diff --git a/files/ansible-playbooks/ptsd-migrate.yml b/files/ansible-playbooks/ptsd-migrate.yml
index 03ea512..61b5a60 100644
--- a/files/ansible-playbooks/ptsd-migrate.yml
+++ b/files/ansible-playbooks/ptsd-migrate.yml
@@ -1,37 +1,36 @@
-# ptsd-migration.yml — PPPoE to super DHCP (phase 0: connectivity prove-out)
-# Focus: reliable connectivity to DEV2
-# Paths:
-#   A) direct LLDP IPv4 (10.x) if available and auth works
-#   B) tunnel via DEV1 (default)
-#   C) LLDP IPv4 (10.x) fallback if tunnel auth fails
-#   D) LLDP IPv6 fallback via DEV1 (nested ssh to [ip6%iface]) if all else fails
-# After connection: run "uptime" on DEV2 and print it.
+# ptsd-migration.yml — PPPoE to super DHCP | Phase 0 connectivity + Phase 1 commands (initially uptime)
 
-- name: PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity + uptime
+- name: "PPPoE to super DHCP | Phase 0 | Prove reliable DEV2 connectivity (no device commands)"
   hosts: all
   gather_facts: no
 
   vars:
+    # Busybox-safe PATH prefix for all remote raw calls on DEV1 / DEV2
     pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "
 
     # DEV1 credentials
     dev1_user: "root"
     dev1_pass: "wavewave"
 
-    # DEV2 default behind DEV1
+    # DEV2 behind DEV1 (default tunnel target; may be overridden by LLDP 192.168.*)
     dev2_host: "192.168.1.1"
     dev2_port: 22
 
     # Temp IP we add to DEV1 so it can reach DEV2
     dev2_side_ip: "192.168.1.11/24"
     dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
-    dev1_iface: "br-wan"     # also used as IPv6 scope-id
+    dev1_iface: "br-wan"
+
+    # ARP refresh interface (as in sot-updater)
     arping_iface: "eth0"
 
-    # DEV2 credentials
+    # DEV2 login candidates
     dev2_ssh_user: "root"
-    dev2_passfiles: [ "basicpass", "basicpass2" ]
+    dev2_passfiles:
+      - "basicpass"
+      - "basicpass2"
 
+    # SSH options used from controller
     ssh_opts_common: >-
       -o PreferredAuthentications=password
       -o PubkeyAuthentication=no
@@ -40,13 +39,11 @@
       -o NumberOfPasswordPrompts=1
       -o ConnectTimeout=30
 
+    # Debugging toggle
     debugging: true
 
-    # Connection state
-    dev2_conn_method: ""
-    dev2_passfile_used: "NONE"         # tunnel or direct_lldp primary
-    dev2_passfile_used_lldp: "NONE"    # LLDP IPv4 fallback
-    dev2_passfile_used_lldp6: "NONE"   # LLDP IPv6 via DEV1 fallback
+    # ssh timeout for nested / probes
+    ssh_timeout: 30
 
   pre_tasks:
     - name: Read DEV1 hostname (busybox-safe)
@@ -62,7 +59,7 @@
             ((dev1_host_read.stdout | trim) != (inventory_hostname | string))
 
   tasks:
-    # ============================ LLDP DISCOVERY (DEV1) ============================
+    # ============================ LLDP DISCOVERY (IPv4 + IPv6) ============================
     - name: Compute hostname digits key for LLDP lookup (DEV2)
       ansible.builtin.set_fact:
         dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
@@ -72,12 +69,12 @@
       ansible.builtin.raw: >
         {{ pathprefix }}
         DIGITS="{{ dev2_lldp_digits }}";
-        cat /var/run/lldp_server.json 2>/dev/null
-        | grep "${DIGITS}" -A 15
-        | grep address
-        | grep -vE 'subtype|ipv6'
-        | awk -F'"' '{ print $4 }'
-        | head -n1
+        cat /var/run/lldp_server.json 2>/dev/null \
+          | grep "${DIGITS}" -A 10 \
+          | grep address \
+          | grep -vE 'subtype|ipv6' \
+          | awk -F'"' '{ print $4 }' \
+          | head -n1
       register: dev2_lldp_ip_raw
       changed_when: false
       failed_when: false
@@ -86,11 +83,11 @@
       ansible.builtin.raw: >
         {{ pathprefix }}
         DIGITS="{{ dev2_lldp_digits }}";
-        cat /var/run/lldp_server.json 2>/dev/null
-        | grep "${DIGITS}" -A 15
-        | grep 'address_ipv6'
-        | awk -F'"' '{ print $4 }'
-        | head -n1
+        cat /var/run/lldp_server.json 2>/dev/null \
+          | grep "${DIGITS}" -A 15 \
+          | grep 'address_ipv6' \
+          | awk -F'"' '{ print $4 }' \
+          | head -n1
       register: dev2_lldp_ip6_raw
       changed_when: false
       failed_when: false
@@ -117,11 +114,13 @@
       delegate_to: localhost
       ansible.builtin.debug:
         msg:
-          - "LLDP digits={{ dev2_lldp_digits }}"
+          - "LLDP digits={{ dev2_lldp_digits | default('') }}"
           - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
           - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
           - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"
 
