Just installed it. Looks like they also changed the dashboard a bit.
Aware but never used it. What happens when the AP that a device is locked to is rebooted or goes offline? Does that device still roam or does that device now have no access?
I tested this once with a single device. It did not roam. I recall rebooting the device to see if a power cycle would get it to connect to a different AP (there are a couple others within reach) but it didn’t connect. I’m fairly confident saying that UniFi treats locking as an imperative, not a suggestion.
I can understand their choice. It doesn’t bother me. My Peloton is nearly unusable when it connects to a distant AP…if the AP in my home gym dies, and I really, really want my Peloton to connect to another AP, I’ll just unlock it 
Because we’re discussing Roon on a vlan…
A couple of people got Roon working in Docker on Synology on a vlan. I’ve bounced between running Roon in Docker on Synology, on Ubuntu on a NUC, and ROCK on a NUC. I moved away from Docker/Synology because I couldn’t get it to work on a vlan.
Based on the work the other guys did, I got mine up and running and am not back to running on Docker/Synology but on my dedicated Roon/Music vlan. My NAS is a rack-mounted RS1221+ with fast drives, 32GB RAM, and SSD cache. I don’t want to debate the pros and cons of a NAS or Docker but thought I’d share this for the people here who are playing with vlans and my think this implies that you can’t run Roon on Synology.
I figured that would be the case so I never even bothered to try it. It’s only 2 or 3 devices so I’ll continue to bounce them as needed to get them to roam to the “correct” AP. Even if I forget to do that after upgrading or rebooting an AP they still work when associated with distant APs even though they stick out a like a soar thumb in the UI when on those distant APs.
Anyway, on my network I only have 3 VLANs and only two of them get used by WiFi devices.
VLAN 1 is my trusted/management/main one and is wired only. My macbook (when docked) is on this VLAN along with management IPs for infra devices (switches, APs, NASes, etc.). Certain hosts (mainly my docked macbook) have access to devices on VLAN 2.
VLAN 2 is my untrusted/catch all for things like IoT, cameras, streaming devices (including Roon) etc. It is for wired or wireless devices and devices on this VLAN have no access to VLAN 1 or 2.
VLAN 3 is for guests (can be wired but so far I’ve only had wireless) only. Aside from AirPrint to a single printer and AirPlay/Chromecast to my biggest TV (all on VLAN 2) this VLAN has no access to the others.
Never saw the need to get any more granular than this. I use Ubuntu server LTS wherever possible for server related stuff (Roon, docker for UI network app, piehole, etc) and is always firewalled. My NASes are strictly for SMB shares and backups (Time Machine, between NASes, etc.) except I use one of my NASes for security camera recordings and the other for downloads/temp space.