diff --git a/.gitignore b/.gitignore
index 3208017..4579ff1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,6 +19,10 @@ update-homelab-docs.py
 # Generated stack config
 pihole/keepalived.conf
 
+# Raw secret-bearing infra exports must stay out of the main repo
+home/doris-dashboard/docs/baselines/*.json
+!home/doris-dashboard/docs/baselines/README.md
+
 # Editor
 .vscode/
 .idea/
diff --git a/docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md b/docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md
new file mode 100644
index 0000000..91957be
--- /dev/null
+++ b/docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md
@@ -0,0 +1,76 @@
+# Incident: UniFi Baseline Secret Leak (2026-05-22)
+
+## Summary
+
+A raw UniFi baseline export was committed to the main `truenas-stacks` repo during the May 22, 2026 network-cutover documentation pass. GitGuardian later flagged three secret leaks in the latest commits.
+
+The leaked material came from a controller export artifact, not from a normal `.env` file.
+
+## What leaked
+
+The committed file contained three WireGuard secrets in `home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json`:
+
+1. an embedded `wireguard_client_configuration_file` containing a `PrivateKey = ...`
+2. one `x_wireguard_private_key`
+3. another `x_wireguard_private_key`
+
+## How it happened
+
+The failure mode was:
+
+1. a read-only UniFi object baseline was captured to support cautious cutover work
+2. the export was saved as a raw JSON artifact under `home/doris-dashboard/docs/baselines/`
+3. that raw export was treated like a harmless recon artifact and committed alongside other network redesign docs
+4. the export included VPN/WireGuard fields that are safe for controller runtime but unsafe for a git-tracked documentation repo
+5. GitGuardian detected the leaked keys after push
+
+## Root cause
+
+This was a process failure, not a git-crypt failure.
+
+The repo already had rules for `.env` secrets, but not a strong enough rule for **controller exports / diagnostic baselines / machine snapshots** that may embed secrets even when they are not named `.env`.
+
+In short:
+- we protected the usual secret files
+- we did **not** treat raw infrastructure exports as secret-bearing by default
+
+## Remediation completed
+
+The following remediation was performed:
+
+- the leaked values were removed from the working tree
+- git history was rewritten to purge the exact leaked values
+- cleaned history was force-pushed to both `origin` and `github`
+- raw JSON baseline exports under `home/doris-dashboard/docs/baselines/` were moved out of the main repo policy
+- the repo now documents that only sanitized summaries or explicitly redacted artifacts belong in the main repo
+
+## New permanent rules
+
+1. **Raw controller/API exports do not belong in the main repo.**
+   - Examples: UniFi `networkconf`, `portconf`, full appliance JSON dumps, diagnostic snapshots, vendor backups, tunnel/client config exports.
+2. **Assume machine exports are secret-bearing until proven otherwise.**
+   - If it came from a controller or appliance, inspect it like a secret file.
+3. **Only commit one of these:**
+   - a markdown summary
+   - a purpose-built redacted JSON artifact
+   - a generated diff with secret-bearing keys removed
+4. **Before committing infra artifacts, scan them explicitly.**
+   - Look for terms like `private_key`, `wireguard`, `token`, `secret`, `password`, `Authorization`, `cookie`, `client_secret`.
+5. **If raw export retention is required, store it outside the main repo.**
+   - Prefer the encrypted secrets repo or another non-public operator-only location.
+6. **If a secret-bearing export is committed, treat it as an incident.**
+   - redact/remove from current tree
+   - rewrite history
+   - force-push
+   - rotate live credentials/keys as appropriate
+
+## Operator follow-up still recommended
+
+History cleanup fixed the repo exposure. If any leaked WireGuard keys were active in production at the time of exposure, rotate them deliberately and update affected clients.
