smoke gate: no floor on executed-assertion count — a near-empty run reads PASSED

[unforced]

Follow-up nit from the #218 review (non-blocking; #218 is correct as shipped).

summarize() in scripts/smoke-report.ts sets exitCode from fail alone, with no floor on pass:

summarize({pass: 0, fail: 0, advisory: 7})
-> exit 0 | SMOKE PASSED — 0 pass, 0 fail, 7 advisory (UNVERIFIED — see below)

That is correct per invariant 1 (advisories never gate) and the state is currently unreachable: login is outside any liveCatch range and runs first, so a dead staging throws and main().catch() exits 1 before reaching a wrapped section.

The point is that the safety is emergent, not pinned. It holds because of where login happens to sit in the file, and nothing fails if a future change wraps an early section or moves login. A floor makes it explicit:

• assert a minimum executed-assertion count (or pass > 0) before allowing exit 0, and
• add a smoke-report.test.ts case for {pass: 0, fail: 0, advisory: N}.

Related cosmetic point: an advisory-only run still leads with the word PASSED. Honest by design, and the caveat is on the same line, but a hurried CI scan reads green. Optional: lead with PASSED (2 UNVERIFIED).

[unforced]

Second item for the same file, from the auth-and-scope specialist pass on #218.

isUnverifiable checks error type first (good), but then falls through to a message regex that is applied regardless of type:

/timed out|timeout|fetch failed|network|unreachable|ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|socket|terminated/i

So a structural throw — a TypeError from a null deref, a SyntaxError from JSON.parse on an HTML error page — whose message happens to contain one of those tokens gets downgraded from fatal to advisory. socket, network and terminated are the realistic collisions; undici and workerd both produce messages containing them for causes that are genuinely broken rather than merely unreachable.

Not currently exploitable — the tests pin the common TypeError shape to fatal, and today's throws come from fetch/JSON.parse which are unlikely to carry a network word by accident. Latent edge, not a live hole. But it is the one place where the classification can fail in the dangerous direction (real break read as "couldn't verify"), so it is worth closing while the file is fresh.

One-line fix — never let a structural throw reach the message heuristic:

if (err instanceof TypeError || err instanceof SyntaxError) return false;

placed before the regex. Add a test with a TypeError whose message contains socket and assert it classifies fatal.