@oneie/claude 0.8.0 → 0.10.0

package/scripts/do-plan-json.mjs

@@ -49,25 +49,83 @@ const fm = t.match(/^---\n([\s\S]*?)\n---/)
 if (!fm) fail('no frontmatter')
 const F = fm[1]
 
-// batches: `- [C0, C2]` lines under `batches:`
-const bm = F.match(/^batches:\n((?:[ \t]+- \[.*\]\n?)+)/m)
-const batches = bm
-  ? bm[1].trim().split('\n').map((l) =>
-      l.replace(/^[\s-]*\[|\]\s*$/g, '').split(',').map((s) => s.trim()).filter(Boolean))
-  : []
+// batches: `- [C0, C2]` rows under `batches:`
+//
+// DEFECT this shape exists to prevent (measured 2026-09-08 on text/ads-loop-todo.md):
+// the capture used to be /^batches:\n((?:[ \t]+- \[.*\]\n?)+)/m. A trailing
+// `# comment` after the closing `]` is legal YAML and carried by most plans in
+// text/ — it leaves text after `]`, so `\n?` matched empty, the `+` quantifier
+// stopped at that row, and EVERY batch from there on was dropped. Nothing
+// called fail(): the script still exited 0 and still emitted a well-formed
+// object. ads-loop parsed as [["C1"…"C9"]] instead of [["C1"…"C9"],["C10"]],
+// so /do would have run nine cycles of a ten-cycle plan and reported complete.
+//
+// Two changes, and the second is the load-bearing one:
+//   1. a row may carry a trailing comment and trailing whitespace;
+//   2. the block is delimited by INDENTATION (YAML's own rule) and every line
+//      inside it must parse — a line that does not is a REFUSAL, never a
+//      shorter list. Comment-tolerance alone would leave the next unreadable
+//      row failing in exactly the same silent way.
+// Blank lines and whole-line `#` comments inside the block are legal and skipped.
+// Inline flow style (`batches: [[C0]]`) still yields [] and fails at the
+// `no batches:` invariant below, exactly as before.
+const BATCH_ROW = /^[ \t]+-[ \t]*\[([^\]]*)\][ \t]*(?:#.*)?$/
+const fLines = F.split('\n')
+const bStart = fLines.findIndex((l) => /^batches:[ \t]*$/.test(l))
+let batches = []
+if (bStart >= 0) {
+  const rows = []
+  const bad = []
+  for (let i = bStart + 1; i < fLines.length; i++) {
+    const line = fLines[i]
+    if (!line.trim()) continue          // blank line inside the block
+    if (!/^[ \t]/.test(line)) break     // a column-0 line is the next key: block over
+    if (/^[ \t]*#/.test(line)) continue // whole-line comment
+    const m = line.match(BATCH_ROW)
+    if (m) rows.push(m[1])
+    else bad.push(line)
+  }
+  if (bad.length) {
+    fail(
+      `\`batches:\` carries ${bad.length} row(s) this parser cannot read. ` +
+      'Refusing: a truncated batch list must never read as a complete one. ' +
+      `A row is \`- [C1, C2]\` with an optional trailing # comment. First offender: ${JSON.stringify(bad[0])}`,
+    )
+  }
+  batches = rows.map((r) => r.split(',').map((s) => s.trim()).filter(Boolean))
+}
 
