[tvancott42]

Change Control - Re-address Networks

After a re-address, devices find the UniFi Console at its new address without a manual set-inform.

• Dry run and Review Plan say how each device finds the Console. A per-device verdict replaces the old "Point the Inform Host at ... first" warning (and its copy in the plan notes):

  Verdict	When	Shown
  Not affected	Inform host outside every moved subnet	Nothing
  Follows automatically	Gateway-hosted Console or CloudKey (a UniFi OS console that is not UniFi OS Server), or the inform host is the gateway's own LAN address	Nothing
  Follows by DNS	A name the gateway's Local DNS serves and the plan moves, and the device asks the gateway (static DNS at a gateway address, or DHCP handing out the gateway, with no DNS DNAT)	Nothing
  Plan re-points the Console	UniFi OS Server (or a Console with no UniFi OS answer) in a moved subnet	One warning when the plan adds the override write
  SSH fallback	Anything else, such as a name a Pi-hole serves	"re-pointed over SSH if it does not reconnect", or the hand command when Device SSH is off

• Inform Host override write. With the override off, the plan turns it on at the Console's new IP (never a name). On with an IP: the existing rewrite moves it, with no extra write. On with a name: left alone. Either write now goes just before the console-path networks (99): the new address does not answer until the Console's host moves, so it waits until every device and network write that still needs the old one has gone. Before this, the rewrite of an override already on was the plan's first write (setting order 1). Roll Back takes the same order. A Console at a gateway LAN address never gets an override write.

• set-inform over SSH for devices still offline. When the re-address watch raises "Network devices offline after", each offline device whose inform host moved gets set-inform through DeviceSshRouter. It is tried at the new static address, then the old one, once per device per plan, 10 s per try, four at a time. At the new address a name the gateway serves stays a name. At the old address, and for any other name, the URL carries the Console's new IP. A DHCP device with no new static is dialed at its last address with the Console's IP; one with no known address is listed. The gateway goes through Gateway SSH. With Device SSH off nothing is dialed. Each attempt is audited as Network Optimizer (change_control.device.inform_set).

• A follow-up alert reports the pass. "Network devices offline after" goes out at once, as before; "Re-point over SSH after: " follows when the pass finishes. It gives the exact command for every device it did not re-point, including one reached at its old address that cannot connect: SSH to it from a host already on the new subnets and run set-inform <url>. When the Console's new IP is on the device's own network, the command starts with ip route add <console>/32 dev <if>.

• The SSH command calls mca-cli-op set-inform. set-inform is only an /etc/profile alias (read on an AP and a UXG), which a non-interactive SSH command never loads, so the pass sends the same guarded form Firmware Rollout uses for upgrade. Hand commands keep plain set-inform. Checked on a live AP with the exact command: exit 0, the AP informed to the IP, and the Console handed back its Inform Host override (a name) within a second.

• A Console on the Gateway is named as such. Review Plan's When to Apply line, its last Lockout item, and the offline alert say Network Devices drop until the Gateway provisions its new addresses, instead of "until the console moves too", which fits only UniFi OS Server. The flag is recorded when the Plan is built.

• "Network Optimizer's host moves" also offers keeping both addresses until every Device is back, so Network Optimizer can reach Devices at their new and old addresses.

• Copy capitalizes the app's terms (Network Devices, UniFi Console, Gateway, Network, Plan) in the re-address watch, Lockout, and alert sentences.

• The Default network reads VLAN 1. Re-address Networks showed "Untagged" for it, and Migrate's name-match note said "untagged in the source". Untagged is a per-port setting; the network with no VLAN ID is VLAN 1. The Pattern tooltip drops its "(1 when untagged)" aside.

What does not change

• Write order: honeypots off first and back last, devices leaves-first, gateway 45, static-home networks 50, console-path networks 100, reservations 101, honeypots 102. Only the Inform Host override write moves, to 99.
• Built-in RADIUS profile skip, NAT rule_index, CarryReservations, ContinueOnError on reservations, no-reply as the only expected path failure, alert-instead-of-revert, Roll Back write order.
• Every other plan kind: the classifier and the SSH pass run for re-address plans only.
• The SSH pass runs off the watch tick. Watch timing, miss counts, alert severity, and plan status are unchanged. It never writes to the Console.

The 10-27 cutover, replayed against this branch

Step on 10-27	Then	Now
Apply 1: honeypot refused	Stopped at write 1	Unchanged: honeypots off before any network (08c761639)
Apply 2: built-in RADIUS profile refused	Stopped at write 2	Unchanged: skipped (af0d8991b)
Apply 3: second NAT update refused	Stopped part way	Unchanged: rule_index carried (363aa005b)
Apply 4: networks refused, honeypot out of range	21/24 landed	Unchanged: honeypots already off
Apply 4: every device offline, plan Watching	Alert only	Same alert. It now also runs set-inform on each offline device whose inform host moved, and lists the rest with their commands
Reservations dropped by the Console	Moved by hand	Unchanged: carried after the networks
Gateway half-provisioned, could not resolve the inform name	SSH from a moved host, host route, set-inform to the IP	Verdict: follows by DNS (it serves the name itself). Offline at the alert: one set-inform through Gateway SSH, name kept. That would not have fixed a gateway whose DNS forwarder pointed at the old resolver, so the alert's hand command is still the way in there
Switch at its old static, could not resolve the name	Host route + set-inform to the IP by hand	Dialed at the new static (fails, it never moved), then at the old static with the Console's IP. With no route that set-inform cannot connect, so the alert gives ip route add <console>/32 dev <if>; set-inform http://<console-ip>:8080/inform
AP isolated (wireless uplink lost), and a switch behind it	Still out at the end	Both dialed at new then old; neither is reachable. Both are listed with their commands. Network Optimizer cannot reach an isolated device
New: Inform Host override	Not handled	That site's override is on with a name, so no write and the name is kept. With it off, the plan writes the new IP at order 99
New: classifier on that site (UniFi OS Server, inform by name)	"Point the Inform Host" warning	Devices that ask the gateway: follows by DNS. Devices on networks behind a DNS DNAT or handing out the Pi-hole: SSH fallback. None: not affected

Outside Network Optimizer and still the runbook's job: the gateway's DNS forwarder boot script, the resolver's listen address, host interfaces and firewall, UniFi OS Server bindings.

Tests

FullyQualifiedName~ChangeControl: 1017 on release/2.11 before, 1055 after, all passing. No existing test edited. New tests are in ReaddressInformTests (one per verdict, the Pi-hole name, override already on with an IP, override order and its Roll Back, URL mapping, the host route) and PlanCoordinatorTests (new then old, once per plan, only moved devices, DHCP skipped, no Device SSH, no Gateway SSH, a non-re-address plan never dials, the hand command and host route).

Feature index: one line under Re-address Networks.