[grimen]

main is red. The Live DocuSign job fails at boot, before it reaches DocuSign at all:

mint-only-demo did not answer within 30s
DocuSignConfigError: DocuSign: missing configuration: DOCUSIGN_RETURN_URL
  workspace esign-mint-only-example@0.0.1

Why

Minting a hosted-form instance requires a returnUrl (HOSTED_FORM_SETTINGS). The demo
serves its own bridge at GET /signing/return but cannot know its own public origin, so
the value is configuration with no safe default — unlike the service, which defaults it
from its own port.

Nothing was setting it for the demos. It looked fine locally because live_env sources
packages/esign-service/.env with set -a, leaking that file's DOCUSIGN_RETURN_URL —
the service's, at the service's port — into every process the suite starts. The branch
CI takes exports only the JWT credentials and the ids, so in CI the demos booted with no
return URL at all.

That is the general shape to watch for here: a component that quietly relies on a leaked
variable is green locally and red in CI. The failure-modes table in
docs/operations/live-e2e-ci.md now says so, with this row added.

What changed

server-demos-smoke.sh's start() derives the return URL per demo from the port that
demo was given, exactly as live_service_up already does for the service. Explicit beats
inherited twice over: CI gets a value, and the local run stops silently pointing the demos
at the service's bridge.

Verified

Booted mint-only-demo with the job's exact environment — the four JWT credentials and the
ids, no return URL: fails with that error without the variable, boots with it. The mock
server-demos-smoke.sh is green on the CI port base. make e2e-live is the real check and
needs the DocuSign credentials.