A VLAN renumber that never touched a live address
- date
- 20260827
- what happened
- Ahead of migrating Node0's flat network onto the new VLAN fabric, several planned VLAN identifiers were renumbered and two new segments added, and the change was reconciled into the address-management records the same day.
- what it cost
- Nothing, because of the discipline applied. The records were updated to the renumbered target state immediately, but every host's live, DNS-resolvable address was deliberately left at its old flat-network value until that specific host was physically migrated, days later, one at a time.
- what changed
- A standing rule: when a numbering scheme changes on paper, the documentation and the live state are allowed to disagree for as long as necessary, but only in one direction. Documentation shows the future, live systems show the present, and the two are reconciled host by host at the moment each one actually moves.
- the check now
- Before any renumbering project, decide and write down which of documentation and live state is allowed to be ahead of the other, and never change a live address or its DNS record until the move it describes has actually happened.
This is the lesson that is boring because it worked. Nothing broke on 20260827, no outage happened, and none of this is a postmortem. It is here because the discipline it represents is what kept the much larger migration a day later from breaking things it easily could have broken.
Renumbering plans naturally want to update everything at once, including DNS and live addressing, because the new numbers are the state the plan describes. Holding two versions of the truth in your head is uncomfortable. The temptation is strongest for the small stuff: a record that is obviously going to change anyway, a host that is obviously moving next week. Each of those edits is individually harmless and collectively produces a network where nobody can tell which addresses are real.
Node0 split the two explicitly. The plan’s numbers went into the address-management records immediately, marked as the target. The network’s current truth, meaning every host’s real address and its DNS record, was forbidden from changing until the moment of that host’s actual physical migration. Correcting an address ahead of the move was written into the plan as something not to do.
That single rule is what let a 135-host, one-day migration proceed without any host’s DNS entry pointing at an address it did not yet have. The generalisable form: in any migration, name which side is allowed to be ahead, write it down before you start, and reconcile at the moment of the move rather than in a batch on either side of it.
Source: node0 lessons v0.1, lesson 4.8. Sanitized: checklist v0.1, 20260921; VLAN identifiers, subnets; voice pass 20260921. Part of oznog.com/node0.