v2.0.3 Release Changes (TBD)

[tvancott42]

Rolling collection of dev changes for the v2.0.3 release. This description tracks what's on dev as PRs land; release notes are drafted from it at release time.

So far: #987 (fixes #986, #982) and #990 (fixes #989), plus 502/503/504 handling and default-site reconnect follow-ups on dev

Settings - Connection

• API key connections self-heal after a UniFi Network application restart or upgrade - While the Network application is restarting, upgrading, or wedged, its proxy answers with 401/403 even though the key is still valid. The client treated any auth failure in API key mode as a revoked key and permanently stopped calling the console - everything that reads the API (Wi-Fi Optimizer, Config Optimizer, Security Audit, Threat Intelligence, SNMP detection) went dark until the container was restarted or the connection re-saved. The client now re-validates the key, throttled to one probe per minute, and recovers on its own within a minute of the console coming back. Username/password (cookie) authentication is unaffected.
• Reverse-proxied consoles recover from 502/503/504 too - A self-hosted UniFi OS Server or Network application behind a reverse proxy answers with 502/503/504 (Bad Gateway / Service Unavailable / Gateway Timeout), not 401/403, while its backend restarts, upgrades, or reprovisions. Those gateway errors used to just fail each console read and leave the connection stuck showing "connected" - no re-authentication, no alert, no recovery. They now self-heal on the same path as an expired session: the client re-authenticates, raises the UniFi Console connection alerts, and recovers when the backend returns. The connection screen shows "temporarily unavailable, retrying" instead of a raw "failed with status 502". Applies to both direct and agent-tunneled connections, API key and cookie auth.
• The main site reconnects on its own after a transient console outage - The periodic reconnect only covered agent-tunneled secondary sites, so a directly-connected console (the default site, or any non-agent secondary site) that was down when the optimizer started - or that dropped and disposed the connection - stayed dark until a schedule ran or the app restarted. Any disconnected site that isn't waiting on an agent tunnel now retries its console every 30s, so it comes back within a minute of the console returning. Verified end to end: console down at cold start recovers automatically ~50s after it comes back, no restart needed.

Multi-Site

• Disable / Remove Site - New third section in a site's Configuration panel (Settings - Multi-Site), alongside Agent and Settings. Disable stops the site's monitoring and console connection immediately and hides it from the site switcher and Sites views; all data is kept and the site can be re-enabled in place without confirmation. Remove is permanent, behind a double confirmation: it deletes the site, its database, and its agent enrollments, and frees the license seat. InfluxDB buckets are left in place (deleting them needs the admin token, which is never stored) and the confirmation says so. Both actions are blocked for the default site and for the site currently being viewed.
• Create Site responsiveness - Two fixes for the accidental duplicate site from Delete a secondary site completely #982: the spinner/disabled state now actually renders during the multi-second provisioning (SQLite completes EF's async calls synchronously, so the render never flushed), and a re-entrancy guard swallows the queued double-click that created a "-2" copy.
• Add Site jumps to the form - The + card on the Sites page lands on the add form scrolled into view with the name field focused.
• Site switcher stays current - Rebuilds in every open tab when sites are created, renamed, enabled/disabled, or removed, instead of waiting for a page reload.
• Site switcher keyboard support - Escape closes the dropdown, Up/Down arrows move through the sites, Enter or Space selects. Tab and Shift+Tab keep their native behavior.

Client Performance

• Devices resolve on dual-stack hosts (Docker/Proxmox) - When the app accepts an IPv4 client on a dual-stack socket, the browser's address arrives as an IPv4-mapped IPv6 (::ffff:a.b.c.d), which never matched the UniFi Console's plain-IPv4 client list - so the page showed "Device Not Found" with a ::ffff:-prefixed address even though the device was right there. The address is normalized to plain IPv4 before lookup, on the default site and via the on-site agent whoami probe on managed sites (fixes Client Performance: device not found / Client Speed Test: showing LAN device as WAN (::ffff: IP prefix) #989). Genuine IPv6 clients are left untouched.

Client Speed Test

• Real client IPs and correct LAN/WAN labels - Results from a dual-stack client stored the mapped ::ffff: address, so the device column showed the prefix and a local device was mislabeled WAN. New results store and display plain IPv4 with the right label; Client WAN Test and LAN Speed Test share the results table and benefit too. A one-time migration collapses existing ::ffff: addresses so past results also show real IPs, and normalizing before enrichment lets a result resolve its device MAC and correlate to that client's Client Performance history.

Alerts & Schedule - Rules

• New UniFi Console event types - console.connection_failed (Warning) after two consecutive failed authentication attempts spanning at least the revalidation interval; console.connection_restored (Info) on recovery. Per-site, armed only after a successful connection, suppressed while a site's agent tunnel is coming up, 30-minute failure cooldown so a flapping console upgrade produces one alert.
• New On-Site Agent event types - agent.offline (Warning) when an enrolled agent is continuously offline for 3 minutes; agent.reconnected (Info) when it returns. Judged by the same live definition the UI uses (open tunnel or fresh heartbeat) via a periodic sweep, so agent redeploys and brief tunnel bounces stay silent. Agents never connected, disabled, or on a disabled site don't alert.
• Seeding - Default rules seed on startup and at site creation. On-Site Agent rules skip the main site unless the default site has its own agent (enrolling one seeds them then), so single-site installs don't see agent rules they can't use. All four types are in the event type patterns catalog and deliver through all existing Notification Channels.

Fixes

• Form help text legibility - Bumped from 0.75rem to 0.8rem across settings forms.