diff --git a/docs/changelog.md b/docs/changelog.md
index 10c90e97..d7a1b1e6 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -17,6 +17,31 @@ roadmap as it read that day, and the *Done* entries keep the shape they had
there. `check_docs.py` does not check this file, for the reason its module
docstring gives: it is a record, not a claim about now.
+## 2026-10-28
+
+- **A ninth camera, the eighth's lease, and the Skids pool rows read with
+ them**
+ ([#1283](https://github.com/Gerrrt/HomeLab/pull/1283),
+ [#1284](https://github.com/Gerrrt/HomeLab/pull/1284)).
+ The 2026-10-26 entry below left `network.md`'s camera row at seven
+ addresses with a note that the eighth was missing. `morpheus`'s lease table
+ for Skids was read on 2026-10-27 and matched against Home Assistant's Ring
+ device registry, whose eight device ids carry the cameras' MAC prefixes:
+ the eight Ring leases were the eight devices, and the new camera's prefix
+ was one the row already listed. A third floodlight was connected on
+ 2026-10-28 and a second read that day showed its lease, one more with a
+ prefix the row already had; `network.md`, `security.md`,
+ `enable-suricata.md` and the diagram said eight cameras and now say nine,
+ and the row is `camera-01…09`. Home Assistant had not reloaded the Ring
+ integration when this was written, so it still listed eight. The first
+ read also showed that all but two of the pool addresses in the table had
+ changed, the base station's with its re-enrolment of 2026-10-25, so the
+ alarm hub, the VTech monitors, the Litter-Robot, the white-noise machine
+ and four of the five Echos carry their new addresses. The fifth Echo held
+ no lease at either read, and the two VTech units, which share a prefix,
+ now share a row. One lease at each read was locally administered, matched
+ no row, and is not in the table. Nothing reserved moved.
+
## 2026-10-26
- **The Ring Alarm's sensors and keypads are paired, and ring-mqtt sees them**
diff --git a/docs/diagrams/current/network.png b/docs/diagrams/current/network.png
index e05ac493..260b8936 100644
Binary files a/docs/diagrams/current/network.png and b/docs/diagrams/current/network.png differ
diff --git a/docs/diagrams/current/network.svg b/docs/diagrams/current/network.svg
index ae205d84..cc31b53e 100644
--- a/docs/diagrams/current/network.svg
+++ b/docs/diagrams/current/network.svg
@@ -674,17 +674,17 @@
assistant ×5
Amazon Echo
-
+
-camera ×8
+camera ×9
Ring cameras, floodlights, doorbell
alarm-hub
-Ring Alarm Base Station · .121
+Ring Alarm Base Station · .108
diff --git a/docs/network.md b/docs/network.md
index 340cb65b..39651910 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -745,13 +745,12 @@ the least trusted.
| eero-iot-3 | `10.0.20.13` | `fc:3f:a6:xx:xx:xx` | eero Pro 6E | eeroOS | Main floor | Wi-Fi mesh |
| bifrost | `10.0.20.20` | `ec:b5:fa:xx:xx:xx` | Philips Hue Bridge[^Huebridge] | — | Main floor | Lighting |
| speaker-01…03 | `10.0.20.21`–`.23` | `d4:90:9c:xx:xx:xx`, `94:ea:32:xx:xx:xx`, `f4:34:f0:xx:xx:xx` | Apple HomePod[^homepod] | audioOS | Various | Assistant |
-| assistant-01…05 | `.105`, `.109`, `.114`, `.133`, `.144` | `74:d4:23:xx:xx:xx`, `58:a8:e8:xx:xx:xx`, `1c:fe:2b:xx:xx:xx`, `4c:ef:c0:xx:xx:xx`, `68:b6:91:xx:xx:xx` | Amazon Echo[^echo] | FireOS | Various | Assistant |
-| camera-01…07 | `.112`, `.118`, `.119`, `.126`, `.130`, `.145`, `.146` | `10:08:2c:xx:xx:xx`, `b4:bc:7c:xx:xx:xx`, `3c:e1:a1:xx:xx:xx`, `54:e0:19:xx:xx:xx`, `5c:47:5e:xx:xx:xx`, `18:7f:88:xx:xx:xx` | Ring cameras, floodlights, doorbell[^floodlight] [^doorbell] [^camera] | — | Interior & exterior | Camera |
-| alarm-hub | `10.0.20.121` | `2c:6b:7d:xx:xx:xx` | Ring Alarm Base Station[^basestation] | — | Main floor | Hub |
-| monitor-01 | `10.0.20.117` | `a4:97:5c:xx:xx:xx` | VTech camera[^Monitor] | — | Main floor | Baby monitor |
-| monitor-02 | `10.0.20.149` | `a4:97:5c:xx:xx:xx` | VTech tablet[^Monitor] | — | Main floor | Baby monitor |
-| appliance-01 | `10.0.20.108` | `c0:49:ef:xx:xx:xx` | Litter-Robot 4[^litterrobot] | — | Utility | Appliance |
-| appliance-02 | `10.0.20.115` | `50:8b:b9:xx:xx:xx` | Tuya white-noise machine[^Whitenoise] | — | Main floor | Appliance |
