diff --git a/docs/reference/platform-infra.md b/docs/reference/platform-infra.md
index 77ed5797..cd1c522a 100644
--- a/docs/reference/platform-infra.md
+++ b/docs/reference/platform-infra.md
@@ -61,6 +61,9 @@
     - drain 与 Node Ready 等待必须由本地 CLI 组合短于 `trans` 上限的
       目标侧操作和短轮询；节点已不可调度且用户要求彻底清空时允许
       `--disable-eviction` 直接删除非 DaemonSet Pod，但不得扩大到其他节点。
+    - 不可调度且无业务 Pod 的 worker 不要求 PodCIDR 代理 probe 成功；
+      host 本地代理健康与外网 probe 仍须成功，空 DNS Deployment、Service
+      和 Endpoints 必须由 drain 一并清理。
   - Flannel 使用 WireGuard 接口承载 VXLAN，不能只用 FRP 转发 Kubernetes API。
   - 参与业务调度的跨地域 worker DNS 使用集群 YAML 声明的独立
     CoreDNS Deployment 和固定 ClusterIP；不可调度 worker 必须移除该
diff --git a/scripts/src/platform-infra-k3s-cluster.ts b/scripts/src/platform-infra-k3s-cluster.ts
index 073024fd..e5549674 100644
--- a/scripts/src/platform-infra-k3s-cluster.ts
+++ b/scripts/src/platform-infra-k3s-cluster.ts
@@ -267,11 +267,15 @@ function status(target: K3sClusterTarget): Record<string, unknown> {
   const workerData = parseFirstJson(worker.stdout);
   const workerScheduling = workerSchedulingStatus(target);
   const workerWorkloads = workerWorkloadStatus(target);
+  const proxyHealth = workerProxyData.health as Record<string, unknown> | undefined;
+  const proxyExternalProbe = workerProxyData.externalProbe as Record<string, unknown> | undefined;
+  const workerProxyReady = workerProxyData.ok === true
+    || (!target.worker.scheduling.schedulable && proxyHealth?.exitCode === 0 && proxyExternalProbe?.exitCode === 0);
   const ok = control.exitCode === 0
-    && workerProxy.exitCode === 0
+    && (workerProxy.exitCode === 0 || (!target.worker.scheduling.schedulable && workerProxyReady))
     && worker.exitCode === 0
     && controlData.ok === true
-    && workerProxyData.ok === true
+    && workerProxyReady
     && workerData.ok === true
     && workerDns.data.ok === true
     && workerScheduling.ok === true
@@ -281,7 +285,7 @@ function status(target: K3sClusterTarget): Record<string, unknown> {
     mutation: false,
     targetId: target.id,
     controlPlane: controlData,
-    workerHostProxy: workerProxyData,
+    workerHostProxy: { ...workerProxyData, ok: workerProxyReady, podAccessRequired: target.worker.scheduling.schedulable },
     worker: workerData,
     workerDns: workerDns.data,
     workerScheduling,
@@ -535,12 +539,16 @@ function reconcileWorkerDns(target: K3sClusterTarget): Record<string, unknown> {
     if (before.data.presence !== true) {
       return { ok: true, mutation: false, enabled: false, reason: "worker-unschedulable", presence: false };
     }
-    const deletion = runCommand([
+    const deploymentDeletion = runCommand([
       "trans", target.controlPlane.kubeRoute, "kubectl", "-n", target.k3s.workerDns.namespace,
-      "delete", "deployment", target.k3s.workerDns.deploymentName,
-      "service", target.k3s.workerDns.serviceName, "--ignore-not-found=true", "--wait=true",
+      "delete", "deployment", target.k3s.workerDns.deploymentName, "--ignore-not-found=true", "--wait=true",
     ], rootPath(), { timeoutMs: 120_000 });
-    requireSuccess(deletion, "worker-dns-delete");
+    requireSuccess(deploymentDeletion, "worker-dns-deployment-delete");
+    const serviceDeletion = runCommand([
+      "trans", target.controlPlane.kubeRoute, "kubectl", "-n", target.k3s.workerDns.namespace,
+      "delete", "service", target.k3s.workerDns.serviceName, "--ignore-not-found=true", "--wait=true",
+    ], rootPath(), { timeoutMs: 120_000 });
+    requireSuccess(serviceDeletion, "worker-dns-service-delete");
     let after = workerDnsStatus(target);
     const deadline = Date.now() + 30_000;
     while (after.data.ok !== true && Date.now() < deadline) {
@@ -548,7 +556,14 @@ function reconcileWorkerDns(target: K3sClusterTarget): Record<string, unknown> {
       after = workerDnsStatus(target);
     }
     if (after.data.ok !== true) throw new Error(`worker-dns-removal failed: ${bounded(JSON.stringify(after.data))}`);
-    return { ok: true, mutation: true, enabled: false, reason: "worker-unschedulable", presence: false, deletion: compact(deletion) };
+    return {
+      ok: true,
+      mutation: true,
+      enabled: false,
+      reason: "worker-unschedulable",
+      presence: false,
+      deletion: { deployment: compact(deploymentDeletion), service: compact(serviceDeletion) },
+    };
   }
   const mutation = before.data.configurationCurrent !== true;
   let applyResult: ReturnType<typeof runCommand> | null = null;
@@ -728,7 +743,15 @@ function workerDnsStatus(target: K3sClusterTarget): { data: Record<string, unkno
     if (!target.worker.scheduling.schedulable && deployment === undefined && service === undefined) {
       return { data: { ok: true, presence: false, configurationCurrent: true, enabled: false, reason: "worker-unschedulable" }, result };
     }
-    return { data: { ok: false, presence: false, configurationCurrent: false, error: "worker-dns-status-incomplete" }, result };
+    return {
+      data: {
+        ok: false,
+        presence: deployment !== undefined || service !== undefined || endpoints !== undefined,
+        configurationCurrent: false,
+        error: "worker-dns-status-incomplete",
+      },
+      result,
+    };
   }
   if (!target.worker.scheduling.schedulable) {
     return {