Two port-reservation registries now run the same protocol in different directories — converge `sdui_pick_free_port` and `smoke_pick_free_port` onto one helper

[os-zhuang]

Filed unassigned by the dev seat working #10212. Not a defect today — recorded so the
duplication is a deliberate state rather than an accident. Duplicate search first
(quoted "port-reservations", "PORT_RESERVATION_DIR", "pick_free_port", plus a
semantic search for registry convergence): no hits other than #10167/#10212 themselves.

What is on main now

Two shell helpers run a byte-identical claim-before-probe protocol against two
different directories:

	sdui_pick_free_port	smoke_pick_free_port
script	scripts/gen-sdui-manifest.sh	scripts/publish-smoke.sh
registry	${TMPDIR:-/tmp}/sdui-port-reservations	${TMPDIR:-/tmp}/objectstack-port-reservations
override	SDUI_PORT_RESERVATION_DIR	SMOKE_PORT_RESERVATION_DIR
base port	5180	3210
probe	probe.listen(port, '127.0.0.1')	probe.listen(port) (wildcard)

Landed by #10217 (#10167) and the #10212 PR respectively. Normalising the names and
diffing the two node programs shows the on-disk format and every algorithm — O_EXCL
claim, release-on-probe-failure, sweep floor/ceiling, pid liveness, flock around the
sweep only — is identical; the only differences are the registry directory and the
probe address.

Why it was left this way rather than merged in the #10212 PR

• The two draw from disjoint ranges — [3210, 3410) and [5180, 5380) — so they
  cannot hand each other the same port. Sharing one directory buys nothing measurable
  today; it only starts to matter if a caller ever passes an overlapping base.
• The probe address difference is load-bearing in both directions and must survive
  any merge: the smoke script probes the wildcard address deliberately, because that is
  the spelling serve.ts's own isPortAvailable() uses, so it sees a busy port exactly
  when the CLI would. The sdui helper probes loopback because that is what vite binds.
  A shared helper needs the probe address as a parameter, not a constant.
• Doing it inside smoke_pick_free_port in scripts/publish-smoke.sh is the same TOCTOU probe as #10167 — concurrent callers scanning from 3210 are all handed 3210 #10212 would have meant editing scripts/gen-sdui-manifest.sh and its
  collision test, both outside that card's declared file surface, hours after fix(devx): reserve the port sdui_pick_free_port hands out, instead of probing and letting go #10217
  landed there.

What converging would look like

One helper — probably sourced from a small scripts/lib/ file both scripts read — taking
base, span and the probe address, against a single neutral registry. The
objectstack-port-reservations directory name was chosen in #10212 expressly so that
convergence is a pure rename on the sdui side, with no on-disk format change and no
migration: existing claim files stay valid.

⚠️ Whoever takes this should keep the two collision tests' contention assertions
(CONCURRENT_DISTINCT, TRIPLE_DISTINCT, and the STEAL_CLAIM_ON_PICK positive
control) running against the real shared registry rather than an overridden scratch
one — the point of those is that they measure the registry actual callers use.

---

Generated by Claude Code