chore(ci): clear the last two release/v3.8.51 base-reds (agent-skills sync + stryker tap.testFiles) (#13826)

Merged in the 2026-09-16 sweep of the maintainer's own open PRs, at the owner's explicit instruction. No push was made to the PR branch: the merge took the head as the owning session left it (verified OPEN, non-draft and MERGEABLE against the release tip immediately before merging).

changelog.d/maintenance/12732-agent-skills-sync-omni-settings.md

@@ -0,0 +1 @@
+- **chore(skills):** regenerate the `omni-settings` agent skill after the pool egress-observation route landed (#13581), clearing the `check:agent-skills-sync` base-red (#12732)

changelog.d/maintenance/12732-pack-artifact-abort-guard.md

@@ -0,0 +1 @@
+- **chore(build):** ship `httpClientAbortGuard.mjs` in the published tarball — the #13636 crash guard was a new `server-ws.mjs` import missing from both pack-artifact allowlists (#12732)

changelog.d/maintenance/12732-stryker-provider-401-ambiguous.md

@@ -0,0 +1 @@
+- **chore(ci):** register the #13609 ambiguous-401 regression test in the mutation-coverage config, clearing the second `check:agent-skills-sync`/`mutation-test-coverage` base-red (#12732)

scripts/build/pack-artifact-policy.ts

@@ -53,6 +53,8 @@ export const APP_STAGING_ALLOWED_EXACT_PATHS: string[] = [
   // server-ws.mjs import (sd_notify helper) — enforced by the closure test
   // tests/unit/pack-artifact-server-ws-closure.test.ts.
   "systemd-notify.mjs",
+  // server-ws.mjs import (process crash guard, #13636) — same closure test.
+  "httpClientAbortGuard.mjs",
   "responses-ws-proxy.mjs",
   "bin/chatgpt-web-codex-mcp.mjs",
   "scripts/dev/sync-env.mjs",
@@ -199,6 +201,7 @@ export const PACK_ARTIFACT_REQUIRED_PATHS: string[] = [
   "dist/main-server-timeouts.mjs",
   // server-ws.mjs import (sd_notify helper) — enforced by the closure test.
   "dist/systemd-notify.mjs",
+  "dist/httpClientAbortGuard.mjs",
   "dist/http-method-guard.cjs",
   // #5452: regression guard — make check:pack-artifact fail loudly if the TLS
   // opt-in sidecar (imported by dist/server-ws.mjs) ever vanishes from the tarball.

skills/omni-settings/SKILL.md

@@ -1150,6 +1150,17 @@ curl -X DELETE https://localhost:20128/api/settings/proxies/pool \
   -H "Authorization: Bearer $OMNIROUTE_TOKEN"
 ```
 
+### GET /api/settings/proxies/pool/egress-observation
+
+GET settings › proxies › pool › egress observation
+
+Read-only observation of how many distinct egress IPs actually served the members of a proxy pool over the last 24 h, read from the proxy log (numbers only, never used for routing). Opt-in through the PROXY_POOL_EGRESS_OBSERVATION feature flag: while it is off, or when the read fails, the body is JSON null. Results are cached for 30 seconds per normalized scope (key is read as account, global as the stored global pool).
+
+```bash
+curl https://localhost:20128/api/settings/proxies/pool/egress-observation \
+  -H "Authorization: Bearer $OMNIROUTE_TOKEN"
+```
+
 ### POST /api/settings/proxy/cloudflare-deploy
 
 POST settings › proxy › cloudflare deploy

stryker.conf.json

@@ -316,6 +316,7 @@
       "tests/unit/no-memory-header.test.ts",
       "tests/unit/noauth-autocombo-lockout-7623.test.ts",
       "tests/unit/noauth-model-lockout.test.ts",
+      "tests/unit/provider-401-ambiguous-runtime.test.ts",
       "tests/unit/ollama-404-model-lockout-11071.test.ts",
       "tests/unit/non-streaming-client-translate.test.ts",
       "tests/unit/non-streaming-provider-leg.test.ts",