docs: record unifi firewall enforcement and closeout

home/doris-dashboard/docs/intellirocks-triage-result-2026-05-23.md

@@ -0,0 +1,37 @@
+# Intellirocks Trusted-Lane Triage Result — 2026-05-23
+
+Purpose: record the disposition of the remaining Intellirocks client that was still sitting in Trusted.
+
+## Device
+- MAC: `d4:ad:fc:f2:df:d2`
+- Vendor: `Shenzhen Intellirocks Tech co.,ltd`
+- Prior state:
+  - network: `Trusted`
+  - SSID: `Yer a Wifi Harry`
+  - IP: `10.5.1.154`
+
+## Rationale
+This device did not earn Trusted placement.
+
+Evidence used:
+- the existing cleanup shortlist already identified it as likely a sibling to the other Intellirocks devices on `Old IoT`
+- vendor-family clustering suggests embedded / smart-home class, not a human/operator endpoint
+- quarantine-first is safer than leaving an unidentified embedded client in Trusted
+
+## Action taken
+Moved the client out of `Trusted` into `Old IoT` using a per-client virtual network override, then kicked it to reassociate.
+
+Applied:
+- `virtual_network_override_enabled=true`
+- `virtual_network_override_id=6963e11c1131084f054622f1`
+- `cmd/stamgr` kick-sta for `d4:ad:fc:f2:df:d2`
+
+## Verified result
+After reassociation and DHCP settle:
+- network: `Old IoT`
+- network id: `6963e11c1131084f054622f1`
+- IP: `192.168.1.154`
+- VLAN: `2`
+
+## Conclusion
+The device no longer has Trusted-lane placement and is now quarantine-aligned with the other unidentified Intellirocks-class devices.