# ptsd_reacquire_attempt.yml
# PTSD DHCP Reacquire Attempt | Phase 0 | Connectivity + wrapper + DHCP state check + case A cleanup

- name: "PTSD DHCP Reacquire Attempt | Phase 0 | Connectivity + wrapper + DHCP state check"
  hosts: all
  gather_facts: no

  vars:
    pathprefix: "PATH=/sbin:/usr/sbin:/bin:/usr/bin:$PATH; "

    rmq_host: "{{ lookup('env','RMQ_HOST') | default('10.210.12.2', true) }}"
    rmq_port: "{{ lookup('env','RMQ_PORT') | default('15672', true) }}"
    rmq_user: "{{ lookup('env','RMQ_USER') | default('admin', true) }}"
    rmq_pass: "{{ lookup('env','RMQ_PASS') | default('change_me', true) }}"
    rmq_vhost: "{{ lookup('env','RMQ_VHOST') | default('app', true) }}"
    rmq_exchange: "{{ lookup('env','RMQ_EXCHANGE') | default('controls', true) }}"
    control_queue: "{{ lookup('env','CONTROL_QUEUE') | default('queue_controls', true) }}"

    dev1_user: "root"
    dev1_pass: "wavewave"

    dev2_host: "192.168.1.1"
    dev2_port: 22

    dev2_side_ip: "192.168.1.11/24"
    dev2_side_ip_addr: "{{ dev2_side_ip.split('/')[0] }}"
    dev1_iface: "br-wan"

    arping_iface: "eth0"

    dev2_ssh_user: "root"
    dev2_passfiles:
      - "basicpass"
      - "basicpass2"

    ssh_opts_common: >-
      -o PreferredAuthentications=password
      -o PubkeyAuthentication=no
      -o StrictHostKeyChecking=no
      -o UserKnownHostsFile=/dev/null
      -o NumberOfPasswordPrompts=1
      -o ConnectTimeout=15
      -o ConnectionAttempts=1
      -o LogLevel=ERROR

    debugging: true
    ssh_timeout: 30

  pre_tasks:
    - name: Initialize passfile facts defensively (avoid undefined vars later)
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_direct: "NONE"
        dev2_passfile_used_tunnel: "NONE"
        dev2_passfile_used_tunnel6: "NONE"
        dev2_passfile_used_lldp4: "NONE"
        dev2_passfile_used_lldp6: "NONE"
      changed_when: false

    - name: Read DEV1 hostname (busybox-safe)
      ansible.builtin.raw: >
        {{ pathprefix }}
        (cat /proc/sys/kernel/hostname 2>/dev/null || echo "")
      register: dev1_host_read
      changed_when: false

    - name: Stop early if connected DEV1 hostname != inventory (guard)
      ansible.builtin.meta: end_host
      when: (dev1_host_read.stdout | trim | length > 0) and
            ((dev1_host_read.stdout | trim) != (inventory_hostname | string))

  tasks:
    - name: Compute hostname digits key for LLDP lookup (DEV2)
      ansible.builtin.set_fact:
        dev2_lldp_digits: "{{ (inventory_hostname | string) | regex_replace('[^0-9]', '') }}"
      changed_when: false

 #   - name: Restart LLDP on DEV1 to refresh DEV2 management data
 #     ansible.builtin.raw: >
 #       {{ pathprefix }}
 #       mv /tmp/launchd/services/lldp-server /root/lldp-server;
 #       sleep 2;
 #       mv /root/lldp-server /tmp/launchd/services/lldp-server;
 #       sleep 10
 #     ignore_errors: true


    - name: Discover DEV2 candidate IPv4 via LLDP on DEV1 (best-effort)
      ansible.builtin.raw: >
        {{ pathprefix }}
        DIGITS="{{ dev2_lldp_digits }}";
        cat /var/run/lldp_server.json 2>/dev/null \
          | grep -Ei "ikeja${DIGITS}" -A 10 \
          | grep address \
          | grep -vE 'subtype|ipv6' \
          | awk -F'"' '{ print $4 }' \
          | head -n1
      register: dev2_lldp_ip_raw
      changed_when: false
      failed_when: false