 // outcome: the kill-switch. A YAML double-quoted scalar carries \" and \\ escapes;
 // stripping the outer quotes WITHOUT unescaping leaves a stray backslash that
 // JSON.stringify then doubles, emitting invalid JSON (measured: lifecycle-money,
 // lifecycle-human, both of whose outcomes contain a quoted grep pattern).
+// A YAML scalar may carry a trailing `# comment`, and text/template-todo.md puts one
+// on EVERY key a plan copies — `anchor: "" # filled by do-board.sh`,
+// `board_workspace: one # where the rows live…`. The old body tested
+// `endsWith('"')`, which a commented value fails, so it returned the raw line
+// INCLUDING the comment. Measured 2026-09-12: boardAnchor came back as
+// `"task:01a0…"   # filled by do-board.sh` and do-board handed that to
+// tasks:subtask as `parent`, dying `{"error":"invalid parent"}` — a message that
+// never names the anchor. boardWorkspace was worse and silent: the whole comment
+// became the workspace name, so rows would be minted somewhere that does not exist.
+// A comment starts at `#` only when it is outside quotes and preceded by
+// whitespace (or begins the value); inside quotes `#` is data.
 function unquote(raw) {
-  if (raw.length > 1 && raw.startsWith('"') && raw.endsWith('"')) {
-    return raw.slice(1, -1).replace(/\\(["\\])/g, '$1')
-  }
-  if (raw.length > 1 && raw.startsWith("'") && raw.endsWith("'")) {
-    return raw.slice(1, -1).replace(/''/g, "'")
+  const q = raw[0]
+  if ((q === '"' || q === "'") && raw.length > 1) {
+    // walk to the matching close quote; everything after it is comment/whitespace
+    for (let i = 1; i < raw.length; i++) {
+      if (q === '"' && raw[i] === '\\') { i++; continue }
+      if (raw[i] !== q) continue
+      if (q === "'" && raw[i + 1] === "'") { i++; continue }   // '' is an escaped quote
+      const body = raw.slice(1, i)
+      return q === '"' ? body.replace(/\\(["\\])/g, '$1') : body.replace(/''/g, "'")
+    }
+    return raw   // unterminated quote — hand it back verbatim rather than guess
   }
-  return raw
+  // plain scalar: a comment needs leading whitespace, so `a#b` stays `a#b`
+  const c = raw.search(/[ \t]#/)
+  return (c === -1 ? raw : raw.slice(0, c)).trim()
 }
 let outcome = ''
 const om = F.match(/^outcome:[ \t]*(?:\|[-+]?|>[-+]?)?[ \t]*(.*)$/m)
@@ -146,6 +204,42 @@ const sharedRecon = srm
       .filter((f) => f && fs.existsSync(path.join(repo, f)))
   : []
 
+// ── the BOARD CONTRACT ──────────────────────────────────────────────────────
+// A plan's cycles and the board's rows are the same work twice, and until this
+// block existed nothing joined them: `batches:` held the ordering in markdown,
+// D1 held it in `blocks` edges, and they drifted silently.
+//
+// It matters because `tasks:claim` is BLOCKER-GATED and reads the very `blocks`
+// edge `tasks:depend` writes. A plan mirrored onto the board cannot be claimed
+// out of order; an unmirrored one hands every agent every cycle at once.
+//
+// So emit both renderings and let the caller SEE the drift. `boardDrift` names
+// every cycle the plan schedules that has no row — the ones invisible to every
+// agent but the one running /do. It is reported, never fatal: a plan may be
+// deliberately off-board, and a parser that refused would block that.
+const anchorM = F.match(/^anchor:[ \t]*(.*)$/m)
+const boardAnchor = anchorM ? unquote(anchorM[1].trim()) : ''
+const bwM = F.match(/^board_workspace:[ \t]*(.*)$/m)
+const boardWorkspace = bwM && bwM[1].trim() ? unquote(bwM[1].trim()) : 'one'
+
+// cycle_rows: either inline flow (`cycle_rows: []`) or a block of
+// `  - {cycle: C1, tid: "task:…"}` rows. Tolerant on purpose — this list is
+// written back by a script and by hand, and a shape it cannot read must read as
+// "no row" (surfaced in boardDrift) rather than crash a plan that is otherwise
+// runnable.
+const cycleRows = {}
+const crStart = fLines.findIndex((l) => /^cycle_rows:[ \t]*$/.test(l))
+if (crStart !== -1) {
+  for (let i = crStart + 1; i < fLines.length; i++) {
+    const l = fLines[i]
+    if (!/^[ \t]+-/.test(l)) { if (l.trim() && !/^[ \t]/.test(l)) break; else continue }
+    const c = l.match(/cycle:[ \t]*['"]?(C\d+)['"]?/)
+    const tid = l.match(/tid:[ \t]*['"]?(task:[0-9a-f]{24})['"]?/)
+    if (c && tid) cycleRows[c[1]] = tid[1]
+  }
+}
+const boardDrift = batches.flat().filter((c) => !cycleRows[c])
+
 process.stdout.write(JSON.stringify({
   slug,
   sharedRecon,
@@ -154,6 +248,10 @@ process.stdout.write(JSON.stringify({
   worktree: path.join(repo, '.do-worktrees', slug),
   outcome,
   batches,
+  boardAnchor,
+  boardWorkspace,
+  cycleRows,
+  boardDrift,
   openCycles,
   closedCycles,
   deps,

