The Quest that wore Unknown

A night gatehaus with a curfew bell over its arch. A gatekeeper raises an amber lantern — the only colour in the sketch — over a ledger of blank ruled lines, while a small anonymous figure in a VR headset slips through the gate behind him. An Abyssinian cat sits on the ledger stand, one paw pointing at the intruder.

Holiday curfew struck 23:00 and the VRVANA PC went dark on schedule. The Meta Quest kept playing past midnight. It could, because the network had never learned its name: the Firewalla knew it only as Unknown-ca04 — a private MAC, no DHCP name, no vendor, and no rule that had ever matched it. The fixes landed on 2026-08-04 and are live on manoir (engine + devices.yaml), unit-gated, with the identity docs updated to match.

What the parent saw

After holiday curfew (23:00), the Meta Quest was still on Wi-Fi. VRVANA PC was blocked correctly. The Quest was not.

What the logs said

Layer	Finding
Presence	`FA:CE:DE:CA:CA:04` online from ~23:16 through ~00:18
Firewalla name	`Unknown-ca04` — empty DHCP, private MAC, vendor Unknown
Flows	Live `graph.oculus.com` + `fbcdn` — it was the Quest
Enforcement	Zero `BLOCKED` lines for that MAC, ever
Curfew-start sweep	Missed — offline ~22:45–23:05
First-discovery pause	Missed — MAC already in discovery registry

RealityDevice was a red herring: that hostname is the Apple Vision Pro, enrolled under Bert as personal, not Albert’s screen.

Fixes shipped

Enroll meta_quest with static MAC + flow_host_patterns (oculus hosts).
Flow / OUI / hostname adopt — rotated private MACs re-pin without a parent typing a MAC; Columbo device-canon holds the display name.
Offline→online during curfew auto-pauses unreviewed strangers (unknown-rejoin-during-curfew).
Steam Deck + both Switches get the same identity surface (empty Deck / Switch 2 slots fill on first sighting; second Nintendo device prefers Switch 2 when Switch 1 is full).
AVP classified as Apple personal, not Meta VR.

Deep reference: Device Identity — Flow / OUI screen identity.

What E2E still needs a body in the room

Unit tests cover adopt resolution and rejoin pause. Live checks confirm Quest and Switch 1 on :4077 with holiday 23:00. Not yet exercised on this ship:

First Wi-Fi join of Steam Deck → auto-adopt log
Second Switch power-on → fills nintendo_switch_2
Full night: Quest rejoin after 23:00 → pause line in force-flow log

Power the Deck or Switch 2 once on haus Wi-Fi, then:

grep -E 'SCREEN IDENTITY ADOPT|host screen identity|flow screen identity' \
  ~/.sanctum/logs/force-flow.stderr.log | tail -20
curl -s http://127.0.0.1:4077/screen/status | jq '.screens[] | select(.key|test("steam|switch|quest"))'