation header;
 - alignment measured from the end of that header;
 - strings as a `u32` length that includes the NUL;
 - sequences with a `u32` count; fixed arrays without one.
 
 It is a few hundred lines, tested against golden bytes captured from
-`ros2 topic pub`. An upstream `no_std` PR to `cdr-encoding` is worth offering, but
+`ros2 topic pub`, and byte for byte against `hiroz-cdr` as a dev-dependency.
+`hiroz-cdr` itself does not fit: it needs std and `zenoh-buffers`, has no
+bounded encode path, and rejects big-endian input. An upstream `no_std` PR to `cdr-encoding` is worth offering, but
 not worth waiting for.
 
-### 4.5 Getting ROS types: prebuilt or hand-written, no codegen
-
-There are two paths, and neither runs a generator on the user's machine.
+### 4.5 Getting ROS types: hand-written, no codegen
 
-**Prebuilt: `aimdb-ros2-msgs`.** This new crate covers the interfaces plant
-integrations use most:
-- `builtin_interfaces` (`Time`, `Duration`);
-- `std_msgs` (`Header` and the primitive wrappers);
-- `sensor_msgs` (`Temperature`, `JointState`, `Imu`, `FluidPressure`, `Range`, …);
-- `geometry_msgs` (`Pose`, `Twist`, `Transform` and their stamped forms).
-
-The crate is `no_std`, CDR-only, and each type is behind a per-package feature so
-firmware links only what it uses. We produce it once per ROS distro with an
-internal script run against a real ROS install. That script lives in the AimDB
-repo's tooling, not in any published crate. A hash is derived from the interface
-definition, so it should be stable across Jazzy, Kilted and Lyrical wherever the
-interface is unchanged. CI verifies that per distro (§9) rather than assuming it. Users `cargo add` the crate and are done.
-
-**Hand-written: custom interfaces.** The robot team's own messages
-(`cell_msgs/…`) are usually few and small. The user writes the struct with
-`#[derive(RosMessage)]` (§4.4):
+In v1 there is one path, and it runs no generator. A cell usually touches a
+handful of interfaces, standard and custom, and each is a short struct. The user
+writes it with `#[derive(RosMessage)]` (§4.4):
 - **Field order** follows the `.msg` exactly. CDR is positional.
 - **Field names** should match the `.msg` too. They do not affect the wire, but they
   keep the door open for the hash check below.
 - **Constants** in the `.msg` are not on the wire and are left out.
-- **Nested types** are other `RosMessage` types, usually from `aimdb-ros2-msgs`.
+- **Nested types** are other hand-written `RosMessage` types. A stamped message
+  therefore also needs `std_msgs/Header` and `builtin_interfaces/Time`, two
+  short structs written once per project (§4.10 shows them).
 - **The hash** is copied once from the robot. `ros2 topic info -v` prints it for
   any active topic as `Topic type hash: RIHS01_…` on Jazzy, Kilted, Lyrical and
   Rolling (**[verified]**, S4 in §10). rmw_zenoh also carries it in every data key.
@@ -518,9 +692,9 @@ The type mapping, as the docs will print it:
 | `byte`, `char`, `uint8` / `int8` | `u8` / `i8` |
 | `uint16` … `int64` | `u16` … `i64` |
 | `float32` / `float64` | `f32` / `f64` |
-| `string`, `string<=N` | `String` (the bound is checked on encode) |
+| `string`, `string<=N` | `String`; a bound is `#[ros(max_len = N)]`, checked on encode (bytes) |
 | `T[N]` | `[T; N]` |
-| `T[]`, `T[<=N]` | `Vec<T>` (the bound is checked on encode) |
+| `T[]`, `T[<=N]` | `Vec<T>`; a bound is `#[ros(max_len = N)]`, checked on encode (elements) |
 | `pkg/Type` | a `RosMessage` struct |
 | `wstring` | unsupported in v1 |
 
@@ -532,64 +706,85 @@ pasted one, a wrong field order, a wrong type or a stale hash all become compile
 errors. That closes both gaps from §4.3. It is deferred until usage shows it is
 needed.
 
-### 4.6 Changes to core (all additive)
-
-The connector needs three facts per route that core's route accessors do not
-give it today:
-- the record's `TypeId`, for the registry lookup;
-- the inbound link config, for QoS overrides and the recorded wire format;
-- whether an outbound link has a topic provider.
-
-**[verified]**: `RecordEntry` already stores `type_id` (`builder.rs:51`).
-`collect_inbound_routes(scheme)` returns `Vec<(String, IngestFn)>` and drops
-`InboundConnectorLink::config` (`builder.rs:1174`). Outbound routes carry
-`config` but no type.
-
-**Not a new field on `OutboundRoute`.** It is a public struct with all-public
-fields and no `#[non_exhaustive]` (`builder.rs:38`), in a crate released as
-2.0.0. Core itself destructures it exhaustively (`session/pump.rs:44`,
-`session/client.rs:865`), and so may any third-party connector. A new field
-there is a semver break. The same holds for `ConnectorLink` (`connector.rs:453`).
-
-The additions instead:
-
-1. **A new route-metadata struct.**
+**Later phase: a prebuilt `aimdb-ros2-msgs`.** A crate of the common interfaces
+(`builtin_interfaces`, `std_msgs`, `sensor_msgs`, `geometry_msgs`) would spare
+users the hand-written standard types. It is postponed because it brings its own
+upkeep: an internal generation script run against a real ROS install, per-package
+features, and a CI job in a ROS image that checks every shipped type's hash and
+decoding per distro. That is worth doing once v1 shows which interfaces users
+actually hand-write. Nothing in v1 has to change for it: the crate would contain
+only `#[derive(RosMessage)]` types.
+
+**Follow-up: hiroz's messages.** `hiroz-msgs` already ships the common interfaces,
+generated from `.msg` files. A std-only `hiroz` feature on the connector could
+wrap them in a `HirozMsg<T>` that implements `Linkable` and `RosMessage`. That
+may replace `aimdb-ros2-msgs`, and it keeps hiroz out of `aimdb-data-contracts`.
+
+### 4.6 Changes to core
+
+The connector needs two facts per route that 054's connector interface does
+not give it:
+- the record's `TypeId`, for the registry lookup, in both directions;
+- the inbound link's config, for QoS overrides and the recorded wire format.
+
+**[verified]** at `eefe2c2`: `RecordEntry` stores `type_id`
+(`builder.rs:40`). `OutboundRoutes::routes()` returns one `RouteInfo` per
+link with `config` (every option the core does not lift, in
+`protocol_options`) and `record_index`, but no type
+(`outbound/routes.rs:18`). `InboundDispatch` exposes `subscriptions()` and
+`route_count()` only (`inbound_dispatch.rs:18`), so an inbound link's config
+and type are out of reach.
+
+rev 8 added `RouteMeta` and two `_with_meta` accessors beside
+`collect_inbound_routes` and `collect_outbound_routes`, to stay additive on
+2.x. 054 and 055 removed those route lists, and no release has shipped
+since 2.0.0, so the next release breaks the connector interface anyway.
+The facts go where connectors now read routes:
+
+1. **`RouteInfo` gains `type_id: TypeId`**, filled in `OutboundRoutes::new`
+   from the record the link belongs to. One field on a struct 054
+   introduced; MQTT's `PublishOpts` tests, which build `RouteInfo` by hand,
+   add it.
+
+2. **`InboundDispatch::routes() -> &[InboundRouteInfo]`**, one per inbound
+   link, in the order the router holds them:
 
