stayZ3RO · Oct 4, 2026 · Oct 4, 2026
diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
@@ -58,3 +58,6 @@ jobs:
           fi
 
           echo "No empty Markdown files found."
+
+      - name: Check relative Markdown links
+        run: python3 scripts/check-relative-links.py
diff --git a/.gitignore b/.gitignore
@@ -19,6 +19,8 @@ Thumbs.db
 # Sensitive network exports
 configs/private/
 configs/raw/
+screenshots/raw/
+screenshots/unredacted/
 *.ovpn
 *.conf.private
 

diff --git a/AGENTS.md b/AGENTS.md
@@ -9,11 +9,11 @@ Read these first:
 
 ## Scope
 
-Project 2 of the home network lab: migration from consumer mesh/router to managed router/switch (ER605 + managed PoE switch), Omada SDN Controller, AP-mode wireless, redundant DNS, Proxmox-hosted services. Builds on `dns` (Project 1). This repo's own scope stops at the managed baseline. VLAN segmentation, firewall policy, and SSID-to-VLAN mapping are the next phase.
+Project 2 of the home network lab: the historical ER605/Omada cutover, followed by the 2026-09-27 UniFi UDM Pro and USW-24-PoE equivalent-state refresh. Deco remains in AP mode. Builds on `dns` (Project 1). The LAN is flat; VLAN segmentation, firewall policy, and SSID-to-VLAN mapping are planned.
 
 ## Directories
 
-`configs/`, `diagrams/`, `docs/`, `screenshots/`
+`configs/`, `diagrams/`, `docs/`, `screenshots/`, `screenshots-redacted/`
 
 ## Rules
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -8,6 +8,17 @@
 
 ---
 
+### 2026-09-27 UniFi hardware refresh
+
+- Replaced the ER605 and TL-SG2210P with a UDM Pro and USW-24-PoE in an equivalent-state cutover.
+- Kept the LAN flat, with the same gateway, DHCP, DNS, and Deco AP behavior. VLAN segmentation and firewall policy remain planned.
+
+### Recent documentation merges
+
+- 2026-09-22: redacted the ER605 WAN and reservation screenshots (#9).
+- 2026-09-27: updated links to renamed public repositories (#11).
+- 2026-09-28: clarified README network status and wording (#12).
+
 ### Added
 
 - Initial project repository structure

diff --git a/CURRENT-STATUS.md b/CURRENT-STATUS.md
@@ -5,24 +5,25 @@
 ![Phase](https://img.shields.io/badge/Phase-1%20Managed%20Cutover-purple)
 ![Docs](https://img.shields.io/badge/Docs-Portfolio%20Ready-informational)
 
-## Phase 1 Complete: Managed Network Baseline Ready for VLAN Segmentation
+## UniFi Network Core Live; VLAN Segmentation Planned
 
 ---
 
 ## Project Status
 
-**Phase 1 is complete.**
+**Phase 1 and the 2026-09-27 UniFi hardware refresh are complete.**
 
-This repository currently documents the managed network cutover from a consumer mesh/router-controlled design to a dedicated router, managed switch, AP-mode wireless, and VLAN-ready network foundation.
+The current network core is a UniFi UDM Pro and USW-24-PoE. The LAN remains flat, with Deco nodes in AP mode. Phase 1 documents the earlier ER605 and Omada cutover as history.
 
 ---
 
 ## Completed Work
 
 | Area | Status | Notes |
 |---|---:|---|
-| ER605 router cutover | ✅ Complete | Router/firewall is now the primary routing device |
-| Managed switch integration | ✅ Complete | TL-SG2210P is in the production network path |
+| ER605 router cutover | ✅ Complete | Historical Phase 1 cutover, replaced by UniFi on 2026-09-27 |
+| Managed switch integration | ✅ Complete | Historical TL-SG2210P integration, replaced by USW-24-PoE |
+| UniFi hardware refresh | ✅ Complete | UDM Pro and USW-24-PoE form the current network core |
 | Deco AP mode migration | ✅ Complete | Deco mesh is no longer acting as the router |
 | DNS validation | ✅ Complete | Pi-hole HA DNS path remained operational |
 | DHCP validation | ✅ Complete | Clients received valid leases |
@@ -42,9 +43,9 @@ ONT
   ↓
 AT&T Gateway / IP Passthrough
   ↓
-TP-Link ER605 Router
+UniFi UDM Pro
   ↓
-TP-Link TL-SG2210P Managed Switch
+UniFi USW-24-PoE Managed Switch
   ├── Deco Mesh APs
   ├── Proxmox Host
   ├── Primary Pi-hole
@@ -87,9 +88,9 @@ This keeps the project clean:
 
