Does HMAC provide anything that AEAD does not? Alice and Bob have to talk through Eve. (server to device through untrusted third party that relays messages, no TLS available)

Assume a secure key. Out of scope. Example, ECDH key exchange with HKDF.

Each payload has associated data. Time, version, type, etc. Data that is used to get a message to the correct function in Alice or Bob. The transport protocols have none of this in their designs.

Message authentication is important, so HMAC. Message payload encryption is sometimes important so at least occasionally AES-GCM128 on payload. Most of the time the payload data is not confidential. AES-GCM128 AEAD could cover both use cases.

Constrained device. Overhead for nonce, keyid, time, time are noticeable. Compiled size for both algorithms also a factor.


If I need to support AEAD sometimes, is it reasonable to just use AEAD all the time and skip HMAC entirely? 
HMAC should be faster, but how much? I’ll need to test this, but suspect the difference might not be huge.
Is there an advantage to HMAC other than speed and being able to debug data that remains in clear text? Only other thing I know is smaller unpadded payload data.
Slightly aside, but does HMAC or AEAD benefit from including their nonces in the hashed / additional data? My replay attack prevention will mostly revolve around server time delivered to device on connection included in each message.
If I need to support AEAD sometimes, is it reasonable to just use AEAD all the time and skip HMAC entirely? 


Yes, and if you only  need integrity / authenticity of the message then you can put all of the message in the Associated Data.


  HMAC should be faster, but how much? I’ll need to test this, but suspect the difference might not be huge.


It won't be faster than GMAC generally, but if you include the CTR mode encryption  then you may see a difference. This is too dependent on the system config to be able to answer this reasonably.

Some settings or openssl speed may help you with this. In my case AES-GCM was even faster than HMAC-MD5 which is normally quite fast - although the MD5 speed in OpenSSL isn't that great (but it's the only supported version of HMAC for the speed command, unfortunately). And SHA-256 may also have hardware acceleration. This is a muddy field...


  Is there an advantage to HMAC other than speed and being able to debug data that remains in clear text? Only other thing I know is smaller unpadded payload data.


HMAC is a very sturdy algorithm that doesn't suddenly fail. AES-GCM may fail catastrophically if the authentication tag is too small or if the IV is repeated. I'd say that HMAC is less brittle than AES-GCM: the latter is secure, but it doesn't bend - it breaks.


  Slightly aside, but does HMAC or AEAD benefit from including their nonces in the hashed / additional data? My replay attack prevention will mostly revolve around server time delivered to device on connection included in each message.


No. HMAC doesn't contain a nonce (although you may need a message specific nonce to avoid replay attacks). AES-GCM always includes the nonce automatically during the verification of the authentication tag, so adding it separately is useless.