diff --git a/files/ansible-playbooks/indoor-restart-cloudagent.yml b/files/ansible-playbooks/indoor-restart-cloudagent.yml
index 9f5e467..d23733f 100644
--- a/files/ansible-playbooks/indoor-restart-cloudagent.yml
+++ b/files/ansible-playbooks/indoor-restart-cloudagent.yml
@@ -116,7 +116,7 @@
           - "LLDP candidate IP={{ lldp_dev2_ip | default('<none>') }}"
           - "LLDP class={{ lldp_ip_class | default('none') }}"
 
-    # >>> STEP 2 (single, correct task): override dev2_host before any tunnel tasks use it <<<
+    # -------------------- CHANGE 1: override tunnel target from LLDP for 192.168.x.x --------------------
     - name: Override dev2_host from LLDP when candidate is 192.168.x.x (for tunnel target)
       when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
       delegate_to: localhost
@@ -400,7 +400,7 @@
         dev2_ssh_port: "{{ _local_port }}"
       changed_when: false
 
-    # ============================ SAFETY GUARD (TUNNEL ONLY): VERIFY WE REACHED DEV2 ============================
+    # -------------------- CHANGE 2: safety guard using dev2_mac (only if we actually discovered one) --------------------
     - name: Read remote eth0 MAC via selected connection (guard: ensure this is DEV2)
       when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
       delegate_to: localhost
@@ -426,7 +426,7 @@
         msg: >
           Safety stop: tunnel reached wrong device.
           expected_dev2_mac={{ dev2_mac | trim }},
-          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | trim }}.
+          remote_eth0_mac={{ dev2_eth0_mac_read.stdout | trim }}
       failed_when: (dev2_eth0_mac_read.stdout | trim | lower) != (dev2_mac | trim | lower)
 
     # ============================ DEV2 HOSTNAME GUARD ============================