 | Task | Status |
 |---|---:|
-| Add final physical topology diagram | ⏳ Pending |
+| Add current physical topology diagram | ✅ Complete |
 | Add final logical topology diagram | ⏳ Pending |
-| Add sanitized Omada screenshots | ⏳ Pending |
+| Add sanitized Phase 1 Omada screenshots | ✅ Complete |
 | Add switch port mapping | ⏳ Pending |
 | Start VLAN/subnet design | ⏳ Pending |
 | Build firewall policy matrix | ⏳ Pending |

diff --git a/LESSONS-LEARNED.md b/LESSONS-LEARNED.md
@@ -133,3 +133,7 @@ That is closer to real infrastructure work than a simple home network diagram.
 The next focus is Phase 2: VLAN segmentation.
 
 The goal is to move from a flat managed network to a segmented design with separate zones for trusted devices, infrastructure, IoT, guest access, and lab systems.
+
+## 2026-09-27 UniFi Equivalent-State Refresh
+
+The UDM Pro and USW-24-PoE replaced the ER605 and TL-SG2210P while the LAN stayed flat. Keeping the gateway, DHCP, DNS, and Deco AP behavior the same made the hardware change easier to validate. The ER605 and Omada screenshots remain Phase 1 evidence; current-state diagrams now show UniFi. Segmentation remains a separate planned change.
diff --git a/README.md b/README.md
@@ -2,16 +2,16 @@
 
 ![Status](https://img.shields.io/badge/Status-Complete-brightgreen)
 ![Project](https://img.shields.io/badge/Project-Managed%20Network%20Infrastructure-blue)
-![Routing](https://img.shields.io/badge/Routing-ER605-informational)
-![Switching](https://img.shields.io/badge/Switching-Managed%20PoE%20Switch-informational)
+![Routing](https://img.shields.io/badge/Routing-UDM%20Pro-informational)
+![Switching](https://img.shields.io/badge/Switching-USW--24--PoE-informational)
 ![DNS](https://img.shields.io/badge/DNS-Pi--hole%20HA-purple)
 ![Platform](https://img.shields.io/badge/Platform-Proxmox-orange)
 
-## Managed Router/Switch Cutover, Omada SDN, AP Mode, and VLAN-Ready Network Foundation
+## Managed Network Cutovers, UniFi, AP Mode, and VLAN-Ready Network Foundation
 
 ---
 
-This repository documents Project 2 of my home network infrastructure lab: the migration from a consumer mesh/router-controlled network to a managed network foundation using a dedicated router/firewall, managed switch, Omada SDN Controller, AP-mode wireless, redundant DNS, Proxmox-hosted services, and monitoring validation.
+This repository documents Project 2 of my home network infrastructure lab. Phase 1 records the ER605 and Omada cutover. A later equivalent-state refresh put a UniFi UDM Pro and USW-24-PoE at the network core on 2026-09-27. Deco nodes remain in AP mode, and the LAN remains flat. VLAN segmentation and firewall policy are planned.
 
 Project 1 focused on building reliable core infrastructure services such as HA DNS, Unbound recursive DNS, monitoring, alerting, Tailscale remote access, Proxmox-hosted services, and operational validation.
 
@@ -40,7 +40,7 @@ This project documents the cutover from a consumer home network design into a mo
 
 The main goal was to move routing and switching responsibilities away from the mesh system and into dedicated network infrastructure while keeping core services stable.
 