+    # ============================ PRIMARY PATH DECISION (same as indoor-restart-cloudagent) ============================
+    # If LLDP gives 192.168.* we use it as dev2_host for the tunnel target
     - name: Override dev2_host from LLDP when candidate is 192.168.x.x
       when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
       delegate_to: localhost
@@ -129,69 +128,66 @@
         dev2_host: "{{ lldp_dev2_ip | trim }}"
       changed_when: false
 
-    # ============================ PATH A: DIRECT LLDP IPv4 (10.x) PRIMARY ============================
+    # Direct LLDP only if 10.x
+    - name: Set connection method initial (direct_lldp if 10.x else tunnel)
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}"
+      changed_when: false
+
+    # ============================ DIRECT LLDP IPv4 AUTH (10.x) ============================
     - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
-      when: (lldp_ip_class | trim) == "10"
+      when: dev2_conn_method == "direct_lldp"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         HOST="{{ lldp_dev2_ip }}"
-        sshpass -f basicpass ssh \
+        sshpass -f basicpass ssh {{ ssh_opts_common }} \
           -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
+          -o ConnectionAttempts=1 \
           "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: direct_lldp_try_basicpass
+      register: dev2_lldp_try_basicpass
       changed_when: false
       ignore_errors: true
 
     - name: Select basicpass for direct LLDP if succeeded
-      when: (lldp_ip_class | trim) == "10" and direct_lldp_try_basicpass.rc == 0
+      when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_conn_method: "direct_lldp"
-        dev2_passfile_used: "basicpass"
-        dev2_ssh_host: "{{ lldp_dev2_ip }}"
-        dev2_ssh_port: 22
+        dev2_passfile_used_direct: "basicpass"
       changed_when: false
 
     - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
-      when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp"
+      when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct is not defined)
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         HOST="{{ lldp_dev2_ip }}"
-        sshpass -f basicpass2 ssh \
+        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
           -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
+          -o ConnectionAttempts=1 \
           "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
-      register: direct_lldp_try_basicpass2
+      register: dev2_lldp_try_basicpass2
       changed_when: false
       ignore_errors: true
 
     - name: Select basicpass2 for direct LLDP if succeeded
-      when: (lldp_ip_class | trim) == "10" and dev2_conn_method != "direct_lldp" and direct_lldp_try_basicpass2.rc == 0
+      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined and dev2_lldp_try_basicpass2.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_conn_method: "direct_lldp"
-        dev2_passfile_used: "basicpass2"
-        dev2_ssh_host: "{{ lldp_dev2_ip }}"
-        dev2_ssh_port: 22
+        dev2_passfile_used_direct: "basicpass2"
       changed_when: false
 
-    # ============================ PATH B: TUNNEL VIA DEV1 (DEFAULT) ============================
-    - name: Set connection method to tunnel if not already direct LLDP
-      when: dev2_conn_method != "direct_lldp"
+    - name: Mark direct LLDP auth as NONE if both failed
+      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct is not defined
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_conn_method: "tunnel"
+        dev2_passfile_used_direct: "NONE"
       changed_when: false
 
+    # ============================ TUNNEL PREP (DEV1 temp IP + ARP + tunnel) ============================
     - name: Add temporary IP on DEV1 (tolerate 'File exists')
       when: dev2_conn_method == "tunnel"
       ansible.builtin.raw: >
@@ -216,7 +212,7 @@
     - name: Capture discovered DEV2 MAC (if any)
       when: dev2_conn_method == "tunnel"
       ansible.builtin.set_fact:
-        dev2_mac: "{{ (dev2_mac_scan.stdout | default('')) | trim }}"
+        dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
       changed_when: false
 
     - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
@@ -243,7 +239,7 @@
       when: dev2_conn_method == "tunnel"
       ansible.builtin.raw: >
         {{ pathprefix }}
-        arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 2 2>/dev/null || true
+        arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3
       changed_when: false
       failed_when: false
 
@@ -276,12 +272,12 @@
       when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
       ansible.builtin.meta: end_host
 
-    # ---- FIX: create ctrl dir first, then derive sock ----
     - name: Create control dir for SSH ControlMaster
       when: dev2_conn_method == "tunnel"
       delegate_to: localhost
-      ansible.builtin.set_fact:
-        _ctrl_dir: "{{ lookup('ansible.builtin.pipe', 'mktemp -d') }}"
+      ansible.builtin.shell: "mktemp -d"
+      args: { executable: /bin/bash }
+      register: mktemp_dir
       changed_when: false
 
     - name: Record chosen local port and build ControlMaster socket path
@@ -289,7 +285,8 @@
       delegate_to: localhost
       ansible.builtin.set_fact:
         _local_port: "{{ pick_port.stdout | trim }}"
-        _ctrl_sock: "{{ _ctrl_dir }}/ssh_tunnel_ctl"
+        _ctrl_dir: "{{ mktemp_dir.stdout | trim }}"
+        _ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl"
       changed_when: false
 
     - name: Start SSH ControlMaster and forward 127.0.0.1:local_port → DEV2:22 via DEV1
@@ -322,18 +319,16 @@
       when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
       ansible.builtin.meta: end_host
 
-    - name: Try DEV2 login through tunnel with basicpass
+    - name: Pick DEV2 password for root (tunnel) try basicpass
       when: dev2_conn_method == "tunnel"
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         PORT="{{ _local_port }}"
-        sshpass -f basicpass ssh \
+        sshpass -f basicpass ssh {{ ssh_opts_common }} \
           -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
-          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
+          -o ConnectionAttempts=1 \
+          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
       register: dev2_try_basicpass
       changed_when: false
@@ -343,106 +338,105 @@
       when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_passfile_used: "basicpass"
-        dev2_ssh_host: "127.0.0.1"
-        dev2_ssh_port: "{{ _local_port }}"
+        dev2_passfile_used_tunnel: "basicpass"
       changed_when: false
 
     - name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE"
+      when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel is not defined)
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         PORT="{{ _local_port }}"
-        sshpass -f basicpass2 ssh \
+        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
           -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
-          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" echo OK >/dev/null 2>&1
+          -o ConnectionAttempts=1 \
+          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
       args: { executable: /bin/bash }
       register: dev2_try_basicpass2
       changed_when: false
       ignore_errors: true
 
     - name: Select basicpass2 if tunnel login succeeded
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used == "NONE" and dev2_try_basicpass2.rc == 0
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined and dev2_try_basicpass2.rc == 0
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_passfile_used: "basicpass2"
-        dev2_ssh_host: "127.0.0.1"
-        dev2_ssh_port: "{{ _local_port }}"
+        dev2_passfile_used_tunnel: "basicpass2"
       changed_when: false
 
+    - name: Mark tunnel auth as NONE if both attempts failed
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel is not defined
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_passfile_used_tunnel: "NONE"
+      changed_when: false
+
+    # Safety guard (only if we discovered MAC)
     - name: Read remote eth0 MAC via tunnel (guard)
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0)
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel != "NONE" and (dev2_mac | default('') | trim | length > 0)
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         PORT="{{ _local_port }}"
-        sshpass -f "{{ dev2_passfile_used }}" ssh \
+        sshpass -f "{{ dev2_passfile_used_tunnel }}" ssh {{ ssh_opts_common }} \
           -o AddressFamily=inet \
-          -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-          -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-          -o ConnectTimeout=30 \
+          -o ConnectionAttempts=1 \
           -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
-          "cat /sys/class/net/eth0/address 2>/dev/null || echo"
+          "cat /sys/class/net/eth0/address 2>/dev/null || echo" 2>&1
       args: { executable: /bin/bash }
       register: dev2_eth0_mac_read
       changed_when: false
       failed_when: false
 
     - name: Abort if remote eth0 MAC != discovered DEV2 MAC
-      when: dev2_conn_method == "tunnel" and dev2_passfile_used != "NONE" and (dev2_mac | default('') | trim | length > 0) and
-            ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
+      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel != "NONE" and (dev2_mac | default('') | trim | length > 0) and ((dev2_eth0_mac_read.stdout | default('') | trim | lower) != (dev2_mac | trim | lower))
       ansible.builtin.fail:
         msg: >
           Safety stop: tunnel reached wrong device.
           expected_dev2_mac={{ dev2_mac | trim }},
           remote_eth0_mac={{ dev2_eth0_mac_read.stdout | default('') | trim }}.
 
