v2050

# RuView Release v2050 — HOMECORE runtime hardening

Release v2050 publishes the HOMECORE alpha hardening work merged in
[PR #1450](https://github.com/ruvnet/RuView/pull/1450) at commit
[`581af67`](https://github.com/ruvnet/RuView/commit/581af67fbcc629fa73363d15b6b9eaf181892498).

The HOMECORE crates remain versioned `0.1.0-alpha.0`. This repository release
does not claim complete Home Assistant compatibility.

## Highlights

- Connected committed state changes and service calls to the shared event bus.
- Fixed WebSocket subscriptions to use client IDs and bounded each connection's
  outbound queue to prevent unbounded memory growth.
- Made bearer authentication fail closed when `HOMECORE_TOKENS` is absent.
- Removed the browser UI's embedded development-token fallback.
- Replaced success-shaped service stubs with executable state-changing
  `turn_on`, `turn_off`, and `toggle` handlers.
- Added authenticated local intent handling at `POST /api/intent/handle`.
- Made synthetic biometric/demo entities explicitly opt-in.
- Enabled durable SQLite recording by default, correct lag recovery, optional
  ruvector semantic indexing, automation YAML loading, and graceful shutdown.
- Made entity-registry migration write an atomic HA-compatible destination file
  without silently overwriting an existing registry.
- Removed inactive plugin/HAP runtime claims and documented the exact supported
  and deferred capability surfaces.

## Validation

- No-default-feature test matrix across the nine HOMECORE crates passed.
- `homecore-server --all-features`: 21 tests passed.
- Wasmtime plugin feature: 32 tests passed.
- Ruvector recorder feature: 31 tests passed.
- HOMECORE UI: 41 tests passed.
- Clippy passed for the default runtime surface with warnings denied.
- Optimized `homecore-server` release build passed.
- Diff integrity checks passed.

## Security and operational defaults

- Configure comma-separated bearer tokens with `HOMECORE_TOKENS`.
- `--insecure-dev-auth` is an explicit development-only escape hatch.
- Synthetic entities require `--seed-demo-entities`.
- SQLite history defaults to `sqlite://homecore.db`.
- Unsupported services fail instead of returning a false acknowledgement.
- Missing BFF upstreams return typed `503 upstream_unavailable` responses.

## Deferred alpha capabilities

- Server-side native/Wasmtime plugin loading.
- A network HomeKit Accessory Protocol server, pairing, and mDNS advertisement.
- Full Home Assistant REST/WebSocket parity.
- Restore-state at server startup.
- Complete device/config-entry migration.
- STT/TTS and satellite voice protocols.

The authoritative capability matrix is
[`v2/docs/homecore-capabilities.md`](https://github.com/ruvnet/RuView/blob/581af67fbcc629fa73363d15b6b9eaf181892498/v2/docs/homecore-capabilities.md).

Release page:
https://github.com/ruvnet/RuView/releases/tag/v2050