diff --git a/files/ansible-playbooks/redirect_and_block.yml b/files/ansible-playbooks/redirect_and_block.yml
index 1021c2a..ea5c0f4 100644
--- a/files/ansible-playbooks/redirect_and_block.yml
+++ b/files/ansible-playbooks/redirect_and_block.yml
@@ -1,11 +1,8 @@
-# ptsd-stage-blockscripts.yml — Connectivity only + stage block scripts
-# Scope:
-#   a) Thorough DEV2 connectivity via DEV1 (LLDP first, then tunnel, then fallbacks)
-#   b) Copy startblock.sh and stopblock.sh from controller to DEV2
-#
-# Everything else from ptsd-migrate.yml intentionally removed.
+# redirect_and_block.yml — connectivity + stage block scripts
+# Phase 0: reliable DEV2 connectivity + wrapper build
+# Phase 1: copy startblock.sh and stopblock.sh to /root on DEV2
 
-- name: "PTSD | Stage block scripts | Connectivity + copy only"
+- name: "Redirect and block | Connectivity + stage scripts"
   hosts: all
   gather_facts: no
 
@@ -43,71 +40,55 @@
     ssh_timeout: 30
 
     block_src_dir: "/opt/containers/ansible-worker/app"
-    block_dst_dir: "/root/"
+    block_dst_dir: "/root"
     block_files:
       - "startblock.sh"
       - "stopblock.sh"
 
   tasks:
-    - name: Initialize passfile facts defensively (avoid undefined vars later)
-      delegate_to: localhost
+    # ============================ PHASE 0: LLDP DISCOVERY (IPv4 + IPv6) ============================
+    - name: Compute hostname digits key for LLDP lookup (DEV2)
       ansible.builtin.set_fact:
-        dev2_passfile_used_direct: "NONE"
-        dev2_passfile_used_tunnel: "NONE"
-        dev2_passfile_used_lldp4: "NONE"
-        dev2_passfile_used_lldp6: "NONE"
+        dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
       changed_when: false
 
-    - name: Read DEV1 hostname (busybox-safe)
+    - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort)
       ansible.builtin.raw: >
         {{ pathprefix }}
-        (cat /proc/sys/kernel/hostname 2>/dev/null || echo "")
-      register: dev1_host_read
+        DIGITS="{{ dev2_lldp_digits }}";
+        cat /var/run/lldp_server.json 2>/dev/null \
+          | grep "${DIGITS}" -A 10 \
+          | grep address \
+          | grep -vE 'subtype|ipv6' \
+          | awk -F'"' '{ print $4 }' \
+          | head -n1
+      register: dev2_lldp_ip_raw
       changed_when: false
+      failed_when: false
 
-    - name: Stop early if connected DEV1 hostname != inventory (guard)
-      ansible.builtin.meta: end_host
-      when: (dev1_host_read.stdout | trim | length > 0) and
-            ((dev1_host_read.stdout | trim) != (inventory_hostname | string))
-
-    # ============================ PHASE 0: LLDP FIRST ============================
-
-    - name: Compute DEV2 LLDP digits from inventory hostname (DEV1 side)
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        dev2_lldp_digits: "{{ (inventory_hostname | string | regex_search('([0-9]+)$')) | default('') }}"
-      changed_when: false
-
-    - name: Read LLDP JSON on DEV1 (best-effort)
+    - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
       ansible.builtin.raw: >
         {{ pathprefix }}
-        (cat /var/run/lldp_server.json 2>/dev/null || echo "")
-      register: lldp_json
+        DIGITS="{{ dev2_lldp_digits }}";
+        cat /var/run/lldp_server.json 2>/dev/null \
+          | grep "${DIGITS}" -A 15 \
+          | grep 'address_ipv6' \
+          | awk -F'"' '{ print $4 }' \
+          | head -n1
+      register: dev2_lldp_ip6_raw
+      changed_when: false
+      failed_when: false
+
+    - name: Capture LLDP-derived DEV2 IP facts
+      ansible.builtin.set_fact:
+        lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}"
+        lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
       changed_when: false
 
