diff --git a/test/cli.sh b/test/cli.sh
index 6c2883b..6d4220f 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -3308,7 +3308,17 @@ check "hermetic: cibox_run() seals the real /usr/local/bin lookup" 0 "" cibox_ru
 # The failed-logout check builds its own env rather than calling undo(), so it
 # needs the same seal — and it is the one that was missed first time round.
 inline_undo_is_sealed() {
-  grep -A 4 'failed logout is loud' "$0" | grep -q 'RIG_FORGEJO_RUNNER_DIR='
+  # Locate the REAL check by line number and read only its own block. Anchoring
+  # on a string and grepping the whole file cannot work here: any pattern this
+  # function searches for necessarily appears inside this function, so the
+  # search matches itself and can never fail. kimi caught the first version of
+  # that on !137; the anchored second version had the identical flaw for the
+  # identical reason. head -1 takes the real check (~:202), never this body.
+  local start end
+  start="$(grep -n 'failed logout is loud' "$0" | head -1 | cut -d: -f1)"
+  [ -n "$start" ] || return 1
+  end=$((start + 5))
+  sed -n "${start},${end}p" "$0" | grep -q RIG_FORGEJO_RUNNER_DIR
 }
 check "hermetic: the hand-rolled undo invocation is sealed too" 0 "" inline_undo_is_sealed