Best possible solution:

Land the cleanup after normal required checks complete, keeping helpers with different lifecycle or ownership semantics local.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this PR is a cleanup refactor rather than a reported bug. The review path was source comparison of the helper contract, sibling helper boundaries, and the PR's focused validation evidence.

Is this the best way to solve the issue?

Yes; exporting the existing root test utility is the narrowest maintainable solution for these exact duplicate bind-close helpers, while helpers with different semantics remain local.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against faa4f4782e76.

Label changes:

• add P3: This is a low-risk maintainer cleanup of test helper duplication with no user-facing runtime behavior change.
• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a maintainer-labeled test-only cleanup, so the external-contributor real behavior proof gate does not apply.

Label justifications:

• P3: This is a low-risk maintainer cleanup of test helper duplication with no user-facing runtime behavior change.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a maintainer-labeled test-only cleanup, so the external-contributor real behavior proof gate does not apply.

PR surface:

Source 0, Tests -84. Total -84 across 5 files.

What I checked:

• Shared helper export matches the old contract: At the PR head, src/test-utils/ports.ts exports isPortFree and getFreePort; getFreePort still binds port 0 on 127.0.0.1, reads the assigned TCP port, closes the server, and resolves only after close succeeds. (src/test-utils/ports.ts:18, 256eaeff50de)
• Gateway derived-port semantics remain local: The gateway live test imports the shared helpers, but getFreeGatewayPort still owns the gateway-specific derived-port check for port, port + 1, port + 2, and port + 4. (src/gateway/gateway-models.profiles.live.test.ts:1951, 256eaeff50de)
• Script-test import follows an existing test pattern: Repository tests already import utilities from src/test-utils, and the changed script test now uses that same repo-internal test utility path for the plain bind-close port allocation. (test/scripts/e2e-mock-config-limits.test.ts:9, 256eaeff50de)
• Sibling helpers with different semantics were not collapsed: A focused helper search still shows separate helpers for deterministic gateway blocks, held live servers, package tests, and provider-local-service tests, which matches the PR body's stated boundary.
• Patch validation is clean for whitespace and reported focused checks: git diff --check against the PR head produced no output, and the live PR body reports the focused Vitest command, Blacksmith Testbox tbx_01kwnf4dmknfx3bxhca58zt15j check:changed, autoreview, and git diff --check as passing. (256eaeff50de)
• Port helper history: History shows Peter Steinberger introduced and later adjusted the deterministic port helper area, including test: stabilize gateway ports and timers and test: spread deterministic port blocks by process. (src/test-utils/ports.ts:44, 1a0d1cb7b23c)

Likely related people:

• Peter Steinberger: Introduced and refined the deterministic port helper and gateway test helper behavior used as the central shared surface for this cleanup. (role: test port helper feature owner; confidence: high; commits: 1a0d1cb7b23c, 208398973baf, fc5a231e9578; files: src/test-utils/ports.ts, src/gateway/test-helpers.server.ts)
• Vincent Koc: Recent history shows live gateway model profile test and src/test-utils/ports.ts work in the release smoke stabilization area touched by this PR. (role: recent live-gateway test contributor; confidence: medium; commits: e085fa1a3ffd; files: src/gateway/gateway-models.profiles.live.test.ts, src/test-utils/ports.ts)
• Friederike Seiler: Added the Chutes OAuth tests whose local free-port helper is now replaced by the shared test utility. (role: introduced Chutes OAuth test surface; confidence: medium; commits: 4efb5cc18efa; files: src/commands/chutes-oauth.test.ts, src/agents/chutes-oauth.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.