+
+## Prevent-recurrence checklist
+
+- [ ] raw exports ignored by default in the repo path where they are commonly captured
+- [ ] incident documented in `SECRETS_MANAGEMENT.md`
+- [ ] dashboard baseline directory has a README explaining what may and may not be committed
+- [ ] future cutover notes point to sanitized summaries rather than raw exports
diff --git a/docs/operations/SECRETS_MANAGEMENT.md b/docs/operations/SECRETS_MANAGEMENT.md
index 61c7a67..d92fb11 100644
--- a/docs/operations/SECRETS_MANAGEMENT.md
+++ b/docs/operations/SECRETS_MANAGEMENT.md
@@ -206,6 +206,39 @@ On a fresh PD after reinstalling TrueNAS:
 
 ---
 
+## Controller Export / Baseline Artifact Rules
+
+Raw infrastructure exports must be treated as potentially secret-bearing even when they are not `.env` files.
+
+Examples:
+- UniFi `networkconf` / `portconf` dumps
+- firewall/router/controller JSON exports
+- VPN client or server config exports
+- diagnostic snapshots taken from appliances or operator APIs
+
+### Permanent rules
+
+- Do **not** commit raw controller or appliance exports to the main repo.
+- Commit only sanitized markdown summaries or explicitly redacted artifacts.
+- If raw retention is needed, store the export in the encrypted secrets repo or another operator-only location outside the main repo.
+- Before committing infra artifacts, scan for obvious secret-bearing keys such as:
+  - `private_key`
+  - `wireguard`
+  - `token`
+  - `secret`
+  - `password`
+  - `Authorization`
+  - `cookie`
+  - `client_secret`
+
+### Incident reference
+
+A real leak occurred on 2026-05-22 when a raw UniFi baseline export under `home/doris-dashboard/docs/baselines/` was committed with embedded WireGuard secrets.
+
+See:
+- `docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md`
+- `home/doris-dashboard/docs/baselines/README.md`
+
 ## Security Reminders
 
 - **Key backup**: `C:\Users\Fizzlepoof\Downloads\.git-crypt-secrets.key` — also store in password manager
diff --git a/home/doris-dashboard/docs/baselines/README.md b/home/doris-dashboard/docs/baselines/README.md
new file mode 100644
index 0000000..fb1afc4
--- /dev/null
+++ b/home/doris-dashboard/docs/baselines/README.md
@@ -0,0 +1,31 @@
+# Baselines Directory Policy
+
+This directory is for **sanitized operator artifacts only**.
+
+## What belongs here
+
+- markdown summaries of controller state
+- redacted JSON examples that have been intentionally scrubbed
+- operator notes that support future change windows
+
+## What does not belong here
+
+- raw UniFi controller exports
+- full `networkconf` / `portconf` dumps captured straight from the API
+- VPN client/server config exports
+- any artifact containing keys, tokens, passwords, cookies, CSRF material, or embedded auth config
+
+## Why this rule exists
+
+A raw UniFi baseline export committed during the 2026-05-22 network redesign documentation pass contained WireGuard private keys and triggered a real secret-leak incident.
+
+See:
+- `docs/operations/INCIDENT_2026-05-22_UNIFI_BASELINE_SECRET_LEAK.md`
+- `docs/operations/SECRETS_MANAGEMENT.md`
+
+## Safe workflow
+
+1. Capture raw exports outside the main repo or in the encrypted secrets repo.
+2. Inspect them for secret-bearing fields.
+3. Commit only a markdown summary or an explicitly redacted artifact.
+4. Prefer human-readable summaries over raw appliance dumps.
