diff --git a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
index c81db3c5d..424de23ea 100644
--- a/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
+++ b/crates/socket-patch-cli/tests/cli/shared_helper_copies.rs
@@ -9,15 +9,10 @@
 use std::path::Path;
 
 /// Files that still define a private `binary()` or `git_sha256`. Each is
-/// changed by an open PR, or is a shared module whose includers don't all
-/// declare `mod common`. Migrate a file onto `common` and delete its entry;
-/// a stale entry is not an error, so a PR that migrates one never turns
-/// another red.
+/// a shared module whose includers don't all declare `mod common`.
+/// Migrate a file onto `common` and delete its entry; a stale entry is
+/// not an error, so a PR that migrates one never turns another red.
 const PENDING_PRIVATE_HELPERS: &[&str] = &[
-    "repair/covgap_commands_repair.rs",
-    "repair/covgap_commands_repair_vendor.rs",
-    "repair/repair_invariants.rs",
-    "scan/covgap_commands_fetch_stage.rs",
     "vex_e2e_common/mod.rs",
     "vlt_e2e_common/mod.rs",
     "vlt_hosted_common/mod.rs",
diff --git a/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
index 8030a5f17..200321737 100644
--- a/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
+++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
@@ -23,18 +23,13 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use crate::common::hermetic_command;
+use crate::common::{binary, git_sha256, hermetic_command};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 const ORG_SLUG: &str = "test-org";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// A `socket-patch` command rooted at `cwd` with every ambient `SOCKET_*`
 /// env var scrubbed by `hermetic_command` (same rationale as `repair_invariants.rs`: an ambient
 /// `SOCKET_OFFLINE`/`SOCKET_JSON`/`SOCKET_SILENT` would flip the very
@@ -46,15 +41,6 @@ fn socket_cmd(cwd: &Path) -> Command {
     cmd
 }
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// A manifest with one patch referencing one blob — the baseline
 /// `.socket/manifest.json` (mirrors `repair_invariants.rs`).
 const MANIFEST_JSON: &str = r#"{
diff --git a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
index dbc946b8e..534f45ed4 100644
--- a/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
+++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
@@ -15,16 +15,11 @@
 
 use std::path::{Path, PathBuf};
 
-use crate::common::hermetic_command;
+use crate::common::{binary, git_sha256, hermetic_command};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -43,17 +38,9 @@ const GEM_PURL_QUALIFIED: &str = "pkg:gem/padlock@1.2.0?platform=ruby";
 const GEM_ENCODED: &str = "pkg%3Agem%2Fpadlock%401.2.0";
 const GEMSPEC_STUB: &[u8] = b"Gem::Specification.new do |s|\n  s.name = \"padlock\"\n  s.version = \"1.2.0\"\n  s.summary = \"repair fixture\"\n  s.authors = [\"socket-patch e2e\"]\n  s.require_paths = [\"lib\"]\nend\n";
 
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 fn sri_of(bytes: &[u8]) -> String {
     use base64::Engine as _;
-    use sha2::Sha512;
+    use sha2::{Digest as _, Sha512};
     format!(
         "sha512-{}",
         base64::engine::general_purpose::STANDARD.encode(Sha512::digest(bytes))
diff --git a/crates/socket-patch-cli/tests/repair/repair_invariants.rs b/crates/socket-patch-cli/tests/repair/repair_invariants.rs
index 26c808615..af5f31964 100644
--- a/crates/socket-patch-cli/tests/repair/repair_invariants.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_invariants.rs
@@ -7,18 +7,13 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-use crate::common::hermetic_command;
+use crate::common::{binary, git_sha256, hermetic_command};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 const ORG_SLUG: &str = "test-org";
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 /// A `socket-patch` command rooted at `cwd` with every ambient `SOCKET_*`
 /// env var scrubbed (`hermetic_command`), so every assertion exercises the flag/argv path and
 /// nothing the ambient environment happened to leak in:
@@ -44,15 +39,6 @@ fn socket_cmd(cwd: &Path) -> Command {
     cmd
 }
 
-/// Git-SHA256: SHA256("blob <len>\0" ++ content).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
 /// A manifest with one patch referencing one blob. Used as the baseline
 /// `.socket/manifest.json` for every test below.
 const MANIFEST_JSON: &str = r#"{
diff --git a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
index 5737eacf5..f1d559a21 100644
--- a/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
+++ b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
@@ -16,33 +16,17 @@
 //! `coverage_fix_apply_silent_mute_exit.rs`; this suite covers the
 //! human-mode (non-quiet) output shape and the mem-stager arms.
 
-use std::path::{Path, PathBuf};
+use std::path::Path;
 
-use crate::common::hermetic_command;
+use crate::common::{binary, git_sha256, hermetic_command};
 
-use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const BEFORE: &[u8] = b"before\n";
 const AFTER: &[u8] = b"after\n";
-/// base64 of AFTER, the shape the view response's `blobContent` carries.
-
-/// Git-SHA256: SHA256("blob <len>\0" ++ content). Computed independently
-/// of the code under test.
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
 
 /// Spawn the built binary in `root` with the hermetic `SOCKET_*`
 /// environment (ambient vars scrubbed, telemetry kill-switch forced) and