    - name: Debug raw DEV2 LLDP IPv6 command output
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        var: dev2_lldp_ip6_raw.stdout_lines      

    - name: Discover DEV2 candidate IPv6 via LLDP on DEV1 (best-effort)
      ansible.builtin.raw: >
        {{ pathprefix }}
        DIGITS="{{ dev2_lldp_digits }}";
        cat /var/run/lldp_server.json 2>/dev/null \
          | grep -Ei "ikeja${DIGITS}" -A 15 \
          | grep 'address_ipv6' \
          | awk -F'"' '{ print $4 }' \
          | head -n1
      register: dev2_lldp_ip6_raw
      changed_when: false
      failed_when: false

    - name: Capture LLDP-derived DEV2 IP facts
      ansible.builtin.set_fact:
        lldp_dev2_ip: "{{ (dev2_lldp_ip_raw.stdout | default('')) | trim }}"
        lldp_dev2_ip6: "{{ (dev2_lldp_ip6_raw.stdout | default('')) | trim }}"
      changed_when: false

    - name: Debug captured DEV2 LLDP IPv6 fact
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "dev2_lldp_ip6_raw={{ dev2_lldp_ip6_raw.stdout | default('') | trim }}"
          - "lldp_dev2_ip6={{ lldp_dev2_ip6 | default('') | trim }}"

    - name: Classify LLDP IPv4 candidate
      delegate_to: localhost
      ansible.builtin.set_fact:
        lldp_ip_class: >-
          {% set ip = (lldp_dev2_ip | default('')) %}
          {% if ip == '' %}none
          {% elif ip.startswith('10.') %}10
          {% elif ip.startswith('192.168.') %}192_168
          {% else %}other{% endif %}
      changed_when: false

    - name: Debug LLDP candidates
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "LLDP digits={{ dev2_lldp_digits | default('') }}"
          - "LLDP IPv4 candidate={{ lldp_dev2_ip | default('<none>') }}"
          - "LLDP IPv4 class={{ lldp_ip_class | default('none') }}"
          - "LLDP IPv6 candidate={{ lldp_dev2_ip6 | default('<none>') }}"

    - name: Override dev2_host from LLDP when candidate is 192.168.x.x
      when: (lldp_ip_class | trim) == "192_168" and (lldp_dev2_ip | trim | length > 0)
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_host: "{{ lldp_dev2_ip | trim }}"
      changed_when: false

    - name: Set connection method initial (direct_lldp if 10.x else tunnel)
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_conn_method: "{{ 'direct_lldp' if ((lldp_ip_class | trim) == '10') else 'tunnel' }}"
      changed_when: false

    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass
      when: dev2_conn_method == "direct_lldp"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        HOST="{{ lldp_dev2_ip }}"
        sshpass -f basicpass ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_lldp_try_basicpass
      changed_when: false
      ignore_errors: true

    - name: Select basicpass for direct LLDP if succeeded
      when: dev2_conn_method == "direct_lldp" and dev2_lldp_try_basicpass.rc == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_direct: "basicpass"
      changed_when: false

    - name: Try DEV2 login via direct LLDP IPv4 (10.x) with basicpass2 (only if first failed)
      when: dev2_conn_method == "direct_lldp" and (dev2_passfile_used_direct == "NONE")
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        HOST="{{ lldp_dev2_ip }}"
        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          "{{ dev2_ssh_user }}@${HOST}" echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_lldp_try_basicpass2
      changed_when: false
      ignore_errors: true

    - name: Select basicpass2 for direct LLDP if succeeded
      when: dev2_conn_method == "direct_lldp" and dev2_passfile_used_direct == "NONE" and dev2_lldp_try_basicpass2.rc == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_direct: "basicpass2"
      changed_when: false

    - name: Add temporary IP on DEV1 (tolerate 'File exists')
      when: dev2_conn_method == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        ip a add {{ dev2_side_ip }} dev {{ dev1_iface }}
      register: add_ip
      changed_when: add_ip.rc == 0
      failed_when: >
        add_ip.rc != 0
        and ('File exists' not in (add_ip.stdout | default('')))
        and ('File exists' not in (add_ip.stderr | default('')))

