fix(release): drain v3.8.52 base-reds — sqlite report stall (#15106), zh-CN glossary, route map, #15979 test fallout

[diegosouzapw]

Drains the base-reds on the release/v3.8.52 tip (977d006). Each item was reproduced red on the clean tip, run on its own (not under load), and traced to the PR that caused it.

⚠️ base-red inherited: #15306. Items listed under "Not fixed here" are still red on the tip.

Fixed

1. Shared root cause of the 4 vitest 5s timeouts (production fix, #15106)

antigravity-quota-family, pipeline-router-taskfitness-mismatch, suffixComposition-4517 and vision-filter-excludes-forced.

• Cause: a CPU profile of the first getResolvedModelCapabilities() call showed 6.0s of the 6.6s inside better-sqlite3/lib/binding.js::isLinuxMusl(). That function calls process.report.getReport(). The report's network section reverse-resolves every open TCP handle, and the vitest worker holds 2. On a host with slow reverse DNS, the measured cost was getReport() = 5948 ms, and 6 ms with excludeNetwork = true. Production pays the same cost on the first DB open when sockets are already open.
• Fix: src/lib/db/adapters/driverFactory.ts builds the better-sqlite3 Database with process.report.excludeNetwork = true and restores the caller's value afterwards. better-sqlite3 only reads header.glibcVersionRuntime from the report.
• Red → green: new test in tests/unit/db-adapters/driverFactory.test.ts (red first: actual: false, expected: true, then 29/29 green). All 4 vitest files are green alone: 7/7, 2/2, 6/6 and 5/5. The first test in each file dropped from ~6.5s to 0.6–1.2s.
• Breaking PR: none. better-sqlite3 13 has been on the branch since August. The stall depends on the host's DNS. test(autoCombo): warm task-fitness DB in beforeAll so first-call init can't time out (#15106) #15253 had only warmed one call path.

2. i18n-glossary-consistency-check: zh-CN contains 提供商

• Cause: feat(api-keys): enforce per-key service tier overrides #13554 added codexKeyServiceMode.description and .warning using 提供商. The glossary term is 提供者, which zh-TW already uses.
• Fix: only those 2 strings in src/i18n/messages/zh-CN.json changed. 33/33 green.

3. i18n-route-namespaces: stale generated map

• Cause: feat(api-keys): enforce per-key service tier overrides #13554 added the codexKeyServiceMode namespace without regenerating the map.
• Fix: ran npm run gen:i18n-routes. 5/5 green. Note: fix(i18n): give the /home route a provider layout — it rendered raw keys #16056 also regenerates this file. Whichever PR merges second only needs to regenerate it again.

4. virtual-auto-combo: "restricts the no-auth pool", plus 4 sibling files with the same cause

Siblings: noauth-autocombo-allowlist, noauth-autocombo-hidden-7620, repro-6557-noauth-connection-disable-ignored, auto-combo-credentialed-model-pool.

• Cause (contract change): fix(auto): honor provider ToS for uncataloged models and clarify setup #15979 made uncataloged models inherit the provider's curated tos: "avoid" verdict and added antigravity: "avoid". fix(auto): exclude tos:avoid providers from auto by default (#15059) #15839 had already turned excludeTosAvoid on by default. Together they remove every opencode and antigravity model from the default auto pool.
• Proof: reverting only the fix(auto): honor provider ToS for uncataloged models and clarify setup #15979 lines (FREE_TIER_TOS fallback and antigravity: "avoid") makes all 5 original files pass.
• Fix: each file now opts out (updateSettings({ excludeTosAvoid: false })), the same pattern fix(auto): exclude tos:avoid providers from auto by default (#15059) #15839 used for the sibling test. Each change carries a // contract changed by #15979 comment. No assertion changed. The ToS default stays covered by issue-15059-tos-avoid-auto-default (3/3 green).

5. zai-web-missing-browser-executable-13232

• Cause (contract change): fix(browser): apply gemini-web provider proxy and start Xvfb for headed zai-web (#15076) #15851 (fix(providers): zai-web fails with 502 "browserType.launch" on v3.8.51 (latest-web, Docker), multiple accounts tested #15300) starts Xvfb before a headed launch. On a host with no display and no Xvfb, the missing-display 503 fires before Playwright looks for the Chromium binary.
• Fix: the test pins DISPLAY=:99 and restores it afterwards, so it exercises the missing-executable branch on any host. Playwright checks the binary before it touches the display. 1/1 green.

6. quota-trackers-batch-init

• Cause (contract change): Security audit fixes #13330 let Prettier reflow await import("…quotaTrackersBatch.ts") onto one line. The test matched a hard-coded line break.
• Fix: a whitespace-tolerant regex. The same order assertion stays (import first, then the call). 3/3 green.

Not fixed here

• quality-rail-gate-membership (fast-gates / cycles): already fixed by the open PR fix(release): drain two v3.8.52 base-reds — cycles membership test, drifted skills mirrors #15682, with the same needle change and a stronger guard. Dropped to avoid a conflict.
• issue-agent-route-execution ("preserves the normal chat route provider failure response"): flaky / load. It passed 3/3 alone (33–40s per run) and failed only in the full suite at 60s with 499 !== 429 (client abort). Not touched.
• chaosVirtualCombo (also fix(auto): honor provider ToS for uncataloged models and clarify setup #15979 fallout, red alone): fixed by the open PR test(auto): seed eligible accounts in chaos combo fixture #16090.
• Skipped as owned elsewhere: executor-map-golden (test(executors): refresh golden for integrated Twinmind aliases #16058), provider-validation-specialty gemini-web (order-dependent), and timing tests (9147, conversationTracker-7847, provider-request-failure-pipeline).

Gates

Run in the worktree:

• typecheck:core clean
• ESLint with suppressions on the changed files: 0
• Prettier clean
• file-size, test-masking (diff vs origin/release/v3.8.52: no weakening), changelog-integrity, test-discovery and env-doc-sync: all OK
• pre-commit hooks passed
• Touched node:test files all green, 10 files, N>0 each
• The 4 vitest files are green when each runs alone

[github-actions]

CI Coverage Report

• Coverage job: skipped
• PR test policy: success

Coverage artifact was not available for this run.