-    # ============================ FALLBACK C: DIRECT LLDP IPv4 (10.x) ============================
+    # ============================ FALLBACKS (only if tunnel/direct failed) ============================
+    # LLDP IPv4 fallback is only for 10.x in sot-updater; keep that behavior:
     - name: Try DEV2 login via LLDP IPv4 10.x (fallback if tunnel auth failed)
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used == "NONE"
-        - (lldp_dev2_ip | default('')) is match('^10\.')
+        - dev2_passfile_used_tunnel == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\\.')
       delegate_to: localhost
       ansible.builtin.shell: |
         set -e
         HOST="{{ lldp_dev2_ip }}"
-        for f in basicpass basicpass2; do
-          if sshpass -f "$f" ssh \
+        for f in {{ dev2_passfiles | join(' ') }}; do
+          if timeout 20s sshpass -f "$f" ssh {{ ssh_opts_common }} \
               -o AddressFamily=inet \
-              -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-              -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-              -o ConnectTimeout=20 \
+              -o ConnectionAttempts=1 -o ConnectTimeout=10 \
               "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1; then
             echo "$f"; exit 0
           fi
         done
-        exit 1
+        echo "NONE"; exit 1
       args: { executable: /bin/bash }
-      register: dev2_auth_lldp
+      register: dev2_auth_lldp4
       changed_when: false
+      failed_when: false
       ignore_errors: true
 
     - name: Record LLDP IPv4 fallback decision
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used == "NONE"
-        - (lldp_dev2_ip | default('')) is match('^10\.')
+        - dev2_passfile_used_tunnel == "NONE"
+        - (lldp_dev2_ip | default('')) is match('^10\\.')
       delegate_to: localhost
       ansible.builtin.set_fact:
-        dev2_passfile_used_lldp: "{{ (dev2_auth_lldp.rc == 0) | ternary((dev2_auth_lldp.stdout | trim), 'NONE') }}"
+        dev2_passfile_used_lldp4: "{{ (dev2_auth_lldp4.rc == 0) | ternary((dev2_auth_lldp4.stdout | trim), 'NONE') }}"
       changed_when: false
 
-    # ============================ FALLBACK D: IPv6 LLDP VIA DEV1 (LAST RESORT) ============================
+    # LLDP IPv6 nested fallback (last resort): only if tunnel and lldp4 failed
     - name: Copy DEV2 passfiles to DEV1 for IPv6 nested SSH (last resort)
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used == "NONE"
-        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - dev2_passfile_used_tunnel == "NONE"
+        - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
         - (lldp_dev2_ip6 | default('') | length) > 0
       ansible.builtin.copy:
         src: "{{ item }}"
@@ -454,8 +448,8 @@
     - name: Try DEV2 login via LLDP IPv6 (nested SSH through DEV1; last resort)
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used == "NONE"
-        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - dev2_passfile_used_tunnel == "NONE"
+        - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
         - (lldp_dev2_ip6 | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.shell: |
@@ -463,44 +457,45 @@
         IP6="{{ lldp_dev2_ip6 }}"
         for f in {{ dev2_passfiles | join(' ') }}; do
           if sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
+              -o ConnectionAttempts=1 \
               "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
-              "timeout 30s sshpass -f '/tmp/${f}' ssh \
+              "timeout {{ ssh_timeout }}s sshpass -f '/tmp/${f}' ssh \
                  -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
                  -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-                 -o ConnectTimeout=30 \
-                 '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
-                 'echo OK'" \
+                 -o ConnectTimeout={{ ssh_timeout }} \
+                 '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' 'echo OK' " \
               >/dev/null 2>&1; then
             echo "$f"; exit 0
           fi
         done
-        exit 1
+        echo "NONE"; exit 1
       args: { executable: /bin/bash }
       register: dev2_auth_lldp6
       changed_when: false
+      failed_when: false
       ignore_errors: true
 
