diff --git a/README.md b/README.md
index acf6f37..dc1c346 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,7 @@
 - 🧠 **Native MCP server** — read telemetry and control hardware from an AI assistant, on devices you are not physically next to. Owner-gated and off by default; see [AI assistants (MCP)](#ai-assistants-mcp).
 - 👥 **Multi-user** — owner / admin / member roles, email invites, and social sign-in (Google, GitHub).
 - 📝 **Audit log** — every privileged action recorded and paginated in the UI.
+- 🔧 **Over-the-air updates** — compile with your own toolchain, upload the image, assign it to a board; it pulls the update on its next check.
 
 ## Quick start
 
@@ -36,6 +37,18 @@
      -H "Authorization: Bearer $NODRIX_TOKEN"
    ```
 
+## Updating hardware over the air
+
+Compile with the toolchain you already use, upload the image, and any board in the project can take it on its next check — no USB, no cable, no physical access.
+
+1. **Version the sketch.** `Nodrix.setFirmwareVersion("1.2.0")` — the board reports this back, and it is how nodrix knows the update landed. Needs the [Nodrix library](https://github.com/decoded-cipher/nodrix-sdk) at 0.2.0 or newer.
+2. **Compile.** Arduino IDE: **Sketch → Export Compiled Binary**, then take `<sketch>.ino.bin` from `build/<board>/`. `arduino-cli compile --output-dir build` and PlatformIO's `.pio/build/<env>/firmware.bin` work the same way. Upload the app image, not `.ino.merged.bin` or `.ino.bootloader.bin` — nodrix rejects those, since a board flashed with one over the air would not boot.
+3. **Upload** it on **Devices → Firmware** with the same version string, then **assign** it to a board on **Devices**.
+
+A board on the control socket is told immediately; one on HTTP finds it at its next check or on reboot. The board reports the new version when it comes back up, which is what marks the update done. If it keeps pulling the image without ever reporting the new version — nearly always the version in the sketch not matching the one on the upload — nodrix stops offering it after a few attempts and says so, instead of leaving the board reinstalling forever. Assigning the firmware again clears that and retries.
+
+The first flash of a board is still over USB, with the Arduino IDE or `esptool`, and it needs a partition scheme with OTA slots (the ESP32 default has them). Every image you ship over the air has to include the nodrix SDK, or the board will have no way to receive the next one.
+
 ## AI assistants (MCP)
 
 nodrix ships a native [Model Context Protocol](https://modelcontextprotocol.io) server, so an assistant can read a project's telemetry and — once you allow it — act on the hardware. Because devices report to your deployment rather than to your laptop, the board does not need to be plugged into the machine running the assistant; it can be in another building.
diff --git a/deploy/wrangler.toml b/deploy/wrangler.toml
index 474906d..37c3864 100644
--- a/deploy/wrangler.toml
+++ b/deploy/wrangler.toml
@@ -1,7 +1,8 @@
-# nodrix deploy carrier. The Deploy to Cloudflare button clones only this
-# subdir; the build command pulls the real source from upstream over it. Don't
-# edit by hand — manage the deployment from the Cloudflare dashboard. Keep the
-# bindings in sync with the repo-root wrangler.toml.
+# nodrix deploy carrier. The Deploy to Cloudflare button clones only this subdir;
+# the build command pulls the real source from upstream over it and rebuilds the
+# deployment's wrangler.toml from this file, keeping only its Worker name,
+# account, routes, resource IDs and vars. Everything else here reaches every
+# existing deployment on its next build — keep it in sync with the root config.
 name = "nodrix"
 main = "worker/src/index.ts"
 compatibility_date = "2025-05-01"
diff --git a/package.json b/package.json
index 2f6dc64..a754523 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "nodrix",
   "private": true,
-  "version": "1.0.1",
+  "version": "1.1.0",
   "type": "module",
   "workspaces": [
     "worker",
diff --git a/scripts/build-from-upstream.sh b/scripts/build-from-upstream.sh
index 038a57a..f189294 100755
--- a/scripts/build-from-upstream.sh
+++ b/scripts/build-from-upstream.sh
@@ -9,9 +9,11 @@
 # source of truth — meaning code changes in upstream never reach them. With
 # this script, every deploy:
 #
-#   1. Preserves the user's wrangler.toml (which has their resource IDs,
-#      filled by the Deploy button on day 1 and never changed since).
-#   2. Replaces every other file with the upstream source's contents.
+#   1. Replaces every file with the upstream source's contents.
+#   2. Rebuilds wrangler.toml from upstream's carrier template, keeping only the
+#      deployment's identity (Worker name, account, routes, resource IDs, vars).
+#      Keeping the whole file instead froze the topology at day 1, so a binding
+#      or flag added upstream never reached anyone who had already deployed.
 #   3. Runs upstream's build pipeline.
 #
 # Result: the user's clone is functionally a config carrier. Code = upstream.
@@ -31,6 +33,7 @@ UPSTREAM_REPO="${NODRIX_UPSTREAM_REPO:-decoded-cipher/nodrix}"
 DEPLOY_CHANNEL="${NODRIX_DEPLOY_CHANNEL:-release}"
 UPSTREAM_DIR="/tmp/nodrix-upstream"
 WRANGLER_BACKUP="/tmp/nodrix-wrangler.toml"
+WRANGLER_MERGED="/tmp/nodrix-wrangler.merged.toml"
 
 if [ -z "${WORKERS_CI_COMMIT_SHA:-}" ]; then
   echo "[build-from-upstream] not in Workers Builds CI — running local build chain"
@@ -43,7 +46,7 @@ fi
 
 echo "[build-from-upstream] CI build — pulling upstream ${UPSTREAM_REPO} (${DEPLOY_CHANNEL} channel)"
 
-# 1. Preserve user's wrangler.toml.
+# 1. Save the deployment's wrangler.toml; step 4 merges it back.
 if [ ! -f wrangler.toml ]; then
   echo "[build-from-upstream] no wrangler.toml in cwd — refusing to proceed" >&2
   exit 1
@@ -114,8 +117,17 @@ for dir in web worker scripts; do
     done
 done
 
-# 4. Restore user's wrangler.toml in case upstream had its own (which it does).
-cp "${WRANGLER_BACKUP}" wrangler.toml
+# 4. Rebuild wrangler.toml. This script comes from master but the clone is the
+#    release tag, so a release predating the merge script falls back instead of
+#    failing.
+if [ -f scripts/merge-wrangler.ts ] && [ -f ./deploy/wrangler.toml ]; then
+  echo "[build-from-upstream] merging deployment identity into upstream wrangler.toml"
+  bun scripts/merge-wrangler.ts "${WRANGLER_BACKUP}" ./deploy/wrangler.toml > "${WRANGLER_MERGED}"
+  mv "${WRANGLER_MERGED}" wrangler.toml
+else
+  echo "[build-from-upstream] upstream has no merge script — keeping wrangler.toml as-is"
+  cp "${WRANGLER_BACKUP}" wrangler.toml
+fi
 
 # 4b. Drop the nested deploy/ that the overlay just brought in. The clone root
 #     IS the deploy carrier; upstream's own deploy/ dir is dead weight here and
diff --git a/scripts/merge-wrangler.test.ts b/scripts/merge-wrangler.test.ts
new file mode 100644
index 0000000..d3eb176
--- /dev/null
+++ b/scripts/merge-wrangler.test.ts
@@ -0,0 +1,116 @@
+// Getting this wrong on a live deployment points it at resources it doesn't own,
+// or renames the Worker. Run with `bun test scripts/merge-wrangler.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { mergeWrangler } from './merge-wrangler';
+
+// Renamed, on a custom domain, tracking a fork, and predating three template changes.
+const DEPLOYMENT = `name = "home-iot"
+main = "worker/src/index.ts"
+compatibility_date = "2025-05-01"
+compatibility_flags = ["nodejs_compat"]
+account_id = "acc_123"
+routes = [
+  { pattern = "iot.example.com", custom_domain = true }
+]
+
+[[d1_databases]]
+binding = "DB"
+database_name = "home-iot-db"
+database_id = "aaaa-bbbb-cccc"
+
+[[kv_namespaces]]
+binding = "KV"
+id = "kv_deadbeef"
+
+[[r2_buckets]]
+binding = "R2"
+bucket_name = "home-iot-telemetry"
+
+[vars]
+NODRIX_UPSTREAM_REPO = "someone/nodrix-fork"
+`;
+
+const TEMPLATE = `name = "nodrix"
+main = "worker/src/index.ts"
+compatibility_date = "2026-01-15"
+compatibility_flags = ["nodejs_compat"]
+
+[build]
+command = "curl -fsSL https://example.invalid/build.sh | bash"
+
+[[d1_databases]]
+binding = "DB"
+database_name = "nodrix"
+database_id = "PLACEHOLDER_FILLED_BY_DEPLOY_OR_WRANGLER"
+migrations_dir = "worker/src/platform/db/migrations"
+
+[[kv_namespaces]]
+binding = "KV"
+id = "PLACEHOLDER_FILLED_BY_DEPLOY_OR_WRANGLER"
+
+[[r2_buckets]]
+binding = "R2"
+bucket_name = "nodrix-telemetry"
+
+[[durable_objects.bindings]]
+name = "PROJECT_DO"
+class_name = "ProjectDO"
+
+[[migrations]]
+tag = "v2"
+new_sqlite_classes = ["DeviceDO"]
+
+[vars]
+NODRIX_UPSTREAM_REPO = "decoded-cipher/nodrix"
+NODRIX_FEATURE_FLAG = "on"
+
+[triggers]
+crons = ["0 0 * * *"]
+`;
+
+const merged = mergeWrangler(DEPLOYMENT, TEMPLATE);
+
+test('keeps the deployment worker name', () => {
+  expect(merged).toContain('name = "home-iot"');
+  expect(merged).not.toContain('name = "nodrix"');
+});
+
+test('keeps resource ids the deployment owns', () => {
+  expect(merged).toContain('database_id = "aaaa-bbbb-cccc"');
+  expect(merged).toContain('database_name = "home-iot-db"');
+  expect(merged).toContain('id = "kv_deadbeef"');
+  expect(merged).toContain('bucket_name = "home-iot-telemetry"');
+  expect(merged).not.toContain('PLACEHOLDER');
+});
+
+test('keeps account and routes the template never declares', () => {
+  expect(merged).toContain('account_id = "acc_123"');
+  expect(merged).toContain('pattern = "iot.example.com"');
+});
+
+test('takes compatibility settings and build config from upstream', () => {
+  expect(merged).toContain('compatibility_date = "2026-01-15"');
+  expect(merged).toContain('https://example.invalid/build.sh');
+});
+
+test('takes new bindings, migrations and triggers from upstream', () => {
+  expect(merged).toContain('class_name = "ProjectDO"');
+  expect(merged).toContain('new_sqlite_classes = ["DeviceDO"]');
+  expect(merged).toContain('crons = ["0 0 * * *"]');
+  expect(merged).toContain('migrations_dir = "worker/src/platform/db/migrations"');
+});
+
+test('keeps an overridden var and adds one the deployment predates', () => {
+  expect(merged).toContain('NODRIX_UPSTREAM_REPO = "someone/nodrix-fork"');
+  expect(merged).toContain('NODRIX_FEATURE_FLAG = "on"');
+});
+
+test('is idempotent against its own output', () => {
+  expect(mergeWrangler(merged, TEMPLATE)).toBe(merged);
+});
+
+test('a fresh deployment carrying only placeholders is left as the template', () => {
+  const fresh = mergeWrangler(TEMPLATE, TEMPLATE);
+  expect(fresh).toBe(TEMPLATE);
+});
diff --git a/scripts/merge-wrangler.ts b/scripts/merge-wrangler.ts
new file mode 100644
index 0000000..88ac0ef
--- /dev/null
+++ b/scripts/merge-wrangler.ts
@@ -0,0 +1,171 @@
+// Rebuilds a deployment's wrangler.toml: bindings, flags and build config from
+// upstream's carrier template, identity from the deployment's own file.
+//
+// Keeping the deployment's file verbatim froze its topology at whatever the
+// Deploy button wrote on day one; taking upstream's verbatim would rename the
+// Worker, creating a second one and orphaning the live one.
+
+import { readFileSync } from 'node:fs';
+
+const PRESERVED_TOP_KEYS = ['name', 'account_id', 'workers_dev', 'preview_urls', 'route', 'routes'];
+
+const PRESERVED_RESOURCE_KEYS: Record<string, string[]> = {
+  d1_databases: ['database_id', 'database_name'],
+  kv_namespaces: ['id'],
+  r2_buckets: ['bucket_name'],
+};
+
+type Section = { header: string; lines: string[] };
+
+function keyOf(line: string): string | null {
+  const m = /^\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*=/.exec(line);
+  return m ? m[1]! : null;
+}
+
+// TOML arrays and inline tables can span lines; those join into one entry.
+function unclosed(text: string): boolean {
+  let depth = 0;
+  let quote = '';
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]!;
+    if (quote) {
+      if (c === '\\') i++;
+      else if (c === quote) quote = '';
+      continue;
+    }
+    if (c === '"' || c === "'") quote = c;
+    else if (c === '#') break;
+    else if (c === '[' || c === '{') depth++;
+    else if (c === ']' || c === '}') depth--;
+  }
+  return depth > 0;
+}
+
+function parse(text: string): Section[] {
+  const sections: Section[] = [{ header: '', lines: [] }];
+  const raw = text.split('\n');
+  for (let i = 0; i < raw.length; i++) {
+    let line = raw[i]!;
+    if (line.trim().startsWith('[')) {
+      sections.push({ header: line.trim(), lines: [] });
+      continue;
+    }
+    if (keyOf(line)) {
+      while (unclosed(line) && i + 1 < raw.length) line += '\n' + raw[++i]!;
+    }
+    sections[sections.length - 1]!.lines.push(line);
+  }
+  return sections;
+}
+
+function valueOf(line: string): string {
+  const eq = line.indexOf('=');
+  return line.slice(eq + 1).trim().replace(/\s*#.*$/, '').replace(/^["']|["']$/g, '');
+}
+
+function lookup(section: Section, key: string): string | undefined {
+  for (const l of section.lines) if (keyOf(l) === key) return l;
+  return undefined;
+}
+
+function arrayName(header: string): string | null {
+  const m = /^\[\[([A-Za-z0-9_.-]+)\]\]$/.exec(header);
+  return m ? m[1]! : null;
+}
+
+export function mergeWrangler(sourceText: string, templateText: string): string {
+  const source = parse(sourceText);
+  const template = parse(templateText);
+
+  const sourceTop = source[0]!;
+  const sourceResources = new Map<string, Section>();
+  let sourceVars: Section | undefined;
+  for (const s of source) {
+    const name = arrayName(s.header);
+    if (name && name in PRESERVED_RESOURCE_KEYS) {
+      const binding = lookup(s, 'binding');
+      if (binding) sourceResources.set(`${name}:${valueOf(binding)}`, s);
+    } else if (s.header === '[vars]') {
+      sourceVars = s;
+    }
+  }
+
+  const out: string[] = [];
+  const usedTopKeys = new Set<string>();
+
+  for (const s of template) {
+    if (s.header) out.push(s.header);
+
+    const name = arrayName(s.header);
+    const resourceKeys = name ? PRESERVED_RESOURCE_KEYS[name] : undefined;
+    let resource: Section | undefined;
+    if (resourceKeys) {
+      const binding = lookup(s, 'binding');
+      if (binding) {
+        resource = sourceResources.get(`${name}:${valueOf(binding)}`);
+        if (!resource) {
+          console.error(
+            `[merge-wrangler] ${name} binding ${valueOf(binding)} is new upstream — this deployment has no id for it`
+          );
+        }
+      }
+    }
+
+    for (const line of s.lines) {
+      const key = keyOf(line);
+      if (!key) {
+        out.push(line);
+        continue;
+      }
+      if (!s.header && PRESERVED_TOP_KEYS.includes(key)) {
+        const own = lookup(sourceTop, key);
+        usedTopKeys.add(key);
+        out.push(own ?? line);
+        continue;
+      }
+      if (resource && resourceKeys!.includes(key)) {
+        out.push(lookup(resource, key) ?? line);
+        continue;
+      }
+      if (s.header === '[vars]' && sourceVars) {
+        out.push(lookup(sourceVars, key) ?? line);
+        continue;
+      }
+      out.push(line);
+    }
+
+    // Custom domains and account ids the template never declares.
+    if (!s.header) {
+      const extra = PRESERVED_TOP_KEYS.filter((k) => !usedTopKeys.has(k) && lookup(sourceTop, k));
+      if (extra.length) {
+        let at = out.length;
+        while (at > 0 && !keyOf(out[at - 1]!)) at--;
+        out.splice(at, 0, ...extra.map((k) => lookup(sourceTop, k)!));
+      }
+    }
+    if (s.header === '[vars]' && sourceVars) {
+      const declared = new Set(s.lines.map(keyOf).filter(Boolean));
+      for (const line of sourceVars.lines) {
+        const k = keyOf(line);
+        if (k && !declared.has(k)) out.push(line);
+      }
+    }
+  }
+
+  if (sourceVars && !template.some((s) => s.header === '[vars]')) {
+    out.push('', '[vars]', ...sourceVars.lines.filter((l) => keyOf(l)));
+  }
+
+  return out.join('\n').replace(/\n{3,}/g, '\n\n').replace(/\n*$/, '\n');
+}
+
+if (import.meta.main) {
+  const [, , sourcePath, templatePath] = process.argv;
+  if (!sourcePath || !templatePath) {
+    console.error('usage: merge-wrangler.ts <deployment.toml> <upstream-template.toml>');
+    process.exit(1);
+  }
+  process.stdout.write(
+    mergeWrangler(readFileSync(sourcePath, 'utf8'), readFileSync(templatePath, 'utf8'))
+  );
+}
diff --git a/shared/blocks/index.ts b/shared/blocks/index.ts
index 981b588..54f7924 100644
--- a/shared/blocks/index.ts
+++ b/shared/blocks/index.ts
@@ -26,6 +26,7 @@ export type BlockFieldType =
   | 'number'
   | 'boolean'
   | 'variable'
+  | 'device'
   | 'integration'
   | 'time'
   | 'weekdays';
diff --git a/shared/blocks/triggers.ts b/shared/blocks/triggers.ts
index 788915c..4416573 100644
--- a/shared/blocks/triggers.ts
+++ b/shared/blocks/triggers.ts
@@ -13,6 +13,12 @@ export const TRIGGER_CATALOG = [
     ports: { out: ['out'] },
     fields: [
       { key: 'variable', label: 'Variable', type: 'variable', required: true },
+      {
+        key: 'device',
+        label: 'Device',
+        type: 'device',
+        hint: 'Leave as any device to fire whichever board reports it.',
+      },
       {
         key: 'operator',
         label: 'Condition',
diff --git a/web/src/api.ts b/web/src/api.ts
index 5e9e189..2bae14e 100644
--- a/web/src/api.ts
+++ b/web/src/api.ts
@@ -47,6 +47,36 @@ async function request<T>(method: string, path: string, body?: unknown): Promise
   }
 }
 
+async function requestBytes(path: string): Promise<ArrayBuffer> {
+  progress.start();
+  try {
+    const res = await fetch(path, { credentials: 'include' });
+    if (res.status === 401) unauthorizedHandler?.();
+    if (!res.ok) throw new ApiError(res.status, await res.json().catch(() => null));
+    return await res.arrayBuffer();
+  } finally {
+    progress.done();
+  }
+}
+
+// The browser sets content-type (with the boundary) itself, so this can't go
+// through request(), which always sends JSON.
+async function upload<T>(path: string, form: FormData): Promise<T> {
+  progress.start();
+  try {
+    const res = await fetch(path, { method: 'POST', body: form, credentials: 'include' });
+
+    if (res.status === 401) unauthorizedHandler?.();
+    if (res.status === 204) return undefined as T;
+
+    const payload = await res.json().catch(() => null);
+    if (!res.ok) throw new ApiError(res.status, payload);
+    return payload as T;
+  } finally {
+    progress.done();
+  }
+}
+
 // Collapse concurrent identical GETs into one network request — e.g. two
 // components mounting at once both calling the same loader. The promise is shared
 // while in flight and dropped as soon as it settles, so this is a dedup of
@@ -63,7 +93,9 @@ function getDeduped<T>(path: string): Promise<T> {
 