diff --git a/home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json b/home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json
deleted file mode 100644
index 13887b9..0000000
--- a/home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json
+++ /dev/null
@@ -1,608 +0,0 @@
-{
-  "captured_at": "2026-05-21T21:46:53-05:00",
-  "site": "default",
-  "networkconf": [
-    {
-      "setting_preference": "auto",
-      "purpose": "wan",
-      "external_id": "d488cbbc-05dd-4bab-9efb-4b58340df685",
-      "wan_type_v6": "disabled",
-      "routing_table_id": 201,
-      "ipv6_wan_delegation_type": "none",
-      "wan_dhcpv6_pd_size_auto": true,
-      "firewall_zone_id": "6963d42a1131084f054618e0",
-      "igmp_proxy_upstream": false,
-      "mac_override_enabled": false,
-      "wan_load_balance_type": "failover-only",
-      "wan_failover_priority": 2,
-      "wan_ipv6_dns_preference": "auto",
-      "wan_networkgroup": "WAN",
-      "wan_dslite_remote_host_auto": false,
-      "wan_smartq_enabled": false,
-      "wan_dns_preference": "auto",
-      "wan_vlan_enabled": false,
-      "wan_load_balance_weight": 99,
-      "site_id": "6963c5321131084f05460911",
-      "name": "Internet 1",
-      "report_wan_event": false,
-      "_id": "6963c5831131084f05460929",
-      "attr_no_delete": true,
-      "wan_type": "dhcp",
-      "attr_hidden_id": "WAN"
-    },
-    {
-      "setting_preference": "manual",
-      "purpose": "wan",
-      "wan_dhcp_cos": 0,
-      "external_id": "c10cd8c4-7f9c-4d12-a7ea-e1a34ab8ead7",
-      "wan_type_v6": "disabled",
-      "routing_table_id": 202,
-      "enabled": true,
-      "wan_dhcp_options": [],
-      "ipv6_wan_delegation_type": "none",
-      "wan_dhcpv6_pd_size_auto": true,
-      "firewall_zone_id": "6963d42a1131084f054618e0",
-      "igmp_proxy_upstream": false,
-      "mac_override_enabled": false,
-      "wan_load_balance_type": "weighted",
-      "wan_failover_priority": 1,
-      "ipv6_setting_preference": "manual",
-      "wan_ipv6_dns_preference": "auto",
-      "single_network_lan": "",
-      "wan_dns2": "9.9.9.9",
-      "wan_ipv6_dns1": "",
-      "wan_dns1": "10.5.1.53",
-      "wan_ipv6_dns2": "",
-      "wan_networkgroup": "WAN2",
-      "wan_dslite_remote_host_auto": false,
-      "wan_provider_capabilities": {
-        "upload_kilobits_per_second": 2409000,
-        "download_kilobits_per_second": 2120000
-      },
-      "wan_ip_aliases": [],
-      "wan_smartq_enabled": false,
-      "wan_dns_preference": "manual",
-      "wan_vlan_enabled": false,
-      "wan_load_balance_weight": 50,
-      "site_id": "6963c5321131084f05460911",
-      "name": "Internet 2",
-      "report_wan_event": false,
-      "_id": "6963c5831131084f0546092a",
-      "wan_type": "dhcp",
-      "attr_no_delete": true,
-      "igmp_proxy_for": "none"
-    },
-    {
-      "setting_preference": "manual",
-      "dhcpdv6_dns_auto": true,
-      "ipv6_pd_stop": "::7d1",
-      "dhcpd_gateway_enabled": false,
-      "ipv6_client_address_assignment": "slaac",
-      "network_isolation_enabled": false,
-      "dhcp_relay_servers": [],
-      "dhcpd_start": "10.5.0.100",
-      "dhcpd_unifi_controller": "",
-      "ipv6_ra_enabled": true,
-      "domain_name": "localdomain",
-      "ip_subnet": "10.5.0.1/24",
-      "ipv6_interface_type": "none",
-      "dhcpd_wins_2": "",
-      "dhcpdv6_stop": "::7d1",
-      "is_nat": true,
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "internet_access_enabled": true,
-      "nat_outbound_ip_addresses": [],
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "dhcpdv6_leasetime": 86400,
