Why: the CI runner container has no iproute2, so port_listening went blind: recover started a service onto a thief-held port and the health probe hit the thief (HTTP 200), reporting a bogus start success. Evidence: no-ss PATH simulation shows the fallback detects a bound port and passes free ports; make test-governance rerun recorded on the task card; CI on the new head is authoritative. Impact: scripts/svc.sh port_listening only (ss stays primary when present). Refs: .task/feature-svc-autorecover.md