 export const api = {
   get: <T>(path: string) => getDeduped<T>(path),
+  bytes: (path: string) => requestBytes(path),
   post: <T>(path: string, body?: unknown) => request<T>('POST', path, body),
+  upload: <T>(path: string, form: FormData) => upload<T>(path, form),
   put: <T>(path: string, body?: unknown) => request<T>('PUT', path, body),
   patch: <T>(path: string, body?: unknown) => request<T>('PATCH', path, body),
   del: <T>(path: string) => request<T>('DELETE', path),
diff --git a/web/src/builder/grid.ts b/web/src/builder/grid.ts
index 1f6689e..efcfd7d 100644
--- a/web/src/builder/grid.ts
+++ b/web/src/builder/grid.ts
@@ -20,5 +20,6 @@ export function normalizeLayout(layout: Layout): Layout {
     }),
     ...(layout.mobile !== undefined ? { mobile: layout.mobile } : {}),
     ...(layout.refresh !== undefined ? { refresh: layout.refresh } : {}),
+    ...(layout.device !== undefined ? { device: layout.device } : {}),
   };
 }
diff --git a/web/src/components/FirmwareUploadDialog.vue b/web/src/components/FirmwareUploadDialog.vue
new file mode 100644
index 0000000..5edfe3b
--- /dev/null
+++ b/web/src/components/FirmwareUploadDialog.vue
@@ -0,0 +1,134 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue';
+import { useProjectStore } from '../stores/project';
+import { toast } from '../lib/toast';
+
+const emit = defineEmits<{ close: [] }>();
+
+const project = useProjectStore();
+
+const fileEl = ref<HTMLInputElement | null>(null);
+const file = ref<File | null>(null);
+const version = ref('');
+const notes = ref('');
+const submitting = ref(false);
+
+const sizeLabel = computed(() => (file.value ? `${(file.value.size / 1024).toFixed(0)} kB` : ''));
+const canSubmit = computed(() => !!file.value && !!version.value.trim() && !submitting.value);
+
+function pick(e: Event) {
+  const input = e.target as HTMLInputElement;
+  file.value = input.files?.[0] ?? null;
+}
+
+function onKey(e: KeyboardEvent) {
+  if (e.key === 'Escape') emit('close');
+}
+
+async function submit() {
+  if (!file.value || !version.value.trim()) return;
+  submitting.value = true;
+  try {
+    const form = new FormData();
+    form.set('file', file.value);
+    form.set('version', version.value.trim());
+    if (notes.value.trim()) form.set('notes', notes.value.trim());
+    await project.uploadFirmware(form);
+    toast.success(`Firmware ${version.value.trim()} uploaded.`);
+    emit('close');
+  } catch (e) {
+    toast.error((e as Error).message);
+  } finally {
+    submitting.value = false;
+  }
+}
+</script>
+
+<template>
+  <div
+    class="fixed inset-0 z-50 flex items-center justify-center bg-neutral-900/40 px-4 dark:bg-black/70"
+    role="dialog"
+    aria-modal="true"
+    @click.self="emit('close')"
+    @keydown="onKey"
+  >
+    <div class="flex max-h-[90dvh] w-full max-w-md flex-col overflow-hidden rounded-xl bg-white shadow-xl dark:bg-neutral-900 dark:ring-1 dark:ring-neutral-800">
+      <header class="flex items-start justify-between gap-3 border-b border-neutral-100 px-5 py-3 dark:border-neutral-800">
+        <div class="min-w-0">
+          <h2 class="text-sm font-semibold leading-tight text-neutral-900 dark:text-neutral-100">Upload firmware</h2>
+          <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-neutral-400">
+            Compile with your own toolchain, then upload the image.
+          </p>
+        </div>
+        <button
+          type="button"
+          class="-mr-1 -mt-0.5 shrink-0 rounded-md p-1 text-neutral-400 transition hover:bg-neutral-100 hover:text-neutral-700 dark:hover:bg-neutral-800 dark:hover:text-neutral-200"
+          aria-label="Close"
+          @click="emit('close')"
+        >
+          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="h-4 w-4">
+            <path d="M6 6l12 12M18 6L6 18" />
+          </svg>
+        </button>
+      </header>
+
+      <form class="flex min-h-0 flex-col" @submit.prevent="submit">
+        <div class="flex-1 space-y-4 overflow-y-auto px-5 py-4">
+          <div class="space-y-1.5">
+            <label class="block text-xs font-medium text-neutral-700 dark:text-neutral-300">Image</label>
+            <input ref="fileEl" type="file" accept=".bin" class="sr-only" @change="pick" />
+            <div class="flex items-center gap-3">
+              <button
+                type="button"
+                class="shrink-0 rounded-md border border-neutral-300 bg-white px-3 py-1.5 text-xs font-medium hover:bg-neutral-100 focus:border-accent-500 focus:outline-none focus:ring-2 focus:ring-accent-500/30 dark:border-neutral-700 dark:bg-neutral-900 dark:hover:bg-neutral-800"
+                @click="fileEl?.click()"
+              >{{ file ? 'Change file' : 'Choose file' }}</button>
+              <span
+                class="min-w-0 truncate text-xs"
+                :class="file ? 'text-neutral-700 dark:text-neutral-300' : 'text-neutral-400 dark:text-neutral-500'"
+              >{{ file ? `${file.name} · ${sizeLabel}` : 'No file chosen' }}</span>
+            </div>
+            <p class="text-[11px] text-neutral-500 dark:text-neutral-400">
+              The app image — <span class="font-mono">.ino.bin</span>, not the merged one. Up to 8 MB.
+            </p>
+          </div>
+
+          <div class="space-y-1.5">
+            <label class="block text-xs font-medium text-neutral-700 dark:text-neutral-300">Version</label>
+            <input
+              v-model="version"
+              placeholder="1.2.0"
+              class="w-full rounded-md border border-neutral-300 bg-white px-3 py-2 text-sm focus:border-accent-500 focus:outline-none focus:ring-2 focus:ring-accent-500/30 dark:border-neutral-700 dark:bg-neutral-950 dark:text-neutral-100"
+            />
+            <p class="text-[11px] text-neutral-500 dark:text-neutral-400">
+              Must match what the sketch passes to <span class="font-mono">setFirmwareVersion()</span>, or the board
+              keeps reinstalling it.
+            </p>
+          </div>
+
+          <div class="space-y-1.5">
+            <label class="block text-xs font-medium text-neutral-700 dark:text-neutral-300">Notes (optional)</label>
+            <input
+              v-model="notes"
+              placeholder="What changed"
+              class="w-full rounded-md border border-neutral-300 bg-white px-3 py-2 text-sm focus:border-accent-500 focus:outline-none focus:ring-2 focus:ring-accent-500/30 dark:border-neutral-700 dark:bg-neutral-950 dark:text-neutral-100"
+            />
+          </div>
+        </div>
+
+        <div class="flex items-center justify-end gap-2 border-t border-neutral-100 bg-neutral-50 px-5 py-3 dark:border-neutral-800 dark:bg-neutral-950">
+          <button
+            type="button"
+            class="rounded-md border border-neutral-300 bg-white px-3 py-1.5 text-xs hover:bg-neutral-100 dark:border-neutral-700 dark:bg-neutral-900 dark:hover:bg-neutral-800"
+            @click="emit('close')"
+          >Cancel</button>
+          <button
+            type="submit"
+            :disabled="!canSubmit"
+            class="rounded-md bg-accent-600 px-3 py-1.5 text-xs font-semibold text-white hover:bg-accent-700 disabled:opacity-50"
+          >{{ submitting ? 'Uploading…' : 'Upload' }}</button>
+        </div>
+      </form>
+    </div>
+  </div>
+</template>
diff --git a/web/src/layouts/Sidebar.vue b/web/src/layouts/Sidebar.vue
index 4ae667b..c8c2ba2 100644
--- a/web/src/layouts/Sidebar.vue
+++ b/web/src/layouts/Sidebar.vue
@@ -22,7 +22,7 @@ const hasProject = computed(() => projId.value !== '');
 
 type IconName =
   | 'home' | 'folder' | 'dashboards' | 'variable' | 'bolt'
-  | 'integrations' | 'users' | 'key' | 'settings' | 'audit';
+  | 'integrations' | 'users' | 'key' | 'settings' | 'audit' | 'device';
 
 type NavItem = {
   label: string;
@@ -58,6 +58,13 @@ const projectScoped = computed<NavItem[]>(() => {
       matchPath: (path) =>
         path === `/p/${id}/dashboards` || path.startsWith(`/p/${id}/d/`),
     },
+    {
+      label: 'Devices',
+      to: `/p/${id}/device`,
+      icon: 'device',
+      disabled: !hasProject.value,
+      matchPath: (path) => path.startsWith(`/p/${id}/device`),
+    },
     {
       label: 'Automations',
       to: `/p/${id}/automations`,
@@ -105,6 +112,7 @@ const ICON_PATHS: Record<IconName, string> = {
   key: 'M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25Z',
   settings: 'M4.5 12a7.5 7.5 0 0 0 .104 1.243l-1.32 1.02a.75.75 0 0 0-.176.957l1.5 2.598a.75.75 0 0 0 .912.328l1.561-.624a7.45 7.45 0 0 0 2.155 1.244l.236 1.66a.75.75 0 0 0 .742.643h3a.75.75 0 0 0 .742-.643l.237-1.66a7.45 7.45 0 0 0 2.154-1.244l1.561.624a.75.75 0 0 0 .912-.328l1.5-2.598a.75.75 0 0 0-.176-.957l-1.32-1.02A7.51 7.51 0 0 0 19.5 12c0-.42-.035-.832-.103-1.232l1.319-1.02a.75.75 0 0 0 .176-.958l-1.5-2.598a.75.75 0 0 0-.912-.327l-1.561.624A7.46 7.46 0 0 0 14.764 5.245l-.236-1.66A.75.75 0 0 0 13.786 3h-3a.75.75 0 0 0-.742.643l-.237 1.66a7.45 7.45 0 0 0-2.154 1.244l-1.561-.624a.75.75 0 0 0-.912.327l-1.5 2.598a.75.75 0 0 0 .176.958l1.32 1.02C4.535 11.168 4.5 11.58 4.5 12Zm10.5 0a3 3 0 1 1-6 0 3 3 0 0 1 6 0Z',
   audit: 'M9 5h6m-6 0H7a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2h-2M9 5a2 2 0 1 1 6 0M9 12h6m-6 4h4',
+  device: 'M8.25 3v1.5M4.5 8.25H3m18 0h-1.5M4.5 12H3m18 0h-1.5m-15 3.75H3m18 0h-1.5M8.25 19.5V21M12 3v1.5m0 15V21m3.75-18v1.5m0 15V21m-9-1.5h10.5a2.25 2.25 0 0 0 2.25-2.25V6.75a2.25 2.25 0 0 0-2.25-2.25H6.75A2.25 2.25 0 0 0 4.5 6.75v10.5a2.25 2.25 0 0 0 2.25 2.25Zm.75-12h9v9h-9v-9Z',
 };
 
 function iconFor(name: IconName): FunctionalComponent {
diff --git a/web/src/pages/Projects.vue b/web/src/pages/Projects.vue
index 33daeda..9ed813a 100644
--- a/web/src/pages/Projects.vue
+++ b/web/src/pages/Projects.vue
@@ -105,6 +105,13 @@ async function removeProject(p: Project) {
   if (editing.value?.id === p.id) editing.value = null;
 }
 
+// Navigation, not fetch — a Blob would defeat the streaming.
+function exportProject(p: Project, event: Event) {
+  event.stopPropagation();
+  openMenuFor.value = null;
+  window.location.href = `/v1/admin/projects/${p.id}/export`;
+}
+
 function deleteFromMenu(p: Project, event: Event) {
   event.stopPropagation();
   openMenuFor.value = null;
@@ -228,6 +235,11 @@ watch(
               class="block w-full px-3 py-1.5 text-left text-xs hover:bg-neutral-100 dark:hover:bg-neutral-800"
               @click="startEdit(p, $event)"
             >Edit project</button>
+            <button
+              type="button"
+              class="block w-full px-3 py-1.5 text-left text-xs hover:bg-neutral-100 dark:hover:bg-neutral-800"
+              @click="exportProject(p, $event)"
+            >Export data</button>
             <button
               type="button"
               class="block w-full px-3 py-1.5 text-left text-xs text-red-700 hover:bg-red-50 dark:text-red-400 dark:hover:bg-red-950/30"
diff --git a/web/src/pages/project/DashboardEdit.vue b/web/src/pages/project/DashboardEdit.vue
index b67ca2e..7af4934 100644
--- a/web/src/pages/project/DashboardEdit.vue
+++ b/web/src/pages/project/DashboardEdit.vue
@@ -6,6 +6,7 @@ import { useProjectStore } from '../../stores/project';
 import { toast } from '../../lib/toast';
 import { manifestFor as specFor } from '@nodrix/widgets-shared';
 import { GRID_COLUMNS, ROW_HEIGHT, GRID_MARGIN, MIN_UNITS, normalizeLayout } from '../../builder/grid';
+import Dropdown from '../../components/Dropdown.vue';
 import WidgetPalette from '../../builder/WidgetPalette.vue';
 import WidgetConfigPanel from '../../builder/WidgetConfigPanel.vue';
 import { applyProps, createWidgetElement, buildDataIndex, applyLiveUpdate, applySnapshotItem, type DataIndex } from '../../builder/render-widget';
@@ -115,6 +116,20 @@ function setViewMode(mode: 'desktop' | 'mobile') {
 }
 
 // Revert the phone layout to the auto-derived arrangement.
+// Empty means the default device, so a dashboard made before devices existed
+// keeps reading what it always did.
+function setDevice(id: string) {
+  layout.value = { ...layout.value, device: id || null };
+}
+
+// The default device is '' here, matching how the DO keys its rows.
+const deviceOptions = computed(() => {
+  const opts = project.devices.map((d) => ({ value: d.is_default ? '' : d.id, label: d.name }));
+  const pinned = layout.value.device;
+  if (pinned && !opts.some((o) => o.value === pinned)) opts.push({ value: pinned, label: 'Deleted device' });
+  return opts;
+});
+
 function resetMobileLayout() {
   if (!layout.value.mobile) return;
   layout.value = { ...layout.value, mobile: null };
@@ -139,6 +154,7 @@ onMounted(async () => {
   }
 
   if (!project.variables.length) await project.loadVariables();
+  if (!project.devices.length) await project.loadDevices();
 
   ws = new DashboardWs(dashId, handleMessage);
   ws.start();
@@ -357,6 +373,15 @@ function exitToView() {
           <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" class="h-4 w-4 lg:hidden"><path d="M3 12a9 9 0 1 0 2.6-6.4L3 8" /><path d="M3 3v5h5" /></svg>
           <span class="hidden lg:inline">Reset layout</span>
         </button>
+        <Dropdown
+          v-if="project.devices.length > 1 || layout.device"
+          :model-value="layout.device ?? ''"
+          :options="deviceOptions"
+          size="sm"
+          class="w-44"
+          title="Which device this dashboard reads"
+          @update:model-value="(v) => setDevice(String(v))"
+        />
         <button
           class="rounded-md border border-neutral-300 px-3 py-1.5 text-sm hover:bg-neutral-100 dark:border-neutral-700 dark:hover:bg-neutral-800"
           @click="exitToView"
diff --git a/web/src/pages/project/automations/AutomationEditor.vue b/web/src/pages/project/automations/AutomationEditor.vue
index c2498ba..6a7006d 100644
--- a/web/src/pages/project/automations/AutomationEditor.vue
+++ b/web/src/pages/project/automations/AutomationEditor.vue
@@ -107,6 +107,7 @@ async function init() {
   if (!project.currentProjectId) return;
   await Promise.all([
     project.variables.length ? Promise.resolve() : project.loadVariables(),
+    project.devices.length ? Promise.resolve() : project.loadDevices(),
     project.loadIntegrations(),
   ]);
 
diff --git a/web/src/pages/project/automations/NodeInspector.vue b/web/src/pages/project/automations/NodeInspector.vue
index 034fbee..a195c2c 100644
--- a/web/src/pages/project/automations/NodeInspector.vue
+++ b/web/src/pages/project/automations/NodeInspector.vue
@@ -17,6 +17,10 @@ const WEEKDAYS = [
 ];
 
 const variableOptions = computed(() => project.variables.map((v) => ({ value: v.key, label: v.key })));
+const deviceOptions = computed(() => [
+  { value: '', label: 'Any device' },
+  ...project.devices.map((d) => ({ value: d.id, label: d.name })),
+]);
 const integrationOptions = computed(() =>
   project.integrations.map((i) => ({ value: i.id, label: i.name, hint: connSpec(i.kind).label }))
 );
@@ -97,6 +101,14 @@ watch(() => cfg.value['operation'], () => { if (isCallIntegration.value) seedDef
         size="sm"
         class="mt-1 w-full"
       />
+      <Dropdown
+        v-else-if="f.type === 'device'"
+        v-model="cfg[f.key]"
+        :options="deviceOptions"
+        placeholder="Any device"
+        size="sm"
+        class="mt-1 w-full"
+      />
       <Dropdown
         v-else-if="f.type === 'integration'"
         v-model="cfg[f.key]"
diff --git a/web/src/pages/project/device/DevicesHub.vue b/web/src/pages/project/device/DevicesHub.vue
new file mode 100644
index 0000000..2254daa
--- /dev/null
+++ b/web/src/pages/project/device/DevicesHub.vue
@@ -0,0 +1,68 @@
+<script setup lang="ts">
+import { computed, ref, watch } from 'vue';
+import { RouterLink, RouterView, useRoute } from 'vue-router';
+import { useProjectStore } from '../../../stores/project';
+import { toast } from '../../../lib/toast';
+import Spinner from '../../../components/Spinner.vue';
+
+const project = useProjectStore();
+const route = useRoute();
+const loading = ref(true);
+
+watch(
+  () => project.currentProjectId,
+  async (id) => {
+    if (!id) return;
+    try {
+      await Promise.all([project.loadDevices(), project.loadFirmware()]);
+    } catch (e) {
+      toast.error((e as Error).message);
+    } finally {
+      loading.value = false;
+    }
+  },
+  { immediate: true }
+);
+
+const proj = computed(() => project.currentProjectId ?? '');
+
+const tabs = computed(() => [
+  { name: 'devices', label: 'Devices', to: `/p/${proj.value}/device`, count: project.devices.length },
+  { name: 'firmware', label: 'Firmware', to: `/p/${proj.value}/device/firmware`, count: project.firmware.length },
+]);
+
+const activeName = computed(() => (route.name === 'device-firmware' ? 'firmware' : 'devices'));
+</script>
+
+<template>
+  <div class="mx-auto max-w-5xl px-4 py-6 sm:px-6 sm:py-8">
+    <header class="mb-5">
+      <h1 class="text-xl font-semibold tracking-tight">Devices</h1>
+      <p class="mt-1 text-sm text-neutral-600 dark:text-neutral-400">
+        The boards reporting to this project — and the firmware they can pull over the air.
+      </p>
+    </header>
+
+    <div class="mb-6 border-b border-neutral-200 dark:border-neutral-800">
+      <nav class="-mb-px flex gap-6 text-sm">
+        <RouterLink
+          v-for="t in tabs"
+          :key="t.name"
+          :to="t.to"
+          class="border-b-2 px-1 pb-2.5 font-medium transition"
+          :class="activeName === t.name
+            ? 'border-accent-600 text-accent-700 dark:text-accent-400'
+            : 'border-transparent text-neutral-500 hover:text-neutral-900 dark:text-neutral-400 dark:hover:text-neutral-100'"
+        >
+          {{ t.label }}
+          <span class="ml-1.5 rounded-full bg-neutral-100 px-1.5 py-0.5 text-[10px] text-neutral-600 dark:bg-neutral-800 dark:text-neutral-300">{{ t.count }}</span>
+        </RouterLink>
+      </nav>
+    </div>
+
+    <div v-if="loading" class="flex justify-center py-10">
+      <Spinner size="sm" label="Loading devices…" />
+    </div>
+    <RouterView v-else />
+  </div>
+</template>
diff --git a/web/src/pages/project/device/DevicesList.vue b/web/src/pages/project/device/DevicesList.vue
new file mode 100644
index 0000000..e6529f9
--- /dev/null
+++ b/web/src/pages/project/device/DevicesList.vue
@@ -0,0 +1,221 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue';
+import { RouterLink } from 'vue-router';
+import { useProjectStore } from '../../../stores/project';
+import { confirm } from '../../../lib/confirm';
+import { toast } from '../../../lib/toast';
+import { relativeTime, formatAbsolute } from '../../../lib/time';
+import Dropdown from '../../../components/Dropdown.vue';
+import type { Device } from '../../../types';
+
+const project = useProjectStore();
+
+const editingId = ref<string | null>(null);
+const draftName = ref('');
+
+const firmwareTab = computed(() => `/p/${project.currentProjectId ?? ''}/device/firmware`);
+
+function startEdit(id: string, name: string) {
+  editingId.value = id;
+  draftName.value = name;
+}
+
+// Derived: a device that stops reporting never writes, so no stored flag would flip.
+const OFFLINE_AFTER_SECONDS = 5 * 60;
+
+function online(lastSeen: number | null): boolean {
+  return !!lastSeen && Math.floor(Date.now() / 1000) - lastSeen < OFFLINE_AFTER_SECONDS;
+}
+
+// A template ref inside v-for collects into an array, so focus on mount instead.
+function focusName(el: Element | null) {
+  if (el instanceof HTMLInputElement) {
+    el.focus();
+    el.select();
+  }
+}
+
+async function saveName(id: string) {
+  const name = draftName.value.trim();
+  if (!name) return;
+  try {
+    await project.renameDevice(id, name);
+    editingId.value = null;
+  } catch (e) {
+    toast.error((e as Error).message);
+  }
+}
+
+const firmwareOptions = computed(() =>
+  project.firmware.map((f) => ({
+    value: f.id,
+    label: f.version,
+    hint: relativeTime(f.created_at),
+  }))
+);
+
+async function assign(deviceId: string, firmwareId: string) {
+  try {
+    await project.assignFirmware(deviceId, firmwareId || null);
+  } catch (e) {
+    toast.error((e as Error).message);
+  }
+}
+
+function otaState(d: Device): { text: string; failed: boolean } | null {
+  if (!d.desired_firmware_id || d.ota_status === 'ok') return null;
+  if (d.ota_status === 'failed') {
+    return { text: 'gave up — the board never reported this version', failed: true };
+  }
+  return { text: online(d.last_seen) ? 'waiting for the board' : 'queued until it reports', failed: false };
+}
+
+const otaStates = computed<Record<string, { text: string; failed: boolean } | null>>(() =>
+  Object.fromEntries(project.devices.map((d) => [d.id, otaState(d)]))
+);
+
+async function retry(d: Device) {
+  if (!d.desired_firmware_id) return;
+  try {
+    await project.assignFirmware(d.id, d.desired_firmware_id);
+    toast.success('Offering the update again.');
+  } catch (e) {
+    toast.error((e as Error).message);
+  }
+}
+
+async function forget(id: string, name: string) {
+  const ok = await confirm({
+    title: `Forget ${name}?`,
+    message: 'Its variables and recent history go with it.',
+    details: [
+      'Telemetry already archived is kept.',
+      'A dashboard reading this device needs one picked again.',
+      'The board reappears here if it reports again, as a new device.',
+    ],
+    confirmLabel: 'Forget',
+  });
+  if (!ok) return;
+  try {
+    await project.forgetDevice(id);
+  } catch (e) {
+    toast.error((e as Error).message);
+  }
+}
+</script>
+
+<template>
+  <div class="overflow-hidden rounded-xl border border-neutral-200 dark:border-neutral-800">
+    <table class="w-full text-sm">
+      <thead class="bg-neutral-50 text-left text-xs uppercase tracking-wide text-neutral-500 dark:bg-neutral-900 dark:text-neutral-400">
+        <tr>
+          <th class="px-4 py-2.5 font-medium">Device</th>
+          <th class="px-4 py-2.5 font-medium">Chip</th>
+          <th class="px-4 py-2.5 font-medium">Running</th>
+          <th class="px-4 py-2.5 font-medium">Update to</th>
+          <th class="px-4 py-2.5 font-medium">Last seen</th>
+          <th class="px-4 py-2.5" />
+        </tr>
+      </thead>
+      <tbody class="divide-y divide-neutral-200 dark:divide-neutral-800">
+        <tr
+          v-for="d in project.devices"
+          :key="d.id"
+          class="group align-top hover:bg-neutral-50 dark:hover:bg-neutral-800/50"
+        >
+          <td class="px-4 py-3">
+            <input
+              v-if="editingId === d.id"
+              :ref="(el) => focusName(el as Element | null)"
+              v-model="draftName"
+              class="w-full rounded-md border border-neutral-300 bg-white px-2 py-1 text-sm focus:border-accent-500 focus:outline-none focus:ring-2 focus:ring-accent-500/30 dark:border-neutral-700 dark:bg-neutral-950 dark:text-neutral-100"
+              @keyup.enter="saveName(d.id)"
+              @keyup.esc="editingId = null"
+              @blur="saveName(d.id)"
+            />
+            <template v-else>
+              <span class="inline-flex items-center gap-2 font-medium">
+                <span
+                  class="h-1.5 w-1.5 shrink-0 rounded-full"
+                  :class="online(d.last_seen) ? 'bg-emerald-500' : 'bg-neutral-300 dark:bg-neutral-600'"
+                  :title="online(d.last_seen) ? 'Reporting' : 'Not reporting'"
+                />
+                {{ d.name }}
+                <span
+                  v-if="d.is_default"
+                  class="rounded-full bg-neutral-100 px-1.5 py-0.5 text-[10px] font-normal text-neutral-600 dark:bg-neutral-800 dark:text-neutral-300"
+                >default</span>
+              </span>
+            </template>
+          </td>
+          <td class="px-4 py-3 text-neutral-600 dark:text-neutral-400">{{ d.chip ?? '—' }}</td>
+          <td class="px-4 py-3 font-mono text-xs text-neutral-600 dark:text-neutral-400">
+            {{ d.firmware_version ?? '—' }}
+          </td>
+          <td class="px-4 py-3">
+            <RouterLink
+              v-if="!project.firmware.length"
+              :to="firmwareTab"
+              class="text-xs font-medium text-accent-700 hover:underline dark:text-accent-400"
+            >Upload firmware first</RouterLink>
+            <template v-else>
+              <Dropdown
+                :model-value="d.desired_firmware_id ?? ''"
+                :options="firmwareOptions"
+                placeholder="Nothing pending"
+                size="sm"
+                class="max-w-[13rem]"
+                @update:model-value="(v) => assign(d.id, String(v))"
+              />
+              <p
+                v-if="otaStates[d.id]"
+                class="mt-1 text-[11px]"
+                :class="otaStates[d.id]?.failed ? 'text-amber-700 dark:text-amber-500' : 'text-neutral-500'"
+              >
+                {{ otaStates[d.id]?.text }}
+                <button
+                  v-if="otaStates[d.id]?.failed"
+                  type="button"
+                  class="ml-1 font-medium underline hover:no-underline"
+                  @click="retry(d)"
+                >Try again</button>
+              </p>
+            </template>
+          </td>
+          <td class="px-4 py-3 text-neutral-600 dark:text-neutral-400" :title="d.last_seen ? formatAbsolute(d.last_seen) : ''">
+            {{ d.last_seen ? relativeTime(d.last_seen) : 'Never' }}
+          </td>
+          <td class="whitespace-nowrap px-4 py-3">
+            <div class="flex items-center justify-end gap-1">
+              <button
+                type="button"
+                aria-label="Rename device"
+                title="Rename device"
+                class="rounded-md p-1.5 text-neutral-400 hover:bg-neutral-100 hover:text-neutral-700 dark:hover:bg-neutral-800 dark:hover:text-neutral-200"
+                @click="startEdit(d.id, d.name)"
+              >
+                <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 20h9"/><path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4Z"/></svg>
+              </button>
+              <button
+                v-if="!d.is_default"
+                type="button"
+                aria-label="Forget device"
+                title="Forget device"
+                class="rounded-md p-1.5 text-neutral-400 hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-950/40 dark:hover:text-red-400"
+                @click="forget(d.id, d.name)"
+              >
+                <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M3 6h18"/><path d="M8 6V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6"/><path d="M10 11v6"/><path d="M14 11v6"/></svg>
+              </button>
+              <span v-else class="h-7 w-7" aria-hidden="true" />
+            </div>
+          </td>
+        </tr>
+        <tr v-if="!project.devices.length">
+          <td colspan="6" class="px-4 py-10 text-center text-sm text-neutral-500">
+            No devices yet. A board appears here the first time it reports.
+          </td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
+</template>
diff --git a/web/src/pages/project/device/FirmwareList.vue b/web/src/pages/project/device/FirmwareList.vue
new file mode 100644
index 0000000..ccdbc23
--- /dev/null
+++ b/web/src/pages/project/device/FirmwareList.vue
@@ -0,0 +1,108 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue';
+import { useProjectStore } from '../../../stores/project';
+import { useSessionStore } from '../../../stores/session';
+import { confirm } from '../../../lib/confirm';
+import { toast } from '../../../lib/toast';
+import { relativeTime, formatAbsolute } from '../../../lib/time';
+import FirmwareUploadDialog from '../../../components/FirmwareUploadDialog.vue';
+import type { Firmware } from '../../../types';
+
+const project = useProjectStore();
+const session = useSessionStore();
+
+const showUpload = ref(false);
+
+const isManager = computed(() => session.user?.role === 'owner' || session.user?.role === 'admin');
+
+function sizeLabel(bytes: number): string {
+  return bytes >= 1024 * 1024
+    ? `${(bytes / 1024 / 1024).toFixed(1)} MB`
+    : `${Math.round(bytes / 1024)} kB`;
+}
+
+function adoption(f: Firmware): string {
+  const running = project.devices.filter((d) => d.firmware_version === f.version).length;
+  const pending = project.devices.filter(
+    (d) => d.desired_firmware_id === f.id && d.firmware_version !== f.version
+  ).length;
+  if (!running && !pending) return 'On no board yet';
+  const parts: string[] = [];
+  if (running) parts.push(`${running} running`);
+  if (pending) parts.push(`${pending} pending`);
+  return parts.join(' · ');
+}
+
+async function remove(f: Firmware) {
+  const ok = await confirm({
+    title: `Delete ${f.version}?`,
+    message: 'The image is removed from storage.',
+    details: [
+      'Any board waiting for it stops being offered the update.',
+      'Boards already running it are unaffected.',
+    ],
+    confirmLabel: 'Delete',
+  });
+  if (!ok) return;
+  try {
+    await project.deleteFirmware(f.id);
+  } catch (e) {
+    toast.error((e as Error).message);
+  }
+}
+</script>
+
+<template>
+  <div>
+    <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+      <p class="max-w-xl text-sm text-neutral-600 dark:text-neutral-400">
+        Compile with your own toolchain and upload the app image — <span class="font-mono text-xs">.ino.bin</span>,
+        not the merged one. Assign it to a board on the Devices tab; it pulls the image on its next check.
+      </p>
+      <button
+        v-if="isManager"
+        type="button"
+        class="inline-flex shrink-0 items-center gap-1.5 rounded-md bg-accent-600 px-3.5 py-2 text-sm font-semibold text-white hover:bg-accent-700"
+        @click="showUpload = true"
+      >
+        <svg class="h-4 w-4" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 16V4m0 0L8 8m4-4 4 4M4 20h16"/></svg>
+        Upload firmware
+      </button>
+    </div>
+
+    <ul class="mt-5 divide-y divide-neutral-200 overflow-hidden rounded-xl border border-neutral-200 dark:divide-neutral-800 dark:border-neutral-800">
+      <li
+        v-for="f in project.firmware"
+        :key="f.id"
+        class="flex items-start justify-between gap-4 px-4 py-3"
+      >
+        <div class="min-w-0">
+          <div class="flex flex-wrap items-center gap-2">
+            <span class="font-medium">{{ f.version }}</span>
+            <span
+              v-if="f.target"
+              class="rounded-full bg-neutral-100 px-1.5 py-0.5 text-[10px] text-neutral-600 dark:bg-neutral-800 dark:text-neutral-300"
+            >{{ f.target }}</span>
+            <span class="text-xs text-neutral-500 dark:text-neutral-400">{{ adoption(f) }}</span>
+          </div>
+          <p v-if="f.notes" class="mt-0.5 truncate text-sm text-neutral-600 dark:text-neutral-400">{{ f.notes }}</p>
+          <div class="mt-0.5 text-xs text-neutral-500 dark:text-neutral-400">
+            {{ sizeLabel(f.size) }} · uploaded <span :title="formatAbsolute(f.created_at)">{{ relativeTime(f.created_at) }}</span>
+            · <span class="font-mono" :title="f.sha256">{{ f.sha256.slice(0, 12) }}</span>
+          </div>
+        </div>
+        <button
+          v-if="isManager"
+          type="button"
+          class="shrink-0 rounded-md border border-red-300 px-3 py-1 text-xs text-red-700 hover:bg-red-50 dark:border-red-900 dark:text-red-400 dark:hover:bg-red-950/40"
+          @click="remove(f)"
+        >Delete</button>
+      </li>
+      <li v-if="!project.firmware.length" class="px-4 py-10 text-center text-sm text-neutral-500 dark:text-neutral-400">
+        No firmware yet. Upload an image to update boards without a cable.
+      </li>
+    </ul>
+
+    <FirmwareUploadDialog v-if="showUpload" @close="showUpload = false" />
+  </div>
+</template>
diff --git a/web/src/router.ts b/web/src/router.ts
index 88ae672..bfc70eb 100644
--- a/web/src/router.ts
+++ b/web/src/router.ts
@@ -43,6 +43,14 @@ const routes: RouteRecordRaw[] = [
               { path: 'tokens', name: 'variable-tokens', component: () => import('./pages/project/variables/ConnectionTokens.vue'), meta: { title: 'Connection tokens' } },
             ],
           },
+          {
+            path: 'device',
+            component: () => import('./pages/project/device/DevicesHub.vue'),
+            children: [
+              { path: '', name: 'devices', component: () => import('./pages/project/device/DevicesList.vue'), meta: { title: 'Devices' } },
+              { path: 'firmware', name: 'device-firmware', component: () => import('./pages/project/device/FirmwareList.vue'), meta: { title: 'Firmware' } },
+            ],
+          },
           // Automations + Integrations live under one hub with two tabs.
           {
             path: 'automations',
diff --git a/web/src/stores/project.ts b/web/src/stores/project.ts
index 3774ae9..9acd662 100644
--- a/web/src/stores/project.ts
+++ b/web/src/stores/project.ts
@@ -8,6 +8,8 @@ import type {
   AutomationGraph,
   Dashboard,
   DashboardMeta,
+  Device,
+  Firmware,
   Variable,
   ProjectToken,
   ProjectTokenWithSecret,
@@ -23,6 +25,8 @@ export const useProjectStore = defineStore('project', () => {
   const currentProjectId = ref<string | null>(null);
   const variables = ref<Variable[]>([]);
   const projectTokens = ref<ProjectToken[]>([]);
+  const devices = ref<Device[]>([]);
+  const firmware = ref<Firmware[]>([]);
   const dashboards = ref<DashboardMeta[]>([]);
   const tokens = ref<UserToken[]>([]);
   const automations = ref<Automation[]>([]);
@@ -42,6 +46,8 @@ export const useProjectStore = defineStore('project', () => {
       automations.value = [];
       integrations.value = [];
       projectTokens.value = [];
+      devices.value = [];
+      firmware.value = [];
     }
     currentProjectId.value = projectId;
     await Promise.all([loadVariables(), loadDashboards()]);
@@ -64,6 +70,58 @@ export const useProjectStore = defineStore('project', () => {
     variables.value = data.variables;
   }
 