-      "site_id": "6963c5321131084f05460911",
-      "name": "Management",
-      "_id": "6963c5831131084f0546092b",
-      "lte_lan_enabled": true,
-      "purpose": "corporate",
-      "dhcpd_leasetime": 86400,
-      "dhcpguard_enabled": false,
-      "dhcpd_time_offset_enabled": false,
-      "external_id": "652279eb-41e5-440d-aad5-231ca9683890",
-      "ipv6_ra_preferred_lifetime": 14400,
-      "dhcpd_stop": "10.5.0.199",
-      "is_smart_subnet_detected": false,
-      "enabled": true,
-      "dhcpd_enabled": true,
-      "dhcpd_wpad_url": "",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d42a1131084f054618df",
-      "dhcpdv6_start": "::2",
-      "vlan_enabled": false,
-      "ipv6_setting_preference": "auto",
-      "ipv6_aliases": [],
-      "gateway_type": "default",
-      "ipv6_ra_priority": "high",
-      "dhcpd_boot_enabled": false,
-      "ipv6_pd_start": "::2",
-      "upnp_lan_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "attr_no_delete": true,
-      "attr_hidden_id": "LAN",
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": false
-    },
-    {
-      "setting_preference": "manual",
-      "dhcpd_gateway_enabled": false,
-      "network_isolation_enabled": false,
-      "dhcp_relay_servers": [],
-      "dhcpd_dns_1": "192.168.1.10",
-      "dhcpd_start": "10.5.1.100",
-      "dhcpd_unifi_controller": "",
-      "domain_name": "",
-      "ip_subnet": "10.5.1.1/24",
-      "dhcpd_dns_4": "",
-      "ipv6_interface_type": "none",
-      "dhcpd_dns_2": "",
-      "dhcpd_dns_3": "",
-      "dhcpd_wins_2": "",
-      "is_nat": true,
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "internet_access_enabled": true,
-      "nat_outbound_ip_addresses": [],
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "name": "Trusted",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963cb201131084f05461635",
-      "lte_lan_enabled": true,
-      "dhcpd_leasetime": 86400,
-      "purpose": "corporate",
-      "dhcpd_time_offset_enabled": false,
-      "dhcpguard_enabled": false,
-      "external_id": "87b66e27-93a9-4fb7-93d2-3b7bca9e6414",
-      "enabled": true,
-      "dhcpd_stop": "10.5.1.199",
-      "dhcpd_enabled": true,
-      "vlan": 51,
-      "dhcpd_wpad_url": "",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d42a1131084f054618df",
-      "vlan_enabled": true,
-      "ipv6_setting_preference": "manual",
-      "ipv6_aliases": [],
-      "gateway_type": "default",
-      "dhcpd_boot_enabled": false,
-      "upnp_lan_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": false
-    },
-    {
-      "setting_preference": "manual",
-      "dhcpd_leasetime": 86400,
-      "purpose": "corporate",
-      "dhcpd_gateway_enabled": false,
-      "dhcpd_time_offset_enabled": false,
-      "dhcpguard_enabled": false,
-      "network_isolation_enabled": true,
-      "dhcp_relay_servers": [],
-      "dhcpd_start": "10.5.10.6",
-      "dhcpd_unifi_controller": "",
-      "external_id": "88180bc3-2c34-4f30-9b57-aed15da2a12a",
-      "enabled": true,
-      "dhcpd_stop": "10.5.10.254",
-      "domain_name": "",
-      "dhcpd_enabled": true,
-      "ip_subnet": "10.5.10.1/24",
-      "vlan": 510,
-      "dhcpd_wpad_url": "",
-      "ipv6_interface_type": "none",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d5a91131084f05461a0d",
-      "vlan_enabled": true,
-      "dhcpd_wins_2": "",
-      "ipv6_setting_preference": "manual",
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "ipv6_aliases": [],
-      "internet_access_enabled": true,
-      "gateway_type": "default",
