@@ -56,9 +56,8 @@ import Database from 'better-sqlite3';
 import {
   childEnv,
   E2E_SECRET_KEY,
-  portContentionError,
-  portDriftError,
-  randomPort,
+  KERNEL_ASSIGNED_PORT,
+  readKernelAssignedPort,
   requireBuiltCli,
   RUN_JS_RESOLVES_FROM_DIST,
 } from './helpers/serve-process.js';
@@ -120,8 +119,14 @@ function stageBareIndex(): void {
   }
 }
 
-/** Boot `os <argv>` until its ready banner, then stop the whole group and return what it printed. */
-function bootUntilReady(argv: string[], port: string, env: Record<string, string | undefined>): Promise<string> {
+/**
+ * Boot `os <argv>` until its ready banner, then stop the whole group and return what it printed.
+ *
+ * Every call passes `-p KERNEL_ASSIGNED_PORT` (#24295): the production leg's child refuses to
+ * auto-shift, so a port drawn and released beforehand is a red whenever another process takes
+ * it in the gap. Nothing here talks to the port; the read-back only checks the banner names one.
+ */
+function bootUntilReady(argv: string[], env: Record<string, string | undefined>): Promise<string> {
   return new Promise((resolveBoot, rejectBoot) => {
     const child = spawn(process.execPath, [CLI, ...argv], {
       cwd: dir,
@@ -163,13 +168,14 @@ function bootUntilReady(argv: string[], port: string, env: Record<string, string
     );
     const onData = (d: unknown) => {
       out += String(d);
-      if (READY.test(out)) finish(portDriftError(out, `os ${argv[0]}`, port));
+      if (!READY.test(out)) return;
+      const bound = readKernelAssignedPort(out, `os ${argv[0]}`);
+      finish(bound instanceof Error ? bound : null);
     };
     child.stdout?.on('data', onData);
     child.stderr?.on('data', onData);
     child.on('exit', (code) =>
-      finish(portContentionError(out, `os ${argv[0]}`, port)
-        ?? new Error(`os ${argv[0]} exited ${String(code)} before ${READY}\n--- output ---\n${out.slice(-4000)}`)),
+      finish(new Error(`os ${argv[0]} exited ${String(code)} before ${READY}\n--- output ---\n${out.slice(-4000)}`)),
     );
   });
 }
@@ -216,18 +222,15 @@ beforeAll(async () => {
   db = join(dir, 'A.db');
 
   // Boot 1: fresh, with the telemetry opt-out.
-  let port = randomPort();
-  await recordBoot('fresh', bootUntilReady(['dev', '--no-watch', '-d', 'file:A.db', '-p', port], port, { OS_TELEMETRY_DB: '0' }));
+  await recordBoot('fresh', bootUntilReady(['dev', '--no-watch', '-d', 'file:A.db', '-p', KERNEL_ASSIGNED_PORT], { OS_TELEMETRY_DB: '0' }));
 
   // Boot 2: the card's restart, on the restaged bare index, telemetry default-on.
   if (existsSync(db)) stageBareIndex();
-  port = randomPort();
-  await recordBoot('restart', bootUntilReady(['dev', '--no-watch', '-d', 'file:A.db', '-p', port], port, {}));
+  await recordBoot('restart', bootUntilReady(['dev', '--no-watch', '-d', 'file:A.db', '-p', KERNEL_ASSIGNED_PORT], {}));
 
   // Boot 3: production (`os serve`, NODE_ENV unset) on the restaged bare index.
   if (existsSync(db)) stageBareIndex();
-  port = randomPort();
-  await recordBoot('production', bootUntilReady(['serve', 'objectstack.config.ts', '-p', port], port, {
+  await recordBoot('production', bootUntilReady(['serve', 'objectstack.config.ts', '-p', KERNEL_ASSIGNED_PORT], {
     OS_DATABASE_URL: 'file:A.db',
     OS_AUTH_SECRET: 'e2e-21733-production-leg-secret-not-for-real-use',
     OS_LOG_LEVEL: 'warn',
 
