sync: auto-sync from HOWARD-HOME at 2026-06-24 17:37:00

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-24 17:37:00

clients/cascades-tucson/docs/network/csc-ent-device-island-plan.md

@@ -40,10 +40,18 @@ WiFi5 and is the correct network for them to use."*). This plan formalizes and e
 
 - **Helpany is WPA2-only** — explicitly **NOT** WPA3 or hybrid WPA2/WPA3 (*"we don't support
   hybrid, only WPA2"*). The device SSID must stay WPA2-PSK.
-- **5 GHz has shorter range** than 2.4 GHz. Both vendors warn: a device with weak 5 GHz signal
-  will fall back to 2.4 GHz or be orphaned. **Per-room 5 GHz coverage must be verified before
-  transitioning** (Cascades is 6 floors with steel hallway walls). Leave any weak-signal device
-  on 2.4 rather than force it.
+- **Neither vendor can pin a device to 5 GHz from their side** (confirmed: Poly/Vertical AND
+  Helpany support, 2026-06-24). The handsets/Pauls choose the band themselves, and band steering
+  doesn't hold them. **Therefore a 5 GHz-only SSID (2.4 disabled) is the ONLY mechanism** — you
+  remove 2.4 as an option so the device has nowhere else to associate. This is the whole basis of
+  the plan.
+- **Consequence — 5 GHz coverage is now a HARD GATE, with no safety net.** On a 5 GHz-only SSID
+  there is **no 2.4 fallback**: a Paul/phone in a weak-5 GHz spot will simply **fail to connect**
+  (not drop to 2.4). 5 GHz has shorter range and Cascades has steel walls. So per-room 5 GHz
+  coverage must be **verified and remediated** (AP placement/power/channel) BEFORE cutover — you
+  cannot "leave a weak device on 2.4," because 2.4 won't exist on this SSID. The 42 Pauls already
+  holding 5 GHz prove coverage in those spots; the **26 Pauls currently on 2.4** (+ any 2.4 phones)
+  are the risk set to survey first.
 - **Reprogramming is painful on Helpany's side** — they can't reach offline devices, and key
   rotations need **72 h notice + the new key**. The SSID/password must be right and stable.
 - **Helpany bandwidth is negligible:** < 0.04 Mbps per Paul device; whole fleet ~0.38 Mbps low /
@@ -107,17 +115,28 @@ are the visible-impact set — they need a relocation/reconnection plan before t
 
 ## Execution sequence
 
-0. **Evacuate the ~79 non-Helpany clients off CSC ENT** to their correct networks (staff -> CSCNet/
-   INTERNAL via domain migration; printers -> internal; resident TVs/IoT/phones -> CSCNet resident
-   PPSK or a dedicated resident SSID). Complete the registry with `stat/alluser` first so offline
-   resident TVs aren't missed. **This is the gating sub-project** — see the inventory doc.
+0. **Remove the ~79 non-Helpany clients from CSC ENT onto EXISTING networks — we do NOT build new
+   VLANs for them** (scope decision, Howard 2026-06-24): staff PCs -> CSCNet/INTERNAL (domain
+   migration); resident TVs/IoT/phones -> CSCNet (resident PPSK / per-room). Only the **phones and
+   Helpany** get dedicated VLANs (30 / 40); internal + resident devices are simply relocated, not
+   segmented.
+   - **2.4-only devices must land on a 2.4-capable SSID (CSCNet), because CSC ENT is losing 2.4.**
+     ~10 of the 11 wireless printers are on 2.4 today and several are likely 2.4-only hardware
+     (SOHO Brother/Canon) — move those to CSCNet (which keeps 2.4+5). Verify model if unsure;
+     default 2.4 printers to CSCNet.
+   - Complete the registry with `stat/alluser` first so offline resident TVs aren't missed. **This
+     is the gating sub-project** — see the inventory doc.
 1. **Build VLAN 40** on pfSense (igc1.40, DHCP scope, DNS) + firewall egress rules above; mirror
    VLAN 30 isolation.
 2. **Enable PPSK on CSC ENT**; add keys: `Ftfd85710#` -> VLAN 40, new voice key -> VLAN 30.
 3. **[ONSITE GATE] Verify 5 GHz coverage** in the rooms where Pauls + phones live (per-floor,
    account for steel walls). Use `unifi-wifi` skill (`live-stats.sh --clients`, `watch-ap.sh`).
-4. **Flip CSC ENT to 5 GHz-only** (`apply-wlan.sh <site> bands 5g --wlan <CSC ENT>`), coordinated
-   with both vendors during a change window.
+4. **Disable 2.4 GHz on CSC ENT (-> 5 GHz-only)** (`apply-wlan.sh <site> bands 5g --wlan <CSC ENT>`),
+   coordinated with both vendors during a change window. **ORDER MATTERS:** 26 of the 68 Pauls (and
+   any 2.4 phones) are on 2.4 today; once 2.4 is off CSC ENT there is **no 2.4 fallback** — a Paul
+   with weak 5 GHz signal goes OFFLINE. So Helpany must verify 5 GHz coverage + move those 26 to
+   5 GHz FIRST; only then disable 2.4. Likewise confirm no 2.4-only device (printer/IoT) is still on
+   CSC ENT before flipping.
 5. **Vendors transition their devices:**
    - **Helpany** remotely moves the Pauls to 5 GHz (we hand them: SSID `CSC ENT`, key
      `Ftfd85710#` — unchanged; they confirm strong 2.4 signal per-device first).