jschoubben
44d3e53bcb
**A password beginning with a dash broke the search for it.** The credential test greps the machine's own files for the delivered password; this run's password started `-S`, so grep read it as an option and refused the whole invocation. The test compared the usage message against "0" and reported the password as leaked. That is the worst way for a search to fail — it says it found something. Fixed with `-e` and `--`, which is what those exist for. **The planning test could not redirect what the scenario does not serve.** Rewriting an image reference only works for repositories the scenario's registry actually holds, and the object store's provisioner was not stocked — so that module kept its placeholder and the refusal fired, correctly. It is stocked now, so all five are planned again. The skip path stays for anything genuinely unserved, and says which module and why: a planning test quietly covering four instead of five is the false coverage this suite exists to prevent. **The forge failed because of the one above it.** The planning test threw before its cleanup could run, leaving a module assigned that refused the next push, so no database container was ever created. Yesterday's fix moved that cleanup where a failure cannot skip it — but `after` still only unassigns what was assigned, so it now tracks what actually got added rather than what was intended.