test(ci): reconcile release/v3.8.30 baseline + test drift

[diegosouzapw]

Summary

Four deterministic CI failures on release/v3.8.30 (reproducible on the no-op cycle-open commit a5c0576c3 AND in clean CI) were stale baselines / test expectations that never got reconciled when the v3.8.30 cycle opened. None are flaky; none are regressions — each tracks a change that was already intentional and shipped.

#	Job	Drift	Fix
1	Quality Ratchet	check:complexity 1885 > baseline 1800	re-baseline 1800→1885 + _rebaseline_2026_06_19_v3830 (legit feature growth, ~130 PRs v3.8.25→v3.8.29)
2	Integration (1/2)	integration-wiring asserts bg-black/5	#4233 ("opaque tables D9") replaced it with opaque bg-surface → assert bg-surface
3	Integration (1/2)	search-providers-catalog EXPECTED_SEARCH_COUNT=12	duckduckgo-free added in v3.8.27 → bump 12→13 (route returns 13 search + 3 fetch = 16)
4	Node 24/26 Compat	tproxy-transparent-socket hard-asserts addon === false	#4236 (prebuilds) makes the addon load on those runners → branch the 3 tests on isTransparentSocketAvailable()

NOT in this PR (deliberately)

The round-robin test resilience-http-e2e.ts:777 fails for a different reason and is left untouched: the undici dispatcher throws "fetch failed" in proxyFetch.ts (getDefaultDispatcher() path) → the p7 request falls through to p6, so the test reads round robin A twice. This is the known undici-dispatcher instability (#4252 territory), NOT a round-robin combo regression — handleRoundRobinCombo's counter logic is correct (verified: counter 0→1→2, startIndex 0→1). Realigning that test would mask the real dispatcher symptom, so it stays as a canary.

Validation (RED→GREEN — tests-only + quality baseline, no production code)

• check:complexity: REGRESSÃO 1885>1800 → OK 1885
• integration-wiring opaque-surface: 1/1
• search-providers-catalog: 14/14
• tproxy-transparent-socket: 11/11 (local exercises the else/absent branch; the if/present branch runs on the Node-compat CI runners with prebuilds)
• check:file-size: OK (none of the 4 files frozen)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Code Review

This pull request updates the complexity baseline to 1885, adjusts integration tests to account for the new duckduckgo-free search provider (increasing the total count to 16), and updates wiring tests to assert the use of bg-surface. It also refactors transparent socket unit tests to handle environment-dependent addon availability dynamically. The reviewer recommends adding a unit test for the connectMarked helper function to ensure comprehensive coverage of all transparent socket utilities.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The connectMarked helper function in transparentSocket.ts is currently untested for its throwing behavior when unavailable or when run without privileges. Adding a test for connectMarked alongside setSocketMark and createTransparentListenerFd ensures complete test coverage for all transparent socket helper functions.

test("setSocketMark throws when unavailable (guard) or when present without privileges (OS error)", () => {
  if (isTransparentSocketAvailable()) {
    assert.throws(() => setSocketMark(7, 0x539));
  } else {
    assert.throws(() => setSocketMark(7, 0x539), /not available/i);
  }
});

test("connectMarked throws when unavailable (guard) or when present without privileges (OS error)", async () => {
  const { connectMarked } = await import("../../src/mitm/tproxy/transparentSocket.ts");
  if (isTransparentSocketAvailable()) {
    assert.throws(() => connectMarked("127.0.0.1", 80, 0x539));
  } else {
    assert.throws(() => connectMarked("127.0.0.1", 80, 0x539), /not available/i);
  }
});