diff --git a/docs/superpowers/plans/2026-07-05-native-port-takeover.md b/docs/superpowers/plans/2026-07-05-native-port-takeover.md
index 1e7faf8..dfafad1 100644
--- a/docs/superpowers/plans/2026-07-05-native-port-takeover.md
+++ b/docs/superpowers/plans/2026-07-05-native-port-takeover.md
@@ -244,7 +244,7 @@ ID="cloudlinux"
 VERSION_ID="8.9"
 ID_LIKE="rhel fedora centos"
 EOF
-if OS_RELEASE_FILE="$TMP_DIR/os-release-cloudlinux" check_os_guard 2>/dev/null; then
+if ( OS_RELEASE_FILE="$TMP_DIR/os-release-cloudlinux" check_os_guard 2>/dev/null ); then
   fail "CloudLinux must be refused by the OS guard"
 fi
 
@@ -253,7 +253,7 @@ cat > "$TMP_DIR/os-release-alma7" <<'EOF'
 ID="almalinux"
 VERSION_ID="7.9"
 EOF
-if OS_RELEASE_FILE="$TMP_DIR/os-release-alma7" check_os_guard 2>/dev/null; then
+if ( OS_RELEASE_FILE="$TMP_DIR/os-release-alma7" check_os_guard 2>/dev/null ); then
   fail "AlmaLinux 7 must be refused by the OS guard (only 8/9 supported)"
 fi
 
@@ -313,13 +313,24 @@ chmod 755 "$TMP_DIR/bin/ss"
 PATH="$TMP_DIR/bin:$PATH" NEW_NATIVE_PORT="3307" preflight_new_port_free \
   || fail "preflight_new_port_free should pass when the target port is free"
 
-if PATH="$TMP_DIR/bin:$PATH" NEW_NATIVE_PORT="9999" preflight_new_port_free 2>/dev/null; then
+if ( PATH="$TMP_DIR/bin:$PATH" NEW_NATIVE_PORT="9999" preflight_new_port_free 2>/dev/null ); then
   fail "preflight_new_port_free should refuse when the target port is already occupied"
 fi
 
 echo "native_mariadb_port_takeover_detect_test: OK"
 ```
 
+Note: the three "expected to fail" calls above (`check_os_guard` for CloudLinux and
+AlmaLinux 7, and `preflight_new_port_free` for an occupied port) are each wrapped in a
+subshell `( ... )` rather than called bare. This test sources the script directly rather
+than executing it as a subprocess, so a bare failing call's `die()` → `exit 1` would
+terminate the whole sourcing shell (this test script itself), never letting the `if`
+statement observe the failure. Wrapping the call in `( ... )` confines that `exit` to the
+subshell, so `if ( failing_call ); then` correctly observes a non-zero status without
+killing the test. Do not "fix" this by changing `die()` to use `return` instead of
+`exit` — `die()` is also used when this script is executed directly (not sourced), where
+`exit` is the correct, intended behavior.
+
 - [ ] **Step 2: Run test to verify it fails**
 
 Run: `bash tests/native_mariadb_port_takeover_detect_test.sh`