Message packages not working as I thought. MQTT

I am sending a message via MQTT and things aren't working as I thought.

This is an example message I am sending:

{"topic":"COMMAND_REPLY/BedPi","payload":{"payload":"Command fail","device":"COMMAND_REPLY/BedPi"},"qos":2,"retain":false,"_msgid":"51f5a1cc.a1fe4","_event":"node:1f11accb.bee033"}

That goes into a MQTT OUT node.

Arriving at the other end, things fall apart.

I put it through a JSON node then a CHANGE node to get back the data I want.

Receiving flow: (With test input)

[{"id":"ea3e72bc.093a6","type":"json","z":"9c1e5490.5d70b","name":"","property":"payload","action":"","pretty":false,"x":370,"y":160,"wires":[["4b2aa5e5.87520c","8e791548.a30768"]]},{"id":"2ffdc757.4feef8","type":"mqtt in","z":"9c1e5490.5d70b","name":"Urgent alarms","topic":"ALARM/A1","qos":"2","datatype":"auto","broker":"8a2e80be.f7c928","x":210,"y":160,"wires":[["fa75dbc1.464fc","ea3e72bc.093a6"]]},{"id":"4b2aa5e5.87520c","type":"debug","z":"9c1e5490.5d70b","name":"A1 alarm After JSON","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":610,"y":110,"wires":[]},{"id":"8e791548.a30768","type":"change","z":"9c1e5490.5d70b","name":"","rules":[{"t":"set","p":"payload","pt":"msg","to":"payload.payload","tot":"msg"},{"t":"set","p":"device","pt":"msg","to":"payload.device","tot":"msg"}],"action":"","property":"","from":"","to":"","reg":false,"x":530,"y":160,"wires":[["e4c7245a.ee0d08"]]},{"id":"fa75dbc1.464fc","type":"debug","z":"9c1e5490.5d70b","name":"RAW A1 alarm","active":false,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":390,"y":110,"wires":[]},{"id":"e4c7245a.ee0d08","type":"debug","z":"9c1e5490.5d70b","name":"Message","active":true,"tosidebar":true,"console":false,"tostatus":false,"complete":"true","targetType":"full","x":720,"y":160,"wires":[]},{"id":"24de9be5.20338c","type":"function","z":"9c1e5490.5d70b","name":"","func":"msg.payload = {\n    \"topic\":\"ALARM/A1\",\"payload\":{\"payload\":\"Command fail\",\"device\":\"COMMAND_REPLY/BedPi\"},\n    \n}\nreturn msg;","outputs":1,"noerr":0,"x":240,"y":240,"wires":[["8e791548.a30768"]]},{"id":"8cac197f.7078b","type":"inject","z":"9c1e5490.5d70b","name":"","topic":"","payload":"","payloadType":"date","repeat":"","crontab":"","once":false,"onceDelay":0.1,"x":90,"y":240,"wires":[["24de9be5.20338c"]]},{"id":"8a2e80be.f7c928","type":"mqtt-broker","z":"","name":"MQTT host","broker":"192.168.0.99","port":"1883","clientid":"","usetls":false,"compatmode":true,"keepalive":"60","cleansession":true,"birthTopic":"ARDUINO_STATUS","birthQos":"2","birthPayload":"connected","willTopic":"ARDUINO_STATUS","willQos":"0","willPayload":"disconnected"}]

My take:
This message is seen in the A1 after JSON debug node:

{"topic":"ALARM/A1","payload":{"payload":"Command fail","device":"COMMAND_REPLY/BedPi"},"qos":2,"retain":false,"_msgid":"86a0f848.bae808"}

Looks good.
It has the payload thingy built/existing/visible.

I then put it through the CHANGE node and set msg.device to msg.payload.device.
Nothing.

But if I press the inject button, it works and I get a msg.payload and msg.device at the end debug node.

Yeah, I am missing something obvious. Alas that's where I am at.
I'll keep trying to work out what I am not seeing, but help would be appreciated.

I'm stupid.

FAULT DISCOVERED!

The CHANGE node!

I set the msg.payload before I set the msg.device.

So when I look to set the msg.device (second change), there is nothing there because I just changed the msg.payload.

Be this a lesson for new people.
If messing around with the CHANGE node:

Modify the msg.payload LAST!