docs(network): a ninth camera, the eighth's lease, and the Skids pool rows read today

docs/changelog.md

@@ -17,6 +17,31 @@ roadmap as it read that day, and the *Done* entries keep the shape they had
 there. `check_docs.py` does not check this file, for the reason its module
 docstring gives: it is a record, not a claim about now.
 
+## 2026-10-28
+
+- **A ninth camera, the eighth's lease, and the Skids pool rows read with
+  them**
+  ([#1283](https://github.com/Gerrrt/HomeLab/pull/1283),
+  [#1284](https://github.com/Gerrrt/HomeLab/pull/1284)).
+  The 2026-10-26 entry below left `network.md`'s camera row at seven
+  addresses with a note that the eighth was missing. `morpheus`'s lease table
+  for Skids was read on 2026-10-27 and matched against Home Assistant's Ring
+  device registry, whose eight device ids carry the cameras' MAC prefixes:
+  the eight Ring leases were the eight devices, and the new camera's prefix
+  was one the row already listed. A third floodlight was connected on
+  2026-10-28 and a second read that day showed its lease, one more with a
+  prefix the row already had; `network.md`, `security.md`,
+  `enable-suricata.md` and the diagram said eight cameras and now say nine,
+  and the row is `camera-01…09`. Home Assistant had not reloaded the Ring
+  integration when this was written, so it still listed eight. The first
+  read also showed that all but two of the pool addresses in the table had
+  changed, the base station's with its re-enrolment of 2026-10-25, so the
+  alarm hub, the VTech monitors, the Litter-Robot, the white-noise machine
+  and four of the five Echos carry their new addresses. The fifth Echo held
+  no lease at either read, and the two VTech units, which share a prefix,
+  now share a row. One lease at each read was locally administered, matched
+  no row, and is not in the table. Nothing reserved moved.
+
 ## 2026-10-26
 
 - **The Ring Alarm's sensors and keypads are paired, and ring-mqtt sees them**

docs/network.md

@@ -745,13 +745,12 @@ the least trusted.
 | eero-iot-3 | `10.0.20.13` | `fc:3f:a6:xx:xx:xx` | eero Pro 6E | eeroOS | Main floor | Wi-Fi mesh |
 | bifrost | `10.0.20.20` | `ec:b5:fa:xx:xx:xx` | Philips Hue Bridge[^Huebridge] | — | Main floor | Lighting |
 | speaker-01…03 | `10.0.20.21`–`.23` | `d4:90:9c:xx:xx:xx`, `94:ea:32:xx:xx:xx`, `f4:34:f0:xx:xx:xx` | Apple HomePod[^homepod] | audioOS | Various | Assistant |
-| assistant-01…05 | `.105`, `.109`, `.114`, `.133`, `.144` | `74:d4:23:xx:xx:xx`, `58:a8:e8:xx:xx:xx`, `1c:fe:2b:xx:xx:xx`, `4c:ef:c0:xx:xx:xx`, `68:b6:91:xx:xx:xx` | Amazon Echo[^echo] | FireOS | Various | Assistant |
-| camera-01…07 | `.112`, `.118`, `.119`, `.126`, `.130`, `.145`, `.146` | `10:08:2c:xx:xx:xx`, `b4:bc:7c:xx:xx:xx`, `3c:e1:a1:xx:xx:xx`, `54:e0:19:xx:xx:xx`, `5c:47:5e:xx:xx:xx`, `18:7f:88:xx:xx:xx` | Ring cameras, floodlights, doorbell[^floodlight] [^doorbell] [^camera] | — | Interior & exterior | Camera |
-| alarm-hub | `10.0.20.121` | `2c:6b:7d:xx:xx:xx` | Ring Alarm Base Station[^basestation] | — | Main floor | Hub |
-| monitor-01 | `10.0.20.117` | `a4:97:5c:xx:xx:xx` | VTech camera[^Monitor] | — | Main floor | Baby monitor |
-| monitor-02 | `10.0.20.149` | `a4:97:5c:xx:xx:xx` | VTech tablet[^Monitor] | — | Main floor | Baby monitor |
-| appliance-01 | `10.0.20.108` | `c0:49:ef:xx:xx:xx` | Litter-Robot 4[^litterrobot] | — | Utility | Appliance |
-| appliance-02 | `10.0.20.115` | `50:8b:b9:xx:xx:xx` | Tuya white-noise machine[^Whitenoise] | — | Main floor | Appliance |
+| assistant-01…05 | `.103`, `.107`, `.111`, `.145` | `74:d4:23:xx:xx:xx`, `58:a8:e8:xx:xx:xx`, `1c:fe:2b:xx:xx:xx`, `4c:ef:c0:xx:xx:xx`, `68:b6:91:xx:xx:xx` | Amazon Echo[^echo] | FireOS | Various | Assistant |
+| camera-01…09 | `.100`, `.102`, `.116`, `.117`, `.125`, `.126`, `.178`, `.179`, `.181` | `10:08:2c:xx:xx:xx`, `b4:bc:7c:xx:xx:xx`, `3c:e1:a1:xx:xx:xx`, `54:e0:19:xx:xx:xx`, `5c:47:5e:xx:xx:xx`, `18:7f:88:xx:xx:xx` | Ring cameras, floodlights, doorbell[^floodlight] [^doorbell] [^camera] | — | Interior & exterior | Camera |
+| alarm-hub | `10.0.20.108` | `2c:6b:7d:xx:xx:xx` | Ring Alarm Base Station[^basestation] | — | Main floor | Hub |
+| monitor-01…02 | `.101`, `.104` | `a4:97:5c:xx:xx:xx` | VTech camera and tablet[^Monitor] | — | Main floor | Baby monitor |
+| appliance-01 | `10.0.20.189` | `c0:49:ef:xx:xx:xx` | Litter-Robot 4[^litterrobot] | — | Utility | Appliance |
+| appliance-02 | `10.0.20.109` | `50:8b:b9:xx:xx:xx` | Tuya white-noise machine[^Whitenoise] | — | Main floor | Appliance |
 | appliance-03 | `10.0.20.122` | `00:d0:2d:xx:xx:xx` | Honeywell THM6000R RedLINK internet gateway, for the thermostat; wired to an eero's port | — | Bedroom | Appliance |
 