package/scripts/do-prove-selftest.sh

@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# do-prove-selftest.sh — the red proof for do-prove.sh's argument contract.
+# Invoked as `do-prove.sh --self-test`; $1 is the do-prove.sh under test.
+#
+# Asked for by .claude/improvements.queue.md:307 ("it has no --self-test, unlike
+# its sibling gates ... or this regresses silently the way it arrived").
+#
+# Every GREEN check here is paired with a RED one that GUTS the guard it depends
+# on and asserts the check then fails. A checker that stays green against gutted
+# code proves nothing.
+#
+# Needs no live server: the parser half is pure argument handling, and the base
+# half points at a closed port on purpose.
+set -uo pipefail
+
+TARGET="${1:-}"
+[ -n "$TARGET" ] && [ -f "$TARGET" ] || { echo "selftest: need the path to do-prove.sh"; exit 2; }
+
+pass=0; fail=0
+ok()  { echo "  ok   — $1"; pass=$((pass+1)); }
+no()  { echo "  FAIL — $1"; fail=$((fail+1)); }
+
+# A port nothing is listening on. Verified closed, not assumed.
+DEAD=""
+for p in 45871 45872 45873 45874; do
+  if ! curl -sf -o /dev/null --max-time 1 "http://127.0.0.1:$p/" 2>/dev/null; then DEAD="$p"; break; fi
+done
+[ -n "$DEAD" ] || { echo "selftest: could not find a closed port"; exit 2; }
+DEADBASE="http://127.0.0.1:$DEAD"
+
+# A gutted copy of do-prove.sh with one guard removed, laid out so its own
+# ROOT-from-BASH_SOURCE derivation still works.
+# A mutant must still PARSE. Deleting the body of an `if` leaves an orphaned
+# `fi`, and bash exits 2 on a syntax error — which is indistinguishable from a
+# usage error and would have let a broken mutant masquerade as a red proof.
+# Measured while writing this file: both base-half mutants "failed" that way.
+# So mutate by SUBSTITUTION (guard → `:`), and refuse a mutant that does not
+# parse rather than scoring it.
+gut() { # $1 = sed program → echoes the path of the mutant, or empty on failure
+  local d; d="$(mktemp -d)"
+  mkdir -p "$d/.claude/scripts"
+  sed "$1" "$TARGET" > "$d/.claude/scripts/do-prove.sh"
+  if ! cmp -s "$TARGET" "$d/.claude/scripts/do-prove.sh"; then :; else
+    echo "" ; return 0   # sed matched nothing — the guard moved
+  fi
+  bash -n "$d/.claude/scripts/do-prove.sh" 2>/dev/null || { echo ""; return 0; }
+  echo "$d/.claude/scripts/do-prove.sh"
+}
+
+echo "do-prove --self-test"
+echo "[1/2] parser — an unrecognised FLAG is a hard error"
+
+out="$(bash "$TARGET" --route / --bogus </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "unknown flag --bogus exits 2 (got $rc)" \
+                || no "unknown flag --bogus should exit 2, got $rc"
+case "$out" in *"unknown flag '--bogus'"*) ok "…and names the flag" ;;
+               *) no "output did not name the flag: $out" ;; esac
+
+out="$(bash "$TARGET" --base </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "--base with no value exits 2" || no "--base with no value: rc=$rc"
