diff --git a/tests/Integration/divi-read-smoke.sh b/tests/Integration/divi-read-smoke.sh
index 3c32604..ea377f6 100755
--- a/tests/Integration/divi-read-smoke.sh
+++ b/tests/Integration/divi-read-smoke.sh
@@ -18,7 +18,7 @@ cleanup() {
   done
   cleanup_app_passwords_for "$ADMIN_LOGIN"
 }
-trap cleanup EXIT
+trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
 
 # Creates a draft page from a fixture file as the admin (no kses re-serialization) and prints its ID.
 create_page() { # $1 = fixture file, $2 = title
@@ -98,4 +98,4 @@ pass "content-get points to the Divi tools; Divi 4 content is refused"
 [ "$(content_hash "$PAGE_ID")" = "$BEFORE" ] || fail "reading changed post_content"
 pass "post_content unchanged after reading"
 
-echo "ALL CHECKS PASSED"
+finish
diff --git a/tests/Integration/divi-write-smoke.sh b/tests/Integration/divi-write-smoke.sh
index 3677238..15d0bd5 100755
--- a/tests/Integration/divi-write-smoke.sh
+++ b/tests/Integration/divi-write-smoke.sh
@@ -37,7 +37,7 @@ foreach (array_filter(explode(" ", (string) getenv("LIT_IDS"))) as $id) {
   wp role delete lit_smoke_editor >/dev/null 2>&1 || true
   wp option update lit_mcp_allowed_roles "$ORIGINAL_ROLES" --format=json >/dev/null 2>&1 || true
 }
-trap cleanup EXIT
+trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
 
 create_page() { # $1 = fixture file ("" = empty page), $2 = title -> prints the ID
   LIT_FILE="${1:+$FIXTURES/$1}" LIT_TITLE="$2" wp --user="$ADMIN_LOGIN" eval '
@@ -361,4 +361,4 @@ echo "$AGAIN" | jq -e '.ok == true and (.warnings | any(contains("beim Speichern
   || fail "8b: follow-up write with the new tree_rev: $AGAIN"
 pass "Divi save filters, other byte form: normalized with CHANGED_ON_SAVE, tree_rev = stored state, page valid, then stable"
 
-echo "ALL CHECKS PASSED"
+finish
diff --git a/tests/Integration/lib.sh b/tests/Integration/lib.sh
index ab64ba7..21d11c5 100644
--- a/tests/Integration/lib.sh
+++ b/tests/Integration/lib.sh
@@ -20,6 +20,20 @@ INIT_RESPONSE=""
 REQUEST_ID=100
 
 fail() { echo "FAIL: $*"; exit 1; }
+
+# A smoke script must reach its last line: finish() marks that and prints the verdict.
+# guard_exit (called first in every EXIT trap) turns any other exit – including a silent
+# stop that still returns 0 – into a failure, so a run can never pass without all checks.
+SMOKE_FINISHED=0
+finish() { SMOKE_FINISHED=1; echo "ALL CHECKS PASSED"; }
+guard_exit() {
+  local rc=$1
+  if [ "$rc" -eq 0 ] && [ "$SMOKE_FINISHED" != 1 ]; then
+    echo "FAIL: script stopped before its last check (exit 0 without finish)"
+    return 1
+  fi
+  return "$rc"
+}
 pass() { echo "ok   - $*"; }
 
 # Removes every "lit-mcp-integration-test" application password of a user.
diff --git a/tests/Integration/mcp-smoke.sh b/tests/Integration/mcp-smoke.sh
index 9e80296..ecb7d8f 100644
--- a/tests/Integration/mcp-smoke.sh
+++ b/tests/Integration/mcp-smoke.sh
@@ -18,7 +18,7 @@ cleanup() {
   cleanup_app_passwords_for lit-smoke-sub
   wp user delete lit-smoke-sub --yes >/dev/null 2>&1 || true
 }
-trap cleanup EXIT
+trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
 
 # 0. Booting REST triggers no _doing_it_wrong(). A regression in the
 # unhook-before-create ordering (ServerRegistrar::createServer()) would
@@ -156,4 +156,4 @@ echo "$SUB_META" | grep -Eq 'lacks required capability|nicht freigegeben' \
   || fail "execute-ability denial lacks role-gate message: $SUB_META"
 pass "role gate blocks subscriber (direct tool and meta-tool)"
 
-echo "ALL CHECKS PASSED"
+finish
diff --git a/tests/Integration/media-admin-smoke.sh b/tests/Integration/media-admin-smoke.sh
index 64a2b1c..e39c710 100755
--- a/tests/Integration/media-admin-smoke.sh
+++ b/tests/Integration/media-admin-smoke.sh
@@ -27,7 +27,7 @@ cleanup() {
   cleanup_app_passwords_for lit-smoke-sub2
   wp user delete lit-smoke-sub2 --yes >/dev/null 2>&1 || true
 }
-trap cleanup EXIT
+trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
 
 connect "$ADMIN_LOGIN"
 
@@ -149,4 +149,4 @@ echo (int) $wpdb->get_var($wpdb->prepare(
 [ "$ROWS" -ge 2 ] || fail "media changes not logged (found $ROWS)"
 pass "media changes logged"
 
-echo "ALL CHECKS PASSED"
+finish
diff --git a/tests/Integration/wp-basis-smoke.sh b/tests/Integration/wp-basis-smoke.sh
index f44cf25..bb6d84b 100644
--- a/tests/Integration/wp-basis-smoke.sh
+++ b/tests/Integration/wp-basis-smoke.sh
@@ -35,7 +35,7 @@ cleanup() {
   [ "$PODS_WAS_ACTIVE" = "no" ] && wp plugin deactivate pods >/dev/null 2>&1 || true
   cleanup_app_passwords_for "$ADMIN_LOGIN"
 }
-trap cleanup EXIT
+trap 'rc=$?; cleanup; guard_exit "$rc" || exit $?' EXIT
 
 wp plugin activate pods >/dev/null
 wp eval-file "$PLUGIN/tests/Integration/pods-fixture.php" create >/dev/null
@@ -223,4 +223,4 @@ ROWS=$(wp db query "SELECT COUNT(*) FROM ${PREFIX}lit_mcp_log WHERE ability = 'l
 [ "$ROWS" -ge 2 ] || fail "change log rows missing (found $ROWS)"
 pass "change log records ability and client"
 
-echo "ALL CHECKS PASSED"
+finish