diff --git a/.claude/handoffs/2026-10-28-dhcp-pool-shrink-prep.md b/.claude/handoffs/2026-10-28-dhcp-pool-shrink-prep.md
new file mode 100644
index 0000000..207787f
--- /dev/null
+++ b/.claude/handoffs/2026-10-28-dhcp-pool-shrink-prep.md
@@ -0,0 +1,31 @@
+# Handoff: DHCP pool shrink to .61–.99 — prep done, blocked on two device statics
+
+Continues: [2026-10-22-ha-lost-ipv4.md](./2026-10-22-ha-lost-ipv4.md)
+
+## Done
+- 2026-10-26: projector had drifted .149 → **.103** despite its GUI-set Omada reservation.
+  HA `/config/configuration.yaml` pjlink `host:` → `.103` (backup in `/config/.backup/`), entity live.
+  `network_inventory.md` + `ROUTER.md` updated (backups in `~/bin/.backup/`).
+- 2026-10-28 pre-change audit (backups: `~/bin/network-tools/.backup/omada-lan-networks-*.json`,
+  `omada-insight-clients-pre-pool-shrink-*.json`, `client-detail-pre-pool-shrink.tsv`):
+  - Every **running** PVE guest is static. DHCP/guest-configured ones (CT 106, VMs 607/116/100/131) are stopped;
+    VM 706 (HA) is static inside HAOS.
+  - Only static inside .60–.99: **CT 693 romm @ .60** → Seth chose pool **.61–.99** (not .60–.99).
+  - .60–.99 already holds ~15 DHCP clients (IoT, XP-7100 .96, LG TV wired now .81). Outside-pool DHCP
+    that will renumber: .55 ESP, .59 Nest cam, .101 TV wifi, .102 Pixel-9, .176, .183 vjtop, .184 printer, .103 projector.
+
+## Blocked on Seth (sequence: statics first, then pool)
+1. Projector: on-screen menu → network → DHCP off, IP 192.168.0.103/24, gw .1, DNS .153.
+   Its web UI is a dead Java applet (ProjectorView X500U) with no IP config.
+2. Receipt printer TM-m30: static .184. EpsonNet Config at https://192.168.0.184 needs HTTP auth
+   (creds unknown; Epson defaults are user `epson` / pw serial number or `epson`). Hard-coded .184 in
+   `hal/backend/printer.py`, `hermes/.../notify.py`, `mcp-pos-print/server.py`.
+
+## Then
+- Verify both answer at their IPs after a power cycle (PJLink `%1POWR`, TCP 9100).
+- Change pool via internal API `PATCH sites/{SITE}/setting/lan/networks/{netId}` (`dhcpSettings.ipRangePool`
+  / ipaddrStart/End → .61/.99) — the full network object is in the backup JSON; read the GET shape first.
+  Verify with GET, then watch for renumbered clients over ~2h. Update ROUTER.md "DHCP range".
+
+## Side finding
+- `~/.ssh/config` `seth-pi` → 192.168.0.102, but Omada shows .102 = Pixel-9-Pro. Alias is stale.