+  async function loadDevices(): Promise<void> {
+    if (!currentProjectId.value) return;
+    const data = await api.get<{ devices: Device[] }>(
+      `/v1/admin/projects/${currentProjectId.value}/devices`
+    );
+    devices.value = data.devices;
+  }
+
+  async function loadFirmware(): Promise<void> {
+    if (!currentProjectId.value) return;
+    const data = await api.get<{ firmware: Firmware[] }>(
+      `/v1/admin/projects/${currentProjectId.value}/firmware`
+    );
+    firmware.value = data.firmware;
+  }
+
+  async function uploadFirmware(form: FormData): Promise<void> {
+    const pid = requireProjectId();
+    await api.upload(`/v1/admin/projects/${pid}/firmware`, form);
+    await loadFirmware();
+  }
+
+  async function deleteFirmware(id: string): Promise<void> {
+    const pid = requireProjectId();
+    await api.del(`/v1/admin/projects/${pid}/firmware/${id}`);
+    firmware.value = firmware.value.filter((f) => f.id !== id);
+    await loadDevices();
+  }
+
+  async function assignFirmware(deviceId: string, firmwareId: string | null): Promise<void> {
+    const pid = requireProjectId();
+    await api.put(`/v1/admin/projects/${pid}/firmware/assign/${deviceId}`, { firmware_id: firmwareId });
+    await loadDevices();
+  }
+
+  async function renameDevice(id: string, name: string): Promise<void> {
+    const pid = requireProjectId();
+    const { device } = await api.patch<{ device: Device }>(
+      `/v1/admin/projects/${pid}/devices/${id}`,
+      { name }
+    );
+    devices.value = devices.value.map((d) => (d.id === id ? device : d));
+  }
+
+  async function forgetDevice(id: string): Promise<void> {
+    const pid = requireProjectId();
+    await api.del(`/v1/admin/projects/${pid}/devices/${id}`);
+    devices.value = devices.value.filter((d) => d.id !== id);
+    // Its variables went with it.
+    await loadVariables();
+  }
+
   async function createVariable(input: { key: string; unit?: string | null }): Promise<Variable> {
     const pid = requireProjectId();
     const v = await api.post<Variable>(
@@ -370,6 +428,8 @@ export const useProjectStore = defineStore('project', () => {
   return {
     currentProjectId,
     variables,
+    devices,
+    firmware,
     projectTokens,
     dashboards,
     tokens,
@@ -377,6 +437,13 @@ export const useProjectStore = defineStore('project', () => {
     integrations,
     pendingAutomation,
     switchTo,
+    loadDevices,
+    loadFirmware,
+    uploadFirmware,
+    deleteFirmware,
+    assignFirmware,
+    renameDevice,
+    forgetDevice,
     loadVariables,
     createVariable,
     updateVariable,
diff --git a/web/src/types.ts b/web/src/types.ts
index a7897fa..ec1d95c 100644
--- a/web/src/types.ts
+++ b/web/src/types.ts
@@ -70,6 +70,29 @@ export type Variable = {
   last_seen: number | null;
 };
 
+export type Device = {
+  id: string;
+  name: string;
+  chip: string | null;
+  firmware_version: string | null;
+  is_default: number;
+  first_seen: number | null;
+  last_seen: number | null;
+  desired_firmware_id: string | null;
+  ota_status: string | null;
+};
+
+export type Firmware = {
+  id: string;
+  version: string;
+  target: string | null;
+  size: number;
+  sha256: string;
+  notes: string | null;
+  created_at: number;
+};
+
+
 export type ProjectToken = {
   id: string;
   name?: string | null;
@@ -111,6 +134,8 @@ export type MobilePlacement = { id: string; x: number; y: number; w: number; h:
 export type Layout = {
   grid: { columns: number };
   items: WidgetInstance[];
+  // Which device the widgets' variable keys belong to. Absent => the default.
+  device?: string | null;
   // Phone layout override, nested in the same layout JSON (no separate column).
   // Absent/null => auto-derive the phone layout from the desktop items.
   mobile?: { items: MobilePlacement[] } | null;
@@ -177,6 +202,7 @@ export type VariableOperator = '>' | '<' | '>=' | '<=' | '==' | '!=' | 'changed'
 