@@ -181,8 +181,9 @@ function probeBind(want: number): number | null {
 }
 
 /**
- * The ONE port draw for every e2e spawn in this directory — a real bind probe,
- * not a blind `Math.random()` (#12441).
+ * The released-port draw — a real bind probe, not a blind `Math.random()`
+ * (#12441) — for the spawns that still take a number. ⛔ NOT for a spawn that
+ * can reach production posture: those take {@link KERNEL_ASSIGNED_PORT}.
  *
  * Listen on `0.0.0.0:0`, read the port the kernel assigned, close the listener,
  * return the port for the caller to hand to `os serve`.
@@ -209,10 +210,33 @@ function probeBind(want: number): number | null {
  * ⛔ The comment this replaced claimed "a run never contends with another
  * agent's dev server on this host". That unqualified negative is the reason
  * nobody re-examined the draw until a real run in this fleet went red on
- * `✗ Port 49402 is already in use`. **Do not write another one here.** The
- * residual race is real and unclosed; what pays for it is
- * `portContentionError()` below, which makes the residual failure SAY it is a
- * port race instead of `serve exited 1 before "Server is ready"`.
+ * `✗ Port 49402 is already in use`. **Do not write another one here.**
+ *
+ * ## Where the race is closed, and where this draw is still allowed (#24295)
+ *
+ * The residual race reached `main` once: an hourly run went red on
+ * `start-mcp-stdio-early-initialize.integration.test.ts`, whose `os start`
+ * child refused a port taken inside this gap. A production-posture child
+ * refuses to auto-shift by design, so for that column the gap is a red, and it
+ * is now CLOSED rather than narrowed: such a spawn passes
+ * {@link KERNEL_ASSIGNED_PORT} and reads the port back with
+ * {@link readKernelAssignedPort}, so no number crosses a gap at all.
+ * `released-port-production-spawn.pin.test.ts` holds it: a file that names the
+ * production-capable entry (`bin/run.js`) may call this or `randomPort()` only
+ * as often as its ledger entry there allows — zero without one, and an entry is
+ * a file whose every spawn of that entry is development posture.
+ *
+ * What may still call it, each with the race still real and unclosed there:
+ *
+ *   • the DEVELOPMENT column — `runServe()` and every other child of
+ *     `bin/run-dev.js`, which pins `NODE_ENV=development` before argv is
+ *     parsed. A lost race there is a hop to the next port, not an exit, and
+ *     `portDriftError()` below is what turns that hop into a red;
+ *   • instruments that need a number NOTHING is listening on (a closed-port
+ *     probe), or that measure this draw itself (`serve-port-bind-probe`).
+ *
+ * `portContentionError()` below is what makes a residual loss SAY it is a port
+ * race instead of `serve exited 1 before "Server is ready"`.
  *
  * ⚠️ One property that is worse than the old range and is stated rather than
  * hidden: the kernel assigns from its ephemeral range
@@ -288,15 +312,73 @@ export function holdPort(): Promise<{ port: number; release: () => Promise<void>
  *
  * ⚠️ The name is kept — and is now a slight misnomer, which is cheaper than the
  * alternative. It is `String(reservePort())` and nothing else; the draw, the
- * guarantees and the residual race are all documented on `reservePort()` above
- * and there is no second mechanism hiding behind this name. Renaming it would
- * be a rename-only edit across the 8 other files in this directory that call
- * it, which is churn this change deliberately does not spend.
+ * guarantees, the residual race and the columns it may still serve (the
+ * development column and instruments — never a production-capable spawn) are
+ * all documented on `reservePort()` above, and there is no second mechanism
+ * hiding behind this name.
  */
 export function randomPort(): string {
   return String(reservePort());
 }
 
