merge: origin/master into fix/803-bound-transactional-revoke-wait - #466 wins the transactional revoke path

Master landed #466 (the revoke-path commit hands itself to the control thread), #468
(WorkContainer equality is identity) and #471, and this PR went CONFLICTING. #466 is a
different answer to the question this branch answered: in transactional mode onPartitionsRevoked no
longer commits on the poll thread at all - it posts a request, wakes the control loop through the
mailbox, and waits, bounded by commitLockAcquisitionTimeout; the confluentinc#548 spin is gone; and
it refutes this branch's decline by experiment (a revoke that commits nothing leaves its output in
the open transaction for the next commit to publish without the offset - the same duplicate through
a different door). Master's own re-premising of docs/inflight/bug-857-transactional-revoke-wait.md
says what is left for this PR: not the absence of a bound, but whether the bound is the right value
- five minutes, against a max.poll.interval.ms it can exceed.

So the resolution is master's on that path, per file:

- AbstractParallelEoSStreamProcessor: master's onPartitionsRevoked, commitOnRevokeViaTheControlThread
  and the no-argument consumer-commit tryCommitOffsetsOnRevoke replace this branch's parameterised
  decline, its performCommit extraction and its post-catch wake (moot: the served commit runs on the
  control thread, which recovers itself); commitOffsetsThatAreReady is master's again; the mailbox
  loop keeps master's wake-up message skip in front of #410's first-failure try; one of two
  identical assertOnControlThread helpers (#410's and master's) is kept - master's, which
  names the new design.
- RebalanceEoSDeadlockTest: master's whole file. Its unamended assertion that committed offsets
  advance inside the callback holds again by construction under #466, and it now reads the
  output topic at read_committed for duplicates; this branch's decline amendment is superseded.
- ArchitectureTest: master's whole file (#465). This branch's interface-hop widening does not
  merge onto it; its note now records that the blind spot is still open on master and the widening
  is to be re-applied on top of #465 as its own change.
- ProducerManagerTest: master's revoke-request tests and this branch's five revocation tests, both
  kept; PartitionState: master's onSuccess(long) javadoc with #410's ledger cross-reference
  folded in; TransactionalClaim: master's scope note plus #410's C15.
- config/infer-known-findings.txt, bug-857-family.md, core-recoverable-producer-fencing.md: master;
  bug-wedged-after-poisoned-transaction.md: master's deletion (the grooming sweep); the three vetted
  notes keep master's markers and this branch's concurrency label; test-untracked-ci-flakes keeps
  master's rows and this branch's three later sightings.
- ProducerRecoveryTest's revoke-path fence test is retargeted to the served-commit shape: the fence
  now fires on the control thread inside the served pass, the callback returns promptly on the failed
  pass, nothing is stranded, and the replacement is built. Its wake assertion is gone with the wake.

What is red, on purpose: Revoke857TransactionalWaitProbeIT, 5/5, with the callback at 19.2s of a 20s
in-flight dwell against its 10s poll-interval budget - and never the 79s starvation the spin
produced. That is the measurement of #466's bound, and it is this PR's remaining acceptance
test, not a broken instrument. What is now dead main code, held for the owner's call: the three
ProducerManager revocation lock helpers and the DeclineCountingProducerManager instrument, which
count a decline the transactional path no longer makes.

Verified: ProducerRecoveryTest, ProducerManagerTest, ProducerManagerDetectionTest, ArchitectureTest
and the convention rules, PartitionStateAbortedTransactionReplayTest, TransactionalClaimCoverageTest;
RebalanceEoSDeadlockTest 5/5, ProducerFencingRecoveryIT 2/2.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PVL2FEJ645T76PbybEBUZ6

Author: astubbs

.claude/hooks/after-push-check-ci.sh

@@ -84,7 +84,7 @@ print(json.dumps({
             "checks that have already cost it once, both recorded in "
             "docs/inflight/ci-duplication-report-can-fail-to-post.md:\n"
             "\n"
-            "1. A RED CHECK CAN HAVE NO COMMENT. `dups: clones` is a required check, and it has "
+            "1. A RED CHECK CAN HAVE NO COMMENT. `dups: clones` is a step of the required `scan: repo` check, and it has "
             "failed on this repo with its finding posted nowhere - GitHub rejected the inline "
             "annotation and nothing fell back to a summary comment. If a check is red and you "
             "cannot find a comment explaining it, the finding is in the job log: "