    - name: Discover DEV2 MAC via bridge fdb on DEV1 (best-effort)
      when: dev2_conn_method == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        bridge fdb show {{ dev1_iface }} | grep eth0 | grep -v permanent | grep master | awk '{print $1}' | head -n1
      register: dev2_mac_scan
      changed_when: false
      failed_when: false

    - name: Capture discovered DEV2 MAC (if any)
      when: dev2_conn_method == "tunnel"
      ansible.builtin.set_fact:
        dev2_mac: "{{ (dev2_mac_scan.stdout | default('') ) | trim }}"
      changed_when: false

    - name: Clear existing ARP entry for DEV2 on DEV1 (best-effort)
      when: dev2_conn_method == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        ip neigh del {{ dev2_host }} dev {{ dev1_iface }} 2>/dev/null || true
      changed_when: false
      failed_when: false

    - name: Add static ARP entry on DEV1 (if MAC discovered; tolerate 'File exists')
      when: dev2_conn_method == "tunnel" and (dev2_mac | default('') | length > 0)
      ansible.builtin.raw: >
        {{ pathprefix }}
        ip neigh add {{ dev2_host }} lladdr {{ dev2_mac }} dev {{ dev1_iface }} nud permanent
      register: dev2_arp_add
      changed_when: dev2_arp_add.rc == 0
      failed_when: >
        dev2_arp_add.rc != 0
        and ('File exists' not in (dev2_arp_add.stdout | default('')))
        and ('File exists' not in (dev2_arp_add.stderr | default('')))

    - name: Refresh ARP (best-effort)
      when: dev2_conn_method == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        arping -U -I {{ arping_iface }} {{ dev2_side_ip_addr }} -c 3
      changed_when: false
      failed_when: false

    - name: Pick a free local TCP port for the tunnel (controller side)
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        pick() {
          for i in $(seq 1 25); do
            p="$(shuf -i 20000-39999 -n 1)"
            if command -v ss >/dev/null 2>&1; then
              if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then
                echo "$p"; return 0
              fi
            else
              if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then
                echo "$p"; return 0
              fi
            fi
          done
          return 1
        }
        pick
      args: { executable: /bin/bash }
      register: pick_port
      changed_when: false

    - name: Stop if no free local port was found
      when: dev2_conn_method == "tunnel" and (pick_port.stdout | trim | length) == 0
      ansible.builtin.meta: end_host

    - name: Create control dir for SSH ControlMaster
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: "mktemp -d"
      args: { executable: /bin/bash }
      register: mktemp_dir
      changed_when: false

    - name: Record chosen local port and build ControlMaster socket path
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.set_fact:
        _local_port: "{{ pick_port.stdout | trim }}"
        _ctrl_dir: "{{ mktemp_dir.stdout | trim }}"
        _ctrl_sock: "{{ (mktemp_dir.stdout | trim) }}/ssh_tunnel_ctl"
      changed_when: false

    - name: Start SSH ControlMaster and forward 127.0.0.1:local_port to DEV2 22 via DEV1
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        USER="{{ dev1_user }}"
        HOST="{{ ansible_host | default(inventory_hostname) }}"
        sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \
          -M -S "{{ _ctrl_sock }}" \
          -L "127.0.0.1:{{ _local_port }}:{{ dev2_host }}:{{ dev2_port }}" \
          "${USER}@${HOST}"
      args: { executable: /bin/bash }
      register: start_tunnel
      changed_when: true

    - name: Probe TCP reachability to DEV2 through the tunnel (nc)
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        nc -z -w5 127.0.0.1 "{{ _local_port }}"
      args: { executable: /bin/bash }
      register: nc_probe
      changed_when: false
      ignore_errors: true

    - name: Stop if tunnel TCP probe failed
      when: dev2_conn_method == "tunnel" and nc_probe.rc != 0
      ansible.builtin.meta: end_host

    - name: Pick DEV2 password for root (tunnel) try basicpass
      when: dev2_conn_method == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        PORT="{{ _local_port }}"
        sshpass -f basicpass ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_try_basicpass
      changed_when: false
      ignore_errors: true