    ```rust
    #[non_exhaustive]
-   pub struct RouteMeta {
-       pub topic: String,
+   pub struct InboundRouteInfo {
+       /// The resolved topic or pattern (after `with_topic_resolver`).
+       pub topic: Arc<str>,
+       /// `TypeId` of the record the link belongs to.
        pub type_id: TypeId,
-       pub config: Vec<(String, String)>,
+       /// The link's configuration, with `record_index` set, as on `RouteInfo`.
+       pub config: ConnectorConfig,
    }
    ```
 
-2. **Two new accessors** that pair each route with its `RouteMeta`:
-   - `collect_outbound_routes_with_meta(scheme) -> Vec<(OutboundRoute, RouteMeta)>`;
-   - `collect_inbound_routes_with_meta(scheme) -> Vec<(IngestFn, RouteMeta)>`.
-
-   The existing `collect_*_routes` are left in place and delegate to them. The
-   `#[non_exhaustive]` on `RouteMeta` means later facts need no third accessor.
-
-3. **A reserved config key for topic providers.** `OutboundConnectorBuilder::finish`
-   appends `("aimdb.topic_provider", "true")` when `.with_topic_provider(..)` was
-   called. The provider itself is fused into the route's source at `finish()`
-   (`typed_api.rs:979`), so nothing else downstream can see it. This rides the
-   existing `with_config` vector, so no struct changes. The per-link wire format
-   from §4.4 uses the same mechanism under `aimdb.wire_format`. Both keys live
-   in the `aimdb.` namespace, which connectors must not use for their own options.
-
-`Ros2Connector` therefore does not use core's `pump_sink` / `pump_source`,
-because those call the old accessors. It drives its own pumps over the `_with_meta`
-accessors, which is also what lets it carry a route index instead of a topic
-`String` (§7). `ZenohConnector` for plain `zenoh://` uses the new accessors too,
-for the recorded wire format and for inbound de-duplication (§4.3).
-
-**Side note, confirmed:** inbound `with_qos` is a blind spot on **both** MQTT
-backends today. The native backend subscribes at a hard-coded `AtLeastOnce`
-(`native.rs:188`). The embedded `warn_unsupported_qos` reads outbound routes
-only (`embedded/mod.rs:572`). The inbound accessor makes the fix possible; the
-fix itself is a separate MQTT change.
+   Built once in `InboundDispatch::new`, beside the compiled routes; nothing
+   on the per-message path reads it. It also gives MQTT the inbound
+   options it would need to honour `with_qos` on subscriptions (055 §5.7
+   leaves that unapplied); that is a separate change.
+
+3. **The reserved `aimdb.wire_format` key** (§4.4) stays in the link
+   config. `with_serializer`, `with_serializer_into`, `with_deserializer`
+   and `with_match_deserializer` remove it. Keys prefixed `aimdb.` are
+   reserved; connectors must not use them for their own options.
+   **Implemented.**
+
+No topic-writer key. rev 8 recorded `aimdb.topic_provider` because the
+provider was fused into the route's source and invisible downstream. 054
+moved the topic writer into `OutboundRoutes`, and
+`RouteInfo::topic_capacity` is non-zero exactly when a link has one, so the
+`ros2://` refusal (§4.3) reads that. The `TOPIC_WRITER_KEY` that the merge
+of `main` carried over is removed in step 4 (§11).
+
+Both connectors follow 054 §4.4: `build()` creates their `OutboundRoutes`
+and `InboundDispatch`, parses per-route options once, and returns the
+session task, which pulls and dispatches. Neither drives a pump. Per-route
+state (ROS data key, attachment sequence number, GID, precomputed token)
+lives in the connector's own tables, indexed by `RouteId`, the way MQTT
+indexes `PublishOpts`.
 
 ### 4.7 One session, two schemes
 
@@ -601,23 +796,33 @@ two `ConnectorBuilder`s that can hold the same `Arc<Shared>`:
 - `zenoh.ros2(node)` clones the handle of an existing `ZenohConnector`, so both
   schemes ride one session.
 
-- **Whichever builds first drives the session.** `Shared` holds a one-shot
-  (core's `session::OneShot`, design 052 §5.5) for the session task. The first
-  `build()` to run takes it and returns the session future, along with its own
-  pump futures. The second `build()` returns only its pumps. So either connector
-  works alone, and registration order does not matter.
-- **Declarations are complete before the first connect.** `AimDbBuilder` calls
-  every `build()` before `AimDbRunner::run()` polls anything. Both connectors
-  therefore record their subscribers, tokens and publishers in `Shared` before the
-  session connects. After a reconnect the session re-declares everything, since
-  the router withdraws tokens when a session drops.
+- **Each `build()` deposits its parts.** A connector's `build()` creates its
+  `OutboundRoutes` and `InboundDispatch` for its own scheme (054 §4.4),
+  validates and precomputes its per-route tables, and moves all of it into
+  its slot in `Shared`: a build-time `Mutex<Option<_>>` (`std` or `spin`,
+  as in core), never locked per message.
+- **Whichever builds first returns the session task.** `Shared` holds a
+  flag for it. The first `build()` to run sets it and returns the session
+  future; the second returns no futures. So either connector works alone,
+  and registration order does not matter (s11: one TCP connection in both
+  orders, counted through a proxy).
+- **The session task collects every slot before it connects.**
+  `AimDbBuilder` calls every `build()` before `AimDbRunner::run()` polls
+  anything, so on its first poll the task takes both connectors' parts. A
+  view created with `.ros2(..)` but never registered leaves its slot empty;
+  the task logs that once and runs without it. After a reconnect the task
+  re-declares every subscriber, publisher and token, since the router
+  withdraws tokens when a session drops.
 - **Each connector owns its scheme** (`owns_scheme() = true`). Registering two
   `ZenohConnector`s, or two views of different sessions, under one scheme is
   refused at build, as it is for MQTT.
-- **One channel pair per session.** Both connectors' pumps feed the same action
-  channel and read from the same event channel. These are `embassy_sync` channels
-  with `CriticalSectionRawMutex` on both backends, so `Shared` is `Send + Sync`
-  without `unsafe`, and the same code carries over to the MCU in v2.
+- **No channels.** The session task pulls from both `OutboundRoutes`, one
+  `poll_stage` arm each, and puts each message on its key (054 §4.2). Each
+  inbound sample is dispatched synchronously from the subscriber callback
+  into the `InboundDispatch` whose `subscriptions()` the filter came from.
+  rev 8's action and event channels, and their per-message copy, are gone.
+  `Shared` stays `Send + Sync` without `unsafe`, and the same code carries
+  over to the MCU in v2.
 - **Refused:** `.ros2(..)` twice on one session. There is one ROS node per session
   in v1. Several nodes on one session is a later extension if a use case needs it.
 