+out="$(bash "$TARGET" --route </dev/null 2>&1)"; rc=$?
+[ "$rc" -eq 2 ] && ok "--route with no value exits 2" || no "--route with no value: rc=$rc"
+
+# The leniency that must SURVIVE: a bare token (cycle slug) is still ignored,
+# not refused. do-w4-gates.sh:210 and do-smoke.sh:85-88 depend on this.
+out="$(bash "$TARGET" some-cycle-slug --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 2 ] && ok "a bare cycle slug is still tolerated (rc=$rc, not a usage error)" \
+                || no "a bare cycle slug was refused as a usage error — this breaks existing callers"
+case "$out" in *"is not a path (cycle slug?)"*) ok "…and still says so" ;;
+               *) no "the lenient note is gone" ;; esac
+
+# RED: remove the -*) branch and the flag guard must stop biting.
+m="$(gut 's|^      exit 2 ;;$|      shift ;;|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the flag-guard mutant"; else
+out="$(bash "$m" --route / --bogus --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 2 ] && ok "RED PROOF: gutted flag guard no longer exits 2 (got $rc) — check 1 is live" \
+                || no "RED PROOF FAILED: mutant still exits 2; check 1 proves nothing"
+fi
+
+echo "[2/2] base — --base pins the leg, and an unrun proof is not a pass"
+
+out="$(bash "$TARGET" --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+[ "$rc" -ne 0 ] && ok "explicit --base that answers nothing exits non-zero (got $rc)" \
+                || no "explicit --base answered nothing and still exited 0 — the fail-open is back"
+case "$out" in *"an unrun proof is not a pass"*) ok "…and says why" ;;
+               *) no "no unrun message: $out" ;; esac
+case "$out" in *"https://one.ie"*) no "--base did not pin the fallback — it reached for https://one.ie" ;;
+               *) ok "--base pinned the fallback (production never named)" ;; esac
+
+# RED: remove the fallback pin → the mutant must reach for https://one.ie.
+m="$(gut 's|^  PROD_URL="\$BASE_URL"$|  :|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the pin mutant"; else
+out="$(bash "$m" --route / --base "$DEADBASE" </dev/null 2>&1)"
+case "$out" in *"https://one.ie"*) ok "RED PROOF: unpinned mutant reaches production — the pin is load-bearing" ;;
+               *) no "RED PROOF FAILED: mutant did not reach production; the pin check proves nothing" ;; esac
+fi
+
+# RED: remove the unrun-is-not-a-pass block → the mutant must go back to exit 0.
+m="$(gut 's|^    exit 1$|    :|')"
+if [ -z "$m" ]; then no "RED PROOF FAILED: could not build the fail-open mutant"; else
+out="$(bash "$m" --route / --base "$DEADBASE" </dev/null 2>&1)"; rc=$?
+if [ "$rc" -eq 0 ]; then ok "RED PROOF: gutted mutant exits 0 on an unreachable base — the guard is live"
+else no "RED PROOF FAILED: mutant still exits $rc; the fail-open check proves nothing"; fi
+fi
+
+echo
+echo "do-prove --self-test: $pass passed, $fail failed"
+[ "$fail" -eq 0 ] || exit 1