.github/PULL_REQUEST_TEMPLATE.md

@@ -16,7 +16,7 @@
 
 ## Checklist
 
-<!-- Keep this checklist and resolve EVERY box: tick it [x], or mark it "N/A - <reason>". The "PR Checklist"
+<!-- Keep this checklist and resolve EVERY box: tick it [x], or mark it "N/A - <reason>". The "repo: hygiene"
      CI check fails a human PR when the checklist is missing entirely, or when a box has no [x] and no N/A.
      Only real bot authors (Dependabot/Renovate etc.) are exempt. -->
 

.github/dependabot.yml

@@ -51,29 +51,31 @@ updates:
           - "version-update:semver-minor"
           - "version-update:semver-major"
       # The second Jackson pin: the jackson-bom import in
-      # parallel-consumer-example-streams, which holds that module at 2.18.9. It needs
+      # parallel-consumer-example-streams, which holds that module on the 2.18 line
+      # (jackson.examples.version in the examples parent says which patch). It needs
       # the same hand management as the databind pin above, and it is a *different*
       # coordinate, so the rule above does not cover it.
       #
       # This one is not just hygiene. Jackson's fixed-version ranges are per-line, and
       # an automated bump can move you INTO a vulnerability: CVE-2026-59889 was
       # introduced in 2.18.0 and fixed only in 2.18.9, and CVE-2026-54518 applies to
       # 2.21.0-2.21.3 only. The root pom greenlights CVE-2026-54518 as a false positive
-      # *because this module resolves 2.18.9*; a bump into 2.21.0-2.21.3 would make that
+      # *because this module resolves a 2.18.x*; a bump into 2.21.0-2.21.3 would make that
       # finding real while the exclusion silently hid it. Leaving the LINE is therefore a
       # hand-managed decision, and the exclusion list gets re-checked when it happens.
       #
       # Allow patches within the pinned line; block minor/major - the same shape as the
       # micrometer entry below, but here the patch allowance is load-bearing rather than
       # tidy. This started out blanket, which was wrong in a way worth recording: every
       # danger named above is a LINE change (2.18 -> 2.21), while a patch inside 2.18 is
-      # the exact thing we are waiting for. The root pom's TEMPORARY exclusions for
-      # CVE-2026-68497 and CVE-2026-19032 retire when jackson-databind 2.18.10 reaches
-      # Central - a patch bump IS the retirement mechanism - and a blanket ignore
-      # suppressed the only PR that would have announced it. Neither id is in OSV, NVD or
-      # GHSA, so no Dependabot alert can arrive instead: the ignore was covering the one
+      # the exact thing we are waiting for. The worked case: the root pom's TEMPORARY
+      # exclusions for CVE-2026-68497 and CVE-2026-19032 retired when jackson-databind
+      # 2.18.10 reached Central (astubbs/parallel-consumer#445, 2026-09-04) - a patch bump
+      # WAS the retirement mechanism - and while this entry was blanket it suppressed the
+      # only PR that would have announced it. Neither id is in OSV, NVD or GHSA, so no
+      # Dependabot alert could arrive instead: the ignore was covering the one
       # notification we were relying on. bin/check-cve-exclusions.sh is the backstop for
-      # when that happens anyway. See docs/inflight/deps-cve-backlog.md.
+      # when that happens again. See docs/inflight/deps-cve-backlog.md.
       - dependency-name: "com.fasterxml.jackson:jackson-bom"
         update-types:
           - "version-update:semver-minor"

.github/scripts/changelog-ref-gate.js

@@ -1,9 +1,10 @@
 // Copyright (C) 2026 Antony Stubbs and contributors
 
 // Pure logic behind the "Verify new changelog entries cite an issue" step in
-// .github/workflows/pr-checklist.yml. It lives here rather than inline in the workflow YAML so it
-// can be unit tested - the same job runs changelog-ref-gate.test.js before the gate, so a
-// regression here fails the PR Checklist rather than silently misjudging changelogs.
+// .github/workflows/repo-hygiene.yml (the `repo: hygiene` job, where the former PR Checklist steps
+// now live). It lives here rather than inline in the workflow YAML so it can be unit tested - the
+// same job runs changelog-ref-gate.test.js before the gate, so a regression here fails the required
+// check rather than silently misjudging changelogs.
 //
 // This is a reminder for ourselves, not a defence against someone gaming it. Where being exactly
 // right would need real cleverness, it takes the simple option and says so: a check nobody can

