Well in trying to move SSIDs the controller totally bricked itself! Won’t boot and factory reset failed too. 
Will have to wait a few days to get a replacement (Rachio chat very responsive where email less so…) before trying anything else!
I’m loathed to abandon the IOT VLAN altogether because of course it’s best practice and all my other devices are having no problems at all; but maybe I could be less controlling and allow some ‘well behaved’ devices onto the main LAN, leaving only less trustworthy manufacturers etc. on the IOT VLAN.
Stewart - While I understood that thread on a theoretical level, it’s way above my current ability to implement. And of course I don’t think that we should have to resort to that in the first place!
I may spin up a Netshark VM to see if I can monitor the DHCP requests.