fix(release): drain the v3.8.51 base-reds after the 2026-09-28/29 merge wave

[diegosouzapw]

Drains the unit/vitest reds on the release/v3.8.51 tip (b636b6d) after the 2026-09-28/29 merge wave. Each red was reproduced on its own with node --import tsx/esm --import ./tests/_setup/isolateDataDir.ts --test --test-force-exit, traced to the commit that caused it, and classified. No assertion was weakened. Where a PR changed a contract on purpose, the test now asserts the new contract, and a comment in the test names the PR.

⚠️ base-red inherited: #15032 (the file-size ceiling reds on files this PR does not touch are left to the orchestrator's rebaseline PR)

Red	Cause (PR)	Kind	Fix
compression/previewRouteFuzzy (1)	#14983 limited fuzzy dedup to callers that advertise omniroute_ccr_retrieve. The studio preview sends only { messages }, so the dashboard fuzzy toggle had become a silent no-op	Production defect	POST /api/compression/preview: with fuzzyDedup.enabled, the dry-run body now advertises the CCR retrieve tool. This is the same simulation the compression benchmark harness already does. The test goes from red on the tip to green
hard-session-lease-bypass-inventory (1)	#13487 (61198da, not #14818) added a getProviderConnections read in models/test-all	New site	Classified as class C. It is a state read that returns 409 when every connection is disabled. The probes still go through the fenced chat pipeline
sse-auth #62–66 (5)	#14848 moved "Verify your account to continue" out of ACCOUNT_DEACTIVATED_SIGNALS on purpose (it is a recoverable, operator-actionable prompt)	Contract	The auto-disable tests use "Your account has been suspended", which is still a ban signal. The asserted behavior is unchanged (banned + auto-disable/scope)
false-terminal-401-quota (1)	#13548 made credit exhaustion on passthrough providers model-scoped. chutes is a passthrough provider	Contract	The case is split in two. (1) An account-level provider (openai) still parks as credits_exhausted. (2) chutes stays active and only the model is locked out (quota_exhausted). Neither is ever parked as expired, which is the #12452 guarantee
opencode-accounts-per-request #4/#5 (2)	Already failing before the wave (a58000c). The process-wide proxy refusal memory (#13578) leaked between cases: the 429 in the overlapping case set member A aside, so later cases skipped it	Test isolation	beforeEach resets __resetProxyRefusalMemoryForTesting and __resetSlowOverrunsForTesting. Each case passes on its own, and now the whole file passes too
opencode-responses-first-byte-stall "flag off…" (1)	Already failing at a58000c. Same leak: the 429 case before it set ports[0] aside	Test isolation	Same reset in beforeEach (14/14)
open-sse/mcp-server/__tests__/audit.test.ts (vitest)	Not reproduced as a real failure. The first test pays for a cold import of the auth.ts graph (mcpCallerIdentity, via #13941, which predates the wave) plus migrations. That takes about 28 s against a 30 s budget on the devbox under load avg ~8. It gave 1 timeout on a cold run, then 8/8 on warm runs	Environment	No change

Validation (worktree on the tip): the 6 files above are all green (sse-auth 67/67, stall 14/14, per-request 5/5, inventory 3/3, false-terminal 4/4, previewRouteFuzzy 2/2). The related suites are green too: auth-passthrough-credit-lockout 4/4, antigravity-verify-account-403-not-a-ban 10/10, sessionDedupFuzzy 7/7, the 8 previewRoute* files, and compression-preview-api. typecheck:core and check:open-sse-typecheck are clean. eslint (with suppressions) and prettier are clean on the changed files. check-file-size was measured after the commit: no violations in files this PR touches. sse-auth.test.ts stays at 1732 lines, within its 1733 ceiling.