-    - name: Parse LLDP IPv4 and IPv6 candidates for DEV2 (best-effort)
+    - name: Classify LLDP IPv4 candidate
       delegate_to: localhost
       ansible.builtin.set_fact:
-        lldp_dev2_ip: >-
-          {{
-            (
-              lldp_json.stdout | default('') |
-              regex_search('"name"\\s*:\\s*"dev2-?'+(dev2_lldp_digits|default(''))+'".*?"ip"\\s*:\\s*"([^"]+)"', '\\1')
-            ) | default('')
-          }}
-        lldp_dev2_ip6: >-
-          {{
-            (
-              lldp_json.stdout | default('') |
-              regex_search('"name"\\s*:\\s*"dev2-?'+(dev2_lldp_digits|default(''))+'".*?"ip6"\\s*:\\s*"([^"]+)"', '\\1')
-            ) | default('')
-          }}
-      changed_when: false
-
-    - name: Classify LLDP IPv4 (none, 10, 192_168, other)
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        lldp_ipv4_class: >-
+        lldp_ip_class: >-
           {% set ip = (lldp_dev2_ip | default('')) %}
           {% if ip == '' %}none
           {% elif ip.startswith('10.') %}10
@@ -122,303 +103,420 @@
         msg:
           - "LLDP digits={{ dev2_lldp_digits | default('') }}"
           - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
-          - "LLDP IPv4 class={{ lldp_ipv4_class | default('none') }}"
+          - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
           - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
-      changed_when: false
 
-    # ============================ PHASE 0: DEV2 MAC DISCOVERY VIA DEV1 (FOR TUNNEL SAFETY) ============================
-
-    - name: Find DEV2 MAC via DEV1 bridge fdb (best-effort)
-      ansible.builtin.raw: >
-        {{ pathprefix }}
-        (bridge fdb show br br-lan 2>/dev/null || echo "")
-      register: bridge_fdb
-      changed_when: false
-      failed_when: false
-
-    - name: Parse DEV2 MAC from bridge fdb output (best-effort)
+    # ============================ PHASE 0: PRIMARY PATH DECISION ============================
+    - name: Override dev2_host from LLDP when candidate is 192.168.x.x
+      when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_mac_from_fdb: >-
-          {{
-            (bridge_fdb.stdout | default('') |
-             regex_search('([0-9a-f]{2}(:[0-9a-f]{2}){5})\\s+dev\\s+{{ arping_iface }}', '\\1')) | default('')
-          }}
-      changed_when: false
-
-    - name: Debug DEV2 MAC candidate from DEV1
-      when: debugging | bool
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg:
-          - "DEV2 MAC from fdb={{ dev2_mac_from_fdb | default('<none>') }}"
-      changed_when: false
-
-    # ============================ PHASE 0: CONNECTION METHOD SELECTION (LLDP DIRECT IF 10.X ELSE TUNNEL) ============================
-
-    - name: Prefer LLDP IPv4 if 192.168.x.x as dev2_host override (tunnel path still allowed)
-      when: lldp_ipv4_class | default('none') == "192_168"
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        dev2_host: "{{ lldp_dev2_ip }}"
+        dev2_host: "{{ lldp_dev2_ip | trim }}"
       changed_when: false
 
     - name: Set connection method initial (direct_lldp if 10.x else tunnel)
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_conn_method: "{{ 'direct_lldp' if (lldp_ipv4_class | default('none') == '10') else 'tunnel' }}"
+        dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}"
       changed_when: false
 
-    # ============================ PHASE 0: DIRECT LLDP AUTH (CONTROLLER -> DEV2) ============================
-
-    - name: Try direct LLDP IPv4 auth with basicpass
+    # ============================ PHASE 0: DIRECT LLDP IPv4 AUTH (10.x) ============================
+    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
       when: dev2_conn_method == "direct_lldp"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        sshpass -f basicpass ssh {{ ssh_opts_common }} -p {{ dev2_port }} "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "true"
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f basicpass ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: direct_try_basicpass
+      register: dev2_lldp_try_basicpass
       changed_when: false
-      failed_when: false
+      ignore_errors: true
 
-    - name: Record direct LLDP passfile used basicpass
-      when: dev2_conn_method == "direct_lldp" and direct_try_basicpass.rc == 0
+    - name: Select basicpass for direct LLDP if succeeded
+      when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_passfile_used_direct: "basicpass"
       changed_when: false
 
