docs(inflight): apply the accepted vetting proposals - ci, static, test, upstream, core

Ten notes carried a PROPOSED vetting marker from the 2026-09-07 sweep. Each proposal was
reviewed and accepted by the owner; this applies them, re-checking the evidence against the
tree first and recording what each check returned in the note's own marker.

- ci-merge-guard-fails-open-on-bsd-stat: CLOSED. The hook probes the platform once and fails
  closed on a non-numeric mtime (ffba759), and repo-hygiene.yml runs the self-tests on
  macos-latest (11c6551). Kept rather than deleted: the fail-open class it names - a guard
  that finds its evidence and discards it, and a suite green because it only runs where the
  bug is invisible - is what a later reader wants.

- ci-the-coverage-uploads-still-use-the-inert-glob: CLOSED. Its own delete-when holds -
  #475, a PR with no Java, has both per-flag gates green, and master's two flags no
  longer report an identical figure. docs/ci.md pointed at this note for an outstanding
  proof, so that paragraph now records the proof arriving.

- static-sneaky-throws-blind-the-analysers: counts corrected by removing them. The title said
  21 main-code sites and the body 122 test ones; both had drifted, and the test figure matches
  neither number depending on whether src/test-integration is counted. Replaced with the two
  greps that answer it, per this directory's rule against writing a count down.

- static-infer-threadsafe-is-blocked-by-third-party-interfaces: Blocker 2 rewritten. The
  setProcessingShards question is discharged - ShardMapIsNeverReplacedArchTest now shuts both
  doors to a replacement and pins the names its rules depend on - so the group is a ratchet
  entry with a reason, not a code change to make first. Blocker 1 and the MONITORENTER gap
  stand. The setter itself still exists, Lombok-generated; the note says so rather than
  repeating the proposal's wording.

- test-retry-queue-behaviour-untested: shrunk to the two unasserted bullets, re-add with a
  different retry-due and the unique/sorted invariant. Four RetryQueue* test classes now
  exist, the shard/queue orphan is fixed in ProcessingShard.getWorkIfAvailable, and revoke is
  covered by RetryQueueRequeueWindowTest.

- ci-codecov-flags-not-like-for-like: shrunk. The first open item - the fix could not be
  verified by the change that makes it - is discharged. What remains is the shared jacoco
  glob, which maven.yml's own comment names this note as owning, and master's two-band unit
  history, whose jumps stopped after #464 without the mechanism ever being named.

- ci-bsd-portability-gaps: shrunk. The third item's guard half shipped as gnu-bsd rows in
  bin/check-shell-hazards.sh. The unreachable quarantine source fallback and the pr-ready
  mtime coverage gap stand.

- upstream-173-revocation-duplicate-processing: shrunk to the unposted draft answer and the
  two mirror-body corrections. The adoc misdirection it was filed against reads REFUTED and
  carries the do-not-close rule, and next-steps 1 and 2 shipped. The draft's mitigation
  paragraph is corrected: the fourth matrix cell has been measured rather than predicted.

- core-unmailboxed-container-recovery: shrunk. Its option 2 shipped as
  failFatallyOnUnmailboxableRecord across core, ExternalEngine and vert.x, so the three
  options are no longer live choices; the note keeps the recovery-mechanism blind spot and
  the one test that would settle it.

- test-chaos-teardown-double-close: item 2 rewritten to the half still open. doStopDrain now
  calls markStopRequested(), but a drain still adds nothing to closingPcs, so settleFleet's
  isClosePending wait still reads false immediately. Items 1, 3 and 4 unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W511R2TZFAqEiqgS5yogTv

Author: astubbs

docs/ci.md

@@ -1100,13 +1100,17 @@ skipped rather than handed an empty `files:`, because empty is what re-opens the
 `build` job collects the two halves into separate outputs, since one half per flag is the split these
 gates compare.
 