    - name: Select basicpass if tunnel login succeeded
      when: dev2_conn_method == "tunnel" and dev2_try_basicpass.rc == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_tunnel: "basicpass"
      changed_when: false

    - name: Try DEV2 login through tunnel with basicpass2 (only if first failed)
      when: dev2_conn_method == "tunnel" and (dev2_passfile_used_tunnel == "NONE")
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        PORT="{{ _local_port }}"
        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_try_basicpass2
      changed_when: false
      ignore_errors: true

    - name: Select basicpass2 if tunnel login succeeded
      when: dev2_conn_method == "tunnel" and dev2_passfile_used_tunnel == "NONE" and dev2_try_basicpass2.rc == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_tunnel: "basicpass2"
      changed_when: false

    - name: Decide if IPv6 tunnel fallback should be attempted
      delegate_to: localhost
      ansible.builtin.set_fact:
        try_ipv6_tunnel: >-
          {{
            (lldp_dev2_ip6 | default('') | trim | length > 0)
            and
            (
              (
                (lldp_ip_class | trim) == '10'
                and
                (dev2_passfile_used_direct | default('NONE')) == 'NONE'
              )
              or
              (
                (lldp_ip_class | trim) == '192_168'
                and
                (dev2_passfile_used_tunnel | default('NONE')) == 'NONE'
              )
            )
          }}
      changed_when: false

    - name: Pick a free local TCP port for the IPv6 tunnel (controller side)
      when: try_ipv6_tunnel | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        pick() {
          for i in $(seq 1 25); do
            p="$(shuf -i 20000-39999 -n 1)"
            if command -v ss >/dev/null 2>&1; then
              if ! ss -ltn | awk '{print $4}' | grep -qE "(:|\.)${p}$"; then
                echo "$p"; return 0
              fi
            else
              if ! nc -z 127.0.0.1 "$p" >/dev/null 2>&1; then
                echo "$p"; return 0
              fi
            fi
          done
          return 1
        }
        pick
      args: { executable: /bin/bash }
      register: pick_port6
      changed_when: false

    - name: Stop if no free local port was found for IPv6 tunnel
      when: try_ipv6_tunnel | bool and (pick_port6.stdout | trim | length) == 0
      ansible.builtin.meta: end_host

    - name: Create control dir for IPv6 tunnel SSH ControlMaster
      when: try_ipv6_tunnel | bool
      delegate_to: localhost
      ansible.builtin.shell: "mktemp -d"
      args: { executable: /bin/bash }
      register: mktemp_dir6
      changed_when: false

    - name: Record chosen local port and build IPv6 tunnel ControlMaster socket path
      when: try_ipv6_tunnel | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        _local_port6: "{{ pick_port6.stdout | trim }}"
        _ctrl_dir6: "{{ mktemp_dir6.stdout | trim }}"
        _ctrl_sock6: "{{ (mktemp_dir6.stdout | trim) }}/ssh_tunnel_ctl6"
      changed_when: false

    - name: Start SSH ControlMaster and forward 127.0.0.1:local_port to DEV2 IPv6 22 via DEV1
      when: try_ipv6_tunnel | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        USER="{{ dev1_user }}"
        HOST="{{ ansible_host | default(inventory_hostname) }}"
        sshpass -p '{{ dev1_pass }}' ssh -f -N {{ ssh_opts_common }} \
          -M -S "{{ _ctrl_sock6 }}" \
          -L "127.0.0.1:{{ _local_port6 }}:[{{ lldp_dev2_ip6 }}%{{ dev1_iface }}]:{{ dev2_port }}" \
          "${USER}@${HOST}"
      args: { executable: /bin/bash }
      register: start_tunnel6
      changed_when: true

    - name: Probe TCP reachability to DEV2 through the IPv6 tunnel (nc)
      when: try_ipv6_tunnel | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        nc -z -w5 127.0.0.1 "{{ _local_port6 }}"
      args: { executable: /bin/bash }
      register: nc_probe6
      changed_when: false
      ignore_errors: true

