chore: clear the safe audit-Low cluster (F4-04, F2-12, F6-02, F6-17 + doc Lows)

[lesnik512]

What

Batched, genuinely-safe Low-severity findings from the 2026-06-14 pass-3 deep audit (the #82 "safe cluster" pattern). Each is small and low-risk; everything is test-first where it's a behavior change.

Code (test-first)

• F4-04 — broker.fetch_unprocessed and the test-broker fake now reject limit < 1 with ValueError. A non-positive limit otherwise hit SQL (LIMIT -1 → DB error) on the real path but silently mis-sliced (rows[:-1]) on the fake — a real/fake divergence. Tests: test_unit.py::test_fetch_unprocessed_rejects_non_positive_limit, test_fake.py::test_fake_broker_fetch_unprocessed_rejects_non_positive_limit.
• F2-12 — client.ping() bounds the connect + SELECT 1 with asyncio.timeout(_PING_TIMEOUT_SECONDS=5.0) so a half-dead TCP socket can't hang the liveness probe for hours (mirrors the LISTEN health probe's existing wait_for). Test drives a genuinely-blocking connection and asserts ping() returns False.
• F6-02 — Prometheus published count default unified to 0 (was 1), matching the OTel adapter. The producer always sets count, so the default is dormant — this removes a latent divergence. Test: test_metrics_prometheus.py::test_prometheus_published_without_count_defaults_to_zero.
• F6-17 — removed the dead if outer is self.config branch in _warn_on_unstarted_foreign_publishers; the wired-producer check below already skips an internal publisher (this broker's config carries a truthy producer). Behavior-identical; verified by the existing suite.

Docs / comments (no behavior change)

• F6-01 stale "Task 5 adds…" plan reference → present tense.
• F6-04 _validate_index_predicates_sync _run_validate cross-reference phrasing.
• F6-13 CLAUDE.md: make_interval applies to activate_in; activate_at is an absolute literal.
• F6-15 fetch_unprocessed docstring now names operator inspection (not just test assertions).
• F1-05 cancel_timer docstring: a returned True is only durable once your transaction commits.
• F2-06 CLAUDE.md: timer_id dedup is "one live row per (queue, timer_id)", resets after delivery/terminal failure.

Still open (deferred to their own changes)

• F2-10 validate indisunique for timer_id_uq — needs a hand-crafted drifted-schema integration test.
• F6-05 _utcnow ×5 dedup — needs a shared-module decision.
• F5-04 parser correlation_id fallback — subtle semantics.
• The larger refactor / test-hardening Lows.

Verification

• just test → 507 passed, 100% coverage
• just lint clean (ruff + ty)

Pass-3 findings doc updated with a resolved-banner for the batch.

🤖 Generated with Claude Code