diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 8e644c009..7370d0fff 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -2879,7 +2879,7 @@ jobs:
 
           connected = []
           refused = []
-          permitted = []
+          unavailable = []
           for host in sys.argv[1:]:
               try:
                   connection = socket.create_connection((host, 22), timeout=1.0)
@@ -2890,23 +2890,25 @@ jobs:
                   # verifier; a stopped sshd must not make a healthy rollout
                   # look like a policy failure.
                   refused.append(host)
-                  permitted.append(host)
               except OSError:
-                  continue
+                  # Endpoint availability is a separate runtime signal. The
+                  # exact five-destination NetworkPolicy allowlist above is
+                  # the source of truth for the security boundary; one down
+                  # host must not roll back all healthy workloads.
+                  unavailable.append(host)
               else:
                   connection.close()
                   connected.append(host)
-                  permitted.append(host)
           print("broker_ssh_connected=" + ",".join(connected))
           print(
               "broker_ssh_refused_but_egress_permitted="
               + ",".join(refused)
           )
-          raise SystemExit(
-              0
-              if connected and len(permitted) == len(sys.argv) - 1
-              else 1
+          print(
+              "broker_ssh_allowlisted_endpoint_unavailable="
+              + ",".join(unavailable)
           )
+          raise SystemExit(0 if connected else 1)
           PY
           }
           verify_ssh_denied awoooi-api api || {
diff --git a/apps/api/tests/test_executor_network_policy_boundary.py b/apps/api/tests/test_executor_network_policy_boundary.py
index 0f49ae496..aaace571d 100644
--- a/apps/api/tests/test_executor_network_policy_boundary.py
+++ b/apps/api/tests/test_executor_network_policy_boundary.py
@@ -120,5 +120,7 @@ def test_cd_applies_rolls_back_and_verifies_network_boundary() -> None:
     assert workflow.count(expected_hosts) >= 4
     assert "except ConnectionRefusedError:" in workflow
     assert "broker_ssh_refused_but_egress_permitted=" in workflow
-    assert "connected and len(permitted) == len(sys.argv) - 1" in workflow
+    assert "broker_ssh_allowlisted_endpoint_unavailable=" in workflow
+    assert "raise SystemExit(0 if connected else 1)" in workflow
+    assert "len(permitted) == len(sys.argv) - 1" not in workflow
     assert "ssh-mcp-key known_hosts 更新失敗，停止部署" in workflow