@@ -693,7 +898,8 @@ computer. It is deferred until these three are true:
 
 Nothing in v1 has to be redone for v2:
 - the profile module is already `no_std + alloc` (§4.1);
-- `Shared` already uses MCU-safe channels (§4.7);
+- `Shared` holds only build-time slots and the session one-shot, with no
+  `unsafe` (§4.7);
 - `Ros2Connector` gains a `.transport(dialer)` path, the way `ZenohConnector`
   already has one.
 
@@ -711,12 +917,24 @@ at implementation time.
 use aimdb_core::{buffer::BufferCfg, AimDbBuilder};
 use aimdb_data_contracts::{link_codecs::Json, LinkCodecRegistrarExt, LinkableRegistrarExt, RosMessage};
 use aimdb_mqtt_connector::MqttConnector;
-use aimdb_ros2_msgs::{builtin_interfaces::Time, sensor_msgs::Temperature, std_msgs::Header};
 use aimdb_tokio_adapter::{TokioAdapter, TokioRecordRegistrarExt};
 use aimdb_zenoh_connector::{Ros2Connector, Ros2Node};
 use serde::{Deserialize, Serialize};
 use std::sync::Arc;
 
+// Standard interfaces, mirrored by hand like any other (§4.5).
+#[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+#[ros(type = "builtin_interfaces/msg/Time", hash = "RIHS01_<…>")]
+pub struct Time { pub sec: i32, pub nanosec: u32 }
+
+#[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+#[ros(type = "std_msgs/msg/Header", hash = "RIHS01_<…>")]
+pub struct Header { pub stamp: Time, pub frame_id: String }
+
+#[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
+#[ros(type = "sensor_msgs/msg/Temperature", hash = "RIHS01_<…>")]
+pub struct Temperature { pub header: Header, pub temperature: f64, pub variance: f64 }
+
 /// Mirrored by hand from cell_msgs/msg/SpindleCommand.msg (§4.5).
 #[derive(Clone, Debug, Serialize, Deserialize, RosMessage)]
 #[ros(type = "cell_msgs/msg/SpindleCommand", hash = "RIHS01_<from `ros2 topic info -v`>")]
@@ -808,21 +1026,56 @@ The last command logs `spindle: 1200 rpm, enabled=true` in the gateway.
 - **[verified]** `session.liveliness().declare_token(..)` and the put
   builder's `.attachment(..)` exist in `zenoh` 1.8.0 (`api/liveliness.rs:114`,
   `api/builders/sample.rs:56`).
+- **Session.** The session task opens the session, retrying with a back-off
+  from 1 s to 30 s while no router answers (client mode gives up at once
+  otherwise). From then on Zenoh reconnects and re-declares subscribers,
+  publishers and tokens itself. Every fixed outbound key is validated at
+  `build()` and declared as a publisher; a key written by a topic writer is
+  checked per message and put through the session.
+- **Remote only.** Subscribers set `allowed_origin(Locality::Remote)` and
+  every publication `allowed_destination(Locality::Remote)`. Zenoh's default,
+  `Any`, delivers a `put` to the same session's subscribers: a record linked
+  to and from one key then ingested its own publications in a loop, and an
+  inbound link saw the database's own writes. Two records of one database
+  therefore cannot exchange values through a Zenoh key; a transform does that.
+- **Deletes are ignored.** A remote `delete()` arrives as an empty sample; a
+  record has nothing to remove, so the callback drops it instead of handing
+  the deserializer zero bytes.
+- **Data path.** The session task pulls with `OutboundRoutes::next()` and
+  calls `put`, whose payload is an owned `ZBytes`: an `Owned` payload moves
+  in, a `Borrowed` one is copied, as in MQTT's native backend (054 §4.7). A
+  ROS publisher's attachment is encoded into a stack array per message.
+  Subscribers are declared with a callback that calls
+  `InboundDispatch::dispatch(sample_key, payload)` on Zenoh's own thread;
+  `dispatch` is synchronous and never blocks (054 §4.1). A payload that
+  arrives in several fragments is made contiguous first, which allocates;
+  a contiguous one is borrowed.
 - Publisher options mirror rmw_zenoh's (`rmw_publisher_data.cpp:942`):
-  - Zenoh `reliability` follows the QoS reliability.
   - Congestion control is `DROP`, or `BLOCK` for `RELIABLE` with `KEEP_ALL`.
-- Pin a zenoh release that is wire-compatible with the router rmw_zenoh vendors:
-  zenoh-c 1.8.0 in Jazzy, Kilted and Lyrical, and 1.10.1 in Rolling (§3). The
-  latest `zenoh` on crates.io is 1.10.1. Zenoh promises 1.x wire
-  compatibility, and the interop test must prove it for both routers
-  (**[spike S2]**).
+    v1 exposes no `KEEP_ALL`, so it is always `DROP`.
+  - Zenoh `reliability` does **not** follow the QoS reliability in v1: the
+    publisher builder's `reliability()` is `#[unstable]` in zenoh 1.10.1
+    **[checked]**. A `BEST_EFFORT` link advertises it in its token and
+    travels on Zenoh's default reliable path, which no subscriber refuses
+    (§6). Revisit when the API is stable.
+- **Verified live (s09)** against Jazzy's and Lyrical's `rmw_zenohd`: a
+  `ros2://` publisher from `Ros2Connector` shows in `ros2 node list` with its
+  namespace, `ros2 topic info -v` shows its type, hash, QoS and GID, and
+  `ros2 topic echo` decodes its values (`examples/ros2_talker.rs`).
+  **Verified live (s10)** the other way: `ros2 topic info -v` lists a
+  `ros2://` subscription with its node, type hash and depth, and every
+  message of `ros2 topic pub` reaches the record (`examples/ros2_listener.rs`).
+- Pin `zenoh` 1.10.1, the latest on crates.io. **[verified]** (S2, §10) that
+  it is wire-compatible with the 1.8.0 router in Lyrical and Rolling and with
+  a 1.10.1 router. The interop test (§9) keeps proving it.
 - Cost: a large dependency tree, kept behind the `std` feature and never reachable
   from `embedded`. The same CI guard pattern as design 041's `rand` tracer applies.
 
