The scenario suite gates zds upgrades (docs rule 2) yet the harness itself was untested: a failure on an upgrade was indistinguishable from a broken gate. Extract the duplicated helpers into tests/harness.zig (L0) with port-from-env and bounded subprocess waits, add L1 unit tests for every assertion helper and the curl api() driver, prove both polarities via fake-zds/fake-linji/fake-serve replay fixtures (L2: scenario-self — good fixtures PASS, broken fixtures FAIL at the checkpoint they break, a hung CLI is reaped by the timeout), and prove concurrent runs stay isolated with teardown (L3: scenario-isolation). Scenario output goes to stdout: stderr was echoed as a bogus failed command on green runs, and in test binaries fd 1 is the --listen protocol channel.