-      "nat_outbound_ip_addresses": [],
-      "dhcpd_boot_enabled": false,
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "name": "IoT",
-      "site_id": "6963c5321131084f05460911",
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "_id": "6963cb461131084f05461642",
-      "lte_lan_enabled": true,
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": true
-    },
-    {
-      "setting_preference": "auto",
-      "dhcpd_leasetime": 86400,
-      "purpose": "guest",
-      "dhcpd_gateway_enabled": false,
-      "dhcpd_time_offset_enabled": false,
-      "dhcpguard_enabled": false,
-      "network_isolation_enabled": false,
-      "dhcp_relay_servers": [],
-      "dhcpd_start": "10.5.90.6",
-      "dhcpd_unifi_controller": "",
-      "external_id": "2986eea1-bf02-4879-a7b0-7d9f91e45c53",
-      "enabled": true,
-      "dhcpd_stop": "10.5.90.254",
-      "domain_name": "",
-      "dhcpd_enabled": true,
-      "ip_subnet": "10.5.90.1/24",
-      "vlan": 590,
-      "dhcpd_wpad_url": "",
-      "ipv6_interface_type": "none",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d42a1131084f054618e3",
-      "vlan_enabled": true,
-      "dhcpd_wins_2": "",
-      "ipv6_setting_preference": "manual",
-      "is_nat": true,
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "ipv6_aliases": [],
-      "internet_access_enabled": true,
-      "gateway_type": "default",
-      "nat_outbound_ip_addresses": [],
-      "dhcpd_boot_enabled": false,
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "upnp_lan_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "name": "Guest",
-      "site_id": "6963c5321131084f05460911",
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "_id": "6963cb941131084f054616af",
-      "lte_lan_enabled": true,
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": true
-    },
-    {
-      "setting_preference": "auto",
-      "dhcpd_leasetime": 86400,
-      "purpose": "corporate",
-      "dhcpd_gateway_enabled": false,
-      "dhcpd_time_offset_enabled": false,
-      "dhcpguard_enabled": false,
-      "network_isolation_enabled": false,
-      "dhcp_relay_servers": [],
-      "dhcpd_start": "10.5.20.6",
-      "dhcpd_unifi_controller": "",
-      "external_id": "98f2aff1-b394-493d-908f-ced4c83bde99",
-      "enabled": true,
-      "dhcpd_stop": "10.5.20.254",
-      "domain_name": "",
-      "dhcpd_enabled": true,
-      "ip_subnet": "10.5.20.1/24",
-      "vlan": 520,
-      "dhcpd_wpad_url": "",
-      "ipv6_interface_type": "none",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d5a91131084f05461a0d",
-      "vlan_enabled": true,
-      "dhcpd_wins_2": "",
-      "ipv6_setting_preference": "manual",
-      "is_nat": true,
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "ipv6_aliases": [],
-      "internet_access_enabled": true,
-      "gateway_type": "default",
-      "nat_outbound_ip_addresses": [],
-      "dhcpd_boot_enabled": false,
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "upnp_lan_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "name": "Camera",
-      "site_id": "6963c5321131084f05460911",
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "_id": "6963cbbf1131084f054616c1",
-      "lte_lan_enabled": true,
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": true
-    },
-    {
-      "setting_preference": "manual",
-      "dhcpd_leasetime": 86400,
-      "purpose": "corporate",
-      "dhcpd_gateway_enabled": false,
-      "dhcpd_time_offset_enabled": false,
-      "dhcpguard_enabled": false,
-      "network_isolation_enabled": false,
-      "dhcp_relay_servers": [],