    - name: Pick DEV2 password for root (IPv6 tunnel) try basicpass
      when: try_ipv6_tunnel | bool and (nc_probe6.rc | default(1)) == 0
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        PORT="{{ _local_port6 }}"
        sshpass -f basicpass ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_try_basicpass6
      changed_when: false
      ignore_errors: true

    - name: Select basicpass if IPv6 tunnel login succeeded
      when: try_ipv6_tunnel | bool and (dev2_try_basicpass6.rc | default(1)) == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_tunnel6: "basicpass"
      changed_when: false

    - name: Try DEV2 login through IPv6 tunnel with basicpass2 (only if first failed)
      when: try_ipv6_tunnel | bool and (dev2_passfile_used_tunnel6 == "NONE") and (nc_probe6.rc | default(1)) == 0
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        PORT="{{ _local_port6 }}"
        sshpass -f basicpass2 ssh {{ ssh_opts_common }} \
          -o AddressFamily=inet \
          -p "$PORT" root@127.0.0.1 echo OK >/dev/null 2>&1
      args: { executable: /bin/bash }
      register: dev2_try_basicpass26
      changed_when: false
      ignore_errors: true

    - name: Select basicpass2 if IPv6 tunnel login succeeded
      when: try_ipv6_tunnel | bool and dev2_passfile_used_tunnel6 == "NONE" and (dev2_try_basicpass26.rc | default(1)) == 0
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_passfile_used_tunnel6: "basicpass2"
      changed_when: false

    - name: Decide final DEV2 connection mode (direct_lldp > tunnel > tunnel6 > lldp4 > lldp6)
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_conn_final: >-
          {%- if dev2_conn_method == 'direct_lldp' and (dev2_passfile_used_direct | default('NONE')) != 'NONE' -%}
            direct_lldp
          {%- elif dev2_conn_method == 'tunnel' and (dev2_passfile_used_tunnel | default('NONE')) != 'NONE' -%}
            tunnel
          {%- elif (dev2_passfile_used_tunnel6 | default('NONE')) != 'NONE' -%}
            tunnel6
          {%- else -%}
            none
          {%- endif -%}
      changed_when: false

    - name: Abort if all DEV2 connection methods failed
      when: dev2_conn_final == "none"
      ansible.builtin.fail:
        msg: >
          DEV2 unreachable:
          tunnel={{ dev2_passfile_used_tunnel | default('n/a') }},
          tunnel6={{ dev2_passfile_used_tunnel6 | default('n/a') }},
          direct={{ dev2_passfile_used_direct | default('n/a') }}.

    - name: Debug final connectivity decision
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "dev2_conn_final={{ dev2_conn_final }}"
          - "tunnel passfile={{ dev2_passfile_used_tunnel | default('n/a') }}"
          - "tunnel6 passfile={{ dev2_passfile_used_tunnel6 | default('n/a') }}"
          - "direct passfile={{ dev2_passfile_used_direct | default('n/a') }}"
          - "tunnel target={{ dev2_host }}:{{ dev2_port }} forwarded 127.0.0.1:{{ _local_port | default('na') }}"
          - "tunnel6 target=[{{ lldp_dev2_ip6 | default('') }}%{{ dev1_iface }}]:{{ dev2_port }} forwarded 127.0.0.1:{{ _local_port6 | default('na') }}"
          - "lldp ipv4={{ lldp_dev2_ip | default('') }}"
          - "lldp ipv6={{ lldp_dev2_ip6 | default('') }}"

    - name: Build DEV2 exec wrapper (controller-side) for verification commands
      delegate_to: localhost
      ansible.builtin.set_fact:
        dev2_exec_cmd: |
          set -e
          MODE="{{ dev2_conn_final }}"
          if [ -z "${DEV2_CMD:-}" ]; then
            echo "ERROR DEV2_CMD empty" >&2
            exit 2
          fi