 ### 5.2 Embedded (`no_std + alloc`): `zenoh-nostd`
 
 `zenoh-nostd` itself is `no_std` and allocation-free. The connector needs `alloc`
-for route tables and payload handoff, like every AimDB connector. In v1 this
+for its build-time state (route tables, leaked subscriber keys), like every
+AimDB connector. In v1 this
 backend serves `zenoh://` only (§4.8, §4.9).
 
 **Transport.** zenoh-nostd abstracts I/O behind `ZLinkManager::connect(Endpoint)`
@@ -850,12 +1103,21 @@ borrows the dialer.
 The backend is therefore generic over any 052 dialer: `EmbassyNet::tcp` today,
 `TokioNet::tcp()` for host tests, and a FreeRTOS `LwipNet` later.
 
-**Task shape.** There is one session future:
+**Task shape.** There is one session future, holding the parts every
+connector deposited (§4.7):
 1. Connect.
-2. Declare the subscribers recorded in `Shared` (§4.7).
-3. `select(session.run(), drain_actions)`, where `drain_actions` turns queued
-   publishes into `put`.
-4. On error, back off through `Delay`, reconnect and re-declare.
+2. Declare one subscriber per filter of each `InboundDispatch::subscriptions()`.
+   The callback dispatches into that connector's `InboundDispatch`.
+3. `select(session.run(), poll_stage arms)`: one `poll_stage` arm per
+   `OutboundRoutes`, each disarmed after `Ready(None)` (054 §4.4). The
+   staged message is taken with `take_staged` after the `select` returns
+   and `put` from the borrowed payload, so it is never copied into a queue.
+   `session.run()` stays pinned across iterations, so a `put` is awaited
+   while `run` is pending; both borrow the session. **[verified]** (S6, §10):
+   a `put` completes without `run` being polled.
+4. On error, back off through `Delay`, reconnect and re-declare. Values
+   produced meanwhile wait in their record buffers, so what is sent after
+   the reconnect depends on each record's buffer type (054 §4.6).
 
 **`Resources` is per connection, not leaked once.** `session_connect` takes
 `&'res mut Resources<'res, Config>` (`api/session.rs:84`). That borrows the value
@@ -868,9 +1130,9 @@ once at build, so nothing is leaked. With an array `Buff`, a reconnect costs no
 heap allocation. With a `Vec` `Buff`, it costs one per connect.
 
 **Subscriber keys must be `'static`.** `declare_subscriber` takes
-`&'static keyexpr` (`api/session/sub.rs:226`). The connector leaks each distinct
-inbound key once at build with `Box::leak`, as the MQTT embedded backend already
-leaks its build-time strings (`embedded/mod.rs:373`), and re-declares the same
+`&'static keyexpr` (`api/session/sub.rs:226`). The connector leaks each filter
+of `subscriptions()` once at build with `Box::leak`, as the MQTT embedded backend already
+leaks its build-time strings (`embedded/mod.rs:327` at `eefe2c2`), and re-declares the same
 keys after every reconnect. `put` takes a borrowed key, so outbound needs no leak.
 
 **What upstream constrains** (**[checked]** at `main` e88f73a, tag 0.2.0, and
@@ -878,9 +1140,9 @@ branch `dev/0.3.0`):
 
 | Finding | Consequence | Plan |
 |---|---|---|
-| Not on crates.io (`zenoh-nostd`, `zenoh-proto` and `zenoh-sansio` all 404); git tag `0.2.0` = `main` @ `e88f73a`, whose workspace `Cargo.toml` still says `0.1.0`; no commits on `main` since 2026-06-26; `dev/0.3.0` is 31 commits and roughly +9.5k lines ahead | A published AimDB crate cannot take a git dependency. **Blocks v1** | Ask upstream to publish. Meanwhile, do what `aimdb-mountain-mqtt` did: publish a zero-delta fork `aimdb-zenoh-nostd` pinned to a tag, and retire it when upstream releases |
+| Not on crates.io (`zenoh-nostd`, `zenoh-proto` and `zenoh-sansio` all 404); git tag `0.2.0` = `main` @ `e88f73a`, whose workspace `Cargo.toml` still says `0.1.0`; no commits on `main` since 2026-06-26; `dev/0.3.0` is 31 commits and roughly +9.5k lines ahead | A published AimDB crate cannot take a git dependency. **Blocks v1's embedded backend** | Ask upstream to publish, and wait for that release (Q7): no fork |
 | No liveliness-token API on `main` or `dev/0.3.0`. `DeclareToken`/`UndeclareToken` exist in `zenoh-proto` only (`msgs/declare.rs:27`) | An MCU cannot announce itself to the ROS graph. **Blocks v2 only** (§4.9) | A small upstream PR: `session.liveliness().declare_token(ke)`, modelled on `put`. Off the v1 critical path |
-| The session future is `!Send` for three separate reasons, **[verified]** with an `assert_send` probe: <ul><li>session and driver state sit behind `embassy_sync` `NoopRawMutex` (`api/session.rs:59`, `io/driver.rs:22`);</li><li>the link and transport traits return `impl Future` / `impl Iterator` with no `+ Send`, for example `ZTransportLinkRx::recv` (`io/transport/traits.rs:63`);</li><li>stored callbacks are `dyn ZDynCallback` without `+ Send`.</li></ul> | The session future is `!Send`, so the runner cannot box it without force-`Send` | Short term, use `aimdb-embassy-adapter::connectors::into_box_future`. That keeps the connector crate free of `unsafe`, but it makes `embedded` Embassy-bound for now: force-`Send` is sound only on a single-core cooperative executor. **[verified]** MQTT is not quite the precedent. It uses `into_box_future` only for its SNTP task (`embedded/mod.rs:533`). Its session tasks go through the connector's own `unsafe { SendSession::new(..) }` (`embedded/session.rs:21`, plus `AssertSend` in `tls.rs:189`). That is sound for MQTT, whose streams really are `Send`, and it keeps MQTT's backend runtime-neutral. It would not be sound over zenoh-nostd's `NoopRawMutex` state, and it breaks criterion 7. Upstream, all three have to change before the backend becomes runtime-neutral: `CriticalSectionRawMutex`, `+ Send` on every return-position `impl Trait` in the link and transport traits (052 §5.1's rule), and `+ Send` on the callback objects. A mutex swap alone is not enough |
+| The session future is `!Send` for three separate reasons, **[verified]** with an `assert_send` probe: <ul><li>session and driver state sit behind `embassy_sync` `NoopRawMutex` (`api/session.rs:59`, `io/driver.rs:22`);</li><li>the link and transport traits return `impl Future` / `impl Iterator` with no `+ Send`, for example `ZTransportLinkRx::recv` (`io/transport/traits.rs:63`);</li><li>stored callbacks are `dyn ZDynCallback` without `+ Send`.</li></ul> | The session future is `!Send`, so the runner cannot box it without force-`Send` | Short term, use `aimdb-embassy-adapter::connectors::into_box_future`. That keeps the connector crate free of `unsafe`, but it makes `embedded` Embassy-bound for now: force-`Send` is sound only on a single-core cooperative executor. **[verified]** MQTT is not quite the precedent. It uses `into_box_future` only for its SNTP task (`embedded/mod.rs:491` at `eefe2c2`). Its session tasks go through the connector's own `unsafe { SendSession::new(..) }` (`embedded/session.rs:21`, plus `AssertSend` in `tls.rs:187`). That is sound for MQTT, whose streams really are `Send`, and it keeps MQTT's backend runtime-neutral. It would not be sound over zenoh-nostd's `NoopRawMutex` state, and it breaks criterion 7. Upstream, all three have to change before the backend becomes runtime-neutral: `CriticalSectionRawMutex`, `+ Send` on every return-position `impl Trait` in the link and transport traits (052 §5.1's rule), and `+ Send` on the callback objects. A mutex swap alone is not enough |
 | Uses `embassy-time` directly (`Timer`, `Instant`) | Every target needs an `embassy-time` driver. Host tests need one too, which the MQTT tests already supply | Accept. A FreeRTOS adapter must ship a driver |
 | `embassy-sync` 0.7.2, while the workspace is patched to 0.8.0 | Two copies in the firmware image | Measure flash; offer upstream a version bump |
 | `Interest` not implemented on `main`: the publisher's interest is a `TODO` (`api/session/pub.rs:98`). Publisher interest is declared on `dev/0.3.0` (`pub.rs:125`). Tracked upstream as issue #10 (open) | The client sends every put to the router whether or not anyone subscribes. That costs bandwidth, not correctness | Whether the router accepts token declarations without it matters for v2 only: **[spike S1]** |
@@ -922,8 +1184,9 @@ subscriber **[checked]**. The advertised QoS in a token is therefore information
 default-constructed `rclcpp` publisher. rmw_zenoh's own default depth is 42, so
 the token's QoS field is `::,10:,:,:,,` (§3), not all-empty. rev 4 derived
 the default from the record's buffer instead. That was dropped because
-**[verified]** routes carry no buffer config: `OutboundRoute`, `RouteMeta`
-(§4.6) and the router know nothing about the record behind them. Adding the
+**[verified]** routes carry no buffer config: `RouteInfo`,
+`InboundRouteInfo` (§4.6) and the router know nothing about the buffer
+behind them. Adding the
 buffer config would mean a third core fact whose only use is an informational
 string.
 