 export type VariableTriggerConfig = {
   variable: string;                   // variable key
+  device?: string | null;             // device id; absent/empty = any device
   operator: VariableOperator;
   value?: number | string | boolean;  // omitted for 'changed'
   mode?: 'edge' | 'always';           // edge = fire once on entry (default)
diff --git a/web/vite.config.ts b/web/vite.config.ts
index ac92a60..5c843d6 100644
--- a/web/vite.config.ts
+++ b/web/vite.config.ts
@@ -22,7 +22,7 @@ export default defineConfig({
       manifest: false,
       workbox: {
         globPatterns: ['**/*.{js,css,html,svg,png,ico,woff2}'],
-        // og.png is only for social scrapers — no need to precache it offline.
+        // og.png is for social scrapers, not for the app shell.
         globIgnores: ['**/og.png'],
         navigateFallback: '/index.html',
         // Never hijack worker-rendered routes with the SPA fallback.
diff --git a/worker/src/domains/devices/routes.ts b/worker/src/domains/devices/routes.ts
new file mode 100644
index 0000000..dd4fffa
--- /dev/null
+++ b/worker/src/domains/devices/routes.ts
@@ -0,0 +1,58 @@
+import { Hono } from 'hono';
+import type { Env } from '../../env';
+import { requireSession } from '../../platform/middleware/require-session';
+import { resolveProject, type ProjectContextVars } from '../../platform/middleware/resolve-project';
+import { recordAudit } from '../../platform/lib/audit';
+import { listDevices, renameDevice, forgetDevice } from './service';
+import { actorFromSession, serviceErrorResponse } from '../../platform/lib/service';
+
+const devices = new Hono<{ Bindings: Env; Variables: ProjectContextVars }>();
+
+devices.use('*', requireSession);
+devices.use('*', resolveProject);
+
+devices.get('/', async (c) => {
+  const project = c.get('project');
+  return c.json({ devices: await listDevices(c.env, project.id) });
+});
+
+devices.patch('/:id', async (c) => {
+  const project = c.get('project');
+  const id = c.req.param('id');
+  const body = await c.req.json<{ name?: string }>();
+  try {
+    const device = await renameDevice(c.env, project.id, id, body.name ?? '');
+    await recordAudit(c.env, {
+      projectId: project.id,
+      userId: c.get('user').id,
+      action: 'device.rename',
+      targetType: 'device',
+      targetId: id,
+      metadata: { name: device.name },
+    });
+    return c.json({ device });
+  } catch (e) {
+    return serviceErrorResponse(c, e);
+  }
+});
+
+devices.delete('/:id', async (c) => {
+  const project = c.get('project');
+  const id = c.req.param('id');
+  try {
+    await forgetDevice(c.env, project.id, id);
+    await recordAudit(c.env, {
+      projectId: project.id,
+      userId: c.get('user').id,
+      action: 'device.forget',
+      targetType: 'device',
+      targetId: id,
+      metadata: { source: actorFromSession(c.get('user')).source },
+    });
+    return c.body(null, 204);
+  } catch (e) {
+    return serviceErrorResponse(c, e);
+  }
+});
+
+export default devices;
diff --git a/worker/src/domains/devices/service.ts b/worker/src/domains/devices/service.ts
new file mode 100644
index 0000000..bb8ff74
--- /dev/null
+++ b/worker/src/domains/devices/service.ts
@@ -0,0 +1,227 @@
+import type { Env } from '../../env';
+import { newId } from '../../platform/lib/ids';
+import { ServiceError } from '../../platform/lib/service';
+import { projectStub } from '../../platform/durable-objects/stubs';
+
+// storageId is '' for the default device — the DO keys rows by it, so pre-devices
+// rows need no backfill.
+export type ResolvedDevice = { id: string; storageId: string };
+
+export type DeviceSummary = {
+  id: string;
+  name: string;
+  chip: string | null;
+  firmware_version: string | null;
+  is_default: number;
+  first_seen: number | null;
+  last_seen: number | null;
+  desired_firmware_id: string | null;
+  ota_status: string | null;
+};
+
+const MAX_DEVICES_PER_PROJECT = 100;
+const MAX_DEVICE_KEY_LEN = 64;
+
+const resolved = new Map<string, string>();
+
+export function forgetCachedDevice(projectId: string, deviceKey?: string | null) {
+  resolved.delete(cacheKey(projectId, deviceKey ?? null));
+  if (deviceKey) return;
+  for (const k of resolved.keys()) if (k.startsWith(`${projectId}:`)) resolved.delete(k);
+}
+
+function cacheKey(projectId: string, deviceKey: string | null): string {
+  return `${projectId}:${deviceKey ?? ''}`;
+}
+
+export function normaliseDeviceKey(raw: string | null | undefined): string | null {
+  if (typeof raw !== 'string') return null;
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.length > MAX_DEVICE_KEY_LEN) return null;
+  return /^[A-Za-z0-9:._-]+$/.test(trimmed) ? trimmed : null;
+}
+
+export async function defaultDeviceId(env: Env, projectId: string): Promise<string | null> {
+  const cached = resolved.get(cacheKey(projectId, null));
+  if (cached) return cached;
+  const row = await env.DB
+    .prepare(`SELECT id FROM devices WHERE project_id = ? AND is_default = 1`)
+    .bind(projectId)
+    .first<{ id: string }>();
+  if (row) resolved.set(cacheKey(projectId, null), row.id);
+  return row?.id ?? null;
+}
+
+// The migration only covers projects that already existed.
+export function createDefaultDevice(env: Env, projectId: string, now: number) {
+  return env.DB
+    .prepare(
+      `INSERT INTO devices (id, project_id, name, is_default, created_at)
+       VALUES (?, ?, 'Default', 1, ?)`
+    )
+    .bind(newId('device'), projectId, now);
+}
+
+// Created on first sight; a board that names nothing lands on the default device.
+export async function resolveDevice(
+  env: Env,
+  projectId: string,
+  deviceKey: string | null,
+  now: number
+): Promise<ResolvedDevice | null> {
+  if (!deviceKey) {
+    const id = await defaultDeviceId(env, projectId);
+    return id ? { id, storageId: '' } : null;
+  }
+
+  const cached = resolved.get(cacheKey(projectId, deviceKey));
+  if (cached) return { id: cached, storageId: cached };
+
+  const existing = await env.DB
+    .prepare(`SELECT id FROM devices WHERE project_id = ? AND device_key = ?`)
+    .bind(projectId, deviceKey)
+    .first<{ id: string }>();
+  if (existing) {
+    resolved.set(cacheKey(projectId, deviceKey), existing.id);
+    return { id: existing.id, storageId: existing.id };
+  }
+
+  const count = await env.DB
+    .prepare(`SELECT COUNT(*) AS n FROM devices WHERE project_id = ?`)
+    .bind(projectId)
+    .first<{ n: number }>();
+  if ((count?.n ?? 0) >= MAX_DEVICES_PER_PROJECT) {
+    const id = await defaultDeviceId(env, projectId);
+    return id ? { id, storageId: '' } : null;
+  }
+
+  const id = newId('device');
+  await env.DB
+    .prepare(
+      `INSERT INTO devices (id, project_id, name, device_key, first_seen, last_seen, created_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(project_id, device_key) DO NOTHING`
+    )
+    .bind(id, projectId, deviceKey, deviceKey, now, now, now)
+    .run();
+
+  // A concurrent isolate may have won the insert, so read back the id that stuck.
+  const settled = await env.DB
+    .prepare(`SELECT id FROM devices WHERE project_id = ? AND device_key = ?`)
+    .bind(projectId, deviceKey)
+    .first<{ id: string }>();
+  if (!settled) return null;
+  resolved.set(cacheKey(projectId, deviceKey), settled.id);
+  return { id: settled.id, storageId: settled.id };
+}
+
+// DO storage calls the default device '', so a D1 id passed straight through
+// silently matches nothing. Everything crossing that boundary goes through here.
+export async function storageIdOf(env: Env, projectId: string, deviceId: string): Promise<string> {
+  const row = await env.DB
+    .prepare(`SELECT is_default FROM devices WHERE id = ? AND project_id = ?`)
+    .bind(deviceId, projectId)
+    .first<{ is_default: number }>();
+  return row?.is_default ? '' : deviceId;
+}
+
+export async function listDevices(env: Env, projectId: string): Promise<DeviceSummary[]> {
+  const rows = await env.DB
+    .prepare(
+      `SELECT id, name, chip, firmware_version, is_default, first_seen, last_seen,
+              desired_firmware_id, ota_status
+         FROM devices WHERE project_id = ? ORDER BY is_default DESC, name ASC`
+    )
+    .bind(projectId)
+    .all<DeviceSummary>();
+  return rows.results;
+}
+
+const MAX_DEVICE_NAME_LEN = 60;
+
+export async function renameDevice(
+  env: Env,
+  projectId: string,
+  id: string,
+  rawName: string
+): Promise<DeviceSummary> {
+  const name = rawName.trim().slice(0, MAX_DEVICE_NAME_LEN);
+  if (!name) throw new ServiceError('bad_request', 'name is required', 'missing_name');
+  const res = await env.DB
+    .prepare(`UPDATE devices SET name = ? WHERE id = ? AND project_id = ?`)
+    .bind(name, id, projectId)
+    .run();
+  if (res.meta.changes === 0) throw new ServiceError('not_found', 'no such device', 'unknown_device');
+  const row = await env.DB
+    .prepare(
+      `SELECT id, name, chip, firmware_version, is_default, first_seen, last_seen,
+              desired_firmware_id, ota_status
+         FROM devices WHERE id = ?`
+    )
+    .bind(id)
+    .first<DeviceSummary>();
+  return row!;
+}
+
+// R2 history stays readable without the row — the device is named in each row.
+export async function forgetDevice(env: Env, projectId: string, id: string): Promise<void> {
+  const row = await env.DB
+    .prepare(`SELECT is_default, device_key FROM devices WHERE id = ? AND project_id = ?`)
+    .bind(id, projectId)
+    .first<{ is_default: number; device_key: string | null }>();
+  if (!row) throw new ServiceError('not_found', 'no such device', 'unknown_device');
+  if (row.is_default) {
+    throw new ServiceError('conflict', 'the default device cannot be forgotten', 'default_device');
+  }
+
+  await env.DB.batch([
+    env.DB.prepare(`DELETE FROM project_variables WHERE device_id = ?`).bind(id),
+    env.DB.prepare(`DELETE FROM devices WHERE id = ? AND project_id = ?`).bind(id, projectId),
+  ]);
+  forgetCachedDevice(projectId, row.device_key);
+  await projectStub(env, projectId).deleteDevice(id);
+}
+
+const SEEN_THROTTLE_MS = 60_000;
+const seenWrites = new Map<string, number>();
+
+// Ingest is hot and last_seen only needs to be roughly right.
+export async function touchDevice(env: Env, id: string): Promise<void> {
+  const nowMs = Date.now();
+  const prev = seenWrites.get(id);
+  if (prev !== undefined && nowMs - prev < SEEN_THROTTLE_MS) return;
+  seenWrites.set(id, nowMs);
+  if (seenWrites.size > 10_000) {
+    const cutoff = nowMs - SEEN_THROTTLE_MS;
+    for (const [k, t] of seenWrites) if (t < cutoff) seenWrites.delete(k);
+  }
+  const now = Math.floor(nowMs / 1000);
+  try {
+    await env.DB
+      .prepare(`UPDATE devices SET last_seen = ?, first_seen = COALESCE(first_seen, ?) WHERE id = ?`)
+      .bind(now, now, id)
+      .run();
+  } catch {
+    seenWrites.delete(id);
+  }
+}
+
+export async function recordDeviceSeen(
+  env: Env,
+  id: string,
+  chip?: string,
+  firmware?: string
+): Promise<void> {
+  const now = Math.floor(Date.now() / 1000);
+  await env.DB
+    .prepare(
+      `UPDATE devices
+          SET last_seen = ?,
+              first_seen = COALESCE(first_seen, ?),
+              chip = COALESCE(?, chip),
+              firmware_version = COALESCE(?, firmware_version)
+        WHERE id = ?`
+    )
+    .bind(now, now, chip ?? null, firmware ?? null, id)
+    .run();
+}
diff --git a/worker/src/domains/firmware/admin.ts b/worker/src/domains/firmware/admin.ts
new file mode 100644
index 0000000..caa58b1
--- /dev/null
+++ b/worker/src/domains/firmware/admin.ts
@@ -0,0 +1,111 @@
+import { Hono } from 'hono';
+import type { Env } from '../../env';
+import { requireSession } from '../../platform/middleware/require-session';
+import { resolveProject, type ProjectContextVars } from '../../platform/middleware/resolve-project';
+import { recordAudit } from '../../platform/lib/audit';
+import { serviceErrorResponse } from '../../platform/lib/service';
+import { listFirmware, deleteFirmware, assignFirmware, uploadFirmware, MAX_IMAGE_BYTES } from './ota';
+
+const admin = new Hono<{ Bindings: Env; Variables: ProjectContextVars }>();
+
+admin.use('*', requireSession);
+admin.use('*', resolveProject);
+
+// Unlike the rest of the project routers, writes here are owner/admin: putting
+// an image on a board isn't undoable from the dashboard.
+admin.use('*', async (c, next) => {
+  if (c.req.method === 'GET') return next();
+  const role = c.get('user').role;
+  if (role !== 'owner' && role !== 'admin') return c.json({ error: 'forbidden' }, 403);
+  await next();
+});
+
+admin.get('/', async (c) => {
+  const project = c.get('project');
+  return c.json({ firmware: await listFirmware(c.env, project.id) });
+});
+
+admin.post('/', async (c) => {
+  const project = c.get('project');
+  const user = c.get('user');
+
+  // Refuse on the header rather than after buffering; the slack is multipart framing.
+  const len = Number(c.req.header('content-length') ?? '0');
+  if (Number.isFinite(len) && len > MAX_IMAGE_BYTES + 4096) {
+    return c.json({ error: 'image_too_large', max_bytes: MAX_IMAGE_BYTES }, 413);
+  }
+
+  let form: FormData;
+  try {
+    form = await c.req.formData();
+  } catch {
+    return c.json({ error: 'bad_request', reason: 'invalid_form_data' }, 400);
+  }
+
+  // workers-types models a form entry as string | File-like, so narrow through unknown.
+  const file = form.get('file') as unknown;
+  if (!(file instanceof File)) return c.json({ error: 'bad_request', reason: 'missing_file' }, 400);
+  if (file.size > MAX_IMAGE_BYTES) {
+    return c.json({ error: 'image_too_large', max_bytes: MAX_IMAGE_BYTES }, 413);
+  }
+
+  const rawNotes = form.get('notes');
+  try {
+    const row = await uploadFirmware(c.env, project.id, user.id, {
+      version: String(form.get('version') ?? ''),
+      notes: typeof rawNotes === 'string' && rawNotes.trim() ? rawNotes.trim() : null,
+      body: await file.arrayBuffer(),
+    });
+    await recordAudit(c.env, {
+      projectId: project.id,
+      userId: user.id,
+      action: 'firmware.upload',
+      targetType: 'firmware',
+      targetId: row.id,
+      metadata: { version: row.version, size: row.size, target: row.target },
+    });
+    return c.json({ firmware: row }, 201);
+  } catch (e) {
+    return serviceErrorResponse(c, e);
+  }
+});
+
+admin.delete('/:id', async (c) => {
+  const project = c.get('project');
+  const id = c.req.param('id');
+  try {
+    await deleteFirmware(c.env, project.id, id);
+    await recordAudit(c.env, {
+      projectId: project.id,
+      userId: c.get('user').id,
+      action: 'firmware.delete',
+      targetType: 'firmware',
+      targetId: id,
+    });
+    return c.body(null, 204);
+  } catch (e) {
+    return serviceErrorResponse(c, e);
+  }
+});
+
+admin.put('/assign/:deviceId', async (c) => {
+  const project = c.get('project');
+  const deviceId = c.req.param('deviceId');
+  const body = await c.req.json<{ firmware_id?: string | null }>();
+  try {
+    await assignFirmware(c.env, project.id, deviceId, body.firmware_id ?? null);
+    await recordAudit(c.env, {
+      projectId: project.id,
+      userId: c.get('user').id,
+      action: 'firmware.assign',
+      targetType: 'device',
+      targetId: deviceId,
+      metadata: { firmware_id: body.firmware_id ?? null },
+    });
+    return c.body(null, 204);
+  } catch (e) {
+    return serviceErrorResponse(c, e);
+  }
+});
+
+export default admin;
diff --git a/worker/src/domains/firmware/device.ts b/worker/src/domains/firmware/device.ts
new file mode 100644
index 0000000..46ddea9
--- /dev/null
+++ b/worker/src/domains/firmware/device.ts
@@ -0,0 +1,64 @@
+import { Hono, type Context } from 'hono';
+import type { Env } from '../../env';
+import { requireProjectToken, type ProjectTokenContextVars } from '../../platform/middleware/require-project-token';
+import { normaliseDeviceKey, recordDeviceSeen, resolveDevice, touchDevice } from '../devices/service';
+import { offerFor, openImage, reconcile, recordOtaAttempt } from './ota';
+import { projectStub } from '../../platform/durable-objects/stubs';
+import { storageIdOf } from '../devices/service';
+
+type OtaContext = Context<{ Bindings: Env; Variables: ProjectTokenContextVars }>;
+
+const ota = new Hono<{ Bindings: Env; Variables: ProjectTokenContextVars }>();
+
+ota.use('*', requireProjectToken);
+
+async function deviceIdFor(c: OtaContext, projectId: string, seen = true) {
+  const device = await resolveDevice(
+    c.env,
+    projectId,
+    normaliseDeviceKey(c.req.header('x-nodrix-device')),
+    Math.floor(Date.now() / 1000)
+  );
+  if (device && seen) c.executionCtx.waitUntil(touchDevice(c.env, device.id));
+  return device?.id ?? null;
+}
+
+// null means the board is already where it should be.
+ota.get('/', async (c) => {
+  const { project_id } = c.get('projectToken');
+  // An HTTP-mode board has no hello frame, so this is where it reports what it
+  // runs — without it a finished update is offered again forever.
+  const firmware = c.req.header('x-nodrix-firmware') ?? null;
+  const deviceId = await deviceIdFor(c, project_id, !firmware);
+  if (!deviceId) return c.json({ update: null });
+
+  if (firmware) {
+    c.executionCtx.waitUntil(
+      recordDeviceSeen(c.env, deviceId, c.req.header('x-nodrix-chip'), firmware)
+        .then(() => reconcile(c.env, deviceId, firmware))
+    );
+  }
+  return c.json({ update: await offerFor(c.env, project_id, deviceId, firmware) });
+});
+
+ota.get('/image', async (c) => {
+  const { project_id } = c.get('projectToken');
+  const deviceId = await deviceIdFor(c, project_id);
+  if (!deviceId) return c.json({ error: 'not_found' }, 404);
+  const storageId = await storageIdOf(c.env, project_id, deviceId);
+  if (!(await projectStub(c.env, project_id).consumeOtaQuota(storageId))) {
+    return c.json({ error: 'too_many_requests' }, 429, { 'retry-after': '3600' });
+  }
+
+  const object = await openImage(c.env, project_id, deviceId);
+  if (!object) return c.json({ error: 'not_found' }, 404);
+  c.executionCtx.waitUntil(recordOtaAttempt(c.env, deviceId));
+  return new Response(object.body, {
+    headers: {
+      'Content-Type': 'application/octet-stream',
+      'Content-Length': String(object.size),
+    },
+  });
+});
+
+export default ota;
diff --git a/worker/src/domains/firmware/image.ts b/worker/src/domains/firmware/image.ts
new file mode 100644
index 0000000..183e7d1
--- /dev/null
+++ b/worker/src/domains/firmware/image.ts
@@ -0,0 +1,48 @@
+// What an uploaded .bin is, read from its own bytes.
+
+export type ImageCheck =
+  | { ok: true; chip: string | null }
+  | { ok: false; code: 'not_an_esp_image' | 'merged_image'; reason: string };
+
+const ESP_MAGIC = 0xe9;
+const PARTITION_TABLE_OFFSET = 0x8000;
+const PARTITION_MAGIC = [0xaa, 0x50];
+
+// chip_id sits at byte 12 of esp_image_header_t. ESP8266 images have no such
+// field, so an unknown id means "don't claim to know", not "wrong chip".
+const CHIP_IDS: Record<number, string> = {
+  0x0000: 'esp32',
+  0x0002: 'esp32-s2',
+  0x0005: 'esp32-c3',
+  0x0009: 'esp32-s3',
+  0x000c: 'esp32-c2',
+  0x000d: 'esp32-c6',
+  0x0010: 'esp32-h2',
+};
+
+export function inspectImage(body: ArrayBuffer): ImageCheck {
+  const bytes = new Uint8Array(body);
+  if (bytes.length < 24 || bytes[0] !== ESP_MAGIC) {
+    return {
+      ok: false,
+      code: 'not_an_esp_image',
+      reason: 'that file is not an ESP firmware image',
+    };
+  }
+
+  // OTA writes to an app slot, so a whole-flash image would brick the board.
+  if (
+    bytes.length > PARTITION_TABLE_OFFSET + 1 &&
+    bytes[PARTITION_TABLE_OFFSET] === PARTITION_MAGIC[0] &&
+    bytes[PARTITION_TABLE_OFFSET + 1] === PARTITION_MAGIC[1]
+  ) {
+    return {
+      ok: false,
+      code: 'merged_image',
+      reason: 'that is a merged flash image — upload the .ino.bin (app image) instead',
+    };
+  }
+
+  const chipId = bytes[12]! | (bytes[13]! << 8);
+  return { ok: true, chip: CHIP_IDS[chipId] ?? null };
+}
diff --git a/worker/src/domains/firmware/ota.ts b/worker/src/domains/firmware/ota.ts
new file mode 100644
index 0000000..cbd2356
--- /dev/null
+++ b/worker/src/domains/firmware/ota.ts
@@ -0,0 +1,226 @@
+import type { Env } from '../../env';
+import { newId } from '../../platform/lib/ids';
+import { ServiceError } from '../../platform/lib/service';
+import { projectStub } from '../../platform/durable-objects/stubs';
+import { storageIdOf } from '../devices/service';
+import { inspectImage } from './image';
+
+export const MAX_IMAGE_BYTES = 8 * 1024 * 1024;
+const KEEP_VERSIONS = 10;
+const SAFE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,63}$/;
+
+export type FirmwareRow = {
+  id: string;
+  version: string;
+  target: string | null;
+  size: number;
+  sha256: string;
+  notes: string | null;
+  created_at: number;
+};
+
+function r2Key(projectId: string, firmwareId: string): string {
+  return `firmware/${projectId}/${firmwareId}.bin`;
+}
+
+// The version is the only handle the board reports back, so it has to match what
+// the sketch passes to setFirmwareVersion() — see reconcile().
+export async function uploadFirmware(
+  env: Env,
+  projectId: string,
+  userId: string,
+  input: { version: string; notes: string | null; body: ArrayBuffer }
+): Promise<FirmwareRow> {
+  const version = input.version.trim();
+  if (!version) throw new ServiceError('bad_request', 'a version is required', 'missing_version');
+  if (!SAFE_VERSION.test(version)) {
+    throw new ServiceError(
+      'bad_request',
+      'a version is letters, digits, dot, underscore, plus or dash, up to 64 characters',
+      'invalid_version'
+    );
+  }
+  if (input.body.byteLength === 0) throw new ServiceError('bad_request', 'the image is empty', 'empty_image');
+  if (input.body.byteLength > MAX_IMAGE_BYTES) {
+    throw new ServiceError('bad_request', 'the image is too large', 'image_too_large');
+  }
+
+  const check = inspectImage(input.body);
+  if (!check.ok) throw new ServiceError('bad_request', check.reason, check.code);
+
+  const digest = await crypto.subtle.digest('SHA-256', input.body);
+  const sha256 = [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join('');
+
+  const id = newId('firmware');
+  const key = r2Key(projectId, id);
+  const now = Math.floor(Date.now() / 1000);
+
+  await env.R2.put(key, input.body, { httpMetadata: { contentType: 'application/octet-stream' } });
+  try {
+    await env.DB
+      .prepare(
+        `INSERT INTO firmware (id, project_id, version, target, size, sha256, r2_key, notes, created_by, created_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      )
+      .bind(id, projectId, version, check.chip, input.body.byteLength, sha256, key, input.notes, userId, now)
+      .run();
+  } catch {
+    await env.R2.delete(key).catch(() => {});
+    throw new ServiceError('conflict', `version ${version} already exists`, 'duplicate_version');
+  }
+
+  await prune(env, projectId).catch(() => {});
+  return {
+    id,
+    version,
+    target: check.chip,
+    size: input.body.byteLength,
+    sha256,
+    notes: input.notes,
+    created_at: now,
+  };
+}
+
+// Spares anything a device runs or is waiting to run; deleting those strands a
+// pending update or loses the image a board is on.
+async function prune(env: Env, projectId: string): Promise<void> {
+  const stale = await env.DB
+    .prepare(
+      `SELECT id, r2_key FROM firmware
+        WHERE project_id = ?
+          AND id NOT IN (SELECT id FROM firmware WHERE project_id = ? ORDER BY created_at DESC LIMIT ?)
+          AND id NOT IN (SELECT desired_firmware_id FROM devices
+                          WHERE project_id = ? AND desired_firmware_id IS NOT NULL)
+          AND version NOT IN (SELECT firmware_version FROM devices
+                               WHERE project_id = ? AND firmware_version IS NOT NULL)`
+    )
+    .bind(projectId, projectId, KEEP_VERSIONS, projectId, projectId)
+    .all<{ id: string; r2_key: string }>();
+  if (stale.results.length === 0) return;
+
+  await env.DB.batch(
+    stale.results.map((r) => env.DB.prepare(`DELETE FROM firmware WHERE id = ?`).bind(r.id))
+  );
+  await env.R2.delete(stale.results.map((r) => r.r2_key)).catch(() => {});
+}
+
+export async function listFirmware(env: Env, projectId: string): Promise<FirmwareRow[]> {
+  const rows = await env.DB
+    .prepare(
+      `SELECT id, version, target, size, sha256, notes, created_at
+         FROM firmware WHERE project_id = ? ORDER BY created_at DESC`
+    )
+    .bind(projectId)
+    .all<FirmwareRow>();
+  return rows.results;
+}
+
+export async function deleteFirmware(env: Env, projectId: string, id: string): Promise<void> {
+  const row = await env.DB
+    .prepare(`SELECT r2_key FROM firmware WHERE id = ? AND project_id = ?`)
+    .bind(id, projectId)
+    .first<{ r2_key: string }>();
+  if (!row) throw new ServiceError('not_found', 'no such firmware', 'unknown_firmware');
+  await env.DB.prepare(`DELETE FROM firmware WHERE id = ? AND project_id = ?`).bind(id, projectId).run();
+  await env.R2.delete(row.r2_key).catch(() => {});
+}
+
+// Setting desired state is the whole of starting an update.
+export async function assignFirmware(
+  env: Env,
+  projectId: string,
+  deviceId: string,
+  firmwareId: string | null
+): Promise<void> {
+  if (firmwareId) {
+    const fw = await env.DB
+      .prepare(`SELECT 1 AS ok FROM firmware WHERE id = ? AND project_id = ?`)
+      .bind(firmwareId, projectId)
+      .first<{ ok: number }>();
+    if (!fw) throw new ServiceError('not_found', 'no such firmware', 'unknown_firmware');
+  }
+  // Assigning is also the retry: a device parked at 'failed' starts over.
+  const res = await env.DB
+    .prepare(
+      `UPDATE devices SET desired_firmware_id = ?, ota_status = ?, ota_updated_at = ?, ota_attempts = 0
+        WHERE id = ? AND project_id = ?`
+    )
+    .bind(firmwareId, firmwareId ? 'pending' : null, Math.floor(Date.now() / 1000), deviceId, projectId)
+    .run();
+  if (res.meta.changes === 0) throw new ServiceError('not_found', 'no such device', 'unknown_device');
+
+  // Best-effort — the board would find it at its next poll anyway.
+  if (firmwareId) {
+    const storageId = await storageIdOf(env, projectId, deviceId);
+    await projectStub(env, projectId).notifyOta(storageId).catch(() => {});
+  }
+}
+
+export type UpdateOffer = { version: string; size: number; sha256: string; url: string } | null;
+
+export const MAX_OTA_ATTEMPTS = 3;
+
+// Reported vs desired is the whole reconciliation; there is no job to track.
+// A version the board claims in this request beats the stored one, which may not
+// have caught up with the update it just applied.
+export async function offerFor(
+  env: Env,
+  projectId: string,
+  deviceId: string,
+  reported?: string | null
+): Promise<UpdateOffer> {
+  const row = await env.DB
+    .prepare(
+      `SELECT f.version AS version, f.size AS size, f.sha256 AS sha256,
+              d.firmware_version AS current, d.ota_status AS status
+         FROM devices d JOIN firmware f ON f.id = d.desired_firmware_id
+        WHERE d.id = ? AND d.project_id = ?`
+    )
+    .bind(deviceId, projectId)
+    .first<{ version: string; size: number; sha256: string; current: string | null; status: string | null }>();
+  if (!row || (reported ?? row.current) === row.version) return null;
+  if (row.status === 'failed') return null;
+  return { version: row.version, size: row.size, sha256: row.sha256, url: '/v1/ota/image' };
+}
+
+export async function recordOtaAttempt(env: Env, deviceId: string): Promise<void> {
+  await env.DB
+    .prepare(`UPDATE devices SET ota_attempts = ota_attempts + 1 WHERE id = ?`)
+    .bind(deviceId)
+    .run();
+}
+
+export async function openImage(env: Env, projectId: string, deviceId: string): Promise<R2ObjectBody | null> {
+  const row = await env.DB
+    .prepare(
+      `SELECT f.r2_key AS r2_key FROM devices d JOIN firmware f ON f.id = d.desired_firmware_id
+        WHERE d.id = ? AND d.project_id = ?`
+    )
+    .bind(deviceId, projectId)
+    .first<{ r2_key: string }>();
+  if (!row) return null;
+  return env.R2.get(row.r2_key);
+}
+
+// Only the board knows it booted, so reporting the version is the success signal.
+// Reporting something else after MAX_OTA_ATTEMPTS pulls means the update isn't
+// landing — usually the sketch's version doesn't match the one on the upload.
+export async function reconcile(env: Env, deviceId: string, reported: string | null): Promise<void> {
+  if (!reported) return;
+  await env.DB
+    .prepare(
+      `UPDATE devices
+          SET ota_status = CASE
+                WHEN desired_firmware_id IS NULL THEN NULL
+                WHEN ? = (SELECT version FROM firmware WHERE id = desired_firmware_id) THEN 'ok'
+                WHEN ota_attempts >= ? THEN 'failed'
+                ELSE ota_status END,
+              ota_attempts = CASE
+                WHEN ? = (SELECT version FROM firmware WHERE id = desired_firmware_id) THEN 0
+                ELSE ota_attempts END,
+              ota_updated_at = ?
+        WHERE id = ?`
+    )
+    .bind(reported, MAX_OTA_ATTEMPTS, reported, Math.floor(Date.now() / 1000), deviceId)
+    .run();
+}
diff --git a/worker/src/domains/projects/export.ts b/worker/src/domains/projects/export.ts
new file mode 100644
index 0000000..dbcd7f0
--- /dev/null
+++ b/worker/src/domains/projects/export.ts
@@ -0,0 +1,74 @@
+import type { Env } from '../../env';
+
+// A project as NDJSON, one typed record per line. Streamed: a year of history is
+// larger than anything that should sit in memory. Carries no secrets — token
+// hashes, sealed integration config and share tokens are all omitted.
+
+type Row = Record<string, unknown>;
+
+function line(type: string, data: Row): string {
+  return `${JSON.stringify({ type, ...data })}\n`;
+}
+
+async function* records(env: Env, projectId: string): AsyncGenerator<string> {
+  const project = await env.DB
+    .prepare(`SELECT id, name, description, created_at, updated_at FROM projects WHERE id = ?`)
+    .bind(projectId)
+    .first<Row>();
+  if (!project) return;
+
+  yield line('project', { exported_at: Math.floor(Date.now() / 1000), project });
+
+  const tables: Array<[string, string]> = [
+    ['device', `SELECT id, name, device_key, chip, firmware_version, is_default, first_seen, last_seen, created_at
+                  FROM devices WHERE project_id = ?`],
+    ['variable', `SELECT id, device_id, key, unit, created_at, updated_at, last_seen
+                    FROM project_variables WHERE project_id = ?`],
+    ['dashboard', `SELECT id, name, description, layout, visibility, created_at, updated_at
+                     FROM dashboards WHERE project_id = ?`],
+    ['automation', `SELECT id, name, description, enabled, trigger_type, graph, created_at, updated_at
+                      FROM automations WHERE project_id = ?`],
+    ['integration', `SELECT id, name, kind, enabled, created_at, updated_at
+                       FROM integrations WHERE project_id = ?`],
+    ['firmware', `SELECT id, version, target, size, sha256, notes, created_at
+                    FROM firmware WHERE project_id = ?`],
+  ];
+
+  for (const [type, sql] of tables) {
+    const rows = await env.DB.prepare(sql).bind(projectId).all<Row>();
+    for (const row of rows.results) yield line(type, row);
+  }
+
+  // Already NDJSON in R2; re-tagged so the whole file reads uniformly.
+  let cursor: string | undefined;
+  do {
+    const list = await env.R2.list({ prefix: `telemetry/${projectId}/`, ...(cursor ? { cursor } : {}) });
+    for (const object of list.objects) {
+      const body = await env.R2.get(object.key);
+      if (!body) continue;
+      const text = await body.text();
+      for (const raw of text.split('\n')) {
+        if (!raw.trim()) continue;
+        try {
+          yield line('telemetry', JSON.parse(raw) as Row);
+        } catch { /* a truncated line beats aborting the export */ }
+      }
+    }
+    cursor = list.truncated ? list.cursor : undefined;
+  } while (cursor);
+}
+
+export function exportProject(env: Env, projectId: string): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  const iterator = records(env, projectId);
+  return new ReadableStream({
+    async pull(controller) {
+      const next = await iterator.next();
+      if (next.done) controller.close();
+      else controller.enqueue(encoder.encode(next.value));
+    },
+    cancel() {
+      void iterator.return(undefined);
+    },
+  });
+}
diff --git a/worker/src/domains/projects/routes.ts b/worker/src/domains/projects/routes.ts
index 360639c..f4ca011 100644
--- a/worker/src/domains/projects/routes.ts
+++ b/worker/src/domains/projects/routes.ts
@@ -4,6 +4,7 @@ import { requireSession, type UserContextVars } from '../../platform/middleware/
 import { recordAudit } from '../../platform/lib/audit';
 import { userCanAccessProject } from '../../platform/lib/roles';
 import { projectStub } from '../../platform/durable-objects/stubs';
+import { exportProject } from './export';
 import { createProject, updateProject, listAccessibleProjects } from './service';
 import { actorFromSession, serviceErrorResponse } from '../../platform/lib/service';
 
