sync: auto-sync from HOWARD-HOME at 2026-06-16 01:09:44

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-06-16 01:09:44

clients/cascades-tucson/session-logs/2026-06/2026-06-15-howard-cascades-wifi-rf-audit.md

@@ -424,3 +424,25 @@ Also surfaced setting.radio_ai (Channel AI: channels_na includes DFS, ht_modes_n
 WiFi APPLY SURFACE NOW COMPLETE: apply-radio (power all-states/width/channel/minrssi/disable/enable,
 --zone/--ap) + apply-wlan (minrate/bandsteer/bands/steer/bsstm, --wlan), all gated + rollback +
 validated on 0-client sandboxes. Coord: this msg. Remaining (ROADMAP C): switch/PoE + gateway collectors.
+
+---
+
+## Update: 2026-06-16 01:09 PT — WiFi control surface complete: full wlanconf knobs + device-lock + client controls
+
+(a) DEVICE LOCK / CONTROL:
+- apply-wlan aps <ap-names|all> -> broadcasting_aps (resolves AP NAMES->MACs; restricts SSID to APs =
+  the "lock device to AP" lever, since UniFi has NO native per-client AP pin). Validated dry-run:
+  aps 622 --wlan CSCNet -> broadcasting_aps=[0c:ea:14:3e:65:a2].
+- apply-wlan macfilter off|allow|deny <macs> -> mac_filter_*. Dry-run validated.
+- NEW client-control.sh: block|unblock|kick a MAC via cmd/stamgr (gated). Validated block+unblock on
+  dummy 00:00:00:00:00:01 (rc:ok), cleaned up.
+
+(b) REMAINING wlanconf TUNING KNOBS added to apply-wlan: wlan(enable/disable), dtim <band> <n>
+  (dtim_mode=custom gate), mcast(mcastenhance), bcfilter, rrm(802.11k), ftroam(802.11r, warns),
+  isolation(l2_isolation), hidessid. dtim apply-validated on 0-client Green Valley (mode default->custom,
+  reverted). Others via the proven gated REST path.
+
+apply-wlan restructured: SITE resolved before the action case (so aps can map names->macs).
+WiFi APPLY SURFACE COMPLETE: apply-radio (radio_table) + apply-wlan (wlanconf, 15 actions) +
+client-control (cmd/stamgr), all gated + rollback + validated on 0-client sandboxes / dummy MAC.
+SKILL.md + ROADMAP updated. Coord: this msg. NEXT: switches/PoE collector (ROADMAP C).