journald

The mitigation playbook died on the ninth server: journald.conf.d had never existed. One file state=directory task closes that assumption for good.

TL;DR: An Ansible playbook copying a journald cap into /etc/systemd/journald.conf.d failed on one server because that directory never existed there; the other eight just happened to have it. The fix is one directory task with state=directory placed before the copy. Lesson: every playbook assumption, like a parent directory existing, should be an explicit idempotent task.