          case "$MODE" in
            tunnel)
              PORT="{{ _local_port | default('') }}"
              PASS="{{ dev2_passfile_used_tunnel }}"
              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
                -o AddressFamily=inet \
                -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
              ;;
            tunnel6)
              PORT="{{ _local_port6 | default('') }}"
              PASS="{{ dev2_passfile_used_tunnel6 }}"
              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
                -o AddressFamily=inet \
                -p "$PORT" "{{ dev2_ssh_user }}@127.0.0.1" \
                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
              ;;
            direct_lldp)
              HOST="{{ lldp_dev2_ip }}"
              PASS="{{ dev2_passfile_used_direct }}"
              sshpass -f "$PASS" ssh {{ ssh_opts_common }} \
                -o AddressFamily=inet \
                "{{ dev2_ssh_user }}@${HOST}" \
                "{{ pathprefix }} ${DEV2_CMD}" 2>&1
              ;;
            *)
              echo "ERROR unknown MODE=$MODE" >&2
              exit 3
              ;;
          esac
      changed_when: false

    - name: VERIFY DEV2 check ppp0 exists?
      delegate_to: localhost
      ansible.builtin.shell: |
        export DEV2_CMD="ip link show ppp0 >/dev/null 2>&1 && echo YES || echo NO"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: dev2_ppp0_exists
      changed_when: false
      failed_when: false

    - name: VERIFY Debug ppp0 probe result
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - 'DEV2 probe ppp0 exists raw={{ (dev2_ppp0_exists.stdout | default("") ) | trim }}'
          - "DEV2 probe ppp0 exists rc={{ dev2_ppp0_exists.rc | default('n/a') }}"

    - name: VERIFY DEV2 check eth0.4000 exists?
      delegate_to: localhost
      ansible.builtin.shell: |
        export DEV2_CMD="ip link show eth0.4000 >/dev/null 2>&1 && echo YES || echo NO"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: dev2_eth04000_exists
      changed_when: false
      failed_when: false

    - name: VERIFY Debug eth0.4000 link probe result
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - 'DEV2 probe eth0.4000 exists raw={{ (dev2_eth04000_exists.stdout | default("") ) | trim }}'
          - "DEV2 probe eth0.4000 exists rc={{ dev2_eth04000_exists.rc | default('n/a') }}"

    - name: VERIFY DEV2 check eth0.4000 has IPv4?
      delegate_to: localhost
      ansible.builtin.shell: |
        export DEV2_CMD="ip -4 addr show dev eth0.4000 2>/dev/null | grep -m1 'inet ' >/dev/null 2>&1 && echo YES || echo NO"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: dev2_eth04000_has_ipv4
      changed_when: false
      failed_when: false

    - name: VERIFY Debug eth0.4000 IPv4 probe result
      when: debugging | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - 'DEV2 probe eth0.4000 has IPv4 raw={{ (dev2_eth04000_has_ipv4.stdout | default("") ) | trim }}'
          - "DEV2 probe eth0.4000 has IPv4 rc={{ dev2_eth04000_has_ipv4.rc | default('n/a') }}"

    - name: VERIFY Summarize DHCP migration state
      delegate_to: localhost
      ansible.builtin.set_fact:
        ppp0_exists: "{{ (dev2_ppp0_exists.stdout | default('') | trim) == 'YES' }}"
        eth04000_exists: "{{ (dev2_eth04000_exists.stdout | default('') | trim) == 'YES' }}"
        eth04000_has_ipv4: "{{ (dev2_eth04000_has_ipv4.stdout | default('') | trim) == 'YES' }}"
        dhcp_migrated_ok: >-
          {{
            ((dev2_ppp0_exists.stdout | default('') | trim) != 'YES')
            and
            ((dev2_eth04000_exists.stdout | default('') | trim) == 'YES')
            and
            ((dev2_eth04000_has_ipv4.stdout | default('') | trim) == 'YES')
          }}
      changed_when: false

    - name: VERIFY Classify migration state
      delegate_to: localhost
      ansible.builtin.set_fact:
        dhcp_state: >-
          {% if (dhcp_migrated_ok | bool) %}
          case_a_dhcp_ok
          {% elif (ppp0_exists | bool) and (not (eth04000_exists | bool)) %}
          case_b_pppoe_old
          {% elif (ppp0_exists | bool) and (eth04000_exists | bool) %}
          case_c_mixed
          {% else %}
          unknown
          {% endif %}
      changed_when: false