package/scripts/do-prove.sh

@@ -4,7 +4,8 @@
 # (chrome-headless-shell page check via chrome.mjs, curl fallback against prod).
 #
 # Usage:
-#   do-prove.sh [--route <path>]... [<changed-path>|<cycle-slug>]...
+#   do-prove.sh [--route <path>]... [--base <url>] [<changed-path>|<cycle-slug>]...
+#   do-prove.sh --self-test
 #   git diff --name-only | do-prove.sh
 #
 # Arg contract:
@@ -12,10 +13,36 @@
 #   - Positional args that do NOT exist on disk (e.g. a cycle slug) are ignored
 #     for surface detection; changed paths then come from `git diff --name-only HEAD`.
 #   - --route <path> (repeatable) forces frontend surface + names the route(s) to prove.
+#   - --base <url> proves against <url> instead of the default localhost base.
 #   - stdin (non-tty) supplies changed paths when no positional paths are given.
+#   - AN UNRECOGNISED FLAG IS A HARD ERROR (exit 2). It was not, until 2026-09-07,
+#     and that is how the launch promise came to prove a laptop. `text/bring-one-to-life.md`
+#     deliverable 6 read `--route /keys --base https://one.ie`; `--base` did not
+#     exist, so BOTH tokens fell through the lenient `*)` branch as "not a path
+#     (cycle slug?)" and the run silently used the localhost default. Measured that
+#     morning with a dev server up on :4321:
+#       PROVE: note — '--base' is not a path (cycle slug?); …
+#       PROVE: ok / — http=200, 0 console/js errors (dev http://localhost:4321)
+#       PROVE: pass (1 route(s) proven)          ← exit 0, prod never contacted
+#     The leniency is deliberate for BARE tokens (a cycle slug is passed
+#     legitimately — do-w4-gates.sh:210, do-smoke.sh:85-88). It is never correct
+#     for a token starting with `-`: nobody passes a flag they do not mean.
+#
+# --base semantics (matches land.sh:344-345, which pins both bases by hand and
+# says why): --base PINS THE FALLBACK TOO, unless PROVE_PROD_URL is explicitly
+# exported. Setting only the dev base would rebuild the same defect one layer
+# down — an unreachable `--base https://staging.x` would fall through to
+# PROD_URL and prove PRODUCTION while reporting it as staging.
+# And an explicit --base that ANSWERS NOTHING exits non-zero rather than
+# `PROVE: skipped` (exit 0): do-promise-settle.sh runs a promise's proof: string
+# verbatim and reads the exit code, so a skipped prod probe would settle the
+# promise KEPT with the site down. An unrun gate is not a pass. Bare invocations
+# keep the old skip-is-0 semantics — land.sh:346-350 reads the ROUTE COUNT and
+# factory-walk.sh:294 matches `PROVE: skipped` → unrun, and both rely on it.
 #
 # Env:
-#   PROVE_BASE_URL   dev base for browser check (default http://localhost:4321)
+#   PROVE_BASE_URL   dev base for browser check (default http://localhost:4321).
+#                    `--base <url>` is the flag form of exactly this, and wins.
 #   PROVE_PROD_URL   prod fallback base       (default https://one.ie)
 #   PROVE_CHECK_CMD  optional check command for non-frontend surfaces; if set and
 #                    it fails, do-prove.sh exits nonzero.
@@ -44,7 +71,10 @@
 #
 # Exit codes: 0 = pass or skipped (no reachable environment) · 1 = a reachable
 # page failed (HTTP >= 500 / 404 / status 0 / console+JS errors / landed on a
-# different path than requested) or declared check failed.
+# different path than requested), a declared check failed, or an explicit --base
+# answered nothing · 2 = usage error (unknown flag, or a flag missing its value).
+#
+# --self-test drives both halves red and green with no live server required.
 set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
@@ -54,11 +84,34 @@ BROWSER_CHECK="$ROOT/.claude/scripts/chrome.mjs"
 
 routes=()
 paths=()
+base_explicit=0
+self_test=0
+
+prove_usage() {
+  echo "PROVE: usage: do-prove.sh [--route <path>]... [--base <url>] [--self-test] [<changed-path>|<cycle-slug>]..."
+}
+
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --route)
-      [ "$#" -ge 2 ] || { echo "PROVE: --route requires a value"; exit 1; }
+      [ "$#" -ge 2 ] || { echo "PROVE: --route requires a value"; exit 2; }
       routes+=("$2"); shift 2 ;;
+    --base)
+      # The flag form of PROVE_BASE_URL. Trailing slash stripped so
+      # "$BASE_URL$route" never produces a double slash.
+      [ "$#" -ge 2 ] || { echo "PROVE: --base requires a value"; exit 2; }
+      BASE_URL="${2%/}"; base_explicit=1; shift 2 ;;
+    --self-test)
+      self_test=1; shift ;;
+    -h|--help)
+      prove_usage; exit 0 ;;
+    -*)
+      # THE ROOT CAUSE, closed. A token that looks like a flag and is not one is
+      # a caller asking for something this script cannot do — never a cycle slug.
+      # Silently continuing is how `--base https://one.ie` became a no-op.
+      echo "PROVE: unknown flag '$1'" >&2
+      prove_usage >&2
+      exit 2 ;;
     *)
       # A real path (exists on disk relative to root or cwd) counts as a changed
       # path; anything else (a cycle slug) is noted and ignored for detection.
@@ -71,6 +124,17 @@ while [ "$#" -gt 0 ]; do
   esac
 done
 