-This phase introduced:
+The original Phase 1 cutover introduced:
 
 - Dedicated routing with TP-Link ER605
 - Managed switching with TP-Link TL-SG2210P
@@ -79,9 +79,9 @@ ONT
   ↓
 AT&T Gateway / IP Passthrough
   ↓
-TP-Link ER605 Router / Firewall
+UniFi UDM Pro Router / Firewall
   ↓
-TP-Link TL-SG2210P Managed PoE Switch
+UniFi USW-24-PoE Managed Switch
   ├── Deco Mesh APs
   ├── Proxmox Host
   ├── Primary Pi-hole Node
@@ -95,7 +95,7 @@ TP-Link TL-SG2210P Managed PoE Switch
 ```text
 Client Device
   ↓
-ER605 DHCP-Provided DNS
+UDM Pro DHCP-Provided DNS
   ↓
 Pi-hole HA VIP
   ↓
@@ -127,7 +127,7 @@ Admin Endpoint
   ↓
 Trusted LAN / Tailscale
   ↓
-Proxmox / Omada / Pi-hole / Monitoring Services
+Proxmox / UniFi Network / Pi-hole / Monitoring Services
 ```
 
 ---
@@ -137,12 +137,13 @@ Proxmox / Omada / Pi-hole / Monitoring Services
 | Phase | Status | Focus |
 |---|---:|---|
 | Phase 1 - Managed Router/Switch Cutover | ✅ Complete | ER605 cutover, managed switch integration, Deco AP mode, baseline validation |
+| UniFi Hardware Refresh (2026-09-27) | ✅ Complete | UDM Pro and USW-24-PoE replaced the ER605 and TL-SG2210P without adding segmentation |
 | Phase 2 - VLAN Segmentation | ⏳ Planned | VLAN IDs, subnet plan, network zones, DHCP scopes |
 | Phase 3 - Firewall Policy | ⏳ Planned | Inter-VLAN rules, restricted management access, IoT/guest isolation |
 | Phase 4 - Wireless SSID Mapping | ⏳ Planned | SSID-to-VLAN mapping for trusted, guest, IoT, and lab wireless |
 | Phase 5 - Monitoring and Operations | ⏳ Planned | Monitoring updates, dashboards, runbooks, backups, validation procedures |
 
-Hardware refresh (2026-09-27): the ER605 and TL-SG2210P were replaced by a UniFi Dream Machine Pro and a USW-24-PoE in an equivalent-state cutover. The network stayed the same (flat `192.168.68.0/24`, same gateway, DHCP, and DNS), and the Deco units stay in AP mode. Phase 1 documents the ER605 and Omada cutover as it happened; Phase 2 onward runs on the UniFi hardware.
+Phase 1 documents the ER605 and Omada cutover as it happened. The 2026-09-27 UniFi refresh kept the same flat LAN, gateway, DHCP, and DNS behavior. Phase 2 onward uses the UniFi hardware.
 
 ---
 
@@ -175,8 +176,7 @@ Hardware refresh (2026-09-27): the ER605 and TL-SG2210P were replaced by a UniFi
 
 | Diagram | Status | Link |
 |---|---:|---|
-| Topology before the UniFi refresh (Omada, flat) | Done | [View](diagrams/current-topology.md) |
-| Current Topology (UniFi, flat) | Planned | Migration done 2026-09-27; diagram not drawn yet |
+| Current Topology (UniFi, flat) | Done | [View](diagrams/current-topology.md) |
 | Phase 2 - VLAN Segmentation Design | Planned | Coming soon |
 | Phase 3 - Firewall Policy Flow | Planned | Coming soon |
 
