diff --git a/.tests/test.sh b/.tests/test.sh
index 274f48e..54420d3 100755
--- a/.tests/test.sh
+++ b/.tests/test.sh
@@ -167,7 +167,11 @@ is "…including scp-style ssh" \
 # normalisation that becomes .../bootstrap.env/bootstrap.env -- a 404 that
 # curl --fail turns into "endpoint refused the credentials", blaming the
 # password for a URL shape. Both forms must land on the same request.
-norm() { P_URL=$1; eval "$(sed -n '/^\tP_URL=\${P_URL%\//p;/^\tP_URL=\${P_URL%\/bootstrap.env}/p' $D)"
+# Indentation-agnostic on purpose: these two lines moved from function body to
+# inside the retry loop, and an anchor of `^\t` silently stopped matching, so
+# the eval became a no-op and the assertions failed as if dotup were broken.
+# Bind to the statement, not to where it happens to sit.
+norm() { P_URL=$1; eval "$(sed -n 's/^[[:space:]]*\(P_URL=\${P_URL%[^}]*}\)$/\1/p' $D)"
          printf '%s\n' "${P_URL%/}/bootstrap.env"; }
 is "a directory URL resolves to the blob" "https://h/r/bootstrap.env" \
    "$(norm 'https://h/r/')"