fix: address CodeQL quality alerts

[tony19]

Follow-up to #479. This takes the open CodeQL alerts from 650 to 67, measured by a local CodeQL 2.27.1 run of the same security-and-quality suite that codeql.yml uses. It also fixes main's red Static Analysis.

Review commit by commit:

1. style: add missing @Override annotations adds 553 @Override lines and nothing else. Every one compiles at --release 8, which confirms each method really does override.
2. ci: catalogue Kotlin packages in the architecture-docs gate: Static Analysis has failed on main since refactor: convert the Android-specific layer to Kotlin #388, because check-architecture-docs.sh only scanned src/main/java and reported classic/android and core/android as stale. It now scans both source roots, for the package catalogue and for both dependency rules. components.md and the architecture-sync skill now mention src/main/kotlin.
3. fix: address CodeQL quality alerts

Bugs fixed

• SiftingAppenderBase.start() threw an NPE instead of reporting "Missing discriminator" when none was configured. New SiftingAppenderBaseTest.
• AbstractSocketAppender threw an NPE once the host resolved if reconnectionDelay was null. Null now counts as zero, which is what the resolution retry loop already did.
• Compressor leaked the FileOutputStream when the GZIPOutputStream constructor threw (the constructor writes the gzip header).
• ElementPath overrode equals() without hashCode(). The new hashCode() folds case the same way equalsIgnoreCase does. New ElementPathTest.
• Logger.level is now volatile: getLevel() read it without the lock that setLevel() holds.
• ScanException overrode Throwable's synchronized getCause(). It now passes the cause to Throwable instead.
• ConfigurationWatchList decoded file URLs with the platform charset through the deprecated URLDecoder.decode(String). It now decodes them as UTF-8, which is the encoding URL escapes use.

Cleanups

• Always-true instanceof and count checks
• Redundant toString() calls
• A local variable that shadowed a field
• An inner class that is now static
• Missing spaces in two status messages
• Stale Javadoc @param names
• "No context given" printed ContextAwareImpl's default toString(); it now prints the origin
• Unused parameters of private and package-private methods only (no public API changes)

Remaining 67 alerts

These can't be fixed without breaking the public API or the Android / Java 8 floor, so they need dismissing on the Security tab after merge:

Rule	#	Dismiss as	Why
unused-parameter	24	Won't fix	Public or overridable signatures
confusing-method-signature	17	Won't fix	slf4j Logger overloads
uncaught-number-format-exception	6	False positive	Callers catch it, or a digits-only regex feeds the parse
deprecated-call	5	Won't fix	Locale.of and URI.toURL replacements aren't available on Android / Java 8 or behave differently
confusing-method-name	4	Won't fix	Public setSMTPHost / setSmtpHost config names
unsafe-deserialization	3	False positive	Class allowlist (#479)
internal-representation-exposure	3	Won't fix	Callers mutate these collections on purpose
missing-clone-method	2	Won't fix	clone() is inherited
unsafe-cert-trust	1	False positive	Hostname verification is on by default (#479)
class-name-matches-super-class	1	Won't fix	Logger implements org.slf4j.Logger
ignored-error-status-of-call	1	Won't fix	neverBlock drops events when the queue is full, by design

Testing

• Main sources (Java + Kotlin) compile at Java 8.
• Ran the unit suite in a scratch Maven build on main and on this branch. Both give 721 passing, with no pass/fail differences. Robolectric tests can't load in that sandbox (no Google Maven access), so CI is their real check.
• The two new tests fail on main and pass here.
• ./scripts/check-architecture-docs.sh passes; on main it fails.

Deferred work considered: none of the open issues (#135, #223, #344, #352, #366, #371) touch the changed code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EZEDsWHuCKX7Cdwm6KvjpF

---

Generated by Claude Code