@@ -189,13 +189,13 @@ Hardware refresh (2026-09-27): the ER605 and TL-SG2210P were replaced by a UniFi
 | AT&T Fiber Connection | WAN connectivity |
 | ONT / Optical Network Terminal | Fiber handoff |
 | AT&T Gateway with IP Passthrough | ISP gateway |
-| TP-Link ER605 | Dedicated router/firewall |
-| TP-Link TL-SG2210P | Managed PoE switch |
+| UniFi UDM Pro | Dedicated router/firewall |
+| UniFi USW-24-PoE | Managed PoE switch |
 | TP-Link Deco Mesh | Wireless access points in AP mode |
 | Raspberry Pi 3B+ | Primary Pi-hole DNS node |
 | Raspberry Pi 3B | Secondary Pi-hole DNS node |
 | Dell OptiPlex Proxmox Host | Virtualization host |
-| Omada Controller LXC | Network controller |
+| UniFi Network | Network management on the UDM Pro |
 | Docker Monitoring VM | Monitoring service host |
 | Admin Workstation / Laptop | Testing and management endpoint |
 
@@ -205,9 +205,9 @@ Hardware refresh (2026-09-27): the ER605 and TL-SG2210P were replaced by a UniFi
 
 | Tool / Service | Purpose |
 |---|---|
-| Omada SDN Controller | Centralized management for router and switch |
-| TP-Link ER605 | Routing, firewalling, DHCP, and WAN handoff |
-| TP-Link TL-SG2210P | Managed switching and future VLAN trunk/access ports |
+| UniFi Network | Centralized management for router and switch |
+| UniFi UDM Pro | Routing, firewalling, DHCP, and WAN handoff |
+| UniFi USW-24-PoE | Managed switching and future VLAN trunk/access ports |
 | Pi-hole | DNS filtering and visibility |
 | Keepalived | DNS virtual IP failover |
 | Gravity Sync | Pi-hole configuration synchronization |
@@ -222,7 +222,7 @@ Hardware refresh (2026-09-27): the ER605 and TL-SG2210P were replaced by a UniFi
 
 ---
 
-## Phase 1 Validation Summary
+## Historical Phase 1 Validation Summary (ER605 and Omada)
 
 | Validation Area | Result |
 |---|---:|
@@ -304,5 +304,7 @@ This repository is part of a broader infrastructure lab portfolio.
 | Repository | Focus | Relationship |
 |---|---|---|
 | [Home Network Infrastructure Lab](https://github.com/stayZ3RO/dns) | HA DNS, Pi-hole, Unbound, monitoring, Tailscale, Proxmox, RustDesk | Provides the core infrastructure foundation used by this project |
-| [Home Network Managed Infrastructure Lab](https://github.com/stayZ3RO/netlab) | Managed router, switching, VLANs, firewall policy, network segmentation | Expands the home lab into managed network infrastructure |
+| [Home Network Managed Infrastructure Lab](https://github.com/stayZ3RO/netlab) | Managed router and switching; VLANs, firewall policy, and segmentation planned | Expands the home lab into managed network infrastructure |
 | [VPS Cloud Infrastructure Lab](https://github.com/stayZ3RO/vps-lab) | Linux VPS hardening, Docker, DNS, HTTPS, monitoring, backups, secure access | Extends infrastructure operations into cloud-hosted services |
+
+See the [portfolio](https://chrisalorenzo.com/) for the live project index.
diff --git a/diagrams/README.md b/diagrams/README.md
@@ -1,6 +1,6 @@
 # Architecture Diagrams
 
-![Status](https://img.shields.io/badge/Status-Planned-yellow)
+![Status](https://img.shields.io/badge/Status-Current-informational)
 ![Project](https://img.shields.io/badge/Project-Managed%20Network%20Infrastructure-blue)
 ![Docs](https://img.shields.io/badge/Docs-Portfolio%20Ready-informational)
 
@@ -14,8 +14,8 @@ This folder contains architecture diagrams for the managed network infrastructur
 
 | Diagram | Status |
 |---|---:|
-| [Current Topology (Omada, flat)](current-topology.md) | Done |
-| Target Topology (UniFi) | Planned, with the router/switch migration |
+| [Current Topology (UniFi, flat)](current-topology.md) | Done |
+| [Phase 1 Diagrams (ER605 and Omada, historical)](../docs/phase-1-managed-network-cutover/diagrams.md) | Done |
 | Phase 2 - VLAN Segmentation Design | Planned |
 | Phase 3 - Firewall Policy Flow | Planned |
 

diff --git a/diagrams/current-topology.md b/diagrams/current-topology.md
@@ -1,51 +1,32 @@
-# Current Topology: Managed Network (Omada, flat)
+# Current Topology: UniFi (flat LAN)
 