@@ -938,20 +1201,20 @@ with `Ros2LinkExt` (§4.3):
 | Reliability | `RELIABLE` by default; `BEST_EFFORT` as an override | rmw_zenoh maps it to the Zenoh publisher's `reliability` (§5.1). A best-effort publication only travels over a best-effort link, such as UDP, if the session has one configured |
 
 If the buffer-derived default is still wanted later, it is one more field
-on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
+on `RouteInfo` and `InboundRouteInfo`.
 
 ## 7. Cost on the MCU (to measure, not assumed)
 
-- **Outbound, per message:** a codec with `ENCODE_BUFFER_CAPACITY` set (Postcard,
-  or CDR for `RosMessage` types) encodes into 045's reusable scratch, with no
-  allocation. The handoff to the session task copies the payload into the action
-  channel, which is one allocation, the same as the MQTT embedded backend today.
-  Carrying a route index instead of a topic `String` removes a second allocation
-  MQTT still pays. That is possible only because the connector drives its own
-  pumps over the `_with_meta` accessors (§4.6). **[verified]** core's `pump_sink`
-  hands a connector `destination: &str` (`session/pump.rs:40`), and MQTT's
-  action carries it as an owned `String` (`embedded/mod.rs:82`).
-- **Inbound, per message:** one `Payload` allocation, as in MQTT.
+- **Outbound, per message:** none on the connector's side. A codec with
+  `ENCODE_BUFFER_CAPACITY` set (Postcard, or CDR for `RosMessage` types)
+  serializes into `OutboundRoutes`' scratch (054 §4.2), and the session task
+  `put`s the borrowed bytes; no action channel, no owned topic. rev 8's two
+  allocations (payload handoff and topic `String`) are gone with the pumps.
+  Whether zenoh-nostd's `put` itself allocates is measured, not assumed.
+- **Inbound, per message:** none on AimDB's side for exact and pattern
+  routes and known keys (055 §3.1, 054 §1), provided zenoh-nostd's `Sample`
+  lends its key and payload from the receive buffer. That is not checked;
+  criterion 12 measures it.
 - **Shared state:** allocated once at build.
 - **Nothing ROS-specific** in v1: no tokens, no attachment, no registry and no
   wall clock on the MCU (§4.8).
@@ -978,8 +1241,8 @@ on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
 - **A `.msg` codegen importer** (rev 2). It gets field layout and hashes right
   mechanically, but it adds a tool, vendored inputs, provenance files and a
   drift-check CI job to every user's repo. That is a lot of ceremony for the
-  handful of custom messages a cell usually has. The prebuilt crate covers the
-  common types, and the derive covers the rest. The derive's future hash check
+  handful of messages a cell usually has. The derive covers all of them in v1,
+  and a prebuilt crate for the common ones can follow (§4.5). The derive's future hash check
   (§4.5) recovers most of codegen's safety without any of its workflow.
 - **`ros2://` on the MCU in v1** (rev 1–3). It would make the MCU a ROS node
   directly, but it put three open upstream items on the critical path:
@@ -993,6 +1256,15 @@ on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
 - **Plain Zenoh only, and let users run `zenoh-bridge-ros2dds`.** This works with
   DDS robots, but AimDB entities stay invisible to the ROS graph and every user maps
   types and keys by hand.
+- **Building on hiroz** (`ZettaScaleLabs/hiroz`), either by adopting its
+  message traits or by running the std side on its node API. Its traits live in
+  std crates that depend on `zenoh`, its CDR traits have no bounded encode path,
+  and it is at 0.2. `RosMessage` has to stay in the `no_std` contracts crate,
+  under that crate's own semver. The type identity already matches: hiroz's `type_name()` is
+  our `ROS_TYPE_NAME`, and both carry the RIHS01 hash. So v1 uses hiroz as a
+  test oracle (§9). Its `hiroz-schema` computes RIHS01 hashes and is the
+  starting point for §4.5's hash check. A std backend built on hiroz, which
+  would bring services, actions and `TRANSIENT_LOCAL`, is a v2 question.
 - **micro-ROS.** An XRCE agent and a C stack. Not our architecture.
 - **An `rmw_aimdb` plugin.** A huge C surface that would make AimDB ROS middleware
   instead of the typed layer beside it.
@@ -1001,11 +1273,20 @@ on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
 