.github/scripts/changelog-ref-gate.test.js

@@ -1,6 +1,6 @@
 // Copyright (C) 2026 Antony Stubbs and contributors
 
-// Unit tests for changelog-ref-gate.js, run by the PR Checklist job before the gate itself.
+// Unit tests for changelog-ref-gate.js, run by the `repo: hygiene` job before the gate itself.
 // Plain node, no dependencies, no runner: `node .github/scripts/changelog-ref-gate.test.js`.
 // Exits non-zero on the first sign of trouble, so a broken gate fails CI loudly.
 

.github/scripts/file-ref-gate.js

@@ -268,7 +268,7 @@ function citationsIn(line) {
 
 /**
  * The oracle resolves() reads, built from `git ls-files`. It lives here because BOTH callers need
- * one - the CI job in pr-checklist.yml and bin/check-file-refs.sh - and two hand-copied versions are
+ * one - the CI gate in repo-hygiene.yml and bin/check-file-refs.sh - and two hand-copied versions are
  * how they would come to disagree about what exists, which is the single thing they cannot differ
  * on. Same reasoning that puts formatFailure here rather than at each call site.
  *
@@ -483,7 +483,7 @@ function newFindings(current, base) {
 
 /**
  * The single copy of what an author is told when either rule fires - rendered by both callers, the
- * CI job in pr-checklist.yml and the local bin/check-file-refs.sh, so the two cannot tell different
+ * CI gate in repo-hygiene.yml and the local bin/check-file-refs.sh, so the two cannot tell different
  * stories. Its sibling gate learned that the hard way: hand-written copies of one message disagreed
  * in both directions within hours of the second being written.
  */

.github/scripts/file-ref-gate.test.js

@@ -1,6 +1,6 @@
 // Copyright (C) 2026 Antony Stubbs and contributors
 
-// Unit tests for file-ref-gate.js. Run by the PR Checklist job before the gate itself, so a broken
+// Unit tests for file-ref-gate.js. Run by the `repo: hygiene` job before the gate itself, so a broken
 // rule fails loudly rather than silently passing - or failing - every PR.
 //
 // The cases that matter most here are the NEGATIVE ones. This gate's failure mode is not missing a

.github/scripts/issue-ref-gate.js

@@ -296,7 +296,7 @@ function prBodyEntry(body) {
 
 /**
  * The single copy of what an author is told when the gate fires. Both callers render this - the CI
- * job in pr-checklist.yml and the local bin/check-issue-refs.sh - so the two cannot tell different
+ * gate in repo-hygiene.yml and the local bin/check-issue-refs.sh - so the two cannot tell different
  * stories. They did exactly that once: hand-written copies disagreed in *both* directions within
  * hours of the second one being created, each carrying a correction the other lacked. The script's
  * own header already says "NO SECOND COPY OF THE RULE" about the matching logic; the message an

.github/scripts/issue-ref-gate.test.js

@@ -1,6 +1,6 @@
 // Copyright (C) 2026 Antony Stubbs and contributors
 
-// Unit tests for issue-ref-gate.js. Run by the PR Checklist job before the gate itself, so a
+// Unit tests for issue-ref-gate.js. Run by the `repo: hygiene` job before the gate itself, so a
 // broken rule fails loudly rather than silently passing - or failing - every PR.
 const assert = require("assert");
 const {

.github/scripts/roadmap-stage-gate.test.js

@@ -1,6 +1,6 @@
 // Copyright (C) 2026 Antony Stubbs and contributors
 
-// Unit tests for roadmap-stage-gate.js. Run by the PR Checklist job before the gate itself, so a
+// Unit tests for roadmap-stage-gate.js. Run by the `repo: hygiene` job before the gate itself, so a
 // broken rule fails loudly rather than silently passing - or failing - every PR.
 // issue-refs: exempt-file - fixtures and check names are deliberately full of bare PR numbers;
 // qualifying them would stop testing what the parser actually sees.