-      "dhcpd_start": "192.168.1.100",
-      "dhcpd_unifi_controller": "",
-      "external_id": "9bd0ee41-3303-4c03-ad81-305248301921",
-      "enabled": true,
-      "dhcpd_stop": "192.168.1.199",
-      "domain_name": "",
-      "dhcpd_enabled": true,
-      "ip_subnet": "192.168.1.1/24",
-      "vlan": 2,
-      "dhcpd_wpad_url": "",
-      "ipv6_interface_type": "none",
-      "networkgroup": "LAN",
-      "firewall_zone_id": "6963d5a91131084f05461a0d",
-      "vlan_enabled": true,
-      "dhcpd_wins_2": "",
-      "ipv6_setting_preference": "manual",
-      "is_nat": true,
-      "dhcpd_wins_1": "",
-      "dhcpd_dns_enabled": false,
-      "ipv6_aliases": [],
-      "internet_access_enabled": true,
-      "gateway_type": "default",
-      "nat_outbound_ip_addresses": [],
-      "dhcpd_boot_enabled": false,
-      "dhcp_relay_enabled": false,
-      "dhcpd_conflict_checking": true,
-      "dhcpd_wins_enabled": false,
-      "upnp_lan_enabled": false,
-      "dhcpd_ntp_enabled": false,
-      "name": "Old IoT",
-      "site_id": "6963c5321131084f05460911",
-      "mdns_enabled": true,
-      "ip_aliases": [],
-      "_id": "6963e11c1131084f054622f1",
-      "lte_lan_enabled": true,
-      "dhcpd_tftp_server": "",
-      "auto_scale_enabled": false
-    },
-    {
-      "wireguard_client_configuration_filename": "Unifi2-US-IL-267.conf",
-      "purpose": "vpn-client",
-      "wireguard_client_mode": "file",
-      "external_id": "8673a0e4-4f1b-42d6-9563-e6f6440065de",
-      "interface_mtu_enabled": false,
-      "routing_table_id": 178,
-      "enabled": true,
-      "vpn_type": "wireguard-client",
-      "mss_clamp": "auto",
-      "ip_subnet": "10.2.0.2/32",
-      "name": "Proton Chicago",
-      "site_id": "6963c5321131084f05460911",
-      "wireguard_id": 1,
-      "firewall_zone_id": "6963d42a1131084f054618e0",
-      "wireguard_client_configuration_file": "[REDACTED: exported WireGuard client config removed from tracked baseline]",
-      "_id": "696411c51131084f05465f8d"
-    },
-    {
-      "setting_preference": "auto",
-      "wireguard_interface_binding_mode_ip_version": "v4",
-      "purpose": "remote-user-vpn",
-      "local_port": 51820,
-      "x_wireguard_private_key": "REDACTED",
-      "external_id": "c625964c-8663-4ef0-bf04-53a5466a168c",
-      "enabled": true,
-      "wireguard_local_wan_ip": "any",
-      "vpn_type": "wireguard-server",
-      "ip_subnet": "192.168.2.1/24",
-      "wireguard_interface": "wan2",
-      "name": "One-Click VPN",
-      "site_id": "6963c5321131084f05460911",
-      "wireguard_id": 1,
-      "firewall_zone_id": "6963d42a1131084f054618e2",
-      "_id": "69a31399822347a1daadae2e"
-    },
-    {
-      "setting_preference": "auto",
-      "wireguard_interface_binding_mode_ip_version": "v4",
-      "purpose": "remote-user-vpn",
-      "x_wireguard_private_key": "REDACTED",
-      "dhcpd_start": "192.168.3.2",
-      "interface_mtu_enabled": false,
-      "external_id": "2431e2ed-2d1f-48ed-9b2f-3ed5b8021504",
-      "enabled": true,
-      "dhcpd_stop": "192.168.3.254",
-      "vpn_type": "wireguard-server",
-      "ip_subnet": "192.168.3.1/24",
-      "wireguard_interface": "wan2",
-      "wireguard_id": 2,
-      "firewall_zone_id": "6963d42a1131084f054618e2",
-      "vpn_client_configuration_remote_ip_override_enabled": false,
-      "dhcpd_dns_enabled": false,
-      "local_port": 51821,
-      "wireguard_local_wan_ip": "any",
-      "mss_clamp": "auto",
-      "dhcpd_wins_enabled": false,
-      "vpn_binding_mode": "any",
-      "name": "Slate 7",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "69dd799da02014d2f4acc4e9",