-    - name: Try direct LLDP IPv4 auth with basicpass2
-      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE"
+    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
+      when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE")
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        sshpass -f basicpass2 ssh {{ ssh_opts_common }} -p {{ dev2_port }} "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "true"
+        HOST="{{ lldp_dev2_ip }}"
+        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: direct_try_basicpass2
+      register: dev2_lldp_try_basicpass2
       changed_when: false
-      failed_when: false
+      ignore_errors: true
 
-    - name: Record direct LLDP passfile used basicpass2
-      when: dev2_conn_method == "direct_lldp" and direct_try_basicpass2.rc == 0
+    - name: Select basicpass2 for direct LLDP if succeeded
+      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_passfile_used_direct: "basicpass2"
       changed_when: false
 
-    # ============================ PHASE 0: TUNNEL SETUP (CONTROLLER -> DEV1 -> DEV2) ============================
-
-    - name: Prepare tunnel temp dir and choose local port
-      when: dev2_conn_method == "tunnel"
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        set -e
-        TMPDIR="$(mktemp -d -t ptsd-tunnel.XXXXXX)"
-        PORT="2222"
-        for p in $(seq 2222 2299); do
-          if ! ss -lnt | awk '{print $4}' | grep -q ":$p$"; then
-            PORT="$p"
-            break
-          fi
-        done
-        echo "$TMPDIR" > "$TMPDIR/tmpdir"
-        echo "$PORT" > "$TMPDIR/port"
-        echo "$TMPDIR"
-      args: { executable: /bin/bash }
-      register: tunnel_tmpdir
-      changed_when: false
-
-    - name: Set tunnel facts
-      when: dev2_conn_method == "tunnel"
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        _tmpdir: "{{ tunnel_tmpdir.stdout | trim }}"
-        _local_port: "{{ (lookup('file', (tunnel_tmpdir.stdout | trim) ~ '/port') | trim) }}"
-        _ctrl_sock: "{{ (tunnel_tmpdir.stdout | trim) ~ '/cm.sock' }}"
-      changed_when: false
-
-    - name: Add temporary IP on DEV1 for DEV2 side (best-effort)
+    # ============================ PHASE 0: TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================
+    - name: Add temporary IP on DEV1 (tolerate 'File exists')
       when: dev2_conn_method == "tunnel"
       ansible.builtin.raw: >
         {{ pathprefix }}
         ip a add {{ dev2_side_ip }} dev {{ dev1_iface }}
       register: add_ip
       changed_when: add_ip.rc == 0
+      failed_when: >
+        add_ip.rc != 0
+        and ('File exists' not in (add_ip.stdout | default('')))
+        and ('File exists' not in (add_ip.stderr | default('')))
+
+    - name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1
+      register: dev2_mac_scan
+      changed_when: false
       failed_when: false
 
+    - name: Capture discovered DEV2 MAC (if any)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.set_fact:
+        dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
+      changed_when: false
+
+    - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true
+      changed_when: false
+      failed_when: false
+
+    - name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists')
+      when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0)
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent
+      register: dev2_arp_add
+      changed_when: dev2_arp_add.rc == 0
+      failed_when: >
+        dev2_arp_add.rc != 0
+        and ('File exists' not in (dev2_arp_add.stdout | default('')))
+        and ('File exists' not in (dev2_arp_add.stderr | default('')))
+
+    - name: Refresh ARP (best-effort)
+      when: dev2_conn_method == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3
+      changed_when: false
+      failed_when: false
+
+    - name: Pick a free local TCP port for the tunnel (controller side)
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        set -e
+        pick() {
+          for i in $(seq 1 25); do
+            p="$(shuf -i 20000-39999 -n 1)"
+            if command -v ss >/dev/null 2>&1; then
+              if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then
+                echo "$p"; return 0
+              fi
+            else
+              if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then
+                echo "$p"; return 0
+              fi
+            fi
+          done
+          return 1
+        }
+        pick
+      args: { executable: /bin/bash }
+      register: pick_port
+      changed_when: false
+
+    - name: Stop if no free local port was found
+      when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
+      ansible.builtin.meta: end_host
+
+    - name: Create control dir for SSH ControlMaster
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: "mktemp -d"
+      args: { executable: /bin/bash }
+      register: mktemp_dir
+      changed_when: false
+
+    - name: Record chosen local port and build ControlMaster socket path
+      when: dev2_conn_method == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        _local_port: "{{ pick_port.stdout | trim }}"
+        _ctrl_dir: "{{ mktemp_dir.stdout | trim }}"
+        _ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl"
+      changed_when: false
+
     - name: Start SSH ControlMaster and forward 127.0.0.1 local_port to DEV2 port 22 via DEV1
       when: dev2_conn_method == "tunnel"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        sshpass -f "{{ dev1_passfiles_used | default('') }}" true
+        USER="{{ dev1_user }}"
+        HOST="{{ ansible_host | default(inventory_hostname) }}"
+        sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \
+          -M -S "{{ _ctrl_sock }}" \
+          -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \
+          "${USER}@${HOST}"
       args: { executable: /bin/bash }
-      changed_when: false
-      failed_when: false
+      register: start_tunnel
+      changed_when: true
 