@@ -52,6 +53,29 @@ projects.post('/:proj/flush', async (c) => {
   return c.json(result);
 });
 
+// Everything the project owns, as NDJSON. Streamed — a project with a year of
+// history is far too big to assemble in memory. Carries no secrets.
+projects.get('/:proj/export', async (c) => {
+  const projId = c.req.param('proj');
+  const user = c.get('user');
+  if (!(await userCanAccessProject(c.env, user.id, projId))) return c.json({ error: 'forbidden' }, 403);
+
+  await recordAudit(c.env, {
+    projectId: projId,
+    userId: user.id,
+    action: 'project.export',
+    targetType: 'project',
+    targetId: projId,
+  });
+
+  return new Response(exportProject(c.env, projId), {
+    headers: {
+      'Content-Type': 'application/x-ndjson',
+      'Content-Disposition': `attachment; filename="${projId}.ndjson"`,
+    },
+  });
+});
+
 // Cascade: wipes the project's Project DO (which owns R2 telemetry history, not
 // covered by D1 FK cascade), then deletes the D1 row — which cascades dashboards,
 // project_variables, project_tokens, user_tokens, project_members via FK.
diff --git a/worker/src/domains/projects/service.ts b/worker/src/domains/projects/service.ts
index d54c8b5..5d184c0 100644
--- a/worker/src/domains/projects/service.ts
+++ b/worker/src/domains/projects/service.ts
@@ -1,6 +1,7 @@
 import type { Env } from '../../env';
 import { type Actor, isInstanceAdmin, ServiceError } from '../../platform/lib/service';
 import { newId } from '../../platform/lib/ids';
+import { createDefaultDevice } from '../devices/service';
 import { recordAudit } from '../../platform/lib/audit';
 import { buildUpdate, chunk, inClause, MAX_BOUND_PARAMS } from '../../platform/lib/sql';
 
@@ -103,12 +104,13 @@ export async function createProject(
 
   const id = newId('project');
   const now = Math.floor(Date.now() / 1000);
-  await env.DB
-    .prepare(
-      `INSERT INTO projects (id, name, created_by, created_at, updated_at) VALUES (?, ?, ?, ?, ?)`
-    )
-    .bind(id, name, actor.userId, now, now)
-    .run();
+  // One batch so a project can never exist without its default device.
+  await env.DB.batch([
+    env.DB
+      .prepare(`INSERT INTO projects (id, name, created_by, created_at, updated_at) VALUES (?, ?, ?, ?, ?)`)
+      .bind(id, name, actor.userId, now, now),
+    createDefaultDevice(env, id, now),
+  ]);
 
   await recordAudit(env, {
     projectId: id,
diff --git a/worker/src/domains/telemetry/control.ts b/worker/src/domains/telemetry/control.ts
index 80a8b9b..3bf6200 100644
--- a/worker/src/domains/telemetry/control.ts
+++ b/worker/src/domains/telemetry/control.ts
@@ -3,6 +3,7 @@ import type { Env } from '../../env';
 import { requireProjectToken, type ProjectTokenContextVars } from '../../platform/middleware/require-project-token';
 import { lookupProjectToken, touchTokenLastUsed } from '../../platform/lib/tokens';
 import { projectStub } from '../../platform/durable-objects/stubs';
+import { normaliseDeviceKey, resolveDevice, touchDevice } from '../devices/service';
 
 const control = new Hono<{ Bindings: Env; Variables: ProjectTokenContextVars }>();
 
@@ -12,8 +13,15 @@ control.use('*', requireProjectToken);
 // Pending cloud->hardware variable writes for the authenticated project.
 control.get('/', async (c) => {
   const { project_id } = c.get('projectToken');
+  const device = await resolveDevice(
+    c.env,
+    project_id,
+    normaliseDeviceKey(c.req.header('x-nodrix-device')),
+    Math.floor(Date.now() / 1000)
+  );
+  if (device) c.executionCtx.waitUntil(touchDevice(c.env, device.id));
   const stub = projectStub(c.env, project_id);
-  const pending = await stub.listPendingControl();
+  const pending = await stub.listPendingControl(device?.storageId ?? '');
   return c.json({ control: pending });
 });
 
@@ -24,8 +32,14 @@ control.post('/ack', async (c) => {
   if (ids.length === 0) return c.json({ acked: 0 });
 
   const { project_id } = c.get('projectToken');
+  const device = await resolveDevice(
+    c.env,
+    project_id,
+    normaliseDeviceKey(c.req.header('x-nodrix-device')),
+    Math.floor(Date.now() / 1000)
+  );
   const stub = projectStub(c.env, project_id);
-  const result = await stub.ackControl(ids);
+  const result = await stub.ackControl(ids, device?.storageId ?? '');
   return c.json(result);
 });
 
diff --git a/worker/src/domains/telemetry/telemetry.ts b/worker/src/domains/telemetry/telemetry.ts
index a641dd7..b5a429c 100644
--- a/worker/src/domains/telemetry/telemetry.ts
+++ b/worker/src/domains/telemetry/telemetry.ts
@@ -4,6 +4,7 @@ import { requireProjectToken, type ProjectTokenContextVars } from '../../platfor
 import { projectStub } from '../../platform/durable-objects/stubs';
 import { parseTelemetryBody, MAX_POINTS, MAX_KEY_LEN, MAX_STRING_VALUE } from './validate';
 import { upsertVariables } from './variables';
+import { normaliseDeviceKey, resolveDevice, touchDevice } from '../devices/service';
 
 const telemetry = new Hono<{ Bindings: Env; Variables: ProjectTokenContextVars }>();
 
@@ -40,14 +41,22 @@ telemetry.post('/', async (c) => {
   const points = parsed.points;
 
   const { project_id } = c.get('projectToken');
+  const now = Math.floor(Date.now() / 1000);
+  const deviceKey = normaliseDeviceKey(c.req.header('x-nodrix-device'));
+  const device = await resolveDevice(c.env, project_id, deviceKey, now);
+
   const stub = projectStub(c.env, project_id);
-  await stub.ingest(project_id, points);
+  await stub.ingest(project_id, points, device?.storageId ?? '');
 
   // Auto-create new variables + bump last_seen off the response path (best-effort).
-  const now = Math.floor(Date.now() / 1000);
-  c.executionCtx.waitUntil(
-    upsertVariables(c.env, project_id, points.map((p) => p.variable), now)
-  );
+  if (device) {
+    c.executionCtx.waitUntil(
+      Promise.all([
+        upsertVariables(c.env, project_id, device.id, points.map((p) => p.variable), now),
+        touchDevice(c.env, device.id),
+      ])
+    );
+  }
 
   return c.body(null, 204);
 });
diff --git a/worker/src/domains/telemetry/variables.ts b/worker/src/domains/telemetry/variables.ts
index 9434a9f..4bd8351 100644
--- a/worker/src/domains/telemetry/variables.ts
+++ b/worker/src/domains/telemetry/variables.ts
@@ -12,8 +12,8 @@ const MAX_VARIABLES_PER_PROJECT = 250;
 const LAST_SEEN_THROTTLE_MS = 60_000;
 const lastSeenWrites = new Map<string, number>();
 
-function dueForLastSeen(projectId: string, key: string, nowMs: number): boolean {
-  const k = `${projectId}:${key}`;
+function dueForLastSeen(deviceId: string, key: string, nowMs: number): boolean {
+  const k = `${deviceId}:${key}`;
   const prev = lastSeenWrites.get(k);
   if (prev !== undefined && nowMs - prev < LAST_SEEN_THROTTLE_MS) return false;
   lastSeenWrites.set(k, nowMs);
@@ -27,11 +27,12 @@ function dueForLastSeen(projectId: string, key: string, nowMs: number): boolean
 export async function upsertVariables(
   env: Env,
   projectId: string,
+  deviceId: string,
   keys: string[],
   now: number
 ): Promise<void> {
   const nowMs = Date.now();
-  const due = [...new Set(keys)].filter((key) => dueForLastSeen(projectId, key, nowMs));
+  const due = [...new Set(keys)].filter((key) => dueForLastSeen(deviceId, key, nowMs));
   if (due.length === 0) return;
   try {
     // Existing keys only refresh last_seen; new keys count against the cap. Chunk the
@@ -40,8 +41,8 @@ export async function upsertVariables(
     for (const part of chunk(due, MAX_BOUND_PARAMS - 1)) {
       const placeholders = part.map(() => '?').join(',');
       const rows = await env.DB
-        .prepare(`SELECT key FROM project_variables WHERE project_id = ? AND key IN (${placeholders})`)
-        .bind(projectId, ...part)
+        .prepare(`SELECT key FROM project_variables WHERE device_id = ? AND key IN (${placeholders})`)
+        .bind(deviceId, ...part)
         .all<{ key: string }>();
       for (const r of rows.results) existing.add(r.key);
     }
@@ -61,15 +62,15 @@ export async function upsertVariables(
       keysToWrite.map((key) =>
         env.DB
           .prepare(
-            `INSERT INTO project_variables (id, project_id, key, created_at, updated_at, last_seen)
-             VALUES (?, ?, ?, ?, ?, ?)
-             ON CONFLICT(project_id, key) DO UPDATE SET last_seen = excluded.last_seen`
+            `INSERT INTO project_variables (id, project_id, device_id, key, created_at, updated_at, last_seen)
+             VALUES (?, ?, ?, ?, ?, ?, ?)
+             ON CONFLICT(project_id, device_id, key) DO UPDATE SET last_seen = excluded.last_seen`
           )
-          .bind(newId('variable'), projectId, key, now, now, now)
+          .bind(newId('variable'), projectId, deviceId, key, now, now, now)
       )
     );
   } catch {
     // Best-effort — never fail telemetry on it. Clear stamps so a failed write retries next ingest.
-    for (const key of due) lastSeenWrites.delete(`${projectId}:${key}`);
+    for (const key of due) lastSeenWrites.delete(`${deviceId}:${key}`);
   }
 }
diff --git a/worker/src/domains/telemetry/ws-protocol.ts b/worker/src/domains/telemetry/ws-protocol.ts
index 66ee2c1..22c1300 100644
--- a/worker/src/domains/telemetry/ws-protocol.ts
+++ b/worker/src/domains/telemetry/ws-protocol.ts
@@ -5,6 +5,7 @@ import { parseTelemetryBody } from './validate';
 import type { IngestPoint } from '../../platform/durable-objects/project-do';
 
 export type DeviceMessage =
+  | { kind: 'hello'; device: string; chip?: string; firmware?: string }
   | { kind: 'ack'; ids: string[] }
   | { kind: 'telemetry'; points: IngestPoint[] }
   | { kind: 'event'; event: string; payload?: Record<string, unknown> }
@@ -24,6 +25,13 @@ export function parseDeviceMessage(raw: string): DeviceMessage {
   const m = msg as Record<string, unknown>;
 
   switch (m.type) {
+    case 'hello': {
+      const device = typeof m.device === 'string' ? m.device.trim() : '';
+      if (!device) return { kind: 'ignore' };
+      const chip = typeof m.chip === 'string' ? m.chip.slice(0, 32) : undefined;
+      const firmware = typeof m.firmware === 'string' ? m.firmware.slice(0, 32) : undefined;
+      return { kind: 'hello', device, ...(chip ? { chip } : {}), ...(firmware ? { firmware } : {}) };
+    }
     case 'ack': {
       const ids = Array.isArray(m.ids) ? m.ids.filter((x): x is string => typeof x === 'string') : [];
       return { kind: 'ack', ids };
diff --git a/worker/src/domains/variables/routes.ts b/worker/src/domains/variables/routes.ts
index 2f046ae..400f417 100644
--- a/worker/src/domains/variables/routes.ts
+++ b/worker/src/domains/variables/routes.ts
@@ -6,6 +6,7 @@ import { newId } from '../../platform/lib/ids';
 import { generateToken } from '../../platform/lib/tokens';
 import { recordAudit } from '../../platform/lib/audit';
 import { projectStub } from '../../platform/durable-objects/stubs';
+import { storageIdOf } from '../devices/service';
 import { createVariable, updateVariable, listVariables } from './service';
 import { actorFromSession, serviceErrorResponse } from '../../platform/lib/service';
 
@@ -59,13 +60,15 @@ variables.delete('/:id', async (c) => {
   const id = c.req.param('id');
 
   const v = await c.env.DB
-    .prepare(`SELECT key FROM project_variables WHERE id = ? AND project_id = ?`)
+    .prepare(`SELECT key, device_id FROM project_variables WHERE id = ? AND project_id = ?`)
     .bind(id, project.id)
-    .first<{ key: string }>();
+    .first<{ key: string; device_id: string }>();
   if (!v) return c.json({ error: 'not_found' }, 404);
 
   try {
-    await projectStub(c.env, project.id).deleteVariable(v.key);
+    // Scoped, or deleting one device's copy would clear the key on all of them.
+    const storageId = await storageIdOf(c.env, project.id, v.device_id);
+    await projectStub(c.env, project.id).deleteVariable(v.key, storageId);
   } catch (e) {
     console.error('variable hot-state delete failed', id, e);
   }
diff --git a/worker/src/domains/variables/service.ts b/worker/src/domains/variables/service.ts
index d313ab5..cd105c6 100644
--- a/worker/src/domains/variables/service.ts
+++ b/worker/src/domains/variables/service.ts
@@ -4,6 +4,7 @@ import { recordAudit } from '../../platform/lib/audit';
 import { projectStub } from '../../platform/durable-objects/stubs';
 import { type Actor, ServiceError } from '../../platform/lib/service';
 import { assertProjectAccess } from '../projects/service';
+import { defaultDeviceId, listDevices, storageIdOf } from '../devices/service';
 
 export type VariableSummary = {
   id: string;
@@ -27,13 +28,27 @@ export async function listVariables(env: Env, projectId: string): Promise<Variab
 }
 
 export type StateEntry = { value: unknown; received_at: number };
+export type DeviceState = { id: string; name: string; variables: Record<string, StateEntry> };
 
-// Latest value of every variable. Mirrors GET /v1/projects/:proj/state.
-export async function getState(env: Env, projectId: string): Promise<Record<string, StateEntry>> {
-  const latest = await projectStub(env, projectId).getLatestState();
-  const out: Record<string, StateEntry> = {};
-  for (const r of latest) out[r.variable] = { value: r.value, received_at: r.received_at };
-  return out;
+// Mirrors GET /v1/projects/:proj/state. Grouped by device because two of them
+// may report the same key, and a flat map would drop one.
+export async function getState(env: Env, projectId: string): Promise<DeviceState[]> {
+  const [latest, devices] = await Promise.all([
+    projectStub(env, projectId).getLatestState(),
+    listDevices(env, projectId),
+  ]);
+  const fallback = devices.find((d) => d.is_default)?.id;
+  const byDevice = new Map<string, DeviceState>();
+  for (const d of devices) byDevice.set(d.id, { id: d.id, name: d.name, variables: {} });
+
+  for (const r of latest) {
+    // The DO marks the default device '' so it never had to backfill.
+    const id = r.device_id || fallback;
+    if (!id) continue;
+    const bucket = byDevice.get(id);
+    if (bucket) bucket.variables[r.variable] = { value: r.value, received_at: r.received_at };
+  }
+  return [...byDevice.values()];
 }
 
 // Recent points from the Project DO ring buffer (never R2). Mirrors
@@ -41,7 +56,8 @@ export async function getSeries(
   env: Env,
   projectId: string,
   variable: string,
-  windowStr: string
+  windowStr: string,
+  deviceId?: string | null
 ): Promise<{ window: string; points: unknown[] }> {
   const now = Math.floor(Date.now() / 1000);
   const m = /^(\d+)([smh])$/.exec(windowStr);
@@ -50,7 +66,9 @@ export async function getSeries(
     const n = Number(m[1]);
     seconds = m[2] === 'h' ? n * 3600 : m[2] === 'm' ? n * 60 : n;
   }
-  const points = await projectStub(env, projectId).getSeries(variable, now - seconds);
+  // No device reads the whole project — what a single-device instance always did.
+  const storageId = deviceId ? await storageIdOf(env, projectId, deviceId) : null;
+  const points = await projectStub(env, projectId).getSeries(variable, now - seconds, storageId);
   return { window: m ? windowStr : '1h', points };
 }
 
@@ -68,13 +86,16 @@ export async function createVariable(
 
   const id = newId('variable');
   const now = Math.floor(Date.now() / 1000);
+  // Hand-declared variables belong to the default device.
+  const deviceId = await defaultDeviceId(env, projectId);
+  if (!deviceId) throw new ServiceError('not_found', 'project has no default device', 'no_default_device');
   try {
     await env.DB
       .prepare(
-        `INSERT INTO project_variables (id, project_id, key, unit, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?)`
+        `INSERT INTO project_variables (id, project_id, device_id, key, unit, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?)`
       )
-      .bind(id, projectId, key, input.unit ?? null, now, now)
+      .bind(id, projectId, deviceId, key, input.unit ?? null, now, now)
       .run();
   } catch {
     throw new ServiceError('conflict', 'a variable with this key already exists', 'duplicate_key');
@@ -130,22 +151,24 @@ export async function setVariableControl(
   env: Env,
   actor: Actor,
   projectId: string,
-  input: { variable: string; value: unknown }
+  input: { variable: string; value: unknown; device?: string | null }
 ): Promise<{ id: string; variable: string; value: unknown }> {
   await assertProjectAccess(env, actor, projectId);
   const variable = (input.variable ?? '').trim();
   if (!variable) throw new ServiceError('bad_request', 'variable is required', 'missing_variable');
+  const deviceId = input.device ?? (await defaultDeviceId(env, projectId));
 
   // The variable must already exist in the project (mirrors the dashboard
   // control path, which refuses variable_not_in_project).
   const exists = await env.DB
-    .prepare(`SELECT 1 AS ok FROM project_variables WHERE project_id = ? AND key = ?`)
-    .bind(projectId, variable)
+    .prepare(`SELECT 1 AS ok FROM project_variables WHERE project_id = ? AND device_id = ? AND key = ?`)
+    .bind(projectId, deviceId, variable)
     .first<{ ok: number }>();
   if (!exists) throw new ServiceError('not_found', 'variable not in project', 'variable_not_in_project');
 
   const id = newId('control');
-  await projectStub(env, projectId).addControl(id, variable, input.value ?? null);
+  const storageId = await storageIdOf(env, projectId, deviceId!);
+  await projectStub(env, projectId).addControl(id, variable, input.value ?? null, storageId);
 
   await recordAudit(env, {
     projectId,
diff --git a/worker/src/mcp/tools-read.ts b/worker/src/mcp/tools-read.ts
index 7d2688d..b889911 100644
--- a/worker/src/mcp/tools-read.ts
+++ b/worker/src/mcp/tools-read.ts
@@ -93,6 +93,7 @@ export function registerReadTools(server: McpServer, env: Env, props: McpProps):
       inputSchema: {
         project: project.optional(),
         variable: z.string().describe('Variable key.'),
+        device: z.string().optional().describe('Device id. Omit to read across every device.'),
         window: z
           .string()
           .regex(/^\d+[smh]$/)
@@ -104,7 +105,7 @@ export function registerReadTools(server: McpServer, env: Env, props: McpProps):
     (args) =>
       run(async () => {
         const pid = await resolveProjectId(env, props, args.project);
-        const { window, points } = await getSeries(env, pid, args.variable, args.window ?? '1h');
+        const { window, points } = await getSeries(env, pid, args.variable, args.window ?? '1h', args.device);
         return { project: pid, variable: args.variable, window, points };
       })
   );
diff --git a/worker/src/mcp/tools-write.ts b/worker/src/mcp/tools-write.ts
index 4547210..9db4e25 100644
--- a/worker/src/mcp/tools-write.ts
+++ b/worker/src/mcp/tools-write.ts
@@ -71,10 +71,18 @@ export function registerWriteTools(server: McpServer, env: Env, props: McpProps)
       inputSchema: {
         project,
         variable: z.string().describe('Variable key.'),
+        device: z.string().optional().describe("Device id. Omit for the project's default device."),
         value: z.any().describe('Value to send (number, boolean, string, or JSON).'),
       },
     },
-    (args) => run(() => setVariableControl(env, actor(), scopeProjectId(props, args.project), { variable: args.variable, value: args.value }))
+    (args) =>
+      run(() =>
+        setVariableControl(env, actor(), scopeProjectId(props, args.project), {
+          variable: args.variable,
+          value: args.value,
+          device: args.device ?? null,
+        })
+      )
   );
 
   server.registerTool(
diff --git a/worker/src/platform/db/auto-migrate.ts b/worker/src/platform/db/auto-migrate.ts
index e857f48..307f49d 100644
--- a/worker/src/platform/db/auto-migrate.ts
+++ b/worker/src/platform/db/auto-migrate.ts
@@ -1,17 +1,13 @@
-// Auto-migrator. On the first request after a deploy, applies any bundled
-// migrations (worker/src/db/migrations/*.sql, baked into migrations.gen.ts) that
-// haven't run yet, tracked in the d1_migrations table.
+// Auto-migrator. On the first request after a deploy, applies bundled migrations
+// that haven't run yet, tracked in d1_migrations.
 //
-// nodrix is pre-alpha: there's a single baseline migration and instances are
-// recreated fresh, so there's no legacy-baseline handling — just "apply what's
-// missing, in order." Concurrent isolates are guarded by an INSERT OR IGNORE
-// claim; a crash mid-migration leaves applied_at=0, which the next run retries.
+// One db.batch() per migration: D1 runs it as a single transaction, so a failure
+// part-way leaves the database untouched. exec() — which D1's migration docs
+// recommend — stops on error without rolling back.
 
 import type { D1Database } from '@cloudflare/workers-types';
 import { MIGRATIONS } from './migrations.gen';
 
-// Module-level guard: at most one migration check per Worker isolate. If it
-// failed we null it out so the next request retries.
 let inFlight: Promise<void> | null = null;
 
 export function ensureMigrated(db: D1Database): Promise<void> {
@@ -40,8 +36,8 @@ async function applyMigrations(db: D1Database): Promise<void> {
     .all<{ name: string; applied_at: number }>();
   const applied = new Set(res.results.filter((r) => r.applied_at > 0).map((r) => r.name));
 
-  // Recover claims that never completed (worker crashed mid-migration) so the
-  // loop below retries them from scratch.
+  // applied_at = 0 means the batch rolled back; releasing the claim is the
+  // whole of the recovery.
   for (const r of res.results) {
     if (r.applied_at === 0) {
       await db.prepare(`DELETE FROM d1_migrations WHERE name = ? AND applied_at = 0`).bind(r.name).run();
@@ -51,8 +47,7 @@ async function applyMigrations(db: D1Database): Promise<void> {
   for (const m of MIGRATIONS) {
     if (applied.has(m.name)) continue;
 
