Why: check_port_free consulted port_owner (ss -ltnp) only, so the /dev/tcp fallback added to port_listening never ran on the start path; CI (no iproute2) still started onto a thief-held port. Evidence: no-ss simulation refuses a bound port and passes a free one; full suite 10/10 and make test-governance rerun recorded on the card; CI on the new head is authoritative. Impact: scripts/svc.sh check_port_free only. Refs: .task/feature-svc-autorecover.md