+# An explicit --base means "prove HERE, nowhere else". Only an explicitly
+# exported PROVE_PROD_URL may name a different fallback (land.sh does exactly
+# that, pinning both to the dev URL).
+if [ "$base_explicit" -eq 1 ] && [ -z "${PROVE_PROD_URL:-}" ]; then
+  PROD_URL="$BASE_URL"
+fi
+
+if [ "$self_test" -eq 1 ]; then
+  exec bash "$ROOT/.claude/scripts/do-prove-selftest.sh" "$ROOT/.claude/scripts/do-prove.sh"
+fi
+
 # stdin (piped) paths
 if [ "${#paths[@]}" -eq 0 ] && [ ! -t 0 ]; then
   while IFS= read -r l; do [ -n "$l" ] && paths+=("$l"); done || true
@@ -265,6 +329,11 @@ report_redirect() { # $1 = route, $2 = landed path, $3 = leg label
   esac
 }
 
+# The result line used to hardcode the word "dev" — so a production run
+# printed "(dev https://one.ie)" on the very receipt someone reads to decide
+# whether the site is live. Name the leg for what it is.
+if _prove_local_base; then LEG="dev $BASE_URL"; else LEG="base $BASE_URL"; fi
+
 fail=0
 checked=0
 for route in "${routes[@]}"; do
@@ -341,14 +410,14 @@ for route in "${routes[@]}"; do
       # the browser leg never did, so a nonexistent route proved itself green
       # whenever the page also logged no errors. 401/403 stay ok — gated, not gone.
       if [ -n "$final" ] && [ "$landed" != "$(path_of "$route")" ]; then
-        report_redirect "$route" "$landed" "dev $BASE_URL"
+        report_redirect "$route" "$landed" "$LEG"
         fail=1
       elif [ "$status" -ge 500 ] || [ "$status" -eq 404 ] || [ "$errs" -gt 0 ]; then
-        echo "PROVE: FAIL $route — http=$status console/js errors=$errs (dev $BASE_URL)"
+        echo "PROVE: FAIL $route — http=$status console/js errors=$errs ($LEG)"
         printf '%s' "$out" | jq -r "$counted[]" 2>/dev/null | head -5 | sed 's/^/PROVE:   error: /'
         fail=1
       else
-        echo "PROVE: ok $route — http=$status, 0 console/js errors (dev $BASE_URL)"
+        echo "PROVE: ok $route — http=$status, 0 console/js errors ($LEG)"
       fi
       # Never silent: an ignored error is still an error someone should see.
       ign="$(printf '%s' "$out" | jq -r "$ignored" 2>/dev/null || echo 0)"
@@ -372,11 +441,11 @@ for route in "${routes[@]}"; do
       # running a tree without the page, and that line was the 17th leg of a
       # promise's proof. 401/403 stay ok: the route answered, it is merely gated.
       if [ -n "$effective" ] && [ "$landed" != "$(path_of "$route")" ]; then
-        report_redirect "$route" "$landed" "dev $BASE_URL, curl"; fail=1
+        report_redirect "$route" "$landed" "$LEG, curl"; fail=1
       elif [ "$code" -ge 500 ] || [ "$code" -eq 404 ]; then
-        echo "PROVE: FAIL $route — http=$code (dev $BASE_URL, curl)"; fail=1
+        echo "PROVE: FAIL $route — http=$code ($LEG, curl)"; fail=1
       else
-        echo "PROVE: ok $route — http=$code (dev $BASE_URL, curl)"
+        echo "PROVE: ok $route — http=$code ($LEG, curl)"
       fi
     fi
   fi
@@ -405,6 +474,13 @@ if [ "$fail" -eq 1 ]; then
   echo "PROVE: fail"; exit 1
 fi
 if [ "$checked" -eq 0 ]; then
+  # An explicitly named base that answered nothing is an UNRUN PROOF, and
+  # do-promise-settle.sh reads this exit code verbatim. Exit 0 here would settle
+  # a promise KEPT because the site was unreachable.
+  if [ "$base_explicit" -eq 1 ]; then
+    echo "PROVE: FAIL — --base $BASE_URL answered nothing; an unrun proof is not a pass"
+    exit 1
+  fi
   echo "PROVE: skipped (no reachable environment)"; exit 0
 fi
 echo "PROVE: pass ($checked route(s) proven)"; exit 0