    - name: VERIFY Report migration state summary
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "DEV2 connectivity via {{ dev2_conn_final }}"
          - "DEV2 probes ppp0={{ ppp0_exists }} eth0.4000={{ eth04000_exists }} eth0.4000_ipv4={{ eth04000_has_ipv4 }}"
          - "DEV2 classified state={{ dhcp_state }}"
          - "DEV2 DHCP migrated ok={{ dhcp_migrated_ok }}"

    - name: VERIFY Report why migration is not confirmed
      when: not (dhcp_migrated_ok | bool)
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "DEV2 is not confirmed as DHCP-migrated"
          - "DEV2 classified state={{ dhcp_state }}"
          - "Expected for success case A: ppp0 absent, eth0.4000 present, eth0.4000 has IPv4"
          - "Observed: ppp0={{ ppp0_exists }}, eth0.4000={{ eth04000_exists }}, eth0.4000_ipv4={{ eth04000_has_ipv4 }}"
      changed_when: false

    - name: VERIFY End host if DHCP migration state is not confirmed
      when: not (dhcp_migrated_ok | bool)
      ansible.builtin.meta: end_host

    - name: CASE A DEV2 run config-test check before reboot cancellation
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="/usr/sbin/config-test.lua -c >/dev/null 2>&1 && echo OK || echo FAIL"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: config_test_check
      changed_when: false
      failed_when: false

    - name: CASE A set config-test check status
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        config_test_ok: "{{ (config_test_check.stdout | default('') | trim) == 'OK' }}"
      changed_when: false

    - name: CASE A append config-test check result
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: >-
          {{
            (cleanup_report | default('case A observed'))
            ~ ', '
            ~ (
              'config-test -c ok'
              if (config_test_ok | bool)
              else 'config-test -c failed'
            )
          }}
      changed_when: false

    - name: CASE A Initialize cumulative cleanup report
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: "case A observed"
      changed_when: false

    - name: CASE A DEV2 find if pending reboot is present
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="ps w | grep eboot | grep -v grep >/dev/null 2>&1 && echo FOUND || echo NOT_FOUND"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: reboot_present
      changed_when: false
      failed_when: false

    - name: CASE A DEV2 cancel reboot if present
      when: dhcp_migrated_ok | bool and (config_test_ok | bool) and (reboot_present.stdout | default('') | trim) == "FOUND"
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="ps w | grep eboot | grep -v grep >/dev/null 2>&1 && killall reboot 2>/dev/null || true; echo DONE"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: reboot_cancel
      changed_when: false
      failed_when: false

    - name: CASE A append reboot cancellation result
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: >-
          {{
            cleanup_report
            ~ ', '
            ~ (
              'pending reboot found and cancelled'
              if (reboot_present.stdout | default('') | trim) == 'FOUND'
              else 'no pending reboot'
            )
          }}
      changed_when: false

    - name: CASE A DEV2 touch confirming_success marker
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="touch /tmp/confirming_success >/dev/null 2>&1 && echo OK || echo FAIL"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: confirming_success_touch
      changed_when: false
      failed_when: false

    - name: CASE A append confirming_success marker result
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: >-
          {{
            cleanup_report
            ~ ', '
            ~ (
              'touched /tmp/confirming_success'
              if (confirming_success_touch.stdout | default('') | trim) == 'OK'
              else 'failed to touch /tmp/confirming_success'
            )
          }}
      changed_when: false

    - name: CASE A sleep 5 seconds
      when: dhcp_migrated_ok | bool
      ansible.builtin.pause:
        seconds: 5

    - name: CASE A DEV2 move config test to config with dhcp
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="mv /tmp/config-test.json /tmp/config-with-dhcp.json >/dev/null 2>&1 && echo OK || echo FAIL"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: mv_config_result
      changed_when: false
      failed_when: false

    - name: CASE A append config move result
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: >-
          {{
            cleanup_report
            ~ ', '
            ~ (
              'moved /tmp/config-test.json to /tmp/config-with-dhcp.json'
              if (mv_config_result.stdout | default('') | trim) == 'OK'
              else 'failed to move /tmp/config-test.json to /tmp/config-with-dhcp.json'
            )
          }}
      changed_when: false

