Guest Wi-Fi is designed to isolate clients from each other and from LAN devices. Matter over Wi-Fi breaks that model: your phone, the plug, and the hub must talk locally during and after commissioning. Setting up Matter while on guest SSID is the most common self-inflicted isolation bug.
Confirm isolation is the issue
Phone on guest, hub on main LAN — discovery spins forever. Vendor app pairs over BLE then loses device at Wi-Fi handoff. Works when you switch phone to main network. Router advertises “guest devices cannot see local devices.”
Fix without weakening security permanently
Move phone to main SSID for setup; move back after if desired (control may still need LAN). Or enable allow guests to access local network only during commissioning if router supports it — disable after. Create dedicated IoT SSID without client isolation instead of guest. Use Thread or hub on Ethernet while phone stays on main Wi-Fi.
Verify
Device commissions on main network and responds from hub app after phone disconnects guest Wi-Fi entirely.