fix(recovery): persist Host111 broker transport

infra/ansible/inventory/hosts.yml

@@ -26,7 +26,17 @@ all:
           ansible_host: 192.168.0.111
           ansible_user: ooo
           ansible_ssh_private_key_file: "~/.ssh/id_rsa"
-          ansible_ssh_common_args: "-o ProxyJump=wooo@192.168.0.110 -o StrictHostKeyChecking=yes"
+          # ProxyJump starts a second ssh process and does not inherit the
+          # executor's pinned key/known_hosts options. Keep both hops pinned.
+          ansible_ssh_common_args: >-
+            -o ProxyCommand="ssh -i /run/secrets/ssh_mcp_key
+            -o UserKnownHostsFile=/etc/ssh-mcp/known_hosts
+            -o StrictHostKeyChecking=yes
+            -o IdentitiesOnly=yes
+            -o BatchMode=yes
+            -o ConnectTimeout=10
+            -W %h:%p wooo@192.168.0.110"
+            -o StrictHostKeyChecking=yes
 
     k3s_masters:
       hosts:

infra/ansible/playbooks/111-ollama-fallback.yml

@@ -145,10 +145,37 @@
         - name: "Ollama111 | rollback 重新啟動 allow proxy"
           ansible.builtin.shell:
             cmd: |
-              set -e
+              set -eu
               launchctl enable gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null || true
               launchctl bootout gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null || true
-              launchctl bootstrap gui/{{ proxy_user_uid }} {{ proxy_plist }}
+              stopped=0
+              for attempt in 1 2 3 4 5 6 7 8 9 10; do
+                if ! launchctl print gui/{{ proxy_user_uid }}/{{ proxy_label }} >/dev/null 2>&1; then
+                  stopped=1
+                  break
+                fi
+                sleep 1
+              done
+              test "$stopped" -eq 1
+              loaded=0
+              for attempt in 1 2 3 4 5; do
+                if launchctl bootstrap gui/{{ proxy_user_uid }} {{ proxy_plist }} >/dev/null 2>&1; then
+                  loaded=1
+                  break
+                fi
+                sleep 1
+              done
+              test "$loaded" -eq 1
+              launchctl kickstart -k gui/{{ proxy_user_uid }}/{{ proxy_label }}
+              running=0
+              for attempt in 1 2 3 4 5 6 7 8 9 10; do
+                if launchctl print gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null | grep -q 'state = running'; then
+                  running=1
+                  break
+                fi
+                sleep 1
+              done
+              test "$running" -eq 1
           when: not ansible_check_mode
           changed_when: true
           tags: ["111", "ollama-fallback", "rollback"]
@@ -195,8 +222,35 @@
     - name: Restart ollama111 allow proxy
       ansible.builtin.shell:
         cmd: |
-          set -e
+          set -eu
           launchctl enable gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null || true
           launchctl bootout gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null || true
-          launchctl bootstrap gui/{{ proxy_user_uid }} {{ proxy_plist }}
+          stopped=0
+          for attempt in 1 2 3 4 5 6 7 8 9 10; do
+            if ! launchctl print gui/{{ proxy_user_uid }}/{{ proxy_label }} >/dev/null 2>&1; then
+              stopped=1
+              break
+            fi
+            sleep 1
+          done
+          test "$stopped" -eq 1
+          loaded=0
+          for attempt in 1 2 3 4 5; do
+            if launchctl bootstrap gui/{{ proxy_user_uid }} {{ proxy_plist }} >/dev/null 2>&1; then
+              loaded=1
+              break
+            fi
+            sleep 1
+          done
+          test "$loaded" -eq 1
+          launchctl kickstart -k gui/{{ proxy_user_uid }}/{{ proxy_label }}
+          running=0
+          for attempt in 1 2 3 4 5 6 7 8 9 10; do
+            if launchctl print gui/{{ proxy_user_uid }}/{{ proxy_label }} 2>/dev/null | grep -q 'state = running'; then
+              running=1
+              break
+            fi
+            sleep 1
+          done
+          test "$running" -eq 1
       changed_when: true