 1. **Golden profile tests.** Data keys, node and entity tokens, QoS strings and
    GIDs are byte-equal to values captured from a real rmw_zenoh on Jazzy and Lyrical
-   (`ros2 topic info -v`, and the router's admin space for tokens).
+   (`ros2 topic info -v`, and the router's admin space for tokens). The captures
+   include a non-zero domain and a namespaced node. **Met (s07)** with
+   captures taken by a `zenoh` client on the router (tokens by liveliness
+   query, keys and attachments by a `**` subscriber). `hiroz-protocol` is not
+   used: its QoS encoding writes depth 42, which rmw_zenoh leaves empty, and
+   drops the depth for keep-all, which rmw_zenoh keeps (`::2,10:…`).
 2. **Interop CI (native).** In Docker (`ros:lyrical` plus rmw_zenoh), a `ros2://`
    outbound link arrives in `ros2 topic echo` with correct values.
    `ros2 topic info -v` lists the publisher with the right node, type, QoS and GID.
    In the reverse direction, `ros2 topic pub` lands in a `ros2://` inbound record.
+   **Met (s12):** the `ros2-interop` CI job runs
+   `aimdb-zenoh-connector/tests/interop/ros2_interop.sh` on Jazzy and Lyrical
+   (`make ros2-interop DISTRO=…` locally). The GIDs themselves are checked
+   against captured attachments in s07 and against our own tokens in s09.
 3. **Gateway interop CI (embedded backend, on host).** The embedded backend over
    `TokioNet::tcp()` publishes on `zenoh://`. A native gateway in the same test
    re-publishes it on `ros2://` (§4.8), and it arrives in `ros2 topic echo`. The
@@ -1023,7 +1304,9 @@ on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
    `cargo check -p aimdb-zenoh-connector --no-default-features --features embedded --target thumbv7em-none-eabihf`
    passes. Flash and RAM are recorded against the MQTT embedded build.
 6. **`aimdb-cdr`.** Round-trip and golden-byte tests pass for primitives, strings,
-   sequences, fixed arrays and nested types. A fuzzed decode never panics.
+   sequences, fixed arrays and nested types, and big-endian golden bytes decode to
+   the same values. Little-endian output equals `hiroz-cdr`'s. A fuzzed decode
+   never panics.
 7. **No `unsafe` in the connector.** The connector crate has no `unsafe impl` (052
    criterion 2). Until zenoh-nostd is `Send`-clean, the only force-`Send` is the
    adapter's `into_box_future`. The MQTT connector does not meet that criterion
@@ -1035,39 +1318,60 @@ on the `#[non_exhaustive]` `RouteMeta`, with no new accessor.
    unregistered-scheme error.
 9. **Refusals.** Every row of §4.3's guarantee table has a test:
    - The two compile-time rows are `trybuild` UI tests.
-   - The `WIRE_FORMAT` row is a `trybuild` test too, but its batch must also
-     contain a `pass` case. trybuild runs `cargo check` otherwise (1.0.121,
-     `cargo.rs:97`), and `cargo check` never evaluates the const (§4.3).
-   - The six build-time rows assert the `build()` error.
-   - The custom-serializer gap has a test asserting the warning.
+   - Every build-time row asserts the `build()` error.
+   - The domain's precedence (explicit, then `ROS_DOMAIN_ID`, then `0`) has a test
+     per step.
+   - The custom-serializer gap has a test asserting the warning, both alone and
+     with `with_serializer` placed after a codec verb.
 
    A *wrong* but well-formed hash is covered by a test that documents it as
    silence, so nobody mistakes that behaviour for a connector bug.
-10. **`aimdb-ros2-msgs` matches ROS.** A CI job in a ROS image checks every shipped
-    type, for each supported distro (Jazzy, Kilted, Lyrical), in two ways:
-    - its hash equals the one ROS reports;
-    - a message published with `ros2 topic pub` decodes into the Rust type with
-      the expected values, and the reverse direction round-trips.
-11. **The derive.** `trybuild` tests cover malformed `type` and `hash` attributes,
+10. **The derive.** `trybuild` tests cover malformed `type` and `hash` attributes,
     and golden tests cover the DDS-name mangling and every row of §4.5's mapping
     table.
+11. **`ZenohGrammar`.** `matches` and `covers` agree with `zenoh-keyexpr`'s
+    `intersects` and `includes` on a generated corpus of key expressions
+    with `*`, `**` (first, middle and last), `$*` and `@` chunks. Captures
+    land on the right chunks, `{name..}` matches zero chunks, and a pattern
+    record keyed by a capture assigns one `KeyId` per publisher. Covered
+    filters are dropped from `subscriptions()`, and a record linked to a
+    covered and a covering filter receives each sample once per route.
+12. **Allocations.** `b0_alloc_connector` gains Zenoh rows on the host,
+    with the embedded backend over `TokioNet::tcp()`: outbound with a
+    bounded codec, and inbound exact, pattern and known key, each 0
+    allocations per message on AimDB's side (§7).
 
 ## 10. Open questions
 
-rev 6 answered S3, S4 and S5 from source and offline runs. The two-day spike
-(§11 step 1) now has to answer **S2 only** for v1. S1 matters only for v2.
+rev 6 answered S3, S4 and S5 from source and offline runs. The spike (§11
+step 1, rev 10) answered S2 and S6, and confirmed S3 and S4 live. Only S1
+remains, and it matters for v2 only.
 