+| assistant-01…05 | `.103`, `.107`, `.111`, `.145` | `74:d4:23:xx:xx:xx`, `58:a8:e8:xx:xx:xx`, `1c:fe:2b:xx:xx:xx`, `4c:ef:c0:xx:xx:xx`, `68:b6:91:xx:xx:xx` | Amazon Echo[^echo] | FireOS | Various | Assistant |
+| camera-01…09 | `.100`, `.102`, `.116`, `.117`, `.125`, `.126`, `.178`, `.179`, `.181` | `10:08:2c:xx:xx:xx`, `b4:bc:7c:xx:xx:xx`, `3c:e1:a1:xx:xx:xx`, `54:e0:19:xx:xx:xx`, `5c:47:5e:xx:xx:xx`, `18:7f:88:xx:xx:xx` | Ring cameras, floodlights, doorbell[^floodlight] [^doorbell] [^camera] | — | Interior & exterior | Camera |
+| alarm-hub | `10.0.20.108` | `2c:6b:7d:xx:xx:xx` | Ring Alarm Base Station[^basestation] | — | Main floor | Hub |
+| monitor-01…02 | `.101`, `.104` | `a4:97:5c:xx:xx:xx` | VTech camera and tablet[^Monitor] | — | Main floor | Baby monitor |
+| appliance-01 | `10.0.20.189` | `c0:49:ef:xx:xx:xx` | Litter-Robot 4[^litterrobot] | — | Utility | Appliance |
+| appliance-02 | `10.0.20.109` | `50:8b:b9:xx:xx:xx` | Tuya white-noise machine[^Whitenoise] | — | Main floor | Appliance |
| appliance-03 | `10.0.20.122` | `00:d0:2d:xx:xx:xx` | Honeywell THM6000R RedLINK internet gateway, for the thermostat; wired to an eero's port | — | Bedroom | Appliance |
### Notes
@@ -803,9 +802,20 @@ the least trusted.
answer.
- Device addresses and rooms are collapsed above deliberately. The exact
camera-to-room mapping is not something a public repository needs to carry.
-- An eighth Ring camera, added 2026-10-25, is not in the camera row yet: it
- sits in the pool by lease like the other seven, and its lease has not been
- read. `security.md` and the diagram count it.
+- **The pool rows above were read from `morpheus`'s lease table on
+ 2026-10-27 and again on 2026-10-28.** All but two of the pool addresses
+ the table carried had changed since their rows were written, the base
+ station's with its re-enrolment of 2026-10-25, which is what the rule
+ above looks like in practice. The eighth Ring camera, added 2026-10-25,
+ and the ninth, a floodlight connected 2026-10-28, are in the camera row;
+ the first read's eight Ring leases were matched to Home Assistant's eight
+ Ring devices by prefix, the ninth is the one lease the second read added,
+ and neither new camera brought a prefix the row did not already list. One
+ Echo held no lease at either read, so `assistant-01…05` carries four
+ addresses. The two VTech units share a prefix and cannot be told apart in
+ a lease table, so they share a row. One lease at each read matched no
+ row: a locally administered address, which is how a phone or watch joins
+ a Wi-Fi network it does not trust. It is not in the table.
[^Huebridge]: [Philips Hue Bridge](https://www.philips-hue.com/en-us/p/hue-bridge/046677458478)
[^echo]: [Amazon Echo](https://www.amazon.com/dp/B07XKF5RM3)
diff --git a/docs/runbooks/enable-suricata.md b/docs/runbooks/enable-suricata.md
index 021a8d6a..c75188a3 100644
--- a/docs/runbooks/enable-suricata.md
+++ b/docs/runbooks/enable-suricata.md
@@ -17,7 +17,7 @@ repository began. This closes that — on the firewall rather than the
hypervisor, for the reasons in
[ADR-0006](../adr/0006-detect-at-the-chokepoint.md): `Saruman` is single-homed
on VLAN 30, so a sensor there sees `Saruman`. `morpheus` terminates every VLAN
-and is the only place that sees the eight cameras, the doorbell and the Tuya
+and is the only place that sees the nine cameras, the doorbell and the Tuya
device.
> [!CAUTION]
diff --git a/docs/security.md b/docs/security.md
index 52ad5679..1cc3037e 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -1227,7 +1227,7 @@ fingerprint of a house is not. Withheld on purpose:
seven days, so nothing in this repository has to enumerate them.
- **Owner-linked device names.** Personal devices are listed by role
(`laptop-01`) rather than by person, and a child's bedroom is not labelled.
-- **Camera-to-room mapping.** Knowing there are eight cameras is fine. Knowing
+- **Camera-to-room mapping.** Knowing there are nine cameras is fine. Knowing
which one covers which door is a physical-security detail.
- **The WAN address**, firewall rule bodies, and Wi-Fi configuration.
- **The WireGuard endpoint and its listen port**, for the same reason and with