 ### Notes
@@ -803,9 +802,20 @@ the least trusted.
   answer.
 - Device addresses and rooms are collapsed above deliberately. The exact
   camera-to-room mapping is not something a public repository needs to carry.
-- An eighth Ring camera, added 2026-10-25, is not in the camera row yet: it
-  sits in the pool by lease like the other seven, and its lease has not been
-  read. `security.md` and the diagram count it.
+- **The pool rows above were read from `morpheus`'s lease table on
+  2026-10-27 and again on 2026-10-28.** All but two of the pool addresses
+  the table carried had changed since their rows were written, the base
+  station's with its re-enrolment of 2026-10-25, which is what the rule
+  above looks like in practice. The eighth Ring camera, added 2026-10-25,
+  and the ninth, a floodlight connected 2026-10-28, are in the camera row;
+  the first read's eight Ring leases were matched to Home Assistant's eight
+  Ring devices by prefix, the ninth is the one lease the second read added,
+  and neither new camera brought a prefix the row did not already list. One
+  Echo held no lease at either read, so `assistant-01…05` carries four
+  addresses. The two VTech units share a prefix and cannot be told apart in
+  a lease table, so they share a row. One lease at each read matched no
+  row: a locally administered address, which is how a phone or watch joins
+  a Wi-Fi network it does not trust. It is not in the table.
 
 [^Huebridge]: [Philips Hue Bridge](https://www.philips-hue.com/en-us/p/hue-bridge/046677458478)
 [^echo]: [Amazon Echo](https://www.amazon.com/dp/B07XKF5RM3)

docs/runbooks/enable-suricata.md

@@ -17,7 +17,7 @@ repository began. This closes that — on the firewall rather than the
 hypervisor, for the reasons in
 [ADR-0006](../adr/0006-detect-at-the-chokepoint.md): `Saruman` is single-homed
 on VLAN 30, so a sensor there sees `Saruman`. `morpheus` terminates every VLAN
-and is the only place that sees the eight cameras, the doorbell and the Tuya
+and is the only place that sees the nine cameras, the doorbell and the Tuya
 device.
 
 > [!CAUTION]

docs/security.md

@@ -1227,7 +1227,7 @@ fingerprint of a house is not. Withheld on purpose:
   seven days, so nothing in this repository has to enumerate them.
 - **Owner-linked device names.** Personal devices are listed by role
   (`laptop-01`) rather than by person, and a child's bedroom is not labelled.
-- **Camera-to-room mapping.** Knowing there are eight cameras is fine. Knowing
+- **Camera-to-room mapping.** Knowing there are nine cameras is fine. Knowing
   which one covers which door is a physical-security detail.
 - **The WAN address**, firewall rule bodies, and Wi-Fi configuration.
 - **The WireGuard endpoint and its listen port**, for the same reason and with