-    - name: Probe local forwarded port readiness (best-effort)
+    - name: Probe TCP reachability to DEV2 through the tunnel (nc)
       when: dev2_conn_method == "tunnel"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        for i in $(seq 1 30); do
-          (echo >/dev/tcp/127.0.0.1/{{ _local_port }}) >/dev/null 2>&1 && exit 0
-          sleep 1
-        done
-        exit 1
+        nc -z -w5 127.0.0.1 "{{ _local_port }}"
       args: { executable: /bin/bash }
-      register: tunnel_port_ready
+      register: nc_probe
       changed_when: false
-      failed_when: false
+      ignore_errors: true
 
-    - name: Try tunnel auth with basicpass
+    - name: Stop if tunnel TCP probe failed
+      when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
+      ansible.builtin.meta: end_host
+
+    - name: Pick DEV2 password for root (tunnel) try basicpass
       when: dev2_conn_method == "tunnel"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        sshpass -f basicpass ssh {{ ssh_opts_common }} -p {{ _local_port }} "{{ dev2_ssh_user }}@127.0.0.1" "true"
+        PORT="{{ _local_port }}"
+        sshpass -f basicpass ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: tunnel_try_basicpass
+      register: dev2_try_basicpass
       changed_when: false
-      failed_when: false
+      ignore_errors: true
 
-    - name: Record tunnel passfile used basicpass
-      when: dev2_conn_method == "tunnel" and tunnel_try_basicpass.rc == 0
+    - name: Select basicpass if tunnel login succeeded
+      when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_passfile_used_tunnel: "basicpass"
       changed_when: false
 
-    - name: Try tunnel auth with basicpass2
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE"
+    - name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
+      when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE")
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        sshpass -f basicpass2 ssh {{ ssh_opts_common }} -p {{ _local_port }} "{{ dev2_ssh_user }}@127.0.0.1" "true"
+        PORT="{{ _local_port }}"
+        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
+          -o AddressFamily=inet \
+          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: tunnel_try_basicpass2
+      register: dev2_try_basicpass2
       changed_when: false
-      failed_when: false
+      ignore_errors: true
 
-    - name: Record tunnel passfile used basicpass2
-      when: dev2_conn_method == "tunnel" and tunnel_try_basicpass2.rc == 0
+    - name: Select basicpass2 if tunnel login succeeded
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_passfile_used_tunnel: "basicpass2"
       changed_when: false
 
-    - name: Read DEV2 eth0 MAC through tunnel (best-effort)
-      when: dev2_conn_method == "tunnel" and (dev2_mac_from_fdb | default('') | length > 0) and (dev2_passfile_used_tunnel != "NONE")
+    # ============================ PHASE 0: SAFETY GUARD (MAC CHECK) ============================
+    - name: Read remote eth0 MAC via tunnel (guard, sanitized)
+      when:
+        - dev2_conn_method == "tunnel"
+        - (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
+        - (dev2_mac | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.shell: |
-        set -e
-        sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} -p {{ _local_port }} "{{ dev2_ssh_user }}@127.0.0.1" "cat /sys/class/net/eth0/address 2>/dev/null || echo ''"
+        PORT="{{ _local_port }}"
+        sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} \
+          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+          "cat /sys/class/net/eth0/address 2>/dev/null || ip link show eth0 2>/dev/null" 2>&1
       args: { executable: /bin/bash }
-      register: dev2_eth0_mac_through_tunnel
+      register: dev2_eth0_mac_raw
       changed_when: false
       failed_when: false
 
