docs: record unifi firewall enforcement and closeout

home/doris-dashboard/docs/google-cast-pilot-result-2026-05-23.md

@@ -0,0 +1,43 @@
+# Google/Cast Pilot Result — 2026-05-23
+
+Purpose: record the first live Google/cast-class pilot move from Trusted into IoT.
+
+## Device moved
+- MAC: `dc:e5:5b:8f:57:d2`
+- Vendor: Google
+- Prior lane: `Trusted`
+- Prior SSID: `Whiskey Neat Fuck Ice`
+- Method: enabled per-client virtual network override to `IoT`, then kicked the station to reassociate
+
+## UniFi evidence
+Before:
+- network: `Trusted`
+- network id: `6963cb201131084f05461635`
+- IP: `10.5.1.132`
+- virtual network override: disabled
+
+Applied:
+- `virtual_network_override_enabled=true`
+- `virtual_network_override_id=6963cb461131084f05461642`
+- `cmd/stamgr` kick-sta for `dc:e5:5b:8f:57:d2`
+
+Verified after reassociation:
+- network: `IoT`
+- network id: `6963cb461131084f05461642`
+- SSID seen after move: `CIA Via`
+- VLAN: `510`
+- final observed IP after DHCP settle: `10.5.10.161`
+
+## Interpretation
+The client successfully moved from Trusted into IoT using a client-specific virtual network override and reassociated cleanly onto the IoT network.
+
+## Still pending
+Human validation still needed from the laptop / household use path:
+- Plex playback
+- casting/discovery behavior
+- Dispatcharr if relevant
+
+If the household behavior is bad, rollback is simple:
+- disable the client's virtual network override
+- kick the station again
+- verify it returns to Trusted / `10.5.1.x`