     - name: Record LLDP IPv6 fallback decision
       when:
         - dev2_conn_method == "tunnel"
-        - dev2_passfile_used == "NONE"
-        - (dev2_passfile_used_lldp | default('NONE')) == "NONE"
+        - dev2_passfile_used_tunnel == "NONE"
+        - (dev2_passfile_used_lldp4 is not defined or dev2_passfile_used_lldp4 == "NONE")
         - (lldp_dev2_ip6 | default('') | length) > 0
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_passfile_used_lldp6: "{{ (dev2_auth_lldp6.rc == 0) | ternary((dev2_auth_lldp6.stdout | trim), 'NONE') }}"
       changed_when: false
 
-    # ============================ FINAL CONNECTION RESOLUTION ============================
+    # ============================ FINAL DECISION + WRAPPER FACTS ============================
     - name: Decide final DEV2 connection mode (direct_lldp > tunnel > lldp4 > lldp6)
       delegate_to: localhost
       ansible.builtin.set_fact:
         dev2_conn_final: >-
-          {%- if (dev2_conn_method == 'direct_lldp') and (dev2_passfile_used != 'NONE') -%}
+          {%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%}
             direct_lldp
-          {%- elif (dev2_conn_method == 'tunnel') and (dev2_passfile_used != 'NONE') -%}
+          {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%}
             tunnel
-          {%- elif (dev2_passfile_used_lldp | default('NONE')) != 'NONE' -%}
+          {%- elif (dev2_passfile_used_lldp4 | default('NONE')) != 'NONE' -%}
             lldp4_fallback
           {%- elif (dev2_passfile_used_lldp6 | default('NONE')) != 'NONE' -%}
             lldp6_via_dev1
@@ -513,8 +508,10 @@
       when: dev2_conn_final == "none"
       ansible.builtin.fail:
         msg: >
-          DEV2 unreachable: tunnel auth failed, LLDP IPv4 fallback failed, and LLDP IPv6 fallback failed.
-          lldp_ipv4='{{ lldp_dev2_ip | default('') }}', lldp_ipv6='{{ lldp_dev2_ip6 | default('') }}'.
+          DEV2 unreachable: tunnel auth={{ dev2_passfile_used_tunnel | default('n/a') }},
+          direct auth={{ dev2_passfile_used_direct | default('n/a') }},
+          lldp4 auth={{ dev2_passfile_used_lldp4 | default('n/a') }},
+          lldp6 auth={{ dev2_passfile_used_lldp6 | default('n/a') }}.
 
     - name: Debug final connectivity decision
       when: debugging | bool
@@ -522,135 +519,140 @@
       ansible.builtin.debug:
         msg:
           - "dev2_conn_final={{ dev2_conn_final }}"
-          - "tunnel passfile={{ dev2_passfile_used }}"
-          - "lldp4 passfile={{ dev2_passfile_used_lldp }}"
-          - "lldp6 passfile={{ dev2_passfile_used_lldp6 }}"
-          - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('n/a') }})"
-          - "lldp ipv4={{ lldp_dev2_ip | default('<none>') }}"
-          - "lldp ipv6={{ lldp_dev2_ip6 | default('<none>') }}"
+          - "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}"
+          - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}"
+          - "lldp4 passfile={{ dev2_passfile_used_lldp4 | default('n/a') }}"
+          - "lldp6 passfile={{ dev2_passfile_used_lldp6 | default('n/a') }}"
+          - "tunnel target={{ dev2_host }}:{{ dev2_port }} (forwarded to 127.0.0.1:{{ _local_port | default('na') }})"
+          - "lldp ipv4={{ lldp_dev2_ip | default('') }}"
+          - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"
 