-    - name: Fail if tunnel lands on unexpected DEV2 MAC (safety guard)
-      when: dev2_conn_method == "tunnel" and (dev2_mac_from_fdb | default('') | length > 0) and (dev2_passfile_used_tunnel != "NONE")
+    - name: Normalize remote eth0 MAC (extract last MAC-like token)
+      when:
+        - dev2_conn_method == "tunnel"
+        - (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
+        - (dev2_mac | default('') | length) > 0
       delegate_to: localhost
+      ansible.builtin.set_fact:
+        remote_eth0_mac: >-
+          {{
+            (
+              (dev2_eth0_mac_raw.stdout | default('') | regex_replace('\r','')) ~ "\n" ~
+              (dev2_eth0_mac_raw.stderr | default('') | regex_replace('\r',''))
+            )
+            | regex_findall('([0-9a-fA-F]{2}(?::[0-9a-fA-F]{2}){5})')
+            | last
+            | default('')
+            | lower
+          }}
+      changed_when: false
+
+    - name: Abort if remote eth0 MAC != discovered DEV2 MAC
+      when:
+        - dev2_conn_method == "tunnel"
+        - (dev2_passfile_used_tunnel | default('NONE')) != "NONE"
+        - (dev2_mac | default('') | length) > 0
+        - (remote_eth0_mac | default('') | length) > 0
+        - (remote_eth0_mac | lower) != (dev2_mac | lower)
       ansible.builtin.fail:
-        msg: "Tunnel connected to unexpected DEV2 MAC. Expected={{ dev2_mac_from_fdb }}, Got={{ dev2_eth0_mac_through_tunnel.stdout | trim }}"
-      when: (dev2_eth0_mac_through_tunnel.stdout | trim | lower) != (dev2_mac_from_fdb | trim | lower)
+        msg: >-
+          Safety stop: tunnel reached wrong device.
+          expected_dev2_mac={{ dev2_mac }}, remote_eth0_mac={{ remote_eth0_mac }}
 
-    # ============================ PHASE 0: FALLBACKS IF TUNNEL AUTH FAILED ============================
-
-    - name: Fallback controller direct LLDP IPv4 if tunnel failed and LLDP IPv4 is 10.x
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_ipv4_class | default('none') == "10")
+    # ============================ PHASE 0: FALLBACKS (only if tunnel auth failed) ============================
+    - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used_tunnel == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\\.')
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        for pf in {{ dev2_passfiles | join(' ') }}; do
-          if sshpass -f "$pf" ssh {{ ssh_opts_common }} -p {{ dev2_port }} "{{ dev2_ssh_user }}@{{ lldp_dev2_ip }}" "true" >/dev/null 2>&1; then
-            echo "$pf"
-            exit 0
+        HOST="{{ lldp_dev2_ip }}"
+        for f in {{ dev2_passfiles | join(' ') }}; do
+          if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
+              -o AddressFamily=inet \
+              -o ConnectTimeout=10 \
+              "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
+            echo "$f"; exit 0
           fi
         done
-        echo "NONE"
-        exit 0
+        echo "NONE"; exit 1
       args: { executable: /bin/bash }
-      register: lldp4_pf
-      changed_when: false
-
-    - name: Record LLDP IPv4 fallback passfile
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_ipv4_class | default('none') == "10")
-      delegate_to: localhost
-      ansible.builtin.set_fact:
-        dev2_passfile_used_lldp4: "{{ lldp4_pf.stdout | trim }}"
-      changed_when: false
-
-    - name: Stage passfiles to DEV1 for IPv6 nested fallback (best-effort)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_dev2_ip6 | default('') | length > 0)
-      ansible.builtin.raw: >
-        {{ pathprefix }}
-        (mkdir -p /tmp/ptsd_passfiles && true)
-      register: stage_dir
+      register: dev2_auth_lldp4
       changed_when: false
       failed_when: false
+      ignore_errors: true
 
