Operator map / graphical redesign artifact

# Network Web v2

Now it is the actual operator map instead of just a conceptual graph. Same core redesign, but with three extra layers: physical/topology intent, firewall-flow reasoning, and staged migration sequencing. Click nodes or switch modes to inspect where the pain is and what the end state should look like.

6 target VLANs Topology overlay Firewall flow layer 4-stage migration path Optional downstairs U6 LR
Topology layer Shows the cabling/placement story: operator, gateway, switch fabric, APs, and where endpoints really hang.
Firewall layer Shows allow, deny, and exception paths so policy intent is visible instead of implied.
Migration layer Shows what moves first, what is annoying, and what can wait until the end.
Operator map Use this to reason about design, staging, and “what breaks if I move this” before touching UniFi.
Stage 1

### Stop obvious sins

Move Protect chimes out of Management, stand up Camera VLAN 60, and make Management clean again.

Stage 2

### Split infrastructure from life

Move PD, Serenity, Nomad, and Rocinante into Servers VLAN 30 so trusted clients stop sharing a lane with infrastructure.

Stage 3

### Drain old IoT

Migrate ecobees, appliances, and low-drama devices first. Leave Google discovery weirdness for last inside IoT.

Stage 4

### Refine radio and policy

Decide whether the downstairs U6 LR returns, clean up SSIDs, then tune firewall exceptions with evidence instead of superstition.

### Topology interpretation

The UDM is routing brains, the USW is the practical center of gravity, and the APs are infrastructure nodes carrying policy-bound SSIDs. That means client traffic categories should be separated by VLAN intent, not by whatever happened to be easiest last year.

### Firewall interpretation

Trusted gets explicit admin reach into Management and Servers. IoT and Cameras only get DNS/NTP/internet plus tightly scoped local-service exceptions. Guest gets nothing but internet. Old IoT gets a one-way ticket to deletion.

### What this graph is saying now

- Management is not a junk drawer.
- Servers are infrastructure and deserve their own lane.
- Cameras/security is a first-class lane because future growth is already obvious.
- Migration difficulty lives mostly in discovery-heavy IoT, not in the easy appliances.

### What changes first

- Move chimes out of Management.
- Create Camera VLAN 60 now.
- Pull core servers out of Trusted.
- Drain and kill Old IoT / VLAN 2.

## Selected node

### Whole design

Click a node in the graph. I will show what it is, what it should talk to, and where it sits in the migration sequence.

Tip: click Mgmt Tip: click Cameras Tip: click Old IoT
Management / infrastructure
Trusted clients / operator lane
Servers / core services
IoT / smart home
Guest
Cameras / security
Legacy / migration pain
Topology / physical intent overlay
Allowed policy path
Denied / blocked path
Migration or restricted exception path

This is no longer just a decision picture. It is an operator map for topology, policy, and staged cutover thinking.