 - **S1 (v2).** Does `rmw_zenohd` accept `DeclareToken` from a zenoh-nostd client
   on `main`, without Interest? Does the node then appear in `ros2 node list`?
-- **S2.** Is zenoh-nostd 0.2 wire-compatible with the zenoh-c 1.8 router, and is the
-  pinned `zenoh` crate? It also has to be checked against Rolling's 1.10.1
-  router (§3).
+- **S2. Answered (rev 10): yes.** Tested on the host, against Lyrical's and
+  Rolling's `rmw_zenohd` (both zenoh-c 1.8.0, §3) and Eclipse's `zenohd`
+  1.10.1:
+  - **`zenoh` 1.10.1 as a ROS node, through all three routers.** A
+    hand-built node token, publisher token and `put` with the attachment:
+    `ros2 node list` shows the node; `ros2 topic info -v` shows its type,
+    hash, QoS and the GID we computed, byte for byte; `ros2 topic echo`
+    decodes the CDR payload. In reverse, `ros2 topic pub` reaches our
+    subscriber with a valid attachment.
+  - **zenoh-nostd 0.2.0 (`e88f73a`) with its std platform.** Its `put` reaches
+    a `zenoh` 1.10.1 subscriber through the 1.8.0 and the 1.10.1 router, and
+    its subscriber receives every `put` from the `zenoh` crate through both.
+    Two zenoh-nostd sessions also reach each other through the 1.8.0 router.
+- **S3** and **S4** were also confirmed live: see §3's captures, and the hash
+  that `ros2 topic info -v` printed above.
 - **S3. Answered: yes.** rmw_zenoh's `simplified_xxhash3.cpp`, compiled
   unchanged, and `xxhash-rust` 0.8.18's `xxh3_128` give identical
   `(low64, high64)` for 603 inputs. Those cover every length from 0 to 600
   bytes, which spans all of XXH3's size classes, plus realistic node and
   publisher tokens. A GID read from a live `ros2 topic info -v` stays in
-  criterion 1 as the end-to-end check.
+  criterion 1 as the end-to-end check. The profile uses `twox-hash` (MIT)
+  instead: `xxhash-rust` is BSL-1.0, which `deny.toml` does not allow. Its
+  GIDs equal the 14 captured from Jazzy and Lyrical attachments.
 - **S4. Answered: yes, on Jazzy, Kilted, Lyrical and Rolling.**
   `ros2 topic info -v` prints each endpoint through rclpy's endpoint-info
   `__str__`, which includes `Topic type hash: RIHS01_<hex>`. That is
@@ -1082,10 +1386,20 @@ rev 6 answered S3, S4 and S5 from source and offline runs. The two-day spike
   *peer's* (`other_zid`). The fix is a one-line upstream accessor, or a
   `with_zid` constructor that lets AimDB choose the ZID it puts in its tokens.
   It joins the liveliness PR in §11 step 6.
-- **Q6.** Should v1 resolve relative topic names against the node namespace, or
-  keep fully qualified names only as proposed?
-- **Q7.** Publish the `aimdb-zenoh-nostd` fork now, or ship the embedded backend as
-  unpublished (git-only) until upstream releases?
+- **S6. Answered (rev 10): yes.** One task, as §5.2 has it: `session.run()`
+  pinned, `select`ed against a timer, and each `put` awaited outside the
+  `select`, so `run` is not polled during it. On zenoh-nostd 0.2.0 through
+  Lyrical's router, 20 paced puts finished in 66–300 µs each. A burst of
+  5,000 back-to-back puts, with `run` polled once between puts, finished
+  with the slowest at 516 µs (debug build), and a `zenoh` subscriber
+  received all 5,000.
+- **Q6. Answered (rev 7): fully qualified only.** The namespace sets the node's
+  identity, not its topics (§4.2, §4.3). The link URL cannot tell an absolute
+  name from a relative one.
+- **Q7. Answered (2026-10-08): wait for upstream.** No `aimdb-zenoh-nostd`
+  fork. The embedded backend ships once zenoh-nostd is released on
+  crates.io; until then the connector releases with the native backend
+  only.
 - **Q8.** Should plain `zenoh://` links carry a contract fingerprint in Zenoh's
   `encoding` field, to catch schema skew between AimDB peers? There is no
   precedent to copy. **[verified]** the WASM schema registry keys on
@@ -1099,18 +1413,16 @@ rev 6 answered S3, S4 and S5 from source and offline runs. The two-day spike
 
 | # | Step | Depends on |
 |---|---|---|
-| 1 | **Spike (about 2 days).** Two parts: (a) with the `zenoh` crate, a hand-built token plus a `put` with an attachment, seen by `ros2 topic echo`, `ros2 node list` and `ros2 topic info -v`; (b) a zenoh-nostd `put` on the host reaching a zenoh 1.8 subscriber through `rmw_zenohd`, and the same against Rolling's 1.10.1 router. Answers S2. S3 and S4 were answered in rev 6, and part (a) now only confirms them live | — |
-| 2 | `aimdb-cdr`; `Linkable::WIRE_FORMAT` and `LinkCodec::WIRE_FORMAT` with the recorded `aimdb.wire_format`; `RosMessage` and `#[derive(RosMessage)]`; `link_codecs::Cdr` (all additive, in data-contracts and aimdb-derive) | — |
+| 1 | ✅ **Spike (about 2 days).** Two parts: (a) with the `zenoh` crate, a hand-built token plus a `put` with an attachment, seen by `ros2 topic echo`, `ros2 node list` and `ros2 topic info -v`; (b) a zenoh-nostd `put` on the host reaching a zenoh 1.8 subscriber through `rmw_zenohd`, and the same against Rolling's 1.10.1 router, with the `put` awaited while `session.run()` is pending. Answers S2 and S6. S3 and S4 were answered in rev 6, and part (a) now only confirms them live | — |
+| 2 | ✅ `aimdb-cdr`; ✅ `Linkable::WIRE_FORMAT` and `LinkCodec::WIRE_FORMAT` with the recorded `aimdb.wire_format`; `RosMessage` and `#[derive(RosMessage)]`; `link_codecs::Cdr` (in data-contracts and aimdb-derive) | — |
 | 3 | `profile/` module and its golden tests (criterion 1) | 1 |
-| 4 | Core `RouteMeta`, the `_with_meta` accessors and `aimdb.topic_provider` (§4.6); `Shared`, `ZenohConnector`, `Ros2Connector` and the registry on the native backend; interop CI (criteria 2, 8, 9). **This ships v1's ROS feature on its own** | 2, 3 |
-| 5 | Embedded backend (`zenoh://` only): gateway interop on host first (criterion 3), then STM32H5 (criteria 4, 5) | 1, 4 |
-| 6 | Upstream. For v1, a crates.io publish or the fork. The rest is v2 prep and off the critical path: `Send` cleanliness (all three causes in §5.2), the liveliness API PR, and an own-ZID accessor (S5) | 1 |
-| 7 | `aimdb-ros2-msgs`: the internal generation script, the four packages, and the per-distro hash CI (criterion 10) | 2 |
-| 8 | Docs: design 012 connector-guide section, a BYOC tutorial built on this connector, an "AimDB and ROS 2" page, and the manufacturing-cell demo | 4, 5 |
-
-Steps 2, 3 and 7 are pure and additive and can land early. Step 7 can also ship
-ahead of the connector: the message types are useful on their own over `mqtt://`
-with CDR. The effort estimate is unverified until the spike: roughly 4–6 weeks for
+| 4 | Core: `RouteInfo::type_id` and `InboundDispatch::routes()`, and removing `TOPIC_WRITER_KEY` (§4.6); `ZenohGrammar` and its oracle tests (criterion 11); `Shared`, `ZenohConnector`, `Ros2Connector` and the registry on the native backend; interop CI (criteria 2, 8, 9). **This ships v1's ROS feature on its own** | 2, 3 |
+| 5 | Embedded backend (`zenoh://` only): gateway interop and allocation rows on host first (criteria 3, 12), then STM32H5 (criteria 4, 5) | 1, 4 |
+| 6 | Upstream. For v1's embedded backend, a crates.io release of zenoh-nostd (Q7: no fork). The rest is v2 prep and off the critical path: `Send` cleanliness (all three causes in §5.2), the liveliness API PR, and an own-ZID accessor (S5) | 1 |
+| 7 | Docs: design 012 connector-guide section, a BYOC tutorial built on this connector, an "AimDB and ROS 2" page, and the manufacturing-cell demo | 4, 5 |
+
+Steps 2 and 3 are pure and can land early; step 2 is half done. `aimdb-ros2-msgs` is
+not in the table: it is a later phase (§4.5). The effort estimate is unverified until the spike: roughly 4–6 weeks for
 one engineer, and the rev 4 scope cut should put it toward the low end. Most of the
 remaining variance is in steps 5 and 6, because both depend on zenoh-nostd being
 publishable.
@@ -1119,9 +1431,8 @@ publishable.
 zenoh-nostd beyond spike part (b). A std gateway speaking `ros2://`, plus
 `zenoh://` between std AimDB peers, is a complete release. Steps 5 and 6 then
 gate only the MCU half, and zenoh-nostd's publishing question (Q7) never holds
-up the ROS feature. After rev 6, the only known blockers are two upstream
-items: S2 (wire compatibility with both vendored routers) and the zenoh-nostd
-publish. The rev 5 and rev 6 corrections each have an in-design fix.
+up the ROS feature. After rev 10, the only known blocker is the zenoh-nostd
+release on crates.io (Q7). The rev 5 and rev 6 corrections each have an in-design fix.
 
