What to try — decoy

# WHAT TO TRY — Item 7 · Decoy Network ("Honeypot Amber")

**Open:** `index.html` in this folder — any browser, works offline. **Read:** `PACKET-7.md` (4 minutes). Nothing is running; there is nothing to turn on.

1. **Start with the explainer.** Top section — "What am I looking at?" — in plain words: probe requests vs. association attempts, and why the log is a doorbell log, not a wiretap.
2. **Play with the filter.** Type `probe`, then `assoc`, then part of a MAC or an SSID name. The count line updates. Every row is labeled SAMPLE and is synthetic — invented for this page, from no real capture.
3. **Read the packet's §4 fence before the §3 template.** The order is the point: metadata only · no traffic interception · no credential capture · no evil-twin impersonation of a real network the house doesn't own · spare hardware only · owner's premises only.
4. **Note the placeholder SSID honestly.** The template shows `xfinitywifi-decoy` as a drafting placeholder in the requested style — and the fence (§4.4) requires any real, separately approved run to use an invented name instead. The template deploys nothing.

**Your call after reading:** whether this ever becomes a real run on spare hardware is a separate commission with a Defender read first (packet §6). This item is the plan and the viewer — deliberately nothing more.