diff --git a/changelog.d/maintenance/release-v3850-basereds-glm-family-20260819.md b/changelog.d/maintenance/release-v3850-basereds-glm-family-20260819.md
new file mode 100644
index 0000000000..04985623c0
--- /dev/null
+++ b/changelog.d/maintenance/release-v3850-basereds-glm-family-20260819.md
@@ -0,0 +1 @@
+- **fix(tests):** drain two base-reds on the release branch — `auto/glm` now expects the Cloudflare AI Playground backend (its registry advertises `zai-org/glm-5.2` and `zai-org/glm-4.7-flash`, so it belongs in the family pool by the same rule already documented for `auggie`, `devin-cli-agentic` and `zcode`), and the ESLint gate is green again after the GitLab executor test dropped its five `as any` casts for a declared response shape and the CLI OAuth suppression count caught up with the two casts #10491 added.
diff --git a/config/quality/eslint-suppressions.json b/config/quality/eslint-suppressions.json
index 66b9ef93ec..8006cbb2f3 100644
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -1898,7 +1898,7 @@
   },
   "tests/unit/cli-oauth-commands.test.ts": {
     "@typescript-eslint/no-explicit-any": {
-      "count": 18
+      "count": 20
     }
   },
   "tests/unit/cli-oneproxy-commands.test.ts": {
@@ -2396,11 +2396,6 @@
       "count": 7
     }
   },
-  "tests/unit/executor-gitlab.test.ts": {
-    "@typescript-eslint/no-explicit-any": {
-      "count": 4
-    }
-  },
   "tests/unit/executor-nlpcloud.test.ts": {
     "@typescript-eslint/no-explicit-any": {
       "count": 2
diff --git a/tests/unit/autoCombo/provider-family-combos.test.ts b/tests/unit/autoCombo/provider-family-combos.test.ts
index 3a7e33e4f2..45ff7eec94 100644
--- a/tests/unit/autoCombo/provider-family-combos.test.ts
+++ b/tests/unit/autoCombo/provider-family-combos.test.ts
@@ -144,7 +144,17 @@ describe("auto/<family> materialization (#6453)", () => {
     // `zcode` joined for the same documented reason too — #10184 added the local
     // ZCode app-server backend whose registry (registry/zcode) advertises the
     // full GLM_SHARED_MODELS line-up, so it genuinely serves the family.
-    assert.deepEqual(providerIds, ["auggie", "devin-cli-agentic", "glm", "zai", "zcode"]);
+    // `cloudflare-playground` joined on the same rule — its registry
+    // (open-sse/config/providers/registry/cloudflare-playground/index.ts) advertises
+    // zai-org/glm-5.2 and zai-org/glm-4.7-flash, so it genuinely serves the family.
+    assert.deepEqual(providerIds, [
+      "auggie",
+      "cloudflare-playground",
+      "devin-cli-agentic",
+      "glm",
+      "zai",
+      "zcode",
+    ]);
     // Every candidate must be a glm-family model (the Cartesian pool now surfaces
     // each backend's full glm line-up, not only the glm-5.2 default), and the
     // connected openai/gpt-4o-mini backend must be excluded — same family
diff --git a/tests/unit/executor-gitlab.test.ts b/tests/unit/executor-gitlab.test.ts
index e873805b4a..f222eeb681 100644
--- a/tests/unit/executor-gitlab.test.ts
+++ b/tests/unit/executor-gitlab.test.ts
@@ -4,6 +4,14 @@ import assert from "node:assert/strict";
 import { GitlabExecutor } from "../../open-sse/executors/gitlab.ts";
 import { getExecutor, hasSpecializedExecutor } from "../../open-sse/executors/index.ts";
 
+/** Shape the GitLab executor tests read back off the translated response. */
+type GitLabResponseBody = {
+  object?: string;
+  model?: string;
+  choices?: { message: { role: string; content: string } }[];
+  error?: { message: string };
+};
+
 function jsonResponse(body: unknown, status = 200) {
   return new Response(JSON.stringify(body), {
     status,
@@ -72,7 +80,7 @@ test("GitlabExecutor posts PAT-backed code suggestion requests to the configured
     assert.match(String(calls[0].body.user_instruction), /Write a hello world function/);
     assert.match(String(calls[0].body.current_file.content_above_cursor), /System instructions:/);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.object, "chat.completion");
     assert.equal(body.choices[0].message.role, "assistant");
     assert.match(body.choices[0].message.content, /hello/);
@@ -131,7 +139,7 @@ test("GitlabExecutor maps upstream auth failures to OpenAI-style errors", async
     });
 
     assert.equal(result.response.status, 403);
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.match(body.error.message, /auth failed/i);
   } finally {
     globalThis.fetch = originalFetch;
@@ -206,7 +214,7 @@ test("GitlabExecutor uses GitLab direct_access for gitlab-duo and persists the c
       "direct-token"
     );
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "GitLab Duo Claude Sonnet");
     assert.match(body.choices[0].message.content, /gitlab duo/i);
   } finally {
@@ -254,7 +262,7 @@ test("GitlabExecutor falls back to the public Code Suggestions endpoint when dir
       "https://gitlab.example.com/api/v4/code_suggestions/completions",
     ]);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "code-gecko");
     assert.match(body.choices[0].message.content, /fallback path/i);
   } finally {
@@ -305,7 +313,7 @@ test("GitlabExecutor falls back to the public Code Suggestions endpoint when dir
       "https://gitlab.example.com/api/v4/code_suggestions/completions",
     ]);
 
-    const body = (await result.response.json()) as any;
+    const body = (await result.response.json()) as GitLabResponseBody;
     assert.equal(body.model, "code-gecko");
     assert.match(body.choices[0].message.content, /monolith fallback works/i);
   } finally {