-      "mss_clamp_ipv6": "auto"
-    }
-  ],
-  "portconf": [
-    {
-      "setting_preference": "auto",
-      "port_security_enabled": false,
-      "stormctrl_ucast_rate": 100,
-      "egress_rate_limit_kbps_enabled": false,
-      "stormctrl_mcast_enabled": false,
-      "lldpmed_notify_enabled": false,
-      "tagged_vlan_mgmt": "auto",
-      "multicast_router_networkconf_ids": [],
-      "stormctrl_bcast_enabled": false,
-      "port_keepalive_enabled": false,
-      "stormctrl_mcast_rate": 100,
-      "native_networkconf_id": "6963c5831131084f0546092b",
-      "qos_profile": {
-        "qos_profile_mode": "custom",
-        "qos_policies": []
-      },
-      "port_security_mac_address": [],
-      "dot1x_idle_timeout": 300,
-      "op_mode": "switch",
-      "poe_mode": "auto",
-      "forward": "all",
-      "stormctrl_ucast_enabled": false,
-      "stormctrl_bcast_rate": 100,
-      "isolation": false,
-      "voice_networkconf_id": "",
-      "stp_port_mode": true,
-      "name": "Management",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963cdbf1131084f0546177c",
-      "autoneg": true,
-      "lldpmed_enabled": true,
-      "dot1x_ctrl": "force_authorized"
-    },
-    {
-      "setting_preference": "auto",
-      "port_security_enabled": false,
-      "stormctrl_ucast_rate": 100,
-      "egress_rate_limit_kbps_enabled": false,
-      "stormctrl_mcast_enabled": false,
-      "lldpmed_notify_enabled": false,
-      "tagged_vlan_mgmt": "auto",
-      "multicast_router_networkconf_ids": [],
-      "stormctrl_bcast_enabled": false,
-      "port_keepalive_enabled": false,
-      "excluded_networkconf_ids": [],
-      "stormctrl_mcast_rate": 100,
-      "native_networkconf_id": "6963cb201131084f05461635",
-      "qos_profile": {
-        "qos_profile_mode": "custom",
-        "qos_policies": []
-      },
-      "port_security_mac_address": [],
-      "dot1x_idle_timeout": 300,
-      "op_mode": "switch",
-      "poe_mode": "auto",
-      "forward": "customize",
-      "stormctrl_ucast_enabled": false,
-      "stormctrl_bcast_rate": 100,
-      "isolation": false,
-      "voice_networkconf_id": "",
-      "stp_port_mode": true,
-      "name": "Trusted",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963cdfe1131084f0546178d",
-      "autoneg": true,
-      "lldpmed_enabled": true,
-      "dot1x_ctrl": "force_authorized"
-    },
-    {
-      "setting_preference": "auto",
-      "port_security_enabled": false,
-      "stormctrl_ucast_rate": 100,
-      "egress_rate_limit_kbps_enabled": false,
-      "stormctrl_mcast_enabled": false,
-      "lldpmed_notify_enabled": false,
-      "tagged_vlan_mgmt": "block_all",
-      "multicast_router_networkconf_ids": [],
-      "stormctrl_bcast_enabled": false,
-      "port_keepalive_enabled": false,
-      "stormctrl_mcast_rate": 100,
-      "native_networkconf_id": "6963cb461131084f05461642",
-      "qos_profile": {
-        "qos_profile_mode": "custom",
-        "qos_policies": []
-      },
-      "port_security_mac_address": [],
-      "dot1x_idle_timeout": 300,
-      "op_mode": "switch",
-      "poe_mode": "auto",
-      "forward": "native",
-      "stormctrl_ucast_enabled": false,
-      "stormctrl_bcast_rate": 100,
-      "isolation": false,
-      "voice_networkconf_id": "",
-      "stp_port_mode": true,
-      "name": "IoT",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963ce221131084f05461791",
-      "autoneg": true,
-      "lldpmed_enabled": true,
-      "dot1x_ctrl": "force_authorized"
-    },
-    {
-      "setting_preference": "auto",
