chore: record pre-existing uncommitted repository state

Snapshot of the in-flight state that already existed, identically, in both
this worktree and the main checkout before this session began: the initial
HTTP Client platform implementation (previously untracked), the redis-lab
removal, and the JPA / object-storage / notification integration work.

Kept separate from this session's HTTP Client review response, which lands
in the following commit, so the two bodies of work stay reviewable apart.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/httpclient/release-checklist.md

@@ -0,0 +1,47 @@
+# HTTP Client Platform — Release Checklist
+
+A release is complete when each item below is demonstrated by a command, not by review.
+
+## Gates
+
+```bash
+cd src
+./gradlew :adapter:outbound:httpclient:test --console=plain
+./gradlew :adapter:outbound:httpclient:httpClientStableContractTest --console=plain
+./gradlew :adapter:outbound:httpclient:httpClientSecurityTest --console=plain
+./gradlew :adapter:outbound:httpclient:httpClientBlockHoundTest --console=plain
+./gradlew :adapter:outbound:httpclient:spring62CompatibilityTest --console=plain
+./gradlew :adapter:outbound:httpclient:spring70CompatibilityTest --console=plain
+./gradlew :adapter:outbound:httpclient:httpClientFailureInjectionTest --console=plain   # needs Docker
+./gradlew :adapter:outbound:httpclient:httpClientPerformanceTest \
+  -Pperformance.assertions.enabled=true --console=plain
+./gradlew verifyCleanArchitectureDependencies --console=plain
+./gradlew :app-bootstrap:test --tests '*CleanArchitectureTest' --console=plain
+python3 ../scripts/verify-httpclient-docs.py
+```
+
+## Completion criteria (design §33)
+
+- [ ] Typed clients are the default entry point; H2 and H3 are separately authorised.
+- [ ] H1–H4 cannot bypass timeout, host, TLS, auth, size, or observation policy.
+- [ ] Apache, JDK, and Reactor produce identical result and exception metadata.
+- [ ] Pool, DNS, connect, TLS, and retry backoff all fit inside the effective deadline.
+- [ ] Every extra attempt is explained by idempotency, replayability, evidence, deadline, and budget.
+- [ ] Non-idempotent `SENT_NO_RESPONSE` surfaces as `HttpAmbiguousExecutionException`.
+- [ ] Pool and buffers are reclaimed after unread bodies, decode errors, cancels, and size rejections.
+- [ ] OAuth2 refresh is single-flight and 401 replay happens at most once.
+- [ ] Trust-all and hostname-verification bypass fail at startup.
+- [ ] Canonicalisation, DNS/IP validation, redirect revalidation, and egress control all pass.
+- [ ] No transparent retry occurs after the first delivered byte.
+- [ ] No platform code blocks a Reactor event loop, proven by a BlockHound self-check.
+- [ ] The negotiated wire protocol matches what the support matrix claims per transport.
+- [ ] Logical calls and attempts are separate metrics with no forbidden label.
+- [ ] DNS, pool, TLS, reset, partial response, and HTTP/2 GOAWAY are reproducible.
+- [ ] Thread, heap, direct memory, pool, and retry budget bounds hold.
+- [ ] The support matrix, configuration reference, security guide, runbook, and migration guide match the code.
+
+## Experimental
+
+Jetty HTTP/3 stays Experimental until `Http3CapabilityReport` reports QUIC and TLS 1.3 and the
+contract subset it declares passes in a dedicated environment. It is never auto-configured by the
+Stable starter.