-    - name: Copy passfiles to DEV1 (best-effort)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_dev2_ip6 | default('') | length > 0)
+    - name: Record LLDP IPv4 fallback decision
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used_tunnel == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\\.')
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}"
+      changed_when: false
+
+    - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used_tunnel == "NONE"
+        - dev2_passfile_used_lldp4 == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
+      ansible.builtin.copy:
+        src: "{{ item }}"
+        dest: "/tmp/{{ item }}"
+        mode: "0600"
+      loop: "{{ dev2_passfiles }}"
+      ignore_errors: true
+
+    - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort)
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used_tunnel == "NONE"
+        - dev2_passfile_used_lldp4 == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
-        for pf in {{ dev2_passfiles | join(' ') }}; do
-          sshpass -f "{{ dev1_pass }}" scp {{ ssh_opts_common }} "$pf" "{{ dev1_user }}@{{ inventory_hostname }}:/tmp/ptsd_passfiles/$pf" >/dev/null 2>&1 || true
+        IP6="{{ lldp_dev2_ip6 }}"
+        for f in {{ dev2_passfiles | join(' ') }}; do
+          if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+              "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
+              "timeout {{ ssh_timeout }}s sshpass -f '/tmp/${f}' ssh \
+                 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
+                 -o PubkeyAuthentication=no \
+                 -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+                 -o ConnectTimeout={{ ssh_timeout }} \
+                 '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' 'echo OK' " \
+              >/dev/null 2>&1; then
+            echo "$f"; exit 0
+          fi
         done
+        echo "NONE"; exit 1
       args: { executable: /bin/bash }
+      register: dev2_auth_lldp6
       changed_when: false
       failed_when: false
+      ignore_errors: true
 
-    - name: Try IPv6 nested fallback via DEV1 to DEV2 (best-effort)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_dev2_ip6 | default('') | length > 0)
-      ansible.builtin.raw: >
-        {{ pathprefix }}
-        (for pf in basicpass basicpass2; do
-           sshpass -f /tmp/ptsd_passfiles/$pf ssh {{ ssh_opts_common }} -6 "{{ dev2_ssh_user }}@{{ lldp_dev2_ip6 }}" "true" >/dev/null 2>&1 && echo $pf && exit 0;
-         done;
-         echo NONE;
-         exit 0)
-      register: lldp6_pf
-      changed_when: false
-      failed_when: false
-
-    - name: Record LLDP IPv6 via DEV1 fallback passfile
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and (lldp_dev2_ip6 | default('') | length > 0)
+    - name: Record LLDP IPv6 fallback decision
+      when:
+        - dev2_conn_method == "tunnel"
+        - dev2_passfile_used_tunnel == "NONE"
+        - dev2_passfile_used_lldp4 == "NONE"
+        - (lldp_dev2_ip6 | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_passfile_used_lldp6: "{{ lldp6_pf.stdout | trim }}"
+        dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}"
       changed_when: false
 
-    # ============================ PHASE 0: FINAL CONNECTION MODE + WRAPPER BUILD ============================
-
-    - name: Decide final connection mode
+    # ============================ PHASE 0: FINAL DECISION + WRAPPER FACTS ============================
+    - name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6)
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_conn_final: >-
-          {% if dev2_conn_method == 'direct_lldp' and dev2_passfile_used_direct != 'NONE' %}
-          direct_lldp
-          {% elif dev2_conn_method == 'tunnel' and dev2_passfile_used_tunnel != 'NONE' %}
-          tunnel
-          {% elif dev2_passfile_used_lldp4 != 'NONE' %}
-          lldp4_fallback
-          {% elif dev2_passfile_used_lldp6 != 'NONE' %}
-          lldp6_via_dev1
-          {% else %}
-          none
-          {% endif %}
+          {%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%}
+            direct_lldp
+          {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%}
+            tunnel
+          {%- elif (dev2_passfile_used_lldp4 | default('NONE')) != 'NONE' -%}
+            lldp4_fallback
+          {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%}
+            lldp6_via_dev1
+          {%- else -%}
+            none
+          {%- endif -%}
       changed_when: false
 
-    - name: Fail if no connectivity method succeeded
-      delegate_to: localhost
-      ansible.builtin.fail:
-        msg: "No DEV2 connectivity method succeeded (direct_lldp/tunnel/lldp4/lldp6)."
+    - name: Abort if all DEV2 connection methods failed
       when: dev2_conn_final == "none"
+      ansible.builtin.fail:
+        msg: >
+          DEV2 unreachable: tunnel auth={{ dev2_passfile_used_tunnel | default('n/a') }},
+          direct auth={{ dev2_passfile_used_direct | default('n/a') }},
+          lldp4 auth={{ dev2_passfile_used_lldp4 | default('n/a') }},
+          lldp6 auth={{ dev2_passfile_used_lldp6 | default('n/a') }}.
 
