fix: bind an ephemeral port in session-self-exit-test.sh

CHANGELOG.md

@@ -10,6 +10,7 @@ Please choose versions by [Semantic Versioning](http://semver.org/).
 
 ## Unreleased
 
+- fix: `session-self-exit-test.sh` binds an ephemeral port instead of the hardcoded 18099, so `make test` no longer fails on a host where anything else already holds that port — the stub server failed to bind silently and the test read the other server's directory as a 404. A stub server that never answers now fails loudly instead.
 - feat: Add `GoalApproveOperation` and `TopicApproveOperation`, which move a `phase: todo` row to `phase: planning` and record `approved_by` / `approved_at` in one write; a row outside the approval inbox, or one already carrying an approval record, is refused with nothing written.
 - feat: Add `vault-cli goal approve` and `vault-cli topic approve`, the CLI surface over those operations (`--by` defaults to `operator`, an empty `--by` is refused, and a refusal exits non-zero in both plain and `--output json` modes). `goal set … phase planning` and `topic set … phase planning` on a `todo` row are now refused and point at the approve verb.
 

scripts/session-self-exit-test.sh

@@ -14,7 +14,17 @@ cd "$ROOT" || exit 2
 
 SCRIPT=scripts/session-self-exit.py
 SID=11111111-2222-3333-4444-555555555555
-PORT=18099
+
+# Bind an ephemeral port instead of a fixed one. A hardcoded port collides with
+# anything else already listening on the host, and the collision is silent: the
+# stub server fails to bind, the test then reads whatever *is* on that port, and
+# every "clear gate" case reads the 404 as "store unreadable". Observed
+# 2026-10-20 — two unrelated processes held 18099 and `make test` was red on the
+# host while green in CI.
+free_port() {
+	python3 -c 'import socket; s = socket.socket(); s.bind(("127.0.0.1", 0)); print(s.getsockname()[1]); s.close()'
+}
+PORT=$(free_port)
 STORE_URL="http://127.0.0.1:$PORT"
 
 TMP=$(mktemp -d)
@@ -145,10 +155,18 @@ chmod +x "$TMP/bin/wezterm"
 cards '[]'
 python3 -m http.server "$PORT" --bind 127.0.0.1 --directory "$TMP/store" >/dev/null 2>&1 &
 SERVER_PID=$!
+server_up=0
 for _ in $(seq 1 50); do
-	curl -sf "$STORE_URL/api/1.0/attention" >/dev/null 2>&1 && break
+	if curl -sf "$STORE_URL/api/1.0/attention" >/dev/null 2>&1; then
+		server_up=1
+		break
+	fi
 	sleep 0.1
 done
+if [ "$server_up" -ne 1 ]; then
+	echo "❌ stub attention store never answered on $STORE_URL" >&2
+	exit 2
+fi
 
 # --- positive path
 task completed done 0