-**It is not proven, and it could not be proven before merging.** The comparison exists only on the
-server, and only once both sides have re-uploaded under real file lists, so the first clean per-flag
-comparison after master has run the `build` job is the evidence. Inside that window a PR is still
-compared against a base assembled the old way, so **a red per-flag gate there is the old defect being
-measured, not a regression**. Tracked in
+**It could not be proven before merging, and it has since been proven on the server.** The
+comparison exists only there, and only once both sides have re-uploaded under real file lists, so the
+first clean per-flag comparison after master has run the `build` job was the evidence - and it
+arrived: master's own two flags now report different figures rather than the identical one that told
+us both held the same data, and astubbs#475, a pull request with no `.java` in its diff, showed
+`codecov/project/unit` and `codecov/project/integration` both green. Inside the window before that a
+PR was still compared against a base assembled the old way, so **a red per-flag gate there was the
+old defect being measured, not a regression**; a PR whose merge-base still predates the change can
+land inside the tail of it. The record is
 [`docs/inflight/ci-the-coverage-uploads-still-use-the-inert-glob.md`](inflight/ci-the-coverage-uploads-still-use-the-inert-glob.md),
-which owns the outstanding proof and the condition for closing it.
+now closed, which carries the measurements and the files-count tell below.
 
 **A second, independent cause reads the same from the check list**: a master run cancelled before it
 uploaded, which leaves Codecov with no report for that base commit and every PR comparing against

docs/inflight/ci-bsd-portability-gaps.md

@@ -2,16 +2,21 @@
 
 <!-- inflight-type: bug -->
 <!-- inflight-impact: blind-spot -->
-<!-- inflight-vetted: 2026-09-07 - PROPOSED shrink: the first two items are unchanged - all three quarantine scripts still carry the unreachable `source ... || source bin/lib/quarantine-common.sh` fallback under `set -e`, and `bin/test-check-pr-ready.sh` still holds no executing `stat`/mtime case (its only match is a prose comment). The THIRD item is stale: `bin/check-shell-hazards.sh` gained `gnu-bsd` rows for both `stat -c` and `stat -f` on 2026-08-26 (957d08423/3d5166799), so the guard half it says does not exist now does; only the triplicated prose remains -->
+<!-- inflight-vetted: 2026-09-08 - applied: shrunk, the third item removed because its guard half shipped as `gnu-bsd` rows in `bin/check-shell-hazards.sh`; items 1 and 2 left as they were; checked: all three quarantine gates still carry the unreachable `|| source bin/lib/quarantine-common.sh` fallback under `set -e`, `bin/test-check-pr-ready.sh` still holds no executing `stat`/mtime case (its only match is a prose comment), and the hazards gate's `gnu-bsd` rows cover both `stat -c` and `stat -f` -->
 
 <!-- post-merge: checked-begin -->
 The hooks in `.claude/hooks/` and the gates in `bin/` were swept for GNU-only constructs, and the
 sweep was then **executed on a Mac** rather than reasoned about
 (astubbs/parallel-consumer#341). The whole `bin/` suite passes there now. What the class *is*, the
 four defects it produced and how to avoid the next one are written up in
 [`docs/solutions/workflow-issues/gnu-only-constructs-fail-silently-on-bsd-2026-08-25.md`](../solutions/workflow-issues/gnu-only-constructs-fail-silently-on-bsd-2026-08-25.md),
-which **owns that knowledge**. This note keeps only what is still open. Delete it when these are
-resolved.
+which **owns that knowledge**. The guard half of that class is now in place too:
+`bin/check-shell-hazards.sh` carries `gnu-bsd` rows for `stat -c` and `stat -f` among others, so the
+argument no longer has to be remembered - which retired this note's third item, the near-verbatim
+repetition of the "probe, never fall back" reasoning across several script headers. What that leaves
+is a comment at the point of use rather than an open item.
+
+This note keeps only what is still open. Delete it when these are resolved.
 <!-- post-merge: checked-end -->
 
 ## A latent instance of the bash 3.2 `source` defect
@@ -38,9 +43,3 @@ or `mtime` reference at all - it greps the script's source text. **The `shell: m
 help here**, unlike the other fixes: a source-text grep passes identically on both platforms, so
 running it on macOS asserts nothing new. This one needs a case that actually dates a file and reads
 the result back.
-
-## The "probe, never fall back" reasoning is stated three times
-
-The identical argument is repeated near-verbatim in three files. `bin/AGENTS.md` has the precedent
-for collapsing that - the SIGPIPE class got a named write-up and a CI guard - and the write-up half
-now exists (linked above). The guard half does not.