docs(tt5): record macOS Tier-4 confirmation + Windows verification stance

- TT5: macOS is now fully covered — the full suite incl. Tier 4 ran green
  natively on macOS (4 flows + startup; Linux-only RSS test cfg-skipped).
- TT5 Windows wording: automated execution is the one open piece. A standing
  Windows CI runner is more involved than the Linux/macOS runners already in
  use; kept open with no timing promise. Interim: Windows builds ship every
  release and are verified by running the suite on Windows by hand periodically
  — the same builds, manually verified rather than per-push. TT5 stays [/] by
  deliberate scope. Framed in project terms, no host specifics.
- handoff-76 §6: macOS confirmation, the `pid` dead-code fix (1ffe11c), normal
  off-target crate downloads, and the Windows decision.

docs/handoff/20260622-handoff-76.md

@@ -96,3 +96,26 @@ managers + TT4 are post-tag → Unreleased.
   the two light-theme contrast bugs and the #39 schema-cache behaviour — both
   before finalizing).
 - Consider a `cargo sweep` at this milestone (release build added ~ a GB).
+
+## §6. Post-finalization (same session)
+
+- **macOS fully verified.** A native `cargo test` on macOS was fully green —
+  1813 lib + **5 `e2e_pty`** + 500 integration + 200 typing. This **confirms
+  Tier 4 on macOS** (the 4 flows + startup; the Linux-only RSS probe is
+  `#[cfg]`-skipped, hence 5 not 6). Closes the runda "Tier-4 unverified on macOS"
+  item.
+- **`fix(tt4)` `1ffe11c`** — the macOS run surfaced a `method `pid` is never
+  used` warning: `rss_kib` is Linux-only and was `pid`'s only caller, so off
+  Linux it was dead code. The Linux clippy gate can't catch this (pid *is* used
+  on Linux). Read `child.process_id()` inline; deleted the helper.
+- **Cross-platform crate downloads off-target are normal** — `cargo` fetches the
+  whole locked graph (Windows ConPTY bindings, Unix libc/nix from `portable-pty`)
+  but only compiles host-target crates; nothing off-target is actually built.
+- **TT5 / Windows decision (2026-06-22):** a permanent Windows CI runner stays
+  **open, no promises** — standing one up is more involved than the Linux/macOS
+  runners already in use. Interim: Windows builds ship every release (D1/D2) and
+  are **verified by running the suite on Windows by hand periodically** — the
+  same builds Windows users get, manually verified rather than per-push. The TT5
+  note was reworded to say this plainly and welcomingly; it stays `[/]` by
+  deliberate scope. (Virtualization options explored for a future runner are not
+  recorded here — they hinge on host specifics rather than project constraints.)

docs/requirements.md

@@ -938,14 +938,24 @@ since ADR-0027.)
   *(Partial, updated 2026-06-22. **CI is live** on the self-hosted
   Gitea Actions (`docs/ci/adr/`): the gate runs `clippy -D warnings`
   + `cargo test` (now Tiers **1–4** — the `e2e_pty` target runs by
-  default) on the **Linux** runner for every branch push / PR, and
+  default) on the **Linux** runner for every branch push / PR.
-  `release-macos` runs the suite natively on the **macOS** runner.
+  **macOS is fully covered**: `release-macos` runs the whole suite
-  **Tier 4 in CI on Linux is now met** (TT4); PTY-in-container was
+  natively on the macOS runner, and Tier 4 was confirmed green on
-  validated (openpty + spawn under Docker), first real CI run is the
+  macOS (2026-06-22 — the 4 flows + startup; the Linux-only RSS probe
-  final confirmation. **Windows is build-only** — cross-compiled,
+  is `#[cfg]`-skipped). **Tier 4 in CI on Linux is met** (TT4);
-  not executed (no Windows runner). "Stable Rust" is satisfied by
+  PTY-in-container was validated (openpty + spawn under Docker), with
-  the flake's pinned `1.95.0`. **Remaining for full TT5: a Windows
+  the first real gate run the final confirmation. "Stable Rust" is
-  execution runner** (the macOS + Tier-4 gaps are now closed).)*
+  satisfied by the flake's pinned `1.95.0`.
+  **Windows — automated execution is the one open piece.** Windows
+  binaries are first-class: cross-built and shipped for every release
+  (D1/D2), and we verify them by **running the suite on Windows by
+  hand from time to time** so the Windows experience stays sound
+  between releases. A standing Windows CI runner is more involved to
+  operate than the Linux and macOS runners already in use; we intend
+  to keep looking for a clean solution but make no promises on timing.
+  Until then, Windows users get exactly the same builds, verified
+  manually rather than on every push. So TT5 stays `[/]` by deliberate
+  scope, not neglect.)*
 
 ## Cross-cutting
 

tests/e2e_pty.rs

@@ -233,14 +233,13 @@ impl PtyApp {
         self.send(b"\r");
     }
 
-    fn pid(&self) -> Option<u32> {
+    /// Resident set size of the child in KiB (Linux only). `process_id`
-        self.child.process_id()
+    /// is read inline here rather than via a helper so the method has no
-    }
+    /// non-Linux callers to go dead (the CI clippy gate runs on Linux,
-
+    /// where such dead code wouldn't surface).
-    /// Resident set size of the child in KiB (Linux only).
     #[cfg(target_os = "linux")]
     fn rss_kib(&self) -> Option<u64> {
-        let pid = self.pid()?;
+        let pid = self.child.process_id()?;
         let status = std::fs::read_to_string(format!("/proc/{pid}/status")).ok()?;
         status.lines().find_map(|l| {
             let rest = l.strip_prefix("VmRSS:")?;