[diegosouzapw]

Clears 9 unit base-reds from the release PR #11442 CI (Unit 3/8 and 4/8). All nine reproduced deterministically in isolation on origin/release/v3.8.51 @ 9bbf6ef before this change.

Production defect (1)

Red	Cause	Culprit	Fix
getPricingForModel — issue #13891 / hits the DB at most once…	db/proxyLogs imported normalizeProxyHostForLog from proxyLogger (#14364), and db/proxies/rotation started importing db/proxyLogs (#14657). Together they dragged proxyLogger, which runs loadFromDb() at import time (PRAGMA table_info(proxy_logs) + SELECT … FROM proxy_logs), into every module reaching settings → proxies. A cold getPricingForModel() made 5 prepare() calls instead of 3. The pricing cache itself was still fine: calls 2–20 made 0.	#14364 + #14657	Moved the pure helper into a zero-import leaf src/lib/proxyLogHost.ts. proxyLogger re-exports it, so existing callers keep working.

Intentional contract changes carried into the tests (7)

Red	Culprit PR	Test change
GHE Copilot registry exposes Claude Opus 5	#14732 added supportsReasoning / supportedThinkingEfforts / supportsXHighEffort to the GHE Copilot Opus 5 entry	Expected object now includes these fields
v1 management proxies main route covers auth…	#15044: requireManagementAuth no longer inherits the public-route shortcut. The test's INITIAL_PASSWORD block had persisted setupComplete=true, so a setup-complete install with no password now requires management auth, even on loopback	resetStorage() after the auth block, so the unauthenticated CRUD branches run against a fresh install that has not been through onboarding
handleAudioSpeech validates HuggingFace model identifiers	#15067 rejects dot-segment ids at parse time (hasUnsafeModelIdSyntax), so huggingface/../escape now fails with 400 "No speech provider found"	Assert that 400. Added a huggingface/facebook//mms-tts-eng case so the handler-level "Invalid model ID" guard stays covered
source guard: auth.ts skips model lockout… on 500+	#13548 moved the status >= 500 predicate into modelScopedQuotaFailure.ts::isModelScopedFailure(). Behavior is unchanged: the no model lockout early return is still in auth.ts	Guard reads the helper and requires isModelScopedFailure(status in auth.ts
VB-14003-BARE / VB-14003-QUALIFIED-LEAF	#14117 (another #14003 fix) gave kimi-for-coding a MODEL_SPECS alias with supportsVision: true, so #14844's fixture no longer had UNKNOWN vision and the guardrail passed it straight through	Fixture switched to deepseek-coder-6.7b / llamagate/deepseek-coder-6.7b. New VB-14003-FIXTURE precondition pins supportsVision === null so a future spec change fails loudly
ninerouter.stub.ts: install / resolveSpawnArgs throw…	#12810 renamed the stub's installNinerouter to install (the real export name) and added the remaining exports	Assert that install, update, uninstall, getInstalledVersion, getLatestVersion and resolveSpawnArgs all throw 9router-installer

No assertions were weakened. Each test still checks the behavior it was written for.

Proof

• 7 target files: 74/74 pass (combined, --test-concurrency=4, per-process DATA_DIR). Each file was red on the tip before this change.
• Neighbor tests touching proxyLogger / db/proxyLogs (27 files): 176/176 pass.
• typecheck:core clean · check:open-sse-typecheck OK (0 errors) · eslint (with suppressions) clean on the changed files · prettier clean · check-file-size OK, measured after commit.