-The network as it runs today: a single flat `192.168.68.0/24`, managed by
-the Omada Controller, with the Pi-hole HA pair providing DNS behind a
-Keepalived VIP.
+The UDM Pro and USW-24-PoE have been the network core since the
+2026-09-27 equivalent-state cutover. Deco nodes remain access points. The LAN
+is still flat; VLAN segmentation and inter-VLAN firewall policy are planned.
+The [Phase 1 diagrams](../docs/phase-1-managed-network-cutover/diagrams.md)
+record the earlier ER605 and Omada network.
 
 ```mermaid
 flowchart TD
-    ONT["AT&T Fiber ONT"]
-    ER["TP-Link ER605 v2<br/>gateway / firewall, 192.168.68.1<br/>Omada-managed · DHCP + DNS source"]
-    SW["TP-Link TL-SG2210P v3<br/>managed PoE switch, 192.168.68.2"]
-    DECO["Deco X25, AP mode<br/>main node on switch port 8<br/>other nodes: wireless mesh"]
-
-    ONT -->|IP passthrough| ER
-    ER --> SW
-    SW -->|port 8| DECO
-
-    subgraph CLUSTER["Proxmox cluster"]
-        direction LR
-        P1["pve01, .80"]
-        P2["pve02, .90"]
-        P3["pve03, .70"]
-    end
-    SW --> CLUSTER
-
-    subgraph SERVICES["Hosted VMs / LXCs"]
-        direction TB
-        PH["Pi-hole HA<br/>pihole01 .4 · pihole02 .5<br/>Keepalived VIP .20 → client DNS"]
-        OC["Omada Controller VM, .3"]
-        MON["monitoring .94 · portainer .92<br/>rustdesk .93 · ts-router01 / 02"]
-    end
-    CLUSTER --> SERVICES
-
-    OC -.->|manages| ER
-    OC -.->|manages| SW
-
-    classDef ext fill:#334155,stroke:#94a3b8,color:#f1f5f9
-    classDef net fill:#075985,stroke:#38bdf8,color:#e0f2fe
-    classDef host fill:#92400e,stroke:#fbbf24,color:#fef3c7
-    classDef svc fill:#166534,stroke:#4ade80,color:#dcfce7
-    class ONT ext
-    class ER,SW,DECO net
-    class P1,P2,P3 host
-    class PH,OC,MON svc
+    ONT["AT&T Fiber ONT and gateway"]
+    UDM["UniFi UDM Pro<br/>gateway, firewall, and DHCP"]
+    SW["UniFi USW-24-PoE<br/>managed PoE switch"]
+    DECO["Deco nodes<br/>AP mode"]
+    DNS["Pi-hole HA pair<br/>Keepalived VIP and Unbound"]
+    PVE["Proxmox cluster"]
+    MON["Monitoring VM 294<br/>Prometheus, Grafana, Alertmanager"]
+    CLIENTS["Wired and wireless clients"]
+
+    ONT -->|IP passthrough| UDM
+    UDM --> SW
+    SW --> DECO
+    SW --> DNS
+    SW --> PVE
+    SW --> CLIENTS
+    PVE --> MON
+    DECO --> CLIENTS
 ```
 
-**Single flat `192.168.68.0/24` · VLAN 1 only · no segmentation.** VLAN
-segmentation, inter-VLAN firewall policy, and SSID-to-VLAN mapping are the
-next phase. A "Target State (UniFi)" variant of this diagram will land with
-the router/switch migration. Same layout, with ER605 → UDM Pro (`.1`),
-SG2210P → USW-24-PoE (`.2`), Deco unchanged.
+The UDM Pro supplies DHCP, with the Pi-hole VIP as client DNS. The
+2026-09-27 cutover kept the same gateway and DNS behavior; it did not
+introduce segmentation.