diff --git a/live/deploy/dryrun.sh b/live/deploy/dryrun.sh
index 1f93a32..9cdde39 100755
--- a/live/deploy/dryrun.sh
+++ b/live/deploy/dryrun.sh
@@ -53,7 +53,9 @@ echo "── 4. 能否 ssh 到采集机 ──"
 # 数一下就等于对端总线的条数，之后它挂着等新内容，由 timeout 收掉。
 rb="${SHIP_REMOTE_BUS:-\$HOME/chan-live/state/signals_live.jsonl}"
 err="$(mktemp)"; outf="$(mktemp)"
-timeout 12 sudo -u "$USER_NAME" ssh -T -o BatchMode=yes -o ConnectTimeout=10 \
+# timeout 要套在 sudo **里面**：套外面时 SIGTERM 只到 sudo，未必传给 ssh，
+# 于是该被收掉的 tail 会继续挂着
+sudo -u "$USER_NAME" timeout 12 ssh -T -o BatchMode=yes -o ConnectTimeout=10 \
     "$SHIP_FROM" "tail -c +0 -F $rb" >"$outf" 2>"$err" || true
 n="$(wc -l < "$outf")"
 if grep -qi "Host key verification failed" "$err"; then