-    - name: Build DEV2 wrapper command (controller-side) for staged commands
+    - name: Debug final connectivity decision
+      when: debugging | bool
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg:
+          - "dev2_conn_final={{ dev2_conn_final }}"
+          - "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}"
+          - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}"
+          - "lldp4 passfile={{ dev2_passfile_used_lldp4 | default('n/a') }}"
+          - "lldp6 passfile={{ dev2_passfile_used_lldp6 | default('n/a') }}"
+          - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('na') }})"
+          - "lldp ipv4={{ lldp_dev2_ip | default('') }}"
+          - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"
+
+    - name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_exec_cmd: |
@@ -433,23 +531,39 @@
             tunnel)
               PORT="{{ _local_port | default('') }}"
               PASS="{{ dev2_passfile_used_tunnel }}"
-              sshpass -f "$PASS" ssh {{ ssh_opts_common }} -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" '{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
               ;;
             direct_lldp)
               HOST="{{ lldp_dev2_ip }}"
               PASS="{{ dev2_passfile_used_direct }}"
-              sshpass -f "$PASS" ssh {{ ssh_opts_common }} -p "{{ dev2_port }}" "{{ dev2_ssh_user }}@${HOST}" '{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                "{{ dev2_ssh_user }}@${HOST}" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
               ;;
             lldp4_fallback)
               HOST="{{ lldp_dev2_ip }}"
               PASS="{{ dev2_passfile_used_lldp4 }}"
-              sshpass -f "$PASS" ssh {{ ssh_opts_common }} -p "{{ dev2_port }}" "{{ dev2_ssh_user }}@${HOST}" '{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                "{{ dev2_ssh_user }}@${HOST}" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
               ;;
             lldp6_via_dev1)
-              HOST6="{{ lldp_dev2_ip6 }}"
-              PASS="{{ dev2_passfile_used_lldp6 }}"
-              sshpass -f "{{ dev1_pass }}" ssh {{ ssh_opts_common }} "{{ dev1_user }}@{{ inventory_hostname }}" \
-                "sshpass -f /tmp/ptsd_passfiles/${PASS} ssh {{ ssh_opts_common }} -6 {{ dev2_ssh_user }}@${HOST6} '{{ pathprefix }} '"${DEV2_CMD}" 2>&1'"
+              IP6="{{ lldp_dev2_ip6 }}"
+              F="{{ dev2_passfile_used_lldp6 }}"
+              sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
+                "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
+                "sshpass -f '/tmp/${F}' ssh \
+                   -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR \
+                   -o PubkeyAuthentication=no \
+                   -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+                   -o ConnectTimeout={{ ssh_timeout }} \
+                   '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+                   '{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
               ;;
             *)
               echo "ERROR: unknown MODE=$MODE" >&2
@@ -458,9 +572,8 @@
           esac
       changed_when: false
 
-    # ============================ COPY BLOCK SCRIPTS TO DEV2 ============================
 
-    - name: Ensure staging dir on DEV2 (via wrapper)
+    - name: Ensure destination directory on DEV2 (via wrapper)
       delegate_to: localhost
       ansible.builtin.shell: |
         export DEV2_CMD='mkdir -p "{{ block_dst_dir }}"'
@@ -480,10 +593,11 @@
           HOST="{{ lldp_dev2_ip }}"
           PASSFILE="{{ dev2_passfile_used_lldp4 }}"
         fi
-
         sshpass -f "$PASSFILE" scp {{ ssh_opts_common }} -P "{{ dev2_port }}" \
           "{{ block_src_dir }}/{{ item }}" \
           "{{ dev2_ssh_user }}@${HOST}:{{ block_dst_dir }}/{{ item }}"
+        sshpass -f "$PASSFILE" ssh {{ ssh_opts_common }} -p "{{ dev2_port }}" \
+          "{{ dev2_ssh_user }}@${HOST}" "chmod 0755 {{ block_dst_dir }}/{{ item }}"
       args: { executable: /bin/bash }
       loop: "{{ block_files }}"
       changed_when: true
@@ -500,7 +614,7 @@
       loop: "{{ block_files }}"
       changed_when: true
 