+/**
+ * ⭐ The CLOSED mechanism for a spawn that can reach production posture (#24295):
+ * the `--port` value that asks the CHILD's own `listen()` for a kernel-assigned
+ * port, so no number is ever unheld between a pick and a bind.
+ *
+ * `0` is a legal request, not an error (`utils/port-contract.ts` declares
+ * `MIN_PORT = 0` from a measurement), and both doors honour it in production
+ * posture: `os serve` on `--port 0`, `OS_PORT=0` and `PORT=0`, and `os start`
+ * on `--port 0`. Measured on the built CLI for #24295: every leg printed a
+ * banner whose `API:` row named a non-zero port, and `GET /api/v1/health` on
+ * that port answered `200`; the same two doors on a port this harness HELD
+ * exited 1 on `Port <n> is already in use`, which is the lost race forced on
+ * purpose.
+ *
+ * The price is that the caller learns the port only AFTER the boot: read it with
+ * {@link readKernelAssignedPort} once the banner tail has printed. A site that
+ * needs the number BEFORE the spawn (a base URL written into a config, an
+ * assertion on which of two numbers won) first asks whether the number it
+ * needs is really the SERVER's: a port the test only has to know, and that must
+ * not be the one the child binds, is a {@link holdPort} that stays bound for the
+ * whole boot — and a held port cannot be the one the kernel assigns.
+ */
+export const KERNEL_ASSIGNED_PORT = '0';
+
+/**
+ * The port a child spawned on {@link KERNEL_ASSIGNED_PORT} actually bound, read
+ * out of its own ready banner — or an `Error` saying why it cannot be read.
+ *
+ * Returned rather than thrown because every caller reads it inside a stream
+ * handler, where a throw escapes the boot's promise; the shape follows
+ * `portDriftError()` and `portContentionError()`, which return their `Error`.
+ *
+ * Call it once the banner TAIL (`Press Ctrl+C to stop`) has printed —
+ * `boundPortFromBanner()` explains why the tail and not the head. Three answers
+ * are refused rather than guessed at:
+ *
+ *   • no complete banner — nothing announced a port;
+ *   • a banner whose `API:` row names no `http://localhost:<port>` — a child
+ *     carrying `OS_AUTH_URL` / `BETTER_AUTH_URL` / `OS_BASE_URL` prints that
+ *     origin instead, and the read-back channel goes with it;
+ *   • `http://localhost:0` — the REQUEST announced in place of the bound port,
+ *     the regression #13062 fixed and `portDriftError()` already names.
+ */
+export function readKernelAssignedPort(output: string, what: string): number | Error {
+  const readback = boundPortFromBanner(output);
+  if (readback.state === 'bound' && readback.port > 0) return readback.port;
+  const said = readback.state === 'no-banner'
+    ? 'printed no complete ready banner, so it never announced a port'
+    : readback.state === 'unreadable'
+      ? `printed a ready banner whose API row names no http://localhost address: ${readback.apiRow}`
+      : 'announced http://localhost:0 — the request, not the port it bound';
+  return new Error(
+    `CANNOT READ BACK THE BOUND PORT of \`${what}\`: it was asked for port ${KERNEL_ASSIGNED_PORT} `
+    + `(a kernel-assigned port, so the harness holds no number of its own) and ${said}.\n`
+    + `--- child output ---\n${output}`,
+  );
+}
+
 /** How a boot says the port was taken — `serve.ts`'s own diagnostic, then the raw kernel error. */
 const PORT_TAKEN_PATTERNS = [
   /Port (\d+) is already in use/,
@@ -325,6 +407,12 @@ const PORT_TAKEN_PATTERNS = [
  * say, in the message, that the port WAS probed free moments earlier — which is
  * what tells the reader this is the residual TOCTOU gap and not a harness that
  * never looked.
+ *
+ * ⛔ Not for a child spawned on {@link KERNEL_ASSIGNED_PORT} (#24295). That child
+ * was handed no number to lose, so a `Port <n> is already in use` from it is
+ * NOT this race, and this message — "a HOST race, not a verdict about the code
+ * under test" — would misattribute a real defect. Such a site reports the
+ * child's own output instead.
  */
 export function portContentionError(
   output: string,
@@ -457,14 +545,16 @@ export type BannerPortReadback =
  *     `--dev`, whatever NODE_ENV                    SILENT drift, GREEN boot
  *     `bin/run-dev.js` (NODE_ENV pinned at :28)     SILENT drift, GREEN boot
  *
- * Measured on this tree: `serve-node-env-production-default.e2e.test.ts` is the
- * ONLY file in this directory that is in the loud row. Every `runServe()` child
- * is in the silent one by the third route, and the three `serve-mcp-*` /
- * `serve-stdio-*` spawners are in it by the second — they pass `--dev`, so the
- * `bin/run.js` entry buys them nothing. ⛔ Do not restate the older reading
- * ("`bin/run.js` + unset `NODE_ENV` ⇒ loud"): it is the sentence that made this
- * population look half its real size, and it survived because `--dev` on those
- * spawn lines predates the cards blamed for it and was simply never read.
+ * Every `runServe()` child is in the silent row by the third route, and a
+ * `bin/run.js` spawner that passes `--dev` is in it by the second. ⛔ Do not
+ * restate the older reading ("`bin/run.js` + unset `NODE_ENV` ⇒ loud"): it is
+ * the sentence that made this population look half its real size. Which files
+ * are in the loud row is ⛔ not counted here either — an earlier count here
+ * ("the ONLY file") went stale as `bin/run.js` spawners were added. The loud row
+ * can only be reached through `bin/run.js`, so
+ * `released-port-production-spawn.pin.test.ts` enumerates every file that names
+ * it, and holds each of them to {@link KERNEL_ASSIGNED_PORT} unless its ledger
+ * entry there says why not (#24295).
  *
  * And the port `runServe()` hands over is an opaque element of an argv list, so
  * until this read-back the harness never learned the child's real one. A test
@@ -500,8 +590,9 @@ export function boundPortFromBanner(output: string): BannerPortReadback {
  * Shaped like `portContentionError()` above and used at the same place, because
  * it is the same host race seen through the other entrypoint: something took
  * the port between this harness's bind probe and the child's `listen()`. The
- * production column dies loudly and gets `portContentionError()`; the
- * development column drifts and gets this.
+ * production column would die loudly, which is why it no longer draws (it takes
+ * {@link KERNEL_ASSIGNED_PORT}, #24295); the development column drifts and gets
+ * this — the race is still real there, and this is what makes it a red.
  *
  * ## Why `unreadable` is an ERROR and not a skip
  *