Branch VPN shows phase 1 up but no IPsec SAs after a re-addressing

Last night the branch team moved its users from 10.2.0.0/24 to a new subnet, 10.20.0.0/24. They updated R2's LAN interface, DHCP, NAT and the crypto ACL on R2. This morning branch users cannot reach anything at HQ (10.1.0.0/24). The branch engineer says "the tunnel is up". The VPN is IKEv1 with crypto maps on both routers, IOS-XE, pre-shared keys, VPNMAP on Gi0/0/0 at each end.