    - name: CASE A DEV2 remove ptsd inprogress marker
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.shell: |
        set -e
        export DEV2_CMD="rm -f /tmp/ptsd.inprogress >/dev/null 2>&1 && echo OK || echo FAIL"
        {{ dev2_exec_cmd }}
      args: { executable: /bin/bash }
      register: rm_inprogress_result
      changed_when: false
      failed_when: false

    - name: CASE A append ptsd inprogress removal result
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.set_fact:
        cleanup_report: >-
          {{
            cleanup_report
            ~ ', '
            ~ (
              'removed /tmp/ptsd.inprogress'
              if (rm_inprogress_result.stdout | default('') | trim) == 'OK'
              else 'failed to remove /tmp/ptsd.inprogress'
            )
          }}
      changed_when: false

    - name: CASE A final cumulative cleanup report
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.debug:
        msg:
          - "{{ cleanup_report }}"
      changed_when: false

    - name: CASE A publish cumulative cleanup report journal
      when: dhcp_migrated_ok | bool
      delegate_to: localhost
      ansible.builtin.uri:
        url: "http://{{ rmq_host }}:{{ rmq_port }}/api/exchanges/{{ rmq_vhost | urlencode }}/{{ rmq_exchange | urlencode }}/publish"
        method: POST
        user: "{{ rmq_user }}"
        password: "{{ rmq_pass }}"
        force_basic_auth: true
        status_code: 200
        headers: { content-type: "application/json" }
        body_format: json
        body:
          properties: { content_type: "application/json" }
          routing_key: "{{ control_queue }}"
          payload: "{{ {
            'inscope_device': (ansible_hostname | default(inventory_hostname)),
            'task_name': 'journal_add',
            'task_result': (cleanup_report | default(''))
          } | to_json }}"
          payload_encoding: "string"
      changed_when: false


  post_tasks:
    - name: Cleanup note
      delegate_to: localhost
      ansible.builtin.debug:
        msg: "Cleanup best-effort, closing tunnel, removing temp IP, removing staged passfiles"
      changed_when: false

    - name: Close SSH ControlMaster (best-effort)
      when: dev2_conn_method | default('') == "tunnel"
      delegate_to: localhost
      ansible.builtin.shell: |
        ssh -S "{{ _ctrl_sock | default('/dev/null') }}" -O exit 2>/dev/null || true
      args: { executable: /bin/bash }
      changed_when: false
      ignore_errors: true

    - name: Remove tunnel control dir (best-effort)
      when: dev2_conn_method | default('') == "tunnel"
      delegate_to: localhost
      ansible.builtin.file:
        path: "{{ _ctrl_dir | default('/tmp/none') }}"
        state: absent
      ignore_errors: true

    - name: Close SSH ControlMaster for IPv6 tunnel (best-effort)
      when: _ctrl_sock6 is defined
      delegate_to: localhost
      ansible.builtin.shell: |
        ssh -S "{{ _ctrl_sock6 | default('/dev/null') }}" -O exit 2>/dev/null || true
      args: { executable: /bin/bash }
      changed_when: false
      ignore_errors: true

    - name: Remove IPv6 tunnel control dir (best-effort)
      when: _ctrl_dir6 is defined
      delegate_to: localhost
      ansible.builtin.file:
        path: "{{ _ctrl_dir6 | default('/tmp/none') }}"
        state: absent
      ignore_errors: true

    - name: Remove staged passfiles from DEV1 (best-effort)
      when: dev2_conn_method | default('') == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        rm -f /tmp/basicpass /tmp/basicpass2 2>/dev/null || true
      changed_when: false
      failed_when: false

    - name: Remove temporary IP on DEV1 (tolerate 'Cannot assign requested address')
      when: dev2_conn_method | default('') == "tunnel"
      ansible.builtin.raw: >
        {{ pathprefix }}
        ip a del {{ dev2_side_ip }} dev {{ dev1_iface }}
      register: del_ip
      changed_when: del_ip.rc == 0
      failed_when: >
        del_ip.rc != 0
        and ('Cannot assign requested address' not in (del_ip.stdout | default('')))
        and ('Cannot assign requested address' not in (del_ip.stderr | default('')))