 On the roadmap, v1 lands after the conformance suite and doubles as BYOC tutorial
 material. v2 (§4.9) is sequenced separately once its three preconditions hold.
@@ -1129,9 +1440,13 @@ material. v2 (§4.9) is sequenced separately once its three preconditions hold.
 ## 12. What this does not change
 
 - Existing connectors, the Tokio and Embassy adapters, and the 052 traits are
-  untouched.
-- `aimdb-core` gains one `#[non_exhaustive]` struct (`RouteMeta`), two accessors
-  and one reserved config key. No existing public struct gains a field.
+  untouched, except that MQTT's `PublishOpts` tests set the new
+  `RouteInfo::type_id`.
+- `aimdb-core`'s connector interface gains `RouteInfo::type_id`,
+  `InboundDispatch::routes()` and the `#[non_exhaustive]` `InboundRouteInfo`,
+  and keeps one reserved config key, `aimdb.wire_format`, which its
+  serializer setters clear. This is a break, made in the same release as
+  054's and 055's; the user-facing link API does not change.
 - `aimdb-data-contracts` gains two defaulted associated consts (`Linkable` and
   `LinkCodec`) and two features, both off by default. The codec verbs also
   record `aimdb.wire_format` on each link, which connectors that do not read
@@ -1159,6 +1474,8 @@ material. v2 (§4.9) is sequenced separately once its three preconditions hold.
 - `ros2/ros2cli` (`ros2topic/verb/info.py`) and `ros2/rclpy`
   (`topic_endpoint_info.py`, `endpoint_info.py`, `type_hash.py`) on `jazzy`,
   `kilted`, `lyrical` and `rolling`.
+- `ros2/rcl` `rolling` (`rcl/src/rcl/{init,domain_id}.c`) and rmw_zenoh's
+  `rmw_init.cpp`, for domain resolution (rev 7, §4.2).
 - `ros-infrastructure/rep` master @ `11ca24a` (`rep-2000.rst`) and
   `ros2/ros2_documentation` @ `617ded6` (`Release-Lyrical-Luth.rst` and the
   Lyrical changelog).
@@ -1170,6 +1487,11 @@ material. v2 (§4.9) is sequenced separately once its three preconditions hold.
   - `assert_send` on the session future.
 
   The last three were compiled inside zenoh-nostd @ `e88f73a` on rustc 1.98.0.
+- AimDB @ `eefe2c2` (rev 9): `aimdb-core/src/{outbound/routes.rs,inbound_dispatch.rs,router.rs,builder.rs,connector.rs,typed_api.rs,session/io.rs}`,
+  `aimdb-data-contracts/src/{linkable.rs,link_codec.rs}`,
+  `aimdb-mqtt-connector/src/{native.rs,publish_opts.rs,grammar.rs,embedded/{mod,session,tls}.rs}`
+  and `tests/tokio_broker.rs`, and
+  `zenoh-keyexpr` 1.10.1 (`lib.rs`, `Cargo.toml`, `key_expr/borrowed.rs`).
 - AimDB @ `e759cbe`: `aimdb-core/src/{builder.rs,connector.rs,typed_api.rs,router.rs,session/io.rs,session/pump.rs,session/client.rs,executor.rs}`,
   `aimdb-data-contracts/src/{lib.rs,linkable.rs,link_codec.rs,streamable.rs}`,
   `aimdb-derive/src/lib.rs`, `aimdb-codegen/src/rust.rs`,
@@ -1178,6 +1500,14 @@ material. v2 (§4.9) is sequenced separately once its three preconditions hold.
   `aimdb-embassy-adapter/src/{connectors.rs,net.rs}`, and
   `aimdb-mqtt-connector/src/{connector.rs,native.rs,link_ext.rs,embedded/{mod,session,tls}.rs}`
   and `tests/tokio_broker.rs`.
+- rev 10's spike, run on 2026-10-08 with Docker on the host network:
+  `ros:lyrical` and `ros:rolling` with `ros-<distro>-rmw-zenoh-cpp` 0.10.6 /
+  0.13.0 and `demo_nodes_cpp`; `eclipse/zenoh:1.10.1` (`zenohd`); a client on
+  the `zenoh` 1.10.1 crate; and zenoh-nostd 0.2.0 (`e88f73a`) with its
+  `zenoh-std` platform, its `z_pub`/`z_sub` examples, and a single-task
+  variant for S6. The spike code is not in the tree.
+- `ZettaScaleLabs/hiroz` @ `c503843` (2026-09-23), rev 8: `hiroz-cdr`,
+  `hiroz-protocol`, `hiroz-schema`, `hiroz-msgs`, and `hiroz/src/{msg,ros_msg}.rs`.
 - rev 5 also ran two checks on the pinned rustc 1.98.0. One confirmed that a
   generic inline-const assert passes `cargo check` and fails `cargo build`. The
   other read trybuild 1.0.121's mode selection (`src/cargo.rs:97`).