-    # ============================ PHASE 0 ACTION: DEV2 UPTIME ============================
-    - name: DEV2 | uptime (tunnel)
-      when: dev2_conn_final == "tunnel"
+    # ---- Wrapper: produce a single executable snippet in dev2_exec_cmd ----
+    - name: Build DEV2 exec wrapper (controller-side) for Phase 1 commands
+      delegate_to: localhost
+      ansible.builtin.set_fact:
+        dev2_exec_cmd: |
+          set -e
+          MODE="{{ dev2_conn_final }}"
+          # DEV2_CMD is injected by Phase 1 tasks
+          if [ -z "${DEV2_CMD:-}" ]; then
+            echo "ERROR: DEV2_CMD is empty" >&2
+            exit 2
+          fi
+
+          case "$MODE" in
+            tunnel)
+              PORT="{{ _local_port }}"
+              PASS="{{ dev2_passfile_used_tunnel }}"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                -o ConnectionAttempts=1 \
+                -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
+              ;;
+            direct_lldp)
+              HOST="{{ lldp_dev2_ip }}"
+              PASS="{{ dev2_passfile_used_direct }}"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                -o ConnectionAttempts=1 \
+                "{{ dev2_ssh_user }}@${HOST}" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
+              ;;
+            lldp4_fallback)
+              HOST="{{ lldp_dev2_ip }}"
+              PASS="{{ dev2_passfile_used_lldp4 }}"
+              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
+                -o AddressFamily=inet \
+                -o ConnectionAttempts=1 \
+                "{{ dev2_ssh_user }}@${HOST}" \
+                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
+              ;;
+            lldp6_via_dev1)
+              IP6="{{ lldp_dev2_ip6 }}"
+              F="{{ dev2_passfile_used_lldp6 }}"
+              sshpass -p "{{ dev1_pass }}" ssh {{ ssh_opts_common }} \
+                -o ConnectionAttempts=1 \
+                "{{ dev1_user }}@{{ ansible_host | default(inventory_hostname) }}" \
+                "sshpass -f '/tmp/${F}' ssh \
+                   -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
+                   -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
+                   -o ConnectTimeout={{ ssh_timeout }} \
+                   '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
+                   '{{ pathprefix }} '"${DEV2_CMD}" 2>&1"
+              ;;
+            *)
+              echo "ERROR: unknown MODE=$MODE" >&2
+              exit 3
+              ;;
+          esac
+      changed_when: false
+
+
+- name: "PPPoE to super DHCP | Phase 1 | On-device actions (initially uptime)"
+  hosts: all
+  gather_facts: no
+
+  tasks:
+    # NOTE: Phase 1 assumes Phase 0 facts are still available in-play execution.
+    # If your runner executes plays independently, merge into one play.
+    - name: DEV2 | exec wrapper run (Phase 1)
       delegate_to: localhost
       ansible.builtin.shell: |
-        PORT="{{ _local_port }}"
-        sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
-          -o AddressFamily=inet \
-          -o ConnectionAttempts=1 \
-          -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
-          "{{ pathprefix }} uptime 2>&1 || true"
+        export DEV2_CMD="uptime"
+        {{ dev2_exec_cmd }}
       args: { executable: /bin/bash }
-      register: dev2_uptime
+      register: dev2_exec
       changed_when: false
       failed_when: false
 
