Locks built with Matter.js reject remote operations when their operating mode prohibits them, closing a path that previously allowed a controller to select “No remote lock or unlock” and then unlock remotely anyway. Commands without a PIN also stop bypassing a wrong-code lockout.
Ingo Fischer extends authorization beyond the timed PIN access reported on October 6: the prohibition on remote control and the wrong-code lockout apply even when a command supplies no PIN. Users marked as having no access are refused, and disposable access ends after one successful unlock. These are rules for lock implementations built with the library; local keypad and fingerprint handling remain separate.