-    // Claim first — INSERT OR IGNORE keeps two concurrent isolates from running
-    // the same DDL twice (second one's changes count is 0, so it skips).
+    // INSERT OR IGNORE keeps two concurrent isolates from running the same DDL.
     const claim = await db
       .prepare(`INSERT OR IGNORE INTO d1_migrations (name, applied_at) VALUES (?, 0)`)
       .bind(m.name)
@@ -61,14 +56,14 @@ async function applyMigrations(db: D1Database): Promise<void> {
 
     console.log(`[migrate] applying ${m.name} (${m.statements.length} statements)`);
     try {
-      for (const stmt of m.statements) await db.prepare(stmt).run();
-      await db
-        .prepare(`UPDATE d1_migrations SET applied_at = ? WHERE name = ?`)
-        .bind(Math.floor(Date.now() / 1000), m.name)
-        .run();
+      await db.batch([
+        ...m.statements.map((s) => db.prepare(s)),
+        db
+          .prepare(`UPDATE d1_migrations SET applied_at = ? WHERE name = ?`)
+          .bind(Math.floor(Date.now() / 1000), m.name),
+      ]);
       console.log(`[migrate] applied ${m.name}`);
     } catch (e) {
-      // Roll back the claim so we retry on a later request.
       await db.prepare(`DELETE FROM d1_migrations WHERE name = ? AND applied_at = 0`).bind(m.name).run();
       throw e;
     }
diff --git a/worker/src/platform/db/migrations.gen.ts b/worker/src/platform/db/migrations.gen.ts
index 3566f99..17bd6a0 100644
--- a/worker/src/platform/db/migrations.gen.ts
+++ b/worker/src/platform/db/migrations.gen.ts
@@ -47,5 +47,27 @@ export const MIGRATIONS: Migration[] = [
       "CREATE INDEX IF NOT EXISTS idx_invites_email ON invites(email) WHERE email IS NOT NULL",
       "CREATE TABLE IF NOT EXISTS invite_projects (\n  invite_id  TEXT NOT NULL REFERENCES invites(id) ON DELETE CASCADE,\n  project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,\n  PRIMARY KEY (invite_id, project_id)\n)"
     ]
+  },
+  {
+    "name": "0002_devices",
+    "statements": [
+      "CREATE TABLE IF NOT EXISTS devices (\n  id               TEXT PRIMARY KEY,\n  project_id       TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,\n  name             TEXT NOT NULL,\n  device_key       TEXT,\n  chip             TEXT,\n  firmware_version TEXT,\n  is_default       INTEGER NOT NULL DEFAULT 0,\n  first_seen       INTEGER,\n  last_seen        INTEGER,\n  created_at       INTEGER NOT NULL\n)",
+      "CREATE INDEX IF NOT EXISTS idx_devices_project ON devices(project_id)",
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_devices_key\n  ON devices(project_id, device_key) WHERE device_key IS NOT NULL",
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_devices_default\n  ON devices(project_id) WHERE is_default = 1",
+      "INSERT INTO devices (id, project_id, name, is_default, created_at)\nSELECT 'dev_' || substr(p.id, 5), p.id, 'Default', 1, p.created_at\nFROM projects p\nWHERE NOT EXISTS (SELECT 1 FROM devices d WHERE d.project_id = p.id AND d.is_default = 1)",
+      "CREATE TABLE project_variables_new (\n  id          TEXT PRIMARY KEY,\n  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,\n  device_id   TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,\n  key         TEXT NOT NULL,\n  unit        TEXT,\n  created_at  INTEGER NOT NULL,\n  updated_at  INTEGER NOT NULL,\n  last_seen   INTEGER\n)",
+      "INSERT INTO project_variables_new (id, project_id, device_id, key, unit, created_at, updated_at, last_seen)\nSELECT v.id, v.project_id, d.id, v.key, v.unit, v.created_at, v.updated_at, v.last_seen\nFROM project_variables v\nJOIN devices d ON d.project_id = v.project_id AND d.is_default = 1",
+      "DROP TABLE project_variables",
+      "ALTER TABLE project_variables_new RENAME TO project_variables",
+      "CREATE UNIQUE INDEX idx_project_variables_key\n  ON project_variables(project_id, device_id, key)",
+      "CREATE TABLE IF NOT EXISTS firmware (\n  id          TEXT PRIMARY KEY,\n  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,\n  version     TEXT NOT NULL,\n  target      TEXT,\n  size        INTEGER NOT NULL,\n  sha256      TEXT NOT NULL,\n  r2_key      TEXT NOT NULL,\n  notes       TEXT,\n  created_by  TEXT REFERENCES users(id),\n  created_at  INTEGER NOT NULL\n)",
+      "CREATE INDEX IF NOT EXISTS idx_firmware_project ON firmware(project_id, created_at DESC)",
+      "CREATE UNIQUE INDEX IF NOT EXISTS idx_firmware_version ON firmware(project_id, version)",
+      "ALTER TABLE devices ADD COLUMN desired_firmware_id TEXT REFERENCES firmware(id) ON DELETE SET NULL",
+      "ALTER TABLE devices ADD COLUMN ota_status TEXT",
+      "ALTER TABLE devices ADD COLUMN ota_updated_at INTEGER",
+      "ALTER TABLE devices ADD COLUMN ota_attempts INTEGER NOT NULL DEFAULT 0"
+    ]
   }
 ];
diff --git a/worker/src/platform/db/migrations/0002_devices.sql b/worker/src/platform/db/migrations/0002_devices.sql
new file mode 100644
index 0000000..c92b1e9
--- /dev/null
+++ b/worker/src/platform/db/migrations/0002_devices.sql
@@ -0,0 +1,80 @@
+-- Devices. Rows appear the first time a board is seen; there is no enrolment.
+CREATE TABLE IF NOT EXISTS devices (
+  id               TEXT PRIMARY KEY,
+  project_id       TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  name             TEXT NOT NULL,
+  device_key       TEXT,
+  chip             TEXT,
+  firmware_version TEXT,
+  is_default       INTEGER NOT NULL DEFAULT 0,
+  first_seen       INTEGER,
+  last_seen        INTEGER,
+  created_at       INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_devices_project ON devices(project_id);
+
+-- What the board calls itself, kept apart from the id so renaming is free and a
+-- MAC never leaks into anything a user reads. NULL on the default device.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_devices_key
+  ON devices(project_id, device_key) WHERE device_key IS NOT NULL;
+
+-- Exactly one default per project, enforced rather than assumed.
+CREATE UNIQUE INDEX IF NOT EXISTS idx_devices_default
+  ON devices(project_id) WHERE is_default = 1;
+
+-- Every project gets a default device. Telemetry that names no device lands
+-- here, so a plain curl with only a token keeps working.
+INSERT INTO devices (id, project_id, name, is_default, created_at)
+SELECT 'dev_' || substr(p.id, 5), p.id, 'Default', 1, p.created_at
+FROM projects p
+WHERE NOT EXISTS (SELECT 1 FROM devices d WHERE d.project_id = p.id AND d.is_default = 1);
+
+-- project_variables gains device_id. Rebuilt rather than altered: the column is
+-- NOT NULL with a foreign key, and the unique key it belongs to changes shape.
+CREATE TABLE project_variables_new (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  device_id   TEXT NOT NULL REFERENCES devices(id) ON DELETE CASCADE,
+  key         TEXT NOT NULL,
+  unit        TEXT,
+  created_at  INTEGER NOT NULL,
+  updated_at  INTEGER NOT NULL,
+  last_seen   INTEGER
+);
+
+INSERT INTO project_variables_new (id, project_id, device_id, key, unit, created_at, updated_at, last_seen)
+SELECT v.id, v.project_id, d.id, v.key, v.unit, v.created_at, v.updated_at, v.last_seen
+FROM project_variables v
+JOIN devices d ON d.project_id = v.project_id AND d.is_default = 1;
+
+DROP TABLE project_variables;
+ALTER TABLE project_variables_new RENAME TO project_variables;
+
+CREATE UNIQUE INDEX idx_project_variables_key
+  ON project_variables(project_id, device_id, key);
+
+-- Firmware uploaded to this instance. The image itself lives in R2; this is the
+-- metadata the dashboard and the update check read.
+CREATE TABLE IF NOT EXISTS firmware (
+  id          TEXT PRIMARY KEY,
+  project_id  TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+  version     TEXT NOT NULL,
+  target      TEXT,
+  size        INTEGER NOT NULL,
+  sha256      TEXT NOT NULL,
+  r2_key      TEXT NOT NULL,
+  notes       TEXT,
+  created_by  TEXT REFERENCES users(id),
+  created_at  INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_firmware_project ON firmware(project_id, created_at DESC);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_firmware_version ON firmware(project_id, version);
+
+-- Desired state. A device compares its own version against this and pulls when
+-- they differ; nothing pushes an image at a device.
+ALTER TABLE devices ADD COLUMN desired_firmware_id TEXT REFERENCES firmware(id) ON DELETE SET NULL;
+ALTER TABLE devices ADD COLUMN ota_status TEXT;
+ALTER TABLE devices ADD COLUMN ota_updated_at INTEGER;
+-- Pulls since the current firmware was assigned. A board that keeps pulling and
+-- never reports the new version is looping, not updating.
+ALTER TABLE devices ADD COLUMN ota_attempts INTEGER NOT NULL DEFAULT 0;
diff --git a/worker/src/platform/durable-objects/dashboard-do.ts b/worker/src/platform/durable-objects/dashboard-do.ts
index d7f4818..7d66a5e 100644
--- a/worker/src/platform/durable-objects/dashboard-do.ts
+++ b/worker/src/platform/durable-objects/dashboard-do.ts
@@ -4,7 +4,9 @@ import { projectStub } from './stubs';
 import { validateLayout, variablesFromLayout, chartVariablesFromLayout, type Layout } from '../lib/layout';
 import { newId } from '../lib/ids';
 import { userCanAccessProject } from '../lib/roles';
+import { storageIdOf } from '../../domains/devices/service';
 import type { CompactSeries } from '../lib/series';
+import { migrateSchema, type SchemaStep } from './schema';
 
 // Cap on points per chart series in the bootstrap snapshot (mirrors the public
 // /state full snapshot). Dense ingest is stride-sampled to this.
@@ -41,13 +43,23 @@ type AckMsg = { type: 'ack'; req: string; ok: boolean; reason?: string };
 type ClientMsg =
   | { type: 'control'; req?: string; variable: string; value?: unknown };
 
+const SCHEMA: SchemaStep[] = [
+  (sql) => {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS subscribed_project (
+        project_id TEXT PRIMARY KEY
+      );
+    `);
+  },
+];
+
 export class DashboardDO extends DurableObject<Env> {
   private sql: SqlStorage;
 
   constructor(ctx: DurableObjectState, env: Env) {
     super(ctx, env);
     this.sql = ctx.storage.sql;
-    this.initSchema();
+    migrateSchema(ctx, SCHEMA);
   }
 
   override async fetch(request: Request): Promise<Response> {
@@ -168,6 +180,9 @@ export class DashboardDO extends DurableObject<Env> {
     await this.subscribe(row.project_id).catch(() => undefined);
 
     const stub = projectStub(this.env, row.project_id);
+    const snapshotDevice = layout.device
+      ? await storageIdOf(this.env, row.project_id, layout.device)
+      : '';
 
     // Only ship what this dashboard renders: latest state for referenced
     // variables + 1h series for chart variables (not the whole project history).
@@ -183,7 +198,8 @@ export class DashboardDO extends DurableObject<Env> {
 
     // One DO round trip (chartVars=[] skips the series query inside the DO).
     const { latest, series, oldestTs } = await stub
-      .getDashboardSnapshot(chartVars, fromTs, cap)
+      // Widgets bind to a bare key, so a second device would merge into the chart.
+      .getDashboardSnapshot(chartVars, fromTs, cap, snapshotDevice)
       .catch(() => ({ latest: [], series: {} as CompactSeries, oldestTs: null as number | null }));
 
     const variables: Record<string, { value: unknown; received_at: number }> = {};
@@ -275,12 +291,4 @@ export class DashboardDO extends DurableObject<Env> {
     );
     this.sql.exec(`DELETE FROM subscribed_project`);
   }
-
-  private initSchema(): void {
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS subscribed_project (
-        project_id TEXT PRIMARY KEY
-      );
-    `);
-  }
 }
diff --git a/worker/src/platform/durable-objects/project-do.ts b/worker/src/platform/durable-objects/project-do.ts
index e44eeee..8e05149 100644
--- a/worker/src/platform/durable-objects/project-do.ts
+++ b/worker/src/platform/durable-objects/project-do.ts
@@ -10,19 +10,26 @@ import { toCompactSeries, type CompactSeries } from '../lib/series';
 import { chunk, MAX_BOUND_PARAMS } from '../lib/sql';
 import { parseDeviceMessage } from '../../domains/telemetry/ws-protocol';
 import { upsertVariables } from '../../domains/telemetry/variables';
+import { defaultDeviceId, normaliseDeviceKey, resolveDevice, recordDeviceSeen, touchDevice } from '../../domains/devices/service';
+import { reconcile } from '../../domains/firmware/ota';
+import { migrateSchema } from './schema';
+import { PROJECT_SCHEMA } from './project-schema';
 
 // Project Durable Object (one per project id, SQLite-backed): latest variable
 // state, recent ring buffer, pending control writes, and the R2 flush cursor.
 
-const RING_BUFFER_MAX_ROWS = 1000;
+// Shared across devices this would silently thin every chart as hardware is added.
+const RING_BUFFER_MAX_ROWS_PER_DEVICE = 1000;
 const RING_BUFFER_MAX_AGE_SECONDS = 60 * 60; // 1 hour
-// Multi-row inserts bind 3 columns/row; this keeps a chunk under MAX_BOUND_PARAMS.
-const ROWS_PER_3COL_INSERT = Math.floor(MAX_BOUND_PARAMS / 3);
+// Multi-row inserts bind 4 columns/row; this keeps a chunk under MAX_BOUND_PARAMS.
+const ROWS_PER_4COL_INSERT = Math.floor(MAX_BOUND_PARAMS / 4);
 // Eviction (age + overflow DELETE + COUNT) runs at most this often instead of on
 // every ingest — a single cheap last_evict_at lookup gates the actual work.
 const EVICT_INTERVAL_SECONDS = 30;
 const FLUSH_INTERVAL_MS = 60_000;
 const HIGH_WATER_MARK_ROWS = 500;
+// Roughly a megabyte a call, and a boot-looping board would pull it forever.
+const OTA_DOWNLOADS_PER_HOUR = 6;
 // Variable-trigger automations are cached in DO SQLite so high-rate telemetry
 // doesn't read D1 per point. Refreshed when stale or on invalidateAutomations().
 const AUTO_CACHE_TTL_MS = 30_000;
@@ -38,6 +45,7 @@ export type IngestResult = {
 };
 
 export type LatestStateRow = {
+  device_id: string;
   variable: string;
   value: unknown;
   received_at: number;
@@ -55,8 +63,10 @@ export type FlushResult = {
   newCursor: number;
 };
 
+
 export class ProjectDO extends DurableObject<Env> {
   private sql: SqlStorage;
+
   private projectId(): string {
     // Stored on first ingest; used as the R2 key prefix.
     const row = this.sql
@@ -68,7 +78,7 @@ export class ProjectDO extends DurableObject<Env> {
   constructor(ctx: DurableObjectState, env: Env) {
     super(ctx, env);
     this.sql = ctx.storage.sql;
-    this.initSchema();
+    migrateSchema(ctx, PROJECT_SCHEMA);
   }
 
   // WS connect calls this so the DO has its project_id for socket-driven ingest —
@@ -80,7 +90,7 @@ export class ProjectDO extends DurableObject<Env> {
     );
   }
 
-  async ingest(projectId: string, points: IngestPoint[], _deviceTs?: number): Promise<IngestResult> {
+  async ingest(projectId: string, points: IngestPoint[], deviceId = ''): Promise<IngestResult> {
     const receivedAt = Math.floor(Date.now() / 1000);
 
     // Persist project_id once for the R2 key (idFromName doesn't round-trip cheaply).
@@ -100,7 +110,8 @@ export class ProjectDO extends DurableObject<Env> {
       const placeholders = part.map(() => '?').join(',');
       const rows = this.sql
         .exec<{ variable: string; value: string }>(
-          `SELECT variable, value FROM latest_state WHERE variable IN (${placeholders})`,
+          `SELECT variable, value FROM latest_state WHERE device_id = ? AND variable IN (${placeholders})`,
+          deviceId,
           ...part
         )
         .toArray();
@@ -111,28 +122,28 @@ export class ProjectDO extends DurableObject<Env> {
     // can't have two VALUES rows hit the same conflict target).
     const latestByVar = new Map<string, unknown>();
     for (const p of points) latestByVar.set(p.variable, p.value);
-    for (const part of chunk([...latestByVar], ROWS_PER_3COL_INSERT)) {
-      const rows = part.map(() => '(?, ?, ?)').join(', ');
+    for (const part of chunk([...latestByVar], ROWS_PER_4COL_INSERT)) {
+      const rows = part.map(() => '(?, ?, ?, ?)').join(', ');
       const binds: unknown[] = [];
       for (const [variable, value] of part) {
-        binds.push(variable, JSON.stringify(value), receivedAt);
+        binds.push(deviceId, variable, JSON.stringify(value), receivedAt);
       }
       this.sql.exec(
-        `INSERT INTO latest_state (variable, value, received_at)
+        `INSERT INTO latest_state (device_id, variable, value, received_at)
          VALUES ${rows}
-         ON CONFLICT(variable) DO UPDATE SET value = excluded.value, received_at = excluded.received_at`,
+         ON CONFLICT(device_id, variable) DO UPDATE SET value = excluded.value, received_at = excluded.received_at`,
         ...binds
       );
     }
 
     // ring_buffer: append every point.
-    for (const part of chunk(points, ROWS_PER_3COL_INSERT)) {
-      const rows = part.map(() => '(?, ?, ?)').join(', ');
+    for (const part of chunk(points, ROWS_PER_4COL_INSERT)) {
+      const rows = part.map(() => '(?, ?, ?, ?)').join(', ');
       const binds: unknown[] = [];
       for (const p of part) {
-        binds.push(receivedAt, p.variable, JSON.stringify(p.value));
+        binds.push(receivedAt, deviceId, p.variable, JSON.stringify(p.value));
       }
-      this.sql.exec(`INSERT INTO ring_buffer (ts, variable, value) VALUES ${rows}`, ...binds);
+      this.sql.exec(`INSERT INTO ring_buffer (ts, device_id, variable, value) VALUES ${rows}`, ...binds);
     }
 
     // Eviction is independent of the flush cursor (copy-not-move).
@@ -141,7 +152,7 @@ export class ProjectDO extends DurableObject<Env> {
 
     // Fire-and-forget; failures never block ingest — the device already got its 204.
     this.notifyDashboards(points, receivedAt);
-    this.evaluateVariableTriggers(projectId, points, prev, receivedAt);
+    this.evaluateVariableTriggers(projectId, points, prev, receivedAt, deviceId);
 
     return { receivedAt, count: points.length };
   }
@@ -150,7 +161,8 @@ export class ProjectDO extends DurableObject<Env> {
     projectId: string,
     points: IngestPoint[],
     prev: Map<string, unknown>,
-    ts: number
+    ts: number,
+    deviceId: string
   ): void {
     this.ctx.waitUntil(
       (async () => {
@@ -158,17 +170,24 @@ export class ProjectDO extends DurableObject<Env> {
           const autos = await this.getVariableAutomations(projectId);
           if (autos.length === 0) return;
 
+          // Triggers name devices by their D1 id; storage calls the default one ''.
+          const triggerDevice = deviceId || (await defaultDeviceId(this.env, projectId)) || '';
+
+          // Both stay on the device that triggered: an automation that reacts to one
+          // greenhouse shouldn't read or switch another's.
           const setVariable = (variable: string, value: unknown): Promise<void> =>
-            this.addControl(newId('control'), variable, value);
-          // Condition nodes read live values; serve them from this DO's own state.
+            this.addControl(newId('control'), variable, value, deviceId);
           const getVariable = async (variable: string): Promise<unknown> =>
-            (await this.getLatestState()).find((r) => r.variable === variable)?.value;
+            (await this.getLatestState())
+              .find((r) => r.device_id === deviceId && r.variable === variable)?.value;
 
           for (const a of autos) {
             for (const node of triggerNodes(toGraph(a))) {
               if (node.kind !== 'variable') continue;
               const cfg = node.config as VariableTriggerConfig;
 
+              if (cfg.device && cfg.device !== triggerDevice) continue;
+
               const point = points.find((p) => p.variable === cfg.variable);
               if (!point) continue;
               if (!matchVariableCondition(cfg, point.value, prev.get(cfg.variable))) continue;
@@ -179,6 +198,7 @@ export class ProjectDO extends DurableObject<Env> {
                 ts,
                 variable: cfg.variable,
                 value: point.value,
+                device: triggerDevice,
                 depth: 0,
                 entryNodeId: node.id,
               };
@@ -268,10 +288,11 @@ export class ProjectDO extends DurableObject<Env> {
   async getDashboardSnapshot(
     variables: string[],
     sinceTs: number | null,
-    cap?: number
+    cap?: number,
+    deviceId = ''
   ): Promise<{ latest: LatestStateRow[]; series: CompactSeries; oldestTs: number | null }> {
-    const latest = this.getLatestState();
-    const series = this.getSeriesForVariables(variables, sinceTs, cap);
+    const latest = this.getLatestState(deviceId);
+    const series = this.getSeriesForVariables(variables, sinceTs, cap, deviceId);
     return { latest: await latest, series: await series, oldestTs: this.ringOldestTs() };
   }
 
@@ -284,13 +305,17 @@ export class ProjectDO extends DurableObject<Env> {
     return rows[0]?.m ?? null;
   }
 
-  async getLatestState(): Promise<LatestStateRow[]> {
+  async getLatestState(deviceId?: string | null): Promise<LatestStateRow[]> {
     const rows = this.sql
-      .exec<{ variable: string; value: string; received_at: number }>(
-        `SELECT variable, value, received_at FROM latest_state ORDER BY variable ASC`
+      .exec<{ device_id: string; variable: string; value: string; received_at: number }>(
+        `SELECT device_id, variable, value, received_at FROM latest_state
+         ${deviceId != null ? 'WHERE device_id = ?' : ''}
+         ORDER BY device_id ASC, variable ASC`,
+        ...(deviceId != null ? [deviceId] : [])
       )
       .toArray();
     return rows.map((r) => ({
+      device_id: r.device_id,
       variable: r.variable,
       value: safeParse(r.value),
       received_at: r.received_at,
@@ -302,18 +327,21 @@ export class ProjectDO extends DurableObject<Env> {
   async getSeriesForVariables(
     variables: string[],
     sinceTs: number | null,
-    cap?: number
+    cap?: number,
+    deviceId?: string | null
   ): Promise<CompactSeries> {
     if (variables.length === 0) return {};
     const cutoff = sinceTs ?? 0;
     const placeholders = variables.map(() => '?').join(',');
+    const scoped = deviceId != null;
     const rows = this.sql
       .exec<{ ts: number; variable: string; value: string }>(
         `SELECT ts, variable, value FROM ring_buffer
-         WHERE variable IN (${placeholders}) AND ts >= ?
+         WHERE variable IN (${placeholders}) AND ts >= ?${scoped ? ' AND device_id = ?' : ''}
          ORDER BY ts ASC`,
         ...variables,
-        cutoff
+        cutoff,
+        ...(scoped ? [deviceId] : [])
       )
       .toArray();
     return toCompactSeries(
@@ -322,26 +350,24 @@ export class ProjectDO extends DurableObject<Env> {
     );
   }
 
-  async getSeries(variable: string | null, sinceTs: number | null): Promise<SeriesRow[]> {
+  async getSeries(
+    variable: string | null,
+    sinceTs: number | null,
+    deviceId?: string | null
+  ): Promise<SeriesRow[]> {
     const cutoff = sinceTs ?? 0;
-    const rows = variable
-      ? this.sql
-          .exec<{ ts: number; variable: string; value: string }>(
-            `SELECT ts, variable, value FROM ring_buffer
-             WHERE variable = ? AND ts >= ?
-             ORDER BY ts ASC`,
-            variable,
-            cutoff
-          )
-          .toArray()
-      : this.sql
-          .exec<{ ts: number; variable: string; value: string }>(
-            `SELECT ts, variable, value FROM ring_buffer
-             WHERE ts >= ?
-             ORDER BY ts ASC`,
-            cutoff
-          )
-          .toArray();
+    const where = ['ts >= ?'];
+    const binds: unknown[] = [cutoff];
+    if (variable) { where.push('variable = ?'); binds.push(variable); }
+    if (deviceId != null) { where.push('device_id = ?'); binds.push(deviceId); }
+    const rows = this.sql
+      .exec<{ ts: number; variable: string; value: string }>(
+        `SELECT ts, variable, value FROM ring_buffer
+         WHERE ${where.join(' AND ')}
+         ORDER BY ts ASC`,
+        ...binds
+      )
+      .toArray();
     return rows.map((r) => ({ ts: r.ts, variable: r.variable, value: safeParse(r.value) }));
   }
 
@@ -357,57 +383,128 @@ export class ProjectDO extends DurableObject<Env> {
     this.sql.exec(`DELETE FROM subscriptions WHERE dashboard_id = ?`, dashboardId);
   }
 
-  async addControl(id: string, variable: string, value: unknown): Promise<void> {
+  async addControl(id: string, variable: string, value: unknown, deviceId: string | null = null): Promise<void> {
     const now = Math.floor(Date.now() / 1000);
     this.sql.exec(
-      `INSERT INTO pending_control (id, variable, value, created_at, delivered_at)
-       VALUES (?, ?, ?, ?, NULL)`,
+      `INSERT INTO pending_control (id, variable, value, created_at, delivered_at, device_id)
+       VALUES (?, ?, ?, ?, NULL, ?)`,
       id,
       variable,
       JSON.stringify(value),
-      now
+      now,
+      deviceId
     );
 
-    // Push to any connected hardware WS clients. If offline, the write stays in
-    // pending_control and is flushed on next connect.
+    // Push to connected hardware. If offline, the write stays in pending_control
+    // and is flushed on next connect.
     const payload = JSON.stringify({ type: 'control', id, variable, value });
     for (const ws of this.ctx.getWebSockets()) {
+      if (deviceId !== null && this.deviceOf(ws) !== deviceId) continue;
       try { ws.send(payload); } catch { /* dead socket; ignore */ }
     }
 
     this.notifyDashboards([{ variable, value: value as IngestPoint['value'] }], now);
   }
 
-  async listPendingControl(): Promise<Array<{ id: string; variable: string; value: unknown }>> {
+  // A device sees broadcasts and its own writes, never another device's.
+  async listPendingControl(deviceId = ''): Promise<Array<{ id: string; variable: string; value: unknown }>> {
     const rows = this.sql
       .exec<{ id: string; variable: string; value: string }>(
         `SELECT id, variable, value FROM pending_control
-         WHERE delivered_at IS NULL
-         ORDER BY created_at ASC`
+         WHERE delivered_at IS NULL AND (device_id IS NULL OR device_id = ?)
+         ORDER BY created_at ASC`,
+        deviceId
       )
       .toArray();
     return rows.map((r) => ({ id: r.id, variable: r.variable, value: safeParse(r.value) }));
   }
 
-  async ackControl(ids: string[]): Promise<{ acked: number }> {
+  async ackControl(ids: string[], deviceId = ''): Promise<{ acked: number }> {
     if (ids.length === 0) return { acked: 0 };
     const now = Math.floor(Date.now() / 1000);
     const placeholders = ids.map(() => '?').join(',');
     const cursor = this.sql.exec(
       `UPDATE pending_control SET delivered_at = ?
-        WHERE id IN (${placeholders}) AND delivered_at IS NULL`,
+        WHERE id IN (${placeholders}) AND delivered_at IS NULL
+          AND (device_id IS NULL OR device_id = ?)`,
       now,
-      ...ids
+      ...ids,
+      deviceId
     );
     return { acked: cursor.rowsWritten };
   }
 
   // Drops hot state for a variable. Cold R2 history (partitioned by project+hour)
   // is left in place — orphaned but harmless.
-  async deleteVariable(variable: string): Promise<void> {
-    this.sql.exec(`DELETE FROM latest_state WHERE variable = ?`, variable);
-    this.sql.exec(`DELETE FROM ring_buffer WHERE variable = ?`, variable);
-    this.sql.exec(`DELETE FROM pending_control WHERE variable = ?`, variable);
+  async deleteVariable(variable: string, deviceId?: string | null): Promise<void> {
+    if (deviceId == null) {
+      this.sql.exec(`DELETE FROM latest_state WHERE variable = ?`, variable);
+      this.sql.exec(`DELETE FROM ring_buffer WHERE variable = ?`, variable);
+      this.sql.exec(`DELETE FROM pending_control WHERE variable = ?`, variable);
+      return;
+    }
+    this.sql.exec(`DELETE FROM latest_state WHERE variable = ? AND device_id = ?`, variable, deviceId);
+    this.sql.exec(`DELETE FROM ring_buffer WHERE variable = ? AND device_id = ?`, variable, deviceId);
+    this.sql.exec(`DELETE FROM pending_control WHERE variable = ? AND device_id IS ?`, variable, deviceId);
+  }
+
+  // Survives hibernation, unlike anything held in memory.
+  private deviceOf(ws: WebSocket): string {
+    const att = ws.deserializeAttachment() as { device?: string } | null;
+    return typeof att?.device === 'string' ? att.device : '';
+  }
+
+  // The attachment holds a storage id; '' has to become a real D1 id.
+  private async d1DeviceId(ws: WebSocket, projectId: string): Promise<string | null> {
+    return this.deviceOf(ws) || (await defaultDeviceId(this.env, projectId));
+  }
+
+  private sendPending(ws: WebSocket, where: string, ...binds: unknown[]): void {
+    const rows = this.sql
+      .exec<{ id: string; variable: string; value: string }>(
+        `SELECT id, variable, value FROM pending_control
+          WHERE delivered_at IS NULL AND ${where}
+          ORDER BY created_at ASC`,
+        ...binds
+      )
+      .toArray();
+    for (const cmd of rows) {
+      try {
+        ws.send(JSON.stringify({ type: 'control', id: cmd.id, variable: cmd.variable, value: safeParse(cmd.value) }));
+      } catch { /* dead socket; ignore */ }
+    }
+  }
+
+  // In DO SQLite, not KV: an eventually consistent counter can be outrun.
+  async consumeOtaQuota(deviceId: string): Promise<boolean> {
+    const window = Math.floor(Date.now() / 1000 / 3600);
+    this.sql.exec(`DELETE FROM ota_quota WHERE window < ?`, window);
+    const row = this.sql
+      .exec<{ count: number }>(`SELECT count FROM ota_quota WHERE device_id = ? AND window = ?`, deviceId, window)
+      .toArray()[0];
+    if ((row?.count ?? 0) >= OTA_DOWNLOADS_PER_HOUR) return false;
+    this.sql.exec(
+      `INSERT INTO ota_quota (device_id, window, count) VALUES (?, ?, 1)
+       ON CONFLICT(device_id, window) DO UPDATE SET count = count + 1`,
+      deviceId,
+      window
+    );
+    return true;
+  }
+
+  // A nudge, not a push: the device still decides whether to pull.
+  async notifyOta(deviceId: string): Promise<void> {
+    const payload = JSON.stringify({ type: 'ota' });
+    for (const ws of this.ctx.getWebSockets()) {
+      if (this.deviceOf(ws) !== deviceId) continue;
+      try { ws.send(payload); } catch { /* dead socket; ignore */ }
+    }
+  }
+
+  async deleteDevice(deviceId: string): Promise<void> {
+    this.sql.exec(`DELETE FROM latest_state WHERE device_id = ?`, deviceId);
+    this.sql.exec(`DELETE FROM ring_buffer WHERE device_id = ?`, deviceId);
+    this.sql.exec(`DELETE FROM pending_control WHERE device_id = ?`, deviceId);
   }
 
   async flushNow(): Promise<FlushResult> {
@@ -427,26 +524,9 @@ export class ProjectDO extends DurableObject<Env> {
     const server = pair[1] as WebSocket;
     this.ctx.acceptWebSocket(server);
 
-    // Flush any pending (undelivered) control writes on connect so a device
-    // that missed messages while offline catches up immediately. The device
-    // acks them via `{type:'ack', ids:[...]}` once processed.
-    const pending = this.sql
-      .exec<{ id: string; variable: string; value: string }>(
-        `SELECT id, variable, value FROM pending_control
-          WHERE delivered_at IS NULL
-          ORDER BY created_at ASC`
-      )
-      .toArray();
-    for (const cmd of pending) {
-      try {
-        server.send(JSON.stringify({
-          type: 'control',
-          id: cmd.id,
-          variable: cmd.variable,
-          value: safeParse(cmd.value),
-        }));
-      } catch { /* ignore */ }
-    }
+    // Until a hello arrives the socket counts as the default device.
+    server.serializeAttachment({ device: '' });
+    this.sendPending(server, `(device_id IS NULL OR device_id = '')`);
 
     return new Response(null, { status: 101, webSocket: client });
   }
@@ -457,14 +537,36 @@ export class ProjectDO extends DurableObject<Env> {
     const raw = typeof message === 'string' ? message : new TextDecoder().decode(message);
     const msg = parseDeviceMessage(raw);
     switch (msg.kind) {
+      case 'hello': {
+        const pid = this.projectId();
+        const key = normaliseDeviceKey(msg.device);
+        const device = key ? await resolveDevice(this.env, pid, key, Math.floor(Date.now() / 1000)) : null;
+        if (!device || !device.storageId) return;
+        ws.serializeAttachment({ device: device.storageId });
+        this.ctx.waitUntil(
+          recordDeviceSeen(this.env, device.id, msg.chip, msg.firmware)
+            .then(() => reconcile(this.env, device.id, msg.firmware ?? null))
+        );
+        this.sendPending(ws, `device_id = ?`, device.storageId);
+        return;
+      }
       case 'ack':
-        if (msg.ids.length > 0) await this.ackControl(msg.ids);
+        if (msg.ids.length > 0) await this.ackControl(msg.ids, this.deviceOf(ws));
         return;
       case 'telemetry': {
         const pid = this.projectId();
-        await this.ingest(pid, msg.points);
+        await this.ingest(pid, msg.points, this.deviceOf(ws));
         const now = Math.floor(Date.now() / 1000);
-        this.ctx.waitUntil(upsertVariables(this.env, pid, msg.points.map((p) => p.variable), now));
+        this.ctx.waitUntil(
+          this.d1DeviceId(ws, pid).then((id) =>
+            id
+              ? Promise.all([
+                  upsertVariables(this.env, pid, id, msg.points.map((p) => p.variable), now),
+                  touchDevice(this.env, id),
+                ])
+              : undefined
+          )
+        );
         return;
       }
       case 'event':
@@ -489,22 +591,22 @@ export class ProjectDO extends DurableObject<Env> {
     // Same as close: nothing to do.
   }
 
-  // Wipes all data owned by this project — DO SQLite + R2 telemetry history.
+  // Wipes all data owned by this project — DO SQLite + everything it owns in R2.
   async destroy(): Promise<void> {
     const projectId = this.projectId();
 
-    // Delete every R2 object under telemetry/{projectId}/ (paginated).
-    let cursor: string | undefined;
-    do {
-      const list = await this.env.R2.list({
-        prefix: `telemetry/${projectId}/`,
-        ...(cursor ? { cursor } : {}),
-      });
-      if (list.objects.length > 0) {
-        await this.env.R2.delete(list.objects.map((o) => o.key));
-      }
-      cursor = list.truncated ? list.cursor : undefined;
-    } while (cursor);
+    // A prefix added elsewhere and not listed here leaks objects nothing reaches.
+    // builds/ is no longer written; kept so agent-era artifacts still get swept.
+    for (const prefix of [`telemetry/${projectId}/`, `firmware/${projectId}/`, `builds/${projectId}/`]) {
+      let cursor: string | undefined;
+      do {
+        const list = await this.env.R2.list({ prefix, ...(cursor ? { cursor } : {}) });
+        if (list.objects.length > 0) {
+          await this.env.R2.delete(list.objects.map((o) => o.key));
+        }
+        cursor = list.truncated ? list.cursor : undefined;
+      } while (cursor);
+    }
 
     // Cancel any scheduled flush + wipe SQLite storage entirely.
     await this.ctx.storage.deleteAlarm();
@@ -558,8 +660,8 @@ export class ProjectDO extends DurableObject<Env> {
   private async runFlush(): Promise<FlushResult> {
     const cursor = this.getFlushCursor();
     const rows = this.sql
-      .exec<{ rowid: number; ts: number; variable: string; value: string }>(
-        `SELECT rowid, ts, variable, value FROM ring_buffer WHERE rowid > ? ORDER BY rowid ASC`,
+      .exec<{ rowid: number; ts: number; device_id: string; variable: string; value: string }>(
+        `SELECT rowid, ts, device_id, variable, value FROM ring_buffer WHERE rowid > ? ORDER BY rowid ASC`,
         cursor
       )
       .toArray();
@@ -583,7 +685,7 @@ export class ProjectDO extends DurableObject<Env> {
       const key = `telemetry/${projectId}/${bucket}/r-${lastRowid.toString().padStart(12, '0')}.ndjson`;
       const body = bucketRows
         .map((r) =>
-          JSON.stringify({ ts: r.ts, variable: r.variable, value: safeParse(r.value) })
+          JSON.stringify({ ts: r.ts, device: r.device_id || null, variable: r.variable, value: safeParse(r.value) })
         )
         .join('\n') + '\n';
 
@@ -601,56 +703,6 @@ export class ProjectDO extends DurableObject<Env> {
     return { flushed: rows.length, keys, newCursor };
   }
 
-  private initSchema(): void {
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS latest_state (
-        variable    TEXT PRIMARY KEY,
-        value       TEXT NOT NULL,
-        received_at INTEGER NOT NULL
-      );
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS ring_buffer (
-        rowid    INTEGER PRIMARY KEY AUTOINCREMENT,
-        ts       INTEGER NOT NULL,
-        variable TEXT NOT NULL,
-        value    TEXT NOT NULL
-      );
-    `);
-    this.sql.exec(`CREATE INDEX IF NOT EXISTS idx_ring_buffer_ts ON ring_buffer(ts);`);
-    // Serves the per-variable series reads (chart snapshots + delta polls); the
-    // ts-only index above stays for age-based eviction.
-    this.sql.exec(
-      `CREATE INDEX IF NOT EXISTS idx_ring_buffer_var_ts ON ring_buffer(variable, ts);`
-    );
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS pending_control (
-        id           TEXT PRIMARY KEY,
-        variable     TEXT NOT NULL,
-        value        TEXT NOT NULL,
-        created_at   INTEGER NOT NULL,
-        delivered_at INTEGER
-      );
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS flush_meta (
-        k TEXT PRIMARY KEY,
-        v TEXT
-      );
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS subscriptions (
-        dashboard_id TEXT PRIMARY KEY
-      );
-    `);
-    this.sql.exec(`
-      CREATE TABLE IF NOT EXISTS auto_cache (
-        k TEXT PRIMARY KEY,
-        v TEXT
-      );
-    `);
-  }
-
   private evictRingBuffer(now: number): void {
     // Gate the actual eviction on a cheap last_evict_at lookup so the age DELETE,
     // COUNT, and overflow DELETE don't run on every single ingest.
@@ -663,16 +715,20 @@ export class ProjectDO extends DurableObject<Env> {
     const ageCutoff = now - RING_BUFFER_MAX_AGE_SECONDS;
     this.sql.exec(`DELETE FROM ring_buffer WHERE ts < ?`, ageCutoff);
 
-    const row = this.sql
-      .exec<{ count: number }>(`SELECT COUNT(*) AS count FROM ring_buffer`)
-      .one();
-    if (row.count > RING_BUFFER_MAX_ROWS) {
-      const overflow = row.count - RING_BUFFER_MAX_ROWS;
+    const over = this.sql
+      .exec<{ device_id: string; count: number }>(
+        `SELECT device_id, COUNT(*) AS count FROM ring_buffer
+          GROUP BY device_id HAVING count > ?`,
+        RING_BUFFER_MAX_ROWS_PER_DEVICE
+      )
+      .toArray();
+    for (const d of over) {
       this.sql.exec(
         `DELETE FROM ring_buffer WHERE rowid IN (
-           SELECT rowid FROM ring_buffer ORDER BY rowid ASC LIMIT ?
+           SELECT rowid FROM ring_buffer WHERE device_id = ? ORDER BY rowid ASC LIMIT ?
          )`,
-        overflow
+        d.device_id,
+        d.count - RING_BUFFER_MAX_ROWS_PER_DEVICE
       );
     }
 
diff --git a/worker/src/platform/durable-objects/project-schema.ts b/worker/src/platform/durable-objects/project-schema.ts
new file mode 100644
index 0000000..bf4d4c9
--- /dev/null
+++ b/worker/src/platform/durable-objects/project-schema.ts
@@ -0,0 +1,87 @@
+import type { SchemaStep } from './schema';
+
+export const PROJECT_SCHEMA: SchemaStep[] = [
+  (sql) => {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS latest_state (
+        variable    TEXT PRIMARY KEY,
+        value       TEXT NOT NULL,
+        received_at INTEGER NOT NULL
+      );
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS ring_buffer (
+        rowid    INTEGER PRIMARY KEY AUTOINCREMENT,
+        ts       INTEGER NOT NULL,
+        variable TEXT NOT NULL,
+        value    TEXT NOT NULL
+      );
+    `);
+    sql.exec(`CREATE INDEX IF NOT EXISTS idx_ring_buffer_ts ON ring_buffer(ts);`);
+    // Serves the per-variable series reads (chart snapshots + delta polls); the
+    // ts-only index above stays for age-based eviction.
+    sql.exec(`CREATE INDEX IF NOT EXISTS idx_ring_buffer_var_ts ON ring_buffer(variable, ts);`);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS pending_control (
+        id           TEXT PRIMARY KEY,
+        variable     TEXT NOT NULL,
+        value        TEXT NOT NULL,
+        created_at   INTEGER NOT NULL,
+        delivered_at INTEGER
+      );
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS flush_meta (
+        k TEXT PRIMARY KEY,
+        v TEXT
+      );
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS subscriptions (
+        dashboard_id TEXT PRIMARY KEY
+      );
+    `);
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS auto_cache (
+        k TEXT PRIMARY KEY,
+        v TEXT
+      );
+    `);
+  },
+  // '' is the default device. NULL can't serve: SQLite treats NULLs as distinct
+  // in a unique key, so the upsert would duplicate on every write.
+  (sql) => {
+    sql.exec(`
+      CREATE TABLE latest_state_new (
+        device_id   TEXT NOT NULL DEFAULT '',
+        variable    TEXT NOT NULL,
+        value       TEXT NOT NULL,
+        received_at INTEGER NOT NULL,
+        PRIMARY KEY (device_id, variable)
+      );
+    `);
+    sql.exec(`
+      INSERT INTO latest_state_new (device_id, variable, value, received_at)
+      SELECT '', variable, value, received_at FROM latest_state;
+    `);
+    sql.exec(`DROP TABLE latest_state;`);
+    sql.exec(`ALTER TABLE latest_state_new RENAME TO latest_state;`);
+
+    sql.exec(`ALTER TABLE ring_buffer ADD COLUMN device_id TEXT NOT NULL DEFAULT '';`);
+    sql.exec(`DROP INDEX IF EXISTS idx_ring_buffer_var_ts;`);
+    sql.exec(`CREATE INDEX IF NOT EXISTS idx_ring_buffer_dev_var_ts ON ring_buffer(device_id, variable, ts);`);
+
+    // NULL device still broadcasts.
+    sql.exec(`ALTER TABLE pending_control ADD COLUMN device_id TEXT;`);
+  },
+  (sql) => {
+    sql.exec(`
+      CREATE TABLE IF NOT EXISTS ota_quota (
+        device_id TEXT NOT NULL,
+        window    INTEGER NOT NULL,
+        count     INTEGER NOT NULL,
+        PRIMARY KEY (device_id, window)
+      );
+    `);
+  },
+];
diff --git a/worker/src/platform/durable-objects/schema.ts b/worker/src/platform/durable-objects/schema.ts
new file mode 100644
index 0000000..9eb7835
--- /dev/null
+++ b/worker/src/platform/durable-objects/schema.ts
@@ -0,0 +1,15 @@
+export type SchemaStep = (sql: SqlStorage) => void;
+
+// Objects that predate versioning have the tables but no version row, so the
+// baseline must stay CREATE ... IF NOT EXISTS — they replay it as a no-op.
+export function migrateSchema(ctx: DurableObjectState, steps: SchemaStep[]): void {
+  ctx.storage.transactionSync(() => {
+    const sql = ctx.storage.sql;
+    sql.exec(`CREATE TABLE IF NOT EXISTS schema_version (v INTEGER PRIMARY KEY)`);
+    const from = sql.exec<{ v: number }>(`SELECT v FROM schema_version`).toArray()[0]?.v ?? 0;
+    if (from >= steps.length) return;
+    for (let i = from; i < steps.length; i++) steps[i]!(sql);
+    sql.exec(`DELETE FROM schema_version`);
+    sql.exec(`INSERT INTO schema_version (v) VALUES (?)`, steps.length);
+  });
+}
diff --git a/worker/src/platform/engine/run.ts b/worker/src/platform/engine/run.ts
index d3096bc..2384906 100644
--- a/worker/src/platform/engine/run.ts
+++ b/worker/src/platform/engine/run.ts
@@ -205,9 +205,11 @@ function defaultEmitEvent(env: Env): ActionDeps['emitEvent'] {
   };
 }
 
+// Schedule, sunset and manual runs carry no device; without this the first by
+// sort order wins.
 function defaultGetVariable(env: Env, projectId: string): (variable: string) => Promise<unknown> {
   return async (variable) => {
-    const rows = await projectStub(env, projectId).getLatestState();
+    const rows = await projectStub(env, projectId).getLatestState('');
     return rows.find((r) => r.variable === variable)?.value;
   };
 }
diff --git a/worker/src/platform/engine/types.ts b/worker/src/platform/engine/types.ts
index d6216c6..32a8f10 100644
--- a/worker/src/platform/engine/types.ts
+++ b/worker/src/platform/engine/types.ts
@@ -7,6 +7,7 @@ export type VariableOperator = '>' | '<' | '>=' | '<=' | '==' | '!=' | 'changed'
 
 export type VariableTriggerConfig = {
   variable: string;                    // variable key
+  device?: string | null;              // device id; absent/null = any device
   operator: VariableOperator;
   value?: number | string | boolean;   // omitted for 'changed'
   mode?: 'edge' | 'always';            // edge (default): fire once on entry
@@ -49,6 +50,7 @@ export type AutomationContext = {
   ts: number;                          // unix seconds
   variable?: string;
   value?: unknown;
+  device?: string;                     // storage id of the device that triggered
   event?: string;
   payload?: Record<string, unknown>;
   depth: number;                       // emit_event recursion depth
diff --git a/worker/src/platform/lib/audit.ts b/worker/src/platform/lib/audit.ts
index 86108e8..f4be0ee 100644
--- a/worker/src/platform/lib/audit.ts
+++ b/worker/src/platform/lib/audit.ts
@@ -21,6 +21,8 @@ export async function isAuditEnabled(env: Env): Promise<boolean> {
 export type AuditTargetType =
   | 'project'
   | 'variable'
+  | 'device'
+  | 'firmware'
   | 'project_token'
   | 'dashboard'
   | 'token'
diff --git a/worker/src/platform/lib/ids.ts b/worker/src/platform/lib/ids.ts
index 7ca5a2d..79f4f0e 100644
--- a/worker/src/platform/lib/ids.ts
+++ b/worker/src/platform/lib/ids.ts
@@ -7,6 +7,7 @@ import { nanoid } from 'nanoid';
 // tok_xxx  token       ctl_xxx  control write
 // aut_xxx  automation  itg_xxx  integration
 // wid_xxx  widget instance (inside a dashboard layout)
+// dev_xxx  device      fwr_xxx  firmware image
 // dly_xxx  delay continuation (pending automation resume)
 
 const PREFIXES = {
@@ -20,6 +21,8 @@ const PREFIXES = {
   integration: 'itg',
   widget: 'wid',
   delay: 'dly',
+  device: 'dev',
+  firmware: 'fwr',
 } as const;
 
 export type IdKind = keyof typeof PREFIXES;
diff --git a/worker/src/platform/lib/layout.ts b/worker/src/platform/lib/layout.ts
index 50076fa..fd56101 100644
--- a/worker/src/platform/lib/layout.ts
+++ b/worker/src/platform/lib/layout.ts
@@ -30,6 +30,9 @@ export type Layout = {
   mobile?: { items: MobilePlacement[] } | null;
   // Public-view auto-refresh cadence in seconds (server-clamped).
   refresh?: number;
+  // Which device this dashboard reads. Absent means the project's default,
+  // which is what every dashboard did before devices existed.
+  device?: string | null;
 };
 
 // Public-view refresh bounds: floor matches the /state edge-cache TTL (polling
@@ -90,6 +93,12 @@ export function validateLayout(input: unknown): { ok: true; value: Layout } | {
     refresh = Math.min(Math.max(Math.round(r), REFRESH_MIN), REFRESH_MAX);
   }
 
+  const d = input['device'];
+  if (d !== undefined && d !== null && typeof d !== 'string') {
+    return { ok: false, reason: 'layout.device must be a string or null' };
+  }
+  const device = typeof d === 'string' && d.trim() ? d.trim() : null;
+
   return {
     ok: true,
     value: {
@@ -97,6 +106,7 @@ export function validateLayout(input: unknown): { ok: true; value: Layout } | {
       items: items as WidgetInstance[],
       ...(mobile !== undefined ? { mobile } : {}),
       ...(refresh !== undefined ? { refresh } : {}),
+      ...(device !== null ? { device } : {}),
     },
   };
 }
diff --git a/worker/src/routes.ts b/worker/src/routes.ts
index cdc2913..9cc1816 100644
--- a/worker/src/routes.ts
+++ b/worker/src/routes.ts
@@ -18,6 +18,9 @@ import publicInvite from './domains/identity/public-invite';
 // projects / variables / dashboards / automations / integrations
 import projects from './domains/projects/routes';
 import variables from './domains/variables/routes';
+import devicesRouter from './domains/devices/routes';
+import firmwareAdmin from './domains/firmware/admin';
+import otaDevice from './domains/firmware/device';
 import { readList, readState, readSeries } from './domains/variables/read';
 import dashboards from './domains/dashboards/routes';
 import publicDashboards from './domains/dashboards/public';
@@ -67,6 +70,9 @@ export function registerRoutes(app: App): void {
   app.route('/v1/admin/invites', invitesRouter);
   app.route('/v1/admin/projects', projects);
   app.route('/v1/admin/projects/:proj/variables', variables);
+  app.route('/v1/admin/projects/:proj/devices', devicesRouter);
+  app.route('/v1/admin/projects/:proj/firmware', firmwareAdmin);
+  app.route('/v1/ota', otaDevice);
   app.route('/v1/admin/projects/:proj/dashboards', dashboards);
   app.route('/v1/admin/projects/:proj/automations', automations);
   app.route('/v1/admin/projects/:proj/integrations', integrations);
diff --git a/worker/test/device-seen.test.ts b/worker/test/device-seen.test.ts
new file mode 100644
index 0000000..825fd35
--- /dev/null
+++ b/worker/test/device-seen.test.ts
@@ -0,0 +1,51 @@
+// A throttle that never lets go is the same bug as no write at all.
+// Run with `bun test worker/test/device-seen.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { touchDevice } from '../src/domains/devices/service';
+import type { Env } from '../src/env';
+
+function fakeEnv(fail = false) {
+  const writes: string[] = [];
+  const env = {
+    DB: {
+      prepare() {
+        return {
+          bind(..._args: unknown[]) {
+            return {
+              run() {
+                if (fail) throw new Error('d1 down');
+                writes.push('write');
+                return Promise.resolve();
+              },
+            };
+          },
+        };
+      },
+    },
+  } as unknown as Env;
+  return { env, writes };
+}
+
+test('writes once and then throttles the same device', async () => {
+  const { env, writes } = fakeEnv();
+  await touchDevice(env, 'dev_throttle_a');
+  await touchDevice(env, 'dev_throttle_a');
+  await touchDevice(env, 'dev_throttle_a');
+  expect(writes.length).toBe(1);
+});
+
+test('throttles per device, not globally', async () => {
+  const { env, writes } = fakeEnv();
+  await touchDevice(env, 'dev_throttle_b');
+  await touchDevice(env, 'dev_throttle_c');
+  expect(writes.length).toBe(2);
+});
+
+test('a failed write retries on the next call', async () => {
+  const failing = fakeEnv(true);
+  await touchDevice(failing.env, 'dev_throttle_d');
+  const ok = fakeEnv();
+  await touchDevice(ok.env, 'dev_throttle_d');
+  expect(ok.writes.length).toBe(1);
+});
diff --git a/worker/test/do-schema.test.ts b/worker/test/do-schema.test.ts
new file mode 100644
index 0000000..b2a1e47
--- /dev/null
+++ b/worker/test/do-schema.test.ts
@@ -0,0 +1,75 @@
+// Durable Objects have no migration runner, so a project created today and one
+// created before devices existed reach their schema by different routes. The
+// classic divergence is silent — a column NOT NULL on one and nullable on the
+// other — so the two are compared directly.
+// Run with `bun test worker/test/do-schema.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { Database } from 'bun:sqlite';
+import { PROJECT_SCHEMA } from '../src/platform/durable-objects/project-schema';
+
+// SqlStorage.exec(sql, ...binds) over bun:sqlite, which is what the steps expect.
+function storage(db: Database) {
+  return { exec: (sql: string, ...binds: unknown[]) => db.run(sql, ...(binds as never[])) };
+}
+
+function applySteps(db: Database, from: number, to: number) {
+  const sql = storage(db) as never;
+  for (let i = from; i < to; i++) PROJECT_SCHEMA[i]!(sql);
+}
+
+function schemaOf(db: Database): string {
+  return db
+    .query<{ type: string; name: string; sql: string | null }, []>(
+      `SELECT type, name, sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name`
+    )
+    .all()
+    .map((r) => `${r.type} ${r.name}\n${r.sql ?? ''}`)
+    .join('\n---\n');
+}
+
+test('an object built step by step matches one built fresh', () => {
+  const stepped = new Database(':memory:');
+  for (let i = 0; i < PROJECT_SCHEMA.length; i++) applySteps(stepped, i, i + 1);
+
+  const fresh = new Database(':memory:');
+  applySteps(fresh, 0, PROJECT_SCHEMA.length);
+
+  expect(schemaOf(stepped)).toBe(schemaOf(fresh));
+});
+
+test('rows written before devices existed land on the default device', () => {
+  const db = new Database(':memory:');
+  applySteps(db, 0, 1);
+  db.run(`INSERT INTO latest_state (variable, value, received_at) VALUES ('temp', '21', 100)`);
+  db.run(`INSERT INTO ring_buffer (ts, variable, value) VALUES (100, 'temp', '21')`);
+  applySteps(db, 1, PROJECT_SCHEMA.length);
+
+  expect(db.query(`SELECT device_id, variable FROM latest_state`).all())
+    .toEqual([{ device_id: '', variable: 'temp' }]);
+  expect(db.query(`SELECT device_id FROM ring_buffer`).all()).toEqual([{ device_id: '' }]);
+});
+
+// The reason '' is the sentinel rather than NULL: SQLite treats NULLs as
+// distinct in a unique key, so the upsert would append instead of updating.
+test('the default device upserts rather than duplicating', () => {
+  const db = new Database(':memory:');
+  applySteps(db, 0, PROJECT_SCHEMA.length);
+  const write = (value: string) =>
+    db.run(
+      `INSERT INTO latest_state (device_id, variable, value, received_at) VALUES ('', 'temp', ?, 1)
+       ON CONFLICT(device_id, variable) DO UPDATE SET value = excluded.value`,
+      value
+    );
+  write('21');
+  write('22');
+  expect(db.query(`SELECT value FROM latest_state`).all()).toEqual([{ value: '22' }]);
+});
+
+test('two devices keep separate state for the same variable', () => {
+  const db = new Database(':memory:');
+  applySteps(db, 0, PROJECT_SCHEMA.length);
+  db.run(`INSERT INTO latest_state (device_id, variable, value, received_at) VALUES ('', 'temp', '21', 1)`);
+  db.run(`INSERT INTO latest_state (device_id, variable, value, received_at) VALUES ('dev_b', 'temp', '30', 1)`);
+  expect(db.query(`SELECT COUNT(*) AS n FROM latest_state WHERE variable = 'temp'`).get()).toEqual({ n: 2 });
+});
diff --git a/worker/test/firmware-image.test.ts b/worker/test/firmware-image.test.ts
new file mode 100644
index 0000000..e308e1d
--- /dev/null
+++ b/worker/test/firmware-image.test.ts
@@ -0,0 +1,50 @@
+// The two uploads that would otherwise reach a board: a file that isn't an app
+// image, and the merged flash image Arduino writes next to it.
+// Run with `bun test worker/test/firmware-image.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { inspectImage } from '../src/domains/firmware/image';
+
+function appImage(chipId: number, length = 4096): ArrayBuffer {
+  const bytes = new Uint8Array(length);
+  bytes[0] = 0xe9;
+  bytes[12] = chipId & 0xff;
+  bytes[13] = (chipId >> 8) & 0xff;
+  return bytes.buffer;
+}
+
+test('reads the chip an ESP32 image was built for', () => {
+  expect(inspectImage(appImage(0x0009))).toEqual({ ok: true, chip: 'esp32-s3' });
+  expect(inspectImage(appImage(0x0000))).toEqual({ ok: true, chip: 'esp32' });
+});
+
+test('an unknown chip id is no chip, not a rejection', () => {
+  expect(inspectImage(appImage(0x00ff))).toEqual({ ok: true, chip: null });
+});
+
+test('rejects a file that is not an ESP image', () => {
+  const notEsp = new Uint8Array(4096);
+  notEsp[0] = 0x7f;
+  const r = inspectImage(notEsp.buffer);
+  expect(r.ok).toBe(false);
+  if (!r.ok) expect(r.code).toBe('not_an_esp_image');
+});
+
+test('rejects anything shorter than a header', () => {
+  const r = inspectImage(new Uint8Array([0xe9, 0x01]).buffer);
+  expect(r.ok).toBe(false);
+});
+
+test('rejects a merged flash image by its partition table', () => {
+  const bytes = new Uint8Array(0x9000);
+  bytes[0] = 0xe9;
+  bytes[0x8000] = 0xaa;
+  bytes[0x8001] = 0x50;
+  const r = inspectImage(bytes.buffer);
+  expect(r.ok).toBe(false);
+  if (!r.ok) expect(r.code).toBe('merged_image');
+});
+
+test('an app image larger than the partition offset still passes', () => {
+  expect(inspectImage(appImage(0x0000, 0x9000))).toEqual({ ok: true, chip: 'esp32' });
+});
diff --git a/worker/test/migrations.test.ts b/worker/test/migrations.test.ts
new file mode 100644
index 0000000..10176a1
--- /dev/null
+++ b/worker/test/migrations.test.ts
@@ -0,0 +1,191 @@
+// A fresh install and an upgraded one have to arrive at the same schema, and the
+// upgrade has to keep its data. Runs the real bundled statements against SQLite.
+// Run with `bun test worker/test/migrations.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { Database } from 'bun:sqlite';
+import { MIGRATIONS } from '../src/platform/db/migrations.gen';
+
+function apply(db: Database, upTo: number) {
+  for (const m of MIGRATIONS.slice(0, upTo)) {
+    for (const stmt of m.statements) db.run(stmt);
+  }
+}
+
+// Ordered so two databases built by different routes compare directly.
+function schemaOf(db: Database): string {
+  const rows = db
+    .query<{ type: string; name: string; sql: string | null }, []>(
+      `SELECT type, name, sql FROM sqlite_master
+       WHERE name NOT LIKE 'sqlite_%' ORDER BY type, name`
+    )
+    .all();
+  return rows.map((r) => `${r.type} ${r.name}\n${r.sql ?? ''}`).join('\n---\n');
+}
+
+function seed(db: Database) {
+  db.run(`INSERT INTO users (id, email, name, role, created_at, updated_at)
+          VALUES ('usr_1', 'a@b.c', 'A', 'owner', 1, 1)`);
+  db.run(`INSERT INTO projects (id, name, created_by, created_at, updated_at)
+          VALUES ('prj_alpha', 'Alpha', 'usr_1', 100, 100),
+                 ('prj_beta', 'Beta', 'usr_1', 200, 200)`);
+  db.run(`INSERT INTO project_variables (id, project_id, key, unit, created_at, updated_at, last_seen)
+          VALUES ('var_1', 'prj_alpha', 'temp', 'C', 100, 100, 500),
+                 ('var_2', 'prj_alpha', 'humidity', NULL, 100, 100, 600),
+                 ('var_3', 'prj_beta', 'temp', NULL, 200, 200, NULL)`);
+}
+
+test('fresh and upgraded instances reach an identical schema', () => {
+  const upgraded = new Database(':memory:');
+  apply(upgraded, 1);
+  seed(upgraded);
+  apply(upgraded, MIGRATIONS.length);
+
+  const fresh = new Database(':memory:');
+  apply(fresh, MIGRATIONS.length);
+
+  expect(schemaOf(upgraded)).toBe(schemaOf(fresh));
+});
+
+test('the upgrade runs clean against an instance with no rows', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  expect(() => apply(db, MIGRATIONS.length)).not.toThrow();
+  expect(db.query(`SELECT COUNT(*) AS n FROM devices`).get()).toEqual({ n: 0 });
+});
+
+test('every project gets exactly one default device', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+
+  const devices = db
+    .query<{ id: string; project_id: string; name: string; is_default: number }, []>(
+      `SELECT id, project_id, name, is_default FROM devices ORDER BY project_id`
+    )
+    .all();
+  expect(devices).toEqual([
+    { id: 'dev_alpha', project_id: 'prj_alpha', name: 'Default', is_default: 1 },
+    { id: 'dev_beta', project_id: 'prj_beta', name: 'Default', is_default: 1 },
+  ]);
+});
+
+test('a second default device cannot be inserted', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+  expect(() =>
+    db.run(`INSERT INTO devices (id, project_id, name, is_default, created_at)
+            VALUES ('dev_x', 'prj_alpha', 'Second', 1, 1)`)
+  ).toThrow();
+});
+
+test('existing variables survive and land on their default device', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+
+  const rows = db
+    .query<{ id: string; project_id: string; device_id: string; key: string; unit: string | null; last_seen: number | null }, []>(
+      `SELECT id, project_id, device_id, key, unit, last_seen FROM project_variables ORDER BY id`
+    )
+    .all();
+  expect(rows).toEqual([
+    { id: 'var_1', project_id: 'prj_alpha', device_id: 'dev_alpha', key: 'temp', unit: 'C', last_seen: 500 },
+    { id: 'var_2', project_id: 'prj_alpha', device_id: 'dev_alpha', key: 'humidity', unit: null, last_seen: 600 },
+    { id: 'var_3', project_id: 'prj_beta', device_id: 'dev_beta', key: 'temp', unit: null, last_seen: null },
+  ]);
+});
+
+test('the same key is now allowed once per device', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+
+  db.run(`INSERT INTO devices (id, project_id, name, created_at) VALUES ('dev_two', 'prj_alpha', 'Shed', 1)`);
+  expect(() =>
+    db.run(`INSERT INTO project_variables (id, project_id, device_id, key, created_at, updated_at)
+            VALUES ('var_4', 'prj_alpha', 'dev_two', 'temp', 1, 1)`)
+  ).not.toThrow();
+  expect(() =>
+    db.run(`INSERT INTO project_variables (id, project_id, device_id, key, created_at, updated_at)
+            VALUES ('var_5', 'prj_alpha', 'dev_alpha', 'temp', 1, 1)`)
+  ).toThrow();
+});
+
+test('a device points at desired firmware and survives its deletion', () => {
+  const db = new Database(':memory:');
+  db.run('PRAGMA foreign_keys = ON');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+
+  db.run(`INSERT INTO firmware (id, project_id, version, size, sha256, r2_key, created_at)
+          VALUES ('fw_1', 'prj_alpha', '1.4.0', 100, 'abc', 'k', 1)`);
+  db.run(`UPDATE devices SET desired_firmware_id = 'fw_1' WHERE id = 'dev_alpha'`);
+  db.run(`DELETE FROM firmware WHERE id = 'fw_1'`);
+
+  // ON DELETE SET NULL, so the device stays; it just has nothing pending.
+  const row = db.query(`SELECT desired_firmware_id FROM devices WHERE id = 'dev_alpha'`).get();
+  expect(row).toEqual({ desired_firmware_id: null });
+});
+
+test('one firmware version per project', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+  const insert = (id: string, project: string) =>
+    db.run(`INSERT INTO firmware (id, project_id, version, size, sha256, r2_key, created_at)
+            VALUES ('${id}', '${project}', '1.0.0', 1, 'a', 'k', 1)`);
+  insert('fw_a', 'prj_alpha');
+  expect(() => insert('fw_b', 'prj_beta')).not.toThrow();
+  expect(() => insert('fw_c', 'prj_alpha')).toThrow();
+});
+
+// Mirrors the retention query in firmware/ota.ts — what it spares is the point.
+test('retention spares recent images and anything a device needs', () => {
+  const db = new Database(':memory:');
+  apply(db, 1);
+  seed(db);
+  apply(db, MIGRATIONS.length);
+
+  const add = (id: string, version: string, at: number) =>
+    db.run(`INSERT INTO firmware (id, project_id, version, size, sha256, r2_key, created_at)
+            VALUES ('${id}', 'prj_alpha', '${version}', 1, 'a', 'k', ${at})`);
+  add('fw_old', '0.1.0', 1);
+  add('fw_running', '0.2.0', 2);
+  add('fw_desired', '0.3.0', 3);
+  add('fw_recent', '0.4.0', 4);
+
+  db.run(`UPDATE devices SET firmware_version = '0.2.0' WHERE id = 'dev_alpha'`);
+  db.run(`INSERT INTO devices (id, project_id, name, desired_firmware_id, created_at)
+          VALUES ('dev_two', 'prj_alpha', 'Shed', 'fw_desired', 1)`);
+
+  const stale = db
+    .query<{ id: string }, []>(
+      `SELECT id FROM firmware
+        WHERE project_id = 'prj_alpha'
+          AND id NOT IN (SELECT id FROM firmware WHERE project_id = 'prj_alpha' ORDER BY created_at DESC LIMIT 1)
+          AND id NOT IN (SELECT desired_firmware_id FROM devices
+                          WHERE project_id = 'prj_alpha' AND desired_firmware_id IS NOT NULL)
+          AND version NOT IN (SELECT firmware_version FROM devices
+                               WHERE project_id = 'prj_alpha' AND firmware_version IS NOT NULL)`
+    )
+    .all();
+  expect(stale).toEqual([{ id: 'fw_old' }]);
+});
+
+// The baseline is all CREATE ... IF NOT EXISTS, including the index whose columns
+// 0002 changes. Replaying it must not put the old shape back.
+test('replaying the baseline over a migrated database changes nothing', () => {
+  const db = new Database(':memory:');
+  apply(db, MIGRATIONS.length);
+  const before = schemaOf(db);
+  apply(db, 1);
+  expect(schemaOf(db)).toBe(before);
+});
diff --git a/worker/test/ota-offer.test.ts b/worker/test/ota-offer.test.ts
new file mode 100644
index 0000000..e2fc392
--- /dev/null
+++ b/worker/test/ota-offer.test.ts
@@ -0,0 +1,47 @@
+// Offering an update the board already applied is a reboot loop, not a retry.
+// Run with `bun test worker/test/ota-offer.test.ts`.
+
+import { test, expect } from 'bun:test';
+import { offerFor } from '../src/domains/firmware/ota';
+import type { Env } from '../src/env';
+
+function envWith(row: Record<string, unknown> | null) {
+  return {
+    DB: {
+      prepare: () => ({ bind: () => ({ first: () => Promise.resolve(row) }) }),
+    },
+  } as unknown as Env;
+}
+
+const desired = { version: '1.2.0', size: 100, sha256: 'abc', current: null, status: 'pending' };
+
+test('offers when the board runs something else', async () => {
+  const offer = await offerFor(envWith({ ...desired, current: '1.1.0' }), 'prj_a', 'dev_a');
+  expect(offer?.version).toBe('1.2.0');
+});
+
+test('offers nothing once the stored version matches', async () => {
+  const offer = await offerFor(envWith({ ...desired, current: '1.2.0' }), 'prj_a', 'dev_a');
+  expect(offer).toBeNull();
+});
+
+test('a version reported in the request beats the stored one', async () => {
+  const env = envWith({ ...desired, current: '1.1.0' });
+  expect(await offerFor(env, 'prj_a', 'dev_a', '1.2.0')).toBeNull();
+});
+
+test('a stale stored version does not suppress a real update', async () => {
+  const env = envWith({ ...desired, current: '1.2.0' });
+  expect((await offerFor(env, 'prj_a', 'dev_a', '1.1.0'))?.version).toBe('1.2.0');
+});
+
+test('offers nothing with no desired firmware', async () => {
+  expect(await offerFor(envWith(null), 'prj_a', 'dev_a')).toBeNull();
+});
+
+// A board that pulled the image and still reports the old version isn't retrying
+// its way out of it; offering again is the reflash loop.
+test('offers nothing once the update is marked failed', async () => {
+  const env = envWith({ ...desired, current: '1.1.0', status: 'failed' });
+  expect(await offerFor(env, 'prj_a', 'dev_a', '1.1.0')).toBeNull();
+});
diff --git a/worker/test/ws-protocol.test.ts b/worker/test/ws-protocol.test.ts
index c74301c..2820d71 100644
--- a/worker/test/ws-protocol.test.ts
+++ b/worker/test/ws-protocol.test.ts
@@ -71,7 +71,24 @@ test('event with no name is an error frame', () => {
 });
 
 test('unknown type is ignored', () => {
+  expect(parseDeviceMessage(JSON.stringify({ type: 'wat' }))).toEqual({ kind: 'ignore' });
+});
+
+test('hello carries the device and its optional metadata', () => {
+  expect(parseDeviceMessage(JSON.stringify({ type: 'hello', device: 'a4:cf:12:00' })))
+    .toEqual({ kind: 'hello', device: 'a4:cf:12:00' });
+  expect(parseDeviceMessage(JSON.stringify({ type: 'hello', device: 'b1', chip: 'esp32s3', firmware: '1.4.0' })))
+    .toEqual({ kind: 'hello', device: 'b1', chip: 'esp32s3', firmware: '1.4.0' });
+});
+
+test('hello without a device is ignored', () => {
   expect(parseDeviceMessage(JSON.stringify({ type: 'hello' }))).toEqual({ kind: 'ignore' });
+  expect(parseDeviceMessage(JSON.stringify({ type: 'hello', device: '  ' }))).toEqual({ kind: 'ignore' });
+});
+
+test('hello metadata is length-capped', () => {
+  const m = parseDeviceMessage(JSON.stringify({ type: 'hello', device: 'b1', chip: 'x'.repeat(80) }));
+  expect(m.kind === 'hello' && m.chip?.length).toBe(32);
 });
 
 test('non-JSON is ignored', () => {
diff --git a/wrangler.toml b/wrangler.toml
index dbcd3ab..fc9f170 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -9,9 +9,9 @@ compatibility_flags = ["nodejs_compat"]
 # bindings change; they can't be symlinked (the subdir must be self-contained).
 #
 # Build pipeline. scripts/build-from-upstream.sh, when running under Workers
-# Builds (detected via WORKERS_CI_COMMIT_SHA), replaces the clone's working
-# tree with upstream source before invoking the build chain. The user's
-# wrangler.toml (resource IDs from the Deploy button) is preserved across it.
+# Builds (detected via WORKERS_CI_COMMIT_SHA), replaces the clone's working tree
+# with upstream source, then rebuilds its wrangler.toml from deploy/wrangler.toml
+# — bindings from upstream, resource IDs and Worker name from the deployment.
 #
 # Locally the same script falls through to the standard build chain, so
 # `bun run build` / `wrangler deploy --dry-run` still work for development.