-      "port_security_enabled": false,
-      "stormctrl_ucast_rate": 100,
-      "egress_rate_limit_kbps_enabled": false,
-      "stormctrl_mcast_enabled": false,
-      "lldpmed_notify_enabled": false,
-      "tagged_vlan_mgmt": "block_all",
-      "multicast_router_networkconf_ids": [],
-      "stormctrl_bcast_enabled": false,
-      "port_keepalive_enabled": false,
-      "stormctrl_mcast_rate": 100,
-      "native_networkconf_id": "6963cbbf1131084f054616c1",
-      "qos_profile": {
-        "qos_profile_mode": "custom",
-        "qos_policies": []
-      },
-      "port_security_mac_address": [],
-      "dot1x_idle_timeout": 300,
-      "op_mode": "switch",
-      "poe_mode": "auto",
-      "forward": "native",
-      "stormctrl_ucast_enabled": false,
-      "stormctrl_bcast_rate": 100,
-      "isolation": false,
-      "voice_networkconf_id": "",
-      "stp_port_mode": true,
-      "name": "Camera",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963ce3b1131084f05461798",
-      "autoneg": true,
-      "lldpmed_enabled": true,
-      "dot1x_ctrl": "force_authorized"
-    },
-    {
-      "setting_preference": "auto",
-      "port_security_enabled": false,
-      "stormctrl_ucast_rate": 100,
-      "egress_rate_limit_kbps_enabled": false,
-      "stormctrl_mcast_enabled": false,
-      "lldpmed_notify_enabled": false,
-      "tagged_vlan_mgmt": "block_all",
-      "multicast_router_networkconf_ids": [],
-      "stormctrl_bcast_enabled": false,
-      "port_keepalive_enabled": false,
-      "stormctrl_mcast_rate": 100,
-      "native_networkconf_id": "6963e11c1131084f054622f1",
-      "qos_profile": {
-        "qos_profile_mode": "custom",
-        "qos_policies": []
-      },
-      "port_security_mac_address": [],
-      "dot1x_idle_timeout": 300,
-      "op_mode": "switch",
-      "poe_mode": "auto",
-      "forward": "native",
-      "stormctrl_ucast_enabled": false,
-      "stormctrl_bcast_rate": 100,
-      "isolation": false,
-      "voice_networkconf_id": "",
-      "stp_port_mode": true,
-      "name": "Old IoT",
-      "site_id": "6963c5321131084f05460911",
-      "_id": "6963e3511131084f054624cf",
-      "autoneg": true,
-      "lldpmed_enabled": true,
-      "dot1x_ctrl": "force_authorized"
-    }
-  ]
-}
diff --git a/home/doris-dashboard/docs/unifi-live-preflight-snapshot-2026-05-22.md b/home/doris-dashboard/docs/unifi-live-preflight-snapshot-2026-05-22.md
index 1c5f838..9feb3b9 100644
--- a/home/doris-dashboard/docs/unifi-live-preflight-snapshot-2026-05-22.md
+++ b/home/doris-dashboard/docs/unifi-live-preflight-snapshot-2026-05-22.md
@@ -103,7 +103,7 @@ These are still the two management-lane ESP-class offenders to identify or evict
 - confirmed named host placement for the server batch and Old IoT migration set
 - confirmed management offenders remain present
 - confirmed U6 LR still appears offline/disconnected
-- captured a raw pre-write baseline of `networkconf` and `portconf` at `/home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/baselines/unifi-object-baseline-2026-05-22-024653.json`
+- captured a raw pre-write baseline of `networkconf` and `portconf` outside the main repo; only sanitized summaries/redacted artifacts belong under `docs/baselines/`
 - authored an idempotent staging helper at `/home/fizzlepoof/repos/truenas-stacks/automation/bin/unifi_stage_low_risk_objects.py`
 - copied that helper to PD at `/mnt/docker-ssd/docker/compose/automation/bin/unifi_stage_low_risk_objects.py`
 - confirmed the current Doris UniFi account is still read-only for writes: `POST /rest/networkconf` returns `403 Forbidden`