-    - name: DEV2 | uptime debug (tunnel)
-      when: dev2_conn_final == "tunnel"
-      delegate_to: localhost
-      ansible.builtin.debug:
-        msg:
-          - "uptime.rc={{ dev2_uptime.rc | default('n/a') }}"
-          - "uptime.stdout='{{ dev2_uptime.stdout | default('') | regex_replace('\r','') }}'"
-          - "uptime.stderr='{{ dev2_uptime.stderr | default('') | regex_replace('\r','') }}'"
-
-
-    - name: DEV2 | uptime (direct LLDP IPv4 primary)
-      when: dev2_conn_final == "direct_lldp"
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        HOST="{{ lldp_dev2_ip }}"
-        sshpass -f "{{ dev2_passfile_used }}" ssh {{ ssh_opts_common }} \
-          -o AddressFamily=inet \
-          -o ConnectionAttempts=1 \
-          "{{ dev2_ssh_user }}@${HOST}" \
-          "{{ pathprefix }} uptime 2>&1 || true"
-      args: { executable: /bin/bash }
-      register: dev2_uptime
-      changed_when: false
-      failed_when: false
-
-    - name: DEV2 | uptime (LLDP IPv4 fallback)
-      when: dev2_conn_final == "lldp4_fallback"
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        HOST="{{ lldp_dev2_ip }}"
-        sshpass -f "{{ dev2_passfile_used_lldp }}" ssh {{ ssh_opts_common }} \
-          -o AddressFamily=inet \
-          -o ConnectionAttempts=1 \
-          "{{ dev2_ssh_user }}@${HOST}" \
-          "{{ pathprefix }} uptime 2>&1 || true"
-      args: { executable: /bin/bash }
-      register: dev2_uptime
-      changed_when: false
-      failed_when: false
-
-    - name: DEV2 | uptime (LLDP IPv6 via DEV1 nested)
-      when: dev2_conn_final == "lldp6_via_dev1"
-      delegate_to: localhost
-      ansible.builtin.shell: |
-        IP6="{{ lldp_dev2_ip6 }}"
-        F="{{ dev2_passfile_used_lldp6 }}"
-        sshpass -p '{{ dev1_pass }}' ssh {{ ssh_opts_common }} \
-          -o ConnectionAttempts=1 \
-          "{{ dev1_user }}@{{ ansible_host|default(inventory_hostname) }}" \
-          "sshpass -f '/tmp/${F}' ssh \
-            -o StrictHostKeyChecking=no -o PubkeyAuthentication=no \
-            -o PreferredAuthentications=password -o NumberOfPasswordPrompts=1 \
-            -o ConnectTimeout=30 \
-            '{{ dev2_ssh_user }}@\[${IP6}%{{ dev1_iface }}\]' \
-            '{{ pathprefix }} uptime 2>&1 || true'"
-      args: { executable: /bin/bash }
-      register: dev2_uptime
-      changed_when: false
-      failed_when: false
-
-    - name: Output DEV2 uptime (stdout)
+    - name: DEV2 | uptime (stdout)
       delegate_to: localhost
       ansible.builtin.debug:
         msg:
           - "DEV2 uptime via {{ dev2_conn_final }}:"
-          - "{{ (dev2_uptime.stdout | default('') | regex_replace('\r','')) }}"
+          - "{{ dev2_exec.stdout | default('') | regex_replace('\r','') }}"
 
   post_tasks:
-    - name: Cleanup (always)
-      block:
-        - ansible.builtin.debug:
-            msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)"
-          delegate_to: localhost
-          changed_when: false
-      always:
-        - name: Close SSH ControlMaster (best-effort)
-          when: dev2_conn_method == "tunnel"
-          delegate_to: localhost
-          ansible.builtin.shell: |
-            ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
-          changed_when: false
-          ignore_errors: true
+    - name: Cleanup note
+      delegate_to: localhost
+      ansible.builtin.debug:
+        msg: "Cleanup: closing tunnel, removing temp IP, removing staged passfiles (best-effort)"
+      changed_when: false
 
-        - name: Remove tunnel control dir (best-effort)
-          when: dev2_conn_method == "tunnel"
-          delegate_to: localhost
-          ansible.builtin.file:
-            path: "{{ _ctrl_dir | default('/tmp/none') }}"
-            state: absent
-          ignore_errors: true
+    - name: Close SSH ControlMaster (best-effort)
+      when: dev2_conn_method | default('') == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.shell: |
+        ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
+      args: { executable: /bin/bash }
+      changed_when: false
+      ignore_errors: true
 
-        - name: Remove staged passfiles from DEV1 (best-effort)
-          ansible.builtin.raw: >
-            {{ pathprefix }}
-            rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
-          changed_when: false
-          failed_when: false
+    - name: Remove tunnel control dir (best-effort)
+      when: dev2_conn_method | default('') == "tunnel"
+      delegate_to: localhost
+      ansible.builtin.file:
+        path: "{{ _ctrl_dir | default('/tmp/none') }}"
+        state: absent
+      ignore_errors: true
 
-        - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
-          when: dev2_conn_method == "tunnel"
-          ansible.builtin.raw: >
-            {{ pathprefix }}
-            ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
-          register: del_ip
-          changed_when: del_ip.rc == 0
-          failed_when: >
-            del_ip.rc != 0
-            and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
-            and ('Cannot assign requested address' not in (del_ip.stderr | default('')))
+    - name: Remove staged passfiles from DEV1 (best-effort)
+      when: dev2_conn_method | default('') == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
+      changed_when: false
+      failed_when: false
+
+    - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
+      when: dev2_conn_method | default('') == "tunnel"
+      ansible.builtin.raw: >
+        {{ pathprefix }}
+        ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
+      register: del_ip
+      changed_when: del_ip.rc == 0
+      failed_when: >
+        del_ip.rc != 0
+        and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
+        and ('Cannot assign requested address' not in (del_ip.stderr | default('')))