[diegosouzapw]

Drains four reds on the release/v3.8.52 tip (4a2269b). Each one reproduced alone on the pure tip. All four are stale test fixtures left behind by merged PRs; none is a production defect. Test-only change, no production code touched.

1. hard-session-lease-bypass-inventory.test.ts: inventory drift

• src/lib/tokenHealthCheck.ts 3 -> 4, caused by fix(oauth): preserve active cooldown diagnostics on token refresh #15891. The new getRefreshRecoveryUpdate() calls getProviderConnectionById() after a successful refresh. It only reads rateLimitedUntil, so an active cooldown's diagnostics are not wiped. That is a state read with no connection selection, credential use or dispatch, so it is class C, the same as the existing fix(oauth): skip a second POST of a consumed Claude refresh token #13874 re-read in the same file.
• open-sse/services/combo/providerWildcard.ts 1 -> 0, caused by fix(routing): share provider alias pools with combo discovery #15927. The Alibaba free-tier drained-model filter used to call getProviderConnections() directly. It now goes through getCachedProviderPoolConnections() in open-sse/services/providerConnectionPool.ts, which calls getCachedProviderConnections(). The underlying getProviderConnections call is already counted under src/lib/db/readCache.ts, so nothing went unclassified. I also removed the entry from the class-B list. Neither change is a lease bypass.
• Red: deepEqual failure on those two keys. Green: 3/3 pass.

2. provider-translate-path-golden.test.ts: snapshot drift

• The only difference is the anthropic provider's Anthropic-Beta header (apiKey, nonStream and oauth variants). It loses claude-code-20250219.
• Caused by fix(anthropic): omit Claude Code beta from API-key defaults #15968 ("omit Claude Code beta from API-key defaults"), which changed ANTHROPIC_BETA_API_KEY in open-sse/config/anthropicHeaders.ts on purpose and pinned it in anthropic-api-key-beta-15942.test.ts. The change is intended, so I regenerated the snapshot with UPDATE_GOLDEN=1. This does not depend on the open feat(jev): opt-in decision layer (System One / bring-your-own classifier) #15641.
• Red: GoldenMismatchError provider/translate-path. Green: 3/3 pass.

3. agnes-cn-provider.test.ts (+ the same red in flagship-0day-discovery.test.ts test 7)

• The failure message was PROVIDER_SEARCH_PAIRS declaration missing, not a wrong pairing. fix(routing): share provider alias pools with combo discovery #15927 moved PROVIDER_SEARCH_PAIRS and getProviderSearchPool out of src/sse/services/auth.ts into open-sse/services/providerConnectionPool.ts. The pair list moved byte-for-byte and still has no agnes, agnes-cn or xai entry.
• The two source-shape guards now read from the new location. Every assertion is unchanged, including the injected-pairing negative control. check-test-masking vs base reports no weakening.
• Red: assertion declaration missing. Green: agnes-cn 16/16 and flagship-0day 10/10 pass. The flagship red was not in the dispatch list but had the same root cause.

Validation

• Target files plus related tests are green: inventory 3/3, golden 3/3, agnes-cn 16/16, flagship-0day 10/10, xai-oauth-discovery 8/8, 8779-agy-prefix 5/5, anthropic-api-key-beta-15942 6/6, token-health-check 13/13, provider-alias-combo-pool-12844 8/8, combo-custom-provider-resolution 8/8, 10085 7/7, provider-node-select-4421 6/6.
• typecheck:core OK. check-api-typecheck OK (within baseline). eslint with suppressions on the changed files OK. check-file-size, check-test-masking (vs base), check-changelog-integrity and check-test-discovery OK. The pre-commit hooks passed.
• flagship-0day-discovery.test.ts also picked up Prettier reformatting of two pre-existing lines.

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.