diff --git a/net_alerter/net_alerter.py b/net_alerter/net_alerter.py
index f92eb43..a1222c2 100644
--- a/net_alerter/net_alerter.py
+++ b/net_alerter/net_alerter.py
@@ -412,6 +412,10 @@ def _clear_recovery():
 
 def _check_churn(mac: str, ip: str) -> bool:
     """Return True and suppress if this device churns too frequently."""
+    # Explicitly labeled personal devices are never churn-suppressed into infrastructure
+    with personal_lock:
+        if mac in device_labels or mac in personal_devices:
+            return False
     now = time.time()
     with _churn_lock:
         events = _churn_tracker.get(mac, [])
@@ -1050,6 +1054,10 @@ def on_arrival(mac: str, ip: str, hostname: str = "") -> None:
             # Device is already known
             dev = known_devices[mac]
             dev['last_seen'] = now
+            # Upgrade from ARP-probe placeholder to real IP
+            if dev.get('ip') in ('0.0.0.0', 'unknown') and ip not in ('0.0.0.0', 'unknown'):
+                dev['ip'] = ip
+                logging.debug(f"Updated {mac} IP from placeholder to {ip}")
 
             # DHCP renewal dedup: if last_seen < 30 min, skip alert
             if now - dev['first_seen'] < 1800:  # 30 min