-    - name: Stage DEV2 passfile on DEV1 (for DEV1 to DEV2 scp)
+    - name: Stage DEV2 passfile on DEV1 for DEV1 to DEV2 scp
       when: dev2_conn_final in ["tunnel", "lldp6_via_dev1"]
       delegate_to: localhost
       ansible.builtin.shell: |
@@ -512,21 +626,35 @@
       args: { executable: /bin/bash }
       changed_when: true
 
-    - name: Copy block scripts DEV1 to DEV2 (tunnel or LLDP6 via DEV1)
-      when: dev2_conn_final in ["tunnel", "lldp6_via_dev1"]
+    - name: Copy block scripts DEV1 to DEV2 (tunnel)
+      when: dev2_conn_final == "tunnel"
       ansible.builtin.raw: >
         {{ pathprefix }}
-        (HOST="{{ dev2_host }}";
-         PASSFILE="/tmp/ptsd_passfile_dev2";
+        (PASSFILE="/tmp/ptsd_passfile_dev2";
          for f in {{ block_files | join(' ') }}; do
-           sshpass -f "$PASSFILE" scp {{ ssh_opts_common }} -P {{ dev2_port }} "/tmp/$f" "{{ dev2_ssh_user }}@${HOST}:{{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
-           sshpass -f "$PASSFILE" ssh {{ ssh_opts_common }} -p {{ dev2_port }} "{{ dev2_ssh_user }}@${HOST}" "chmod 0755 {{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
+           sshpass -f "$PASSFILE" scp {{ ssh_opts_common }} -P {{ dev2_port }} "/tmp/$f" "{{ dev2_ssh_user }}@{{ dev2_host }}:{{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
+           sshpass -f "$PASSFILE" ssh {{ ssh_opts_common }} -p {{ dev2_port }} "{{ dev2_ssh_user }}@{{ dev2_host }}" "chmod 0755 {{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
          done;
          exit 0)
       register: dev1_to_dev2_copy
       changed_when: true
       failed_when: dev1_to_dev2_copy.rc != 0
 
+    - name: Copy block scripts DEV1 to DEV2 (LLDP6 via DEV1)
+      when: dev2_conn_final == "lldp6_via_dev1"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        (PASSFILE="/tmp/ptsd_passfile_dev2";
+         HOST6="{{ lldp_dev2_ip6 }}";
+         for f in {{ block_files | join(' ') }}; do
+           sshpass -f "$PASSFILE" scp {{ ssh_opts_common }} -6 -P {{ dev2_port }} "/tmp/$f" "{{ dev2_ssh_user }}@${HOST6}:{{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
+           sshpass -f "$PASSFILE" ssh {{ ssh_opts_common }} -6 -p {{ dev2_port }} "{{ dev2_ssh_user }}@${HOST6}" "chmod 0755 {{ block_dst_dir }}/$f" >/dev/null 2>&1 || exit 1;
+         done;
+         exit 0)
+      register: dev1_to_dev2_copy6
+      changed_when: true
+      failed_when: dev1_to_dev2_copy6.rc != 0
+
   post_tasks:
     - name: Cleanup note
       delegate_to: localhost
@@ -543,20 +671,19 @@
       changed_when: false
       ignore_errors: true
 
-    - name: Remove tunnel temp dir (best-effort)
+    - name: Remove tunnel control dir (best-effort)
       when: dev2_conn_method | default('') == "tunnel"
       delegate_to: localhost
-      ansible.builtin.shell: |
-        rm -rf "{{ _tmpdir | default('') }}" 2>/dev/null || true
-      args: { executable: /bin/bash }
-      changed_when: false
+      ansible.builtin.file:
+        path: "{{ _ctrl_dir | default('/tmp/none') }}"
+        state: absent
       ignore_errors: true
 
-    - name: Remove staged passfiles on DEV1 (best-effort)
+    - name: Remove staged passfiles from DEV1 (best-effort)
       when: dev2_conn_method | default('') == "tunnel"
       ansible.builtin.raw: >
         {{ pathprefix }}
-        (rm -rf /tmp/ptsd_passfiles 